@blamejs/blamejs-shop 0.5.5 → 0.5.6

package/lib/vendor/blamejs/test/layer-0-primitives/template-escape-html.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // b.template.escapeHtml — the {{ expr }} interpolation escaper (XSS boundary).
 // Now delegates to the centralized markup-escape so the five-character HTML set

package/lib/vendor/blamejs/test/layer-0-primitives/tenant-quota.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.tenantQuota — per-tenant DB storage caps + query budget +

package/lib/vendor/blamejs/test/layer-0-primitives/test-coverage.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * test-coverage — gate that flags operator-facing primitives on `b.*`

package/lib/vendor/blamejs/test/layer-0-primitives/test-harness.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.testHarness — isolated-boot helper for framework-consumer test

package/lib/vendor/blamejs/test/layer-0-primitives/testing-request.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.testing.request — supertest-style chainable HTTP test helper.

package/lib/vendor/blamejs/test/layer-0-primitives/testing.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.testing — operator-facing test helpers.

package/lib/vendor/blamejs/test/layer-0-primitives/time.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.time — timezone-aware datetime arithmetic + formatting.

package/lib/vendor/blamejs/test/layer-0-primitives/tls-exporter.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.tlsExporter — RFC 9266 TLS-Exporter channel binding.

package/lib/vendor/blamejs/test/layer-0-primitives/tls-ocsp-ct.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.network.tls.ocsp + b.network.tls.ct — surface tests.

package/lib/vendor/blamejs/test/layer-0-primitives/tls-ocsp-freshness.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.network.tls.ocsp.evaluate — OCSP response FRESHNESS enforcement
@@ -61,8 +63,10 @@ function _buildSignedOcsp(opts) {
   var serialHex = serial.toString("hex");
 
   // certID = SEQ { AlgId{sha1,NULL}, issuerNameHash OCTET(20), issuerKeyHash OCTET(20), serial INT }
-  // (the evaluator only reads the serial from certID; the two hashes are not
-  // checked, so fixed 20-byte fillers are fine.)
+  // (these freshness cases pass no opts.issuerCertDer, so the evaluator binds on
+  // the serial only and the issuerNameHash/issuerKeyHash are not checked here —
+  // fixed 20-byte fillers are fine. The CertID issuer binding is exercised in
+  // tls-ocsp-verify.test.js.)
   var hashAlg = asn1.writeSequence([asn1.writeOid("1.3.14.3.2.26"), asn1.writeNull()]);  // sha1
   var nameHash = asn1.writeOctetString(Buffer.alloc(20, 0xaa));
   var keyHash  = asn1.writeOctetString(Buffer.alloc(20, 0xbb));

package/lib/vendor/blamejs/test/layer-0-primitives/tls-ocsp-verify.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.network.tls.ocsp.parseResponse + .evaluate + .requireGood — RFC 6960
@@ -6,9 +8,11 @@
  * parser's malformed-input rejection + the surface contract.
  */
 
-var helpers = require("../helpers");
-var b       = helpers.b;
-var check   = helpers.check;
+var helpers    = require("../helpers");
+var b          = helpers.b;
+var check      = helpers.check;
+var nodeCrypto = require("node:crypto");
+var asn1       = require("../../lib/asn1-der");
 
 function testSurface() {
   check("ocsp.parseResponse is a function",
@@ -85,6 +89,123 @@ async function testRequireGoodRequiresIssuerPem() {
         threw && /ocsp-missing-issuer/.test(threw.code || ""));
 }
 
