npm - @blamejs/blamejs-shop - Versions diffs - 0.5.5 → 0.5.6 - Mend

@blamejs/blamejs-shop 0.5.5 → 0.5.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1404) hide show

package/lib/vendor/blamejs/test/layer-0-primitives/file-upload-ownership.test.js ADDED Viewed

@@ -0,0 +1,214 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * file-upload — per-upload OWNERSHIP is enforced (IDOR / CWE-639).
+ *
+ * init() records the upload's owner (actor.id || actor.userId). Every
+ * subsequent lifecycle call (acceptChunk / finalize / status / cancelUpload)
+ * refuses a caller who is not the owner — even when that caller holds the
+ * coarse "fileUpload.<op>" capability scope. Actor A's own calls succeed
+ * (positive control). The allowCrossActor escape hatch (plus the
+ * "fileUpload.admin" scope when permissions are wired) restores cross-actor
+ * access for operator admin tooling.
+ *
+ * RED on the pre-fix tree: B's finalize / cancelUpload / status / acceptChunk
+ * on A's uploadId SUCCEED (no owner comparison exists).
+ */
+var nodeOs = require("node:os");
+var nodePath = require("node:path");
+var nodeFs = require("node:fs");
+var nodeCrypto = require("node:crypto");
+var helpers = require("../helpers");
+var check = helpers.check;
+var b = helpers.b;
+var ACTOR_A = { id: "actor-a" };
+var ACTOR_B = { id: "actor-b" };
+function _tmpDir(suffix) {
+  var dir = nodePath.join(nodeOs.tmpdir(), "fileupload-ownership-" + suffix + "-" +
+    nodeCrypto.randomBytes(6).toString("hex"));
+  nodeFs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  return dir;
+}
+function _chunkSha3(buf) { return require("../../lib/crypto").sha3Hash(buf); }
+function _fullSha3(pieces) {
+  var h = nodeCrypto.createHash("sha3-512");
+  for (var i = 0; i < pieces.length; i++) h.update(pieces[i]);
+  return h.digest("hex");
+}
+function _manifestFor(pieces) {
+  var total = 0;
+  for (var i = 0; i < pieces.length; i++) total += pieces[i].length;
+  return {
+    totalBytes: total,
+    sha3:       _fullSha3(pieces),
+    chunks:     pieces.map(function (p, idx) { return { index: idx, sha3: _chunkSha3(p) }; }),
+  };
+}
+// Drive init + one chunk for `actor`, leaving the upload READY to finalize.
+async function _seedUpload(u, uploadId, pieces, actor) {
+  await u.init({ uploadId: uploadId, actor: actor, metadata: { filename: "doc.txt" } });
+  for (var i = 0; i < pieces.length; i++) {
+    await u.acceptChunk({ uploadId: uploadId, index: i, body: pieces[i],
+                          sha3: _chunkSha3(pieces[i]), actor: actor });
+  }
+}
+async function _expectThrows(fn) {
+  try { await fn(); return null; }
+  catch (e) { return e; }
+}
+async function run() {
+  var pieces = [Buffer.from("hello ownership", "utf8")];
+  // A permissions instance that GRANTS every coarse fileUpload.* scope to BOTH
+  // actors (but NOT fileUpload.admin) — so the cross-actor refusal comes from
+  // per-upload ownership, not the capability scope.
+  var coarsePerms = {
+    check: function (actor, scope) {
+      if (scope === "fileUpload.admin") return false;   // no admin for anyone here
+      return true;                                       // every other fileUpload.* scope granted
+    },
+  };
+  // ---- Cross-actor finalize is REFUSED (this is the RED assertion) ----
+  {
+    var u = b.fileUpload.create({
+      stagingDir:     _tmpDir("finalize"),
+      filenameSafety: null, contentSafety: null,
+      permissions:    coarsePerms,
+    });
+    await _seedUpload(u, "u-own-1", pieces, ACTOR_A);
+    var manifest = _manifestFor(pieces);
+    var bErr = await _expectThrows(function () {
+      return u.finalize({ uploadId: "u-own-1", manifest: manifest, actor: ACTOR_B });
+    });
+    // RED ON CURRENT TREE: B's finalize SUCCEEDS today → bErr === null → fails.
+    check("ownership[finalize]: actor B cannot finalize A's upload",
+          bErr !== null && bErr.code === "OWNERSHIP_VIOLATION");
+    // Positive control — the owner CAN finalize.
+    var aRv = await u.finalize({ uploadId: "u-own-1", manifest: manifest, actor: ACTOR_A });
+    check("ownership[finalize]: owner A finalizes successfully",
+          aRv && aRv.ok === true && aRv.size === pieces[0].length);
+  }
+  // ---- Cross-actor cancelUpload is REFUSED ----
+  {
+    var u2 = b.fileUpload.create({
+      stagingDir:     _tmpDir("cancel"),
+      filenameSafety: null, contentSafety: null,
+      permissions:    coarsePerms,