+// ---- CertID issuer binding (RFC 6960 §4.1.1) ----------------------------
+// A "good" SingleResponse whose serial matches the cert under validation but
+// whose issuerNameHash/issuerKeyHash belong to a DIFFERENT issuer must be
+// REFUSED — a serial is unique only per issuer, so a delegated responder /
+// shared CA key could otherwise have a "good" for serial-S under issuer-Y
+// accepted as proof for serial-S under issuer-X.
+
+// Minimal RFC 5280-shaped X.509 cert (issuer DN = one CN + the given key bytes).
+// Shape only — the binding hashes its DN + SPKI BIT STRING, never verifies its
+// own signature.
+function _synthCert(serialBytes, cnBytes, pubKeyBytes) {
+  var algId    = asn1.writeSequence([asn1.writeOid("1.2.840.113549.1.1.1"), asn1.writeNull()]);
+  var cn       = asn1.writeSequence([asn1.writeOid("2.5.4.3"), asn1.writeNode(0x0c, cnBytes)]);
+  var name     = asn1.writeSequence([asn1.writeNode(0x31, cn)]);
+  var validity = asn1.writeSequence([
+    asn1.writeNode(0x17, Buffer.from("260101000000Z")),
+    asn1.writeNode(0x17, Buffer.from("270101000000Z")),
+  ]);
+  var spki     = asn1.writeSequence([algId,
+    asn1.writeNode(0x03, Buffer.concat([Buffer.from([0]), pubKeyBytes]))]);
+  var version  = asn1.writeContextExplicit(0, asn1.writeInteger(Buffer.from([2])));
+  var tbs = asn1.writeSequence([version, asn1.writeInteger(serialBytes), algId,
+                                name, validity, name, spki]);
+  return asn1.writeSequence([tbs, algId, asn1.writeNode(0x03, Buffer.from([0, 0, 0, 0]))]);
+}
+
+// Build a signed "good" OCSP response for `serial`, embedding a CertID whose
+// issuer hashes come from `certIdIssuerDer` (SHA-1, what buildRequest emits).
+// The response signer key is INDEPENDENT of the issuer — the delegated /
+// shared-key model the binding defends.
+function _buildSignedOcspWithCertIdIssuer(serial, certIdIssuerDer) {
+  var kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "prime256v1" });
+  var issuerPem = kp.publicKey.export({ type: "spki", format: "pem" });
+
+  // Reuse buildRequest to obtain the exact CertID for certIdIssuerDer; pull the
+  // certID SEQUENCE out (request → tbs → requestList → request → certId).
+  var req = b.network.tls.ocsp.buildRequest({
+    leafCertDer:   _synthCert(serial, Buffer.from("Leaf"), Buffer.from("leaf-key-bytes-aaaaaaaaaaaaaaaa")),
+    issuerCertDer: certIdIssuerDer,
+    nonce:         false,
+  });
+  var reqTop  = asn1.readNode(req.requestDer);
+  var reqTbs  = asn1.readSequence(reqTop.value)[0];
+  var reqList = asn1.readSequence(reqTbs.value)[0];
+  var reqOne  = asn1.readSequence(reqList.value)[0];
+  var certId  = asn1.readSequence(reqOne.value)[0];   // the CertID SEQUENCE node
+
+  var certStatusGood = asn1.writeContextImplicit(0, Buffer.alloc(0));   // [0] IMPLICIT NULL
+  var thisU = asn1.writeNode(0x18, Buffer.from("20250615000000Z"));
+  var nextU = asn1.writeContextExplicit(0, asn1.writeNode(0x18, Buffer.from("20991231000000Z")));
+  var singleResponse = asn1.writeSequence([certId.raw, certStatusGood, thisU, nextU]);
+
+  var responderId = asn1.writeContextExplicit(2, asn1.writeOctetString(Buffer.alloc(20, 0xcc)));
+  var producedAt  = asn1.writeNode(0x18, Buffer.from("20250615000000Z"));
+  var responses   = asn1.writeSequence([singleResponse]);
+  var tbs = asn1.writeSequence([responderId, producedAt, responses]);