+    });
+    await _seedUpload(u2, "u-own-2", pieces, ACTOR_A);
+    var cErr = await _expectThrows(function () {
+      return u2.cancelUpload("u-own-2", { actor: ACTOR_B });
+    });
+    // RED: B's cancel returns { ok:true } today (deletes A's staging) → cErr === null.
+    check("ownership[cancel]: actor B cannot cancel A's upload",
+          cErr !== null && cErr.code === "OWNERSHIP_VIOLATION");
+    // Positive control — the upload still exists and the owner can cancel it.
+    var aCancel = await u2.cancelUpload("u-own-2", { actor: ACTOR_A });
+    check("ownership[cancel]: owner A cancels successfully",
+          aCancel && aCancel.ok === true);
+  }
+  // ---- Cross-actor status is REFUSED ----
+  {
+    var u3 = b.fileUpload.create({
+      stagingDir:     _tmpDir("status"),
+      filenameSafety: null, contentSafety: null,
+      permissions:    coarsePerms,
+    });
+    await _seedUpload(u3, "u-own-3", pieces, ACTOR_A);
+    var sErr = await _expectThrows(function () {
+      return u3.status("u-own-3", { actor: ACTOR_B });
+    });
+    // RED: B's status returns A's metadata today → sErr === null.
+    check("ownership[status]: actor B cannot read A's upload status",
+          sErr !== null && sErr.code === "OWNERSHIP_VIOLATION");
+    // Positive control — the owner reads status.
+    var aStatus = u3.status("u-own-3", { actor: ACTOR_A });
+    check("ownership[status]: owner A reads status successfully",
+          aStatus && aStatus.uploadId === "u-own-3");
+  }
+  // ---- Cross-actor acceptChunk is REFUSED ----
+  {
+    var u4 = b.fileUpload.create({
+      stagingDir:     _tmpDir("accept"),
+      filenameSafety: null, contentSafety: null,
+      permissions:    coarsePerms,
+    });
+    await u4.init({ uploadId: "u-own-4", actor: ACTOR_A, metadata: {} });
+    var extra = Buffer.from("interloper chunk", "utf8");
+    var acErr = await _expectThrows(function () {
+      return u4.acceptChunk({ uploadId: "u-own-4", index: 0, body: extra,
+                              sha3: _chunkSha3(extra), actor: ACTOR_B });
+    });
+    // RED: B's acceptChunk writes a chunk into A's upload today → acErr === null.
+    check("ownership[accept]: actor B cannot push a chunk to A's upload",
+          acErr !== null && acErr.code === "OWNERSHIP_VIOLATION");
+    // Positive control — the owner can push.
+    var aAccept = await u4.acceptChunk({ uploadId: "u-own-4", index: 0, body: pieces[0],
+                                         sha3: _chunkSha3(pieces[0]), actor: ACTOR_A });
+    check("ownership[accept]: owner A pushes a chunk successfully",
+          aAccept && aAccept.received === 1);
+  }
+  // ---- Escape hatch: allowCrossActor + fileUpload.admin scope ALLOWS cross-actor ----
+  {
+    var adminPerms = {
+      check: function () { return true; },   // grants fileUpload.admin too
+    };
+    var u5 = b.fileUpload.create({
+      stagingDir:      _tmpDir("admin"),
+      filenameSafety:  null, contentSafety: null,
+      permissions:     adminPerms,
+      allowCrossActor: true,
+    });
+    await _seedUpload(u5, "u-own-5", pieces, ACTOR_A);
+    var manifest5 = _manifestFor(pieces);
+    // B (admin) finalizes A's upload — the opt actually works.
+    var adminRv = await u5.finalize({ uploadId: "u-own-5", manifest: manifest5, actor: ACTOR_B });
+    check("ownership[admin]: allowCrossActor + admin scope lets B finalize A's upload",
+          adminRv && adminRv.ok === true);
+  }
+  // ---- Escape hatch is GATED: allowCrossActor WITHOUT the admin scope is refused ----
+  {
+    var u6 = b.fileUpload.create({
+      stagingDir:      _tmpDir("admin-denied"),
+      filenameSafety:  null, contentSafety: null,
+      permissions:     coarsePerms,        // grants everything EXCEPT fileUpload.admin
+      allowCrossActor: true,
+    });
+    await _seedUpload(u6, "u-own-6", pieces, ACTOR_A);
+    var manifest6 = _manifestFor(pieces);
+    var gateErr = await _expectThrows(function () {
+      return u6.finalize({ uploadId: "u-own-6", manifest: manifest6, actor: ACTOR_B });
+    });
+    check("ownership[admin-gated]: allowCrossActor still requires the fileUpload.admin scope",
+          gateErr !== null && gateErr.code === "PERMISSION_DENIED");
+  }
+}
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/flag.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.flag — feature-flag primitive (OpenFeature spec).

package/lib/vendor/blamejs/test/layer-0-primitives/forensic-snapshot.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.auditTools.forensicSnapshot — post-compromise composer that

package/lib/vendor/blamejs/test/layer-0-primitives/fsm.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/gate-contract-content-gate.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.gateContract.buildContentGate — the content-guard gate action-chain

package/lib/vendor/blamejs/test/layer-0-primitives/gcs-bucket-ops.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * gcs-bucket-ops — bucket-level operations.

package/lib/vendor/blamejs/test/layer-0-primitives/gdpr-ropa.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");
 var b = helpers.b;

package/lib/vendor/blamejs/test/layer-0-primitives/graphql-federation.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.graphqlFederation — _service.sdl trust-boundary guard.

package/lib/vendor/blamejs/test/layer-0-primitives/guard-agent-registry.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-all.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-all — registry + aggregator for the guard-* family (b.guardAll).

package/lib/vendor/blamejs/test/layer-0-primitives/guard-archive.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-archive — archive content-safety primitive (b.guardArchive).

package/lib/vendor/blamejs/test/layer-0-primitives/guard-csv.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-csv — CSV content-safety primitive (b.guardCsv) + the

package/lib/vendor/blamejs/test/layer-0-primitives/guard-dsn.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.guardDsn — RFC 3464 Delivery Status Notification parser.

package/lib/vendor/blamejs/test/layer-0-primitives/guard-email.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-email — Email content-safety primitive (b.guardEmail).

package/lib/vendor/blamejs/test/layer-0-primitives/guard-envelope.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.guardEnvelope — RFC 7489 §3.1 DMARC Identifier Alignment.

package/lib/vendor/blamejs/test/layer-0-primitives/guard-event-bus-payload.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-event-bus-topic.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-filename.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-filename — filename content-safety primitive (b.guardFilename).

package/lib/vendor/blamejs/test/layer-0-primitives/guard-gate-disposition-coverage.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Gate-disposition coverage — every finding kind a content guard can emit MUST

package/lib/vendor/blamejs/test/layer-0-primitives/guard-html-wcag.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Tests for b.guardHtml.wcag.audit (WCAG 2.2 audit-only scanner).

package/lib/vendor/blamejs/test/layer-0-primitives/guard-html.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-html — HTML content-safety primitive (b.guardHtml).

package/lib/vendor/blamejs/test/layer-0-primitives/guard-idempotency-key.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-image.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-image — image content-safety primitive (b.guardImage).

package/lib/vendor/blamejs/test/layer-0-primitives/guard-imap-command.test.js CHANGED Viewed

Binary file

package/lib/vendor/blamejs/test/layer-0-primitives/guard-jmap.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-json.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-json — JSON content-safety primitive (b.guardJson).

package/lib/vendor/blamejs/test/layer-0-primitives/guard-list-id.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.guardListId — RFC 2919 List-Id header validator.

package/lib/vendor/blamejs/test/layer-0-primitives/guard-list-unsubscribe.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.guardListUnsubscribe — RFC 2369 + RFC 8058 List-Unsubscribe /

package/lib/vendor/blamejs/test/layer-0-primitives/guard-mail-compose.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-mail-move.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-mail-query.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-mail-reply.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-mail-sieve.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-managesieve-command.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-markdown.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-markdown — Markdown content-safety primitive (b.guardMarkdown).

package/lib/vendor/blamejs/test/layer-0-primitives/guard-message-id.test.js CHANGED Viewed

Binary file

package/lib/vendor/blamejs/test/layer-0-primitives/guard-oauth-replay-failopen.test.js ADDED Viewed

@@ -0,0 +1,57 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * b.guardOauth code-reuse (replay) defense must FAIL CLOSED when the operator's
+ * seenCodeStore errors. A store-lookup failure means "could not prove the
+ * authorization code is unused" — which is a denial, not "the code is fresh".
+ * Pre-fix the seenCodeStore.hasSeen() call was wrapped in a drop-silent catch,
+ * so a backend outage silently skipped the replay check and the code was
+ * accepted (codeReusePolicy is "reject" at every profile, so the defense is
+ * meant to be unconditional).
+ */
+var helpers = require("../helpers");
+var b = helpers.b;
+var check = helpers.check;
+var BENIGN_FLOW = {
+  response_type: "code",
+  redirect_uri:  "https://app.example.com/callback",
+  state:         "csrf-rand-1",
+  scope:         "openid profile",
+  code_challenge: "abc123def456ghi789jkl012mno345pqr678",
+  code_challenge_method: "S256",
+  code:          "auth-code-xyz",
+};
+var OPTS = {
+  profile: "strict",
+  allowedRedirectUris: ["https://app.example.com/callback"],
+};
+async function run() {
+  // Control 1 — store says "not seen": the flow validates.
+  var freshStore = { hasSeen: function () { return false; } };
+  var rvFresh = b.guardOauth.validate(BENIGN_FLOW, Object.assign({}, OPTS, { seenCodeStore: freshStore }));
+  check("guard-oauth: an unused code with a working store validates", rvFresh.ok === true);
+  // Control 2 — store says "seen": the replay is refused.
+  var seenStore = { hasSeen: function () { return true; } };
+  var rvSeen = b.guardOauth.validate(BENIGN_FLOW, Object.assign({}, OPTS, { seenCodeStore: seenStore }));
+  check("guard-oauth: a replayed code (store hit) is refused",
+        rvSeen.ok === false && rvSeen.issues.some(function (i) { return i.ruleId === "oauth.code-reused"; }));
+  // THE FIX — store THROWS (backend outage): must fail closed, not accept.
+  var throwingStore = { hasSeen: function () { throw new Error("replay store backend unavailable"); } };
+  var rvErr = b.guardOauth.validate(BENIGN_FLOW, Object.assign({}, OPTS, { seenCodeStore: throwingStore }));
+  check("guard-oauth: a replay-store error FAILS CLOSED (code not accepted)", rvErr.ok === false);
+  check("guard-oauth: a replay-store error surfaces a could-not-verify refusal",
+        rvErr.issues.some(function (i) { return i.ruleId === "oauth.code-reuse-unverifiable"; }));
+}
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/guard-pdf.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-pdf — PDF content-safety primitive (b.guardPdf).

package/lib/vendor/blamejs/test/layer-0-primitives/guard-pop3-command.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-posture-chain.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-saga-config.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-smtp-command.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.guardSmtpCommand — SMTP command-line validator. Tests bare-CR /

package/lib/vendor/blamejs/test/layer-0-primitives/guard-snapshot-envelope.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-stream-args.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-svg.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-svg — SVG content-safety primitive (b.guardSvg).

package/lib/vendor/blamejs/test/layer-0-primitives/guard-tenant-id.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-text.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-text — general-purpose UTF-8 free-text content-safety primitive

package/lib/vendor/blamejs/test/layer-0-primitives/guard-trace-context.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/guard-xml.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-xml — XML content-safety primitive (b.guardXml).

package/lib/vendor/blamejs/test/layer-0-primitives/guard-yaml.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-yaml — YAML content-safety primitive (b.guardYaml).

package/lib/vendor/blamejs/test/layer-0-primitives/hal.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // b.hal — HAL hypermedia resource builder.

package/lib/vendor/blamejs/test/layer-0-primitives/honeytoken.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.honeytoken — canary credential framework.

package/lib/vendor/blamejs/test/layer-0-primitives/html-balance.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");

package/lib/vendor/blamejs/test/layer-0-primitives/http-client-cache.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.httpClient.cache — RFC 9111 outbound cache.

package/lib/vendor/blamejs/test/layer-0-primitives/http-client-stream.test.js CHANGED Viewed

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.httpClient.downloadStream + b.httpClient.uploadMultipartStream.