+
+  var sig    = nodeCrypto.sign("sha256", tbs, kp.privateKey);
+  var sigAlg = asn1.writeSequence([asn1.writeOid("1.2.840.10045.4.3.2")]);   // ecdsa-with-SHA256
+  var basic  = asn1.writeSequence([tbs, sigAlg, asn1.writeBitString(sig)]);
+  var rbInner = asn1.writeSequence([asn1.writeOid("1.3.6.1.5.5.7.48.1.1"), asn1.writeOctetString(basic)]);
+  var der = asn1.writeSequence([asn1.writeNode(0x0a, Buffer.from([0])),
+                                asn1.writeContextExplicit(0, rbInner)]);
+  return { der: der, issuerPem: issuerPem };
+}
+
+var _OCSP_SERIAL = Buffer.from([0x12, 0x34, 0x56, 0x78]);
+var _OCSP_NOW    = Date.parse("2025-06-15T00:00:01Z");
+
+// Positive control — CertID issuer == cert-under-validation issuer → accepted.
+function testCertIdIssuerMatchAccepted() {
+  var issuer = _synthCert(Buffer.from([0x01]), Buffer.from("Real CA"),
+                          Buffer.from("real-ca-key-bytes-aaaaaaaaaaaaaa"));
+  var fx = _buildSignedOcspWithCertIdIssuer(_OCSP_SERIAL, issuer);
+  var rv = b.network.tls.ocsp.evaluate(fx.der, {
+    issuerPem:     fx.issuerPem,
+    issuerCertDer: issuer,
+    serialHex:     _OCSP_SERIAL.toString("hex"),
+    now:           _OCSP_NOW,
+  });
+  check("certID match: accepted (ok=true)", rv.ok === true);
+  check("certID match: no errors", Array.isArray(rv.errors) && rv.errors.length === 0);
+}
+
+// RED today — CertID issuer is a DIFFERENT CA than the cert under validation
+// but the serial collides. Bound only by serial → accepted today; must be
+// REFUSED for the wrong-issuer reason after the fix.
+function testCrossIssuerCertIdRefused() {
+  var realIssuer = _synthCert(Buffer.from([0x01]), Buffer.from("Real CA"),
+                              Buffer.from("real-ca-key-bytes-aaaaaaaaaaaaaa"));
+  var otherIssuer = _synthCert(Buffer.from([0x02]), Buffer.from("Evil CA"),
+                               Buffer.from("evil-ca-key-bytes-bbbbbbbbbbbbbb"));
+  var fx = _buildSignedOcspWithCertIdIssuer(_OCSP_SERIAL, otherIssuer);
+  var rv = b.network.tls.ocsp.evaluate(fx.der, {
+    issuerPem:     fx.issuerPem,
+    issuerCertDer: realIssuer,                  // the issuer we actually asked about
+    serialHex:     _OCSP_SERIAL.toString("hex"), // same serial → matches on serial alone
+    now:           _OCSP_NOW,
+  });
+  check("cross-issuer: REFUSED (ok=false) — not bound on serial alone", rv.ok === false);
+  check("cross-issuer: signature still verified (reached the binding gate)",
+        rv.signatureValid === true);
+  check("cross-issuer: refused for the wrong-issuer reason",
+        /issuerNameHash|issuerKeyHash|wrong-issuer/i.test((rv.errors || []).join(" ; ")));
+}
+
+// Without issuerCertDer the binding is not enforced (serial-only legacy path).
+function testNoIssuerCertDerStaysSerialBound() {
+  var otherIssuer = _synthCert(Buffer.from([0x02]), Buffer.from("Evil CA"),
+                               Buffer.from("evil-ca-key-bytes-bbbbbbbbbbbbbb"));
+  var fx = _buildSignedOcspWithCertIdIssuer(_OCSP_SERIAL, otherIssuer);
+  var rv = b.network.tls.ocsp.evaluate(fx.der, {
+    issuerPem: fx.issuerPem, serialHex: _OCSP_SERIAL.toString("hex"), now: _OCSP_NOW,
+  });
+  check("no issuerCertDer: serial-only bind still resolves (ok=true)", rv.ok === true);
+}
+
 async function run() {
   testSurface();
   testParseRejectsBadInput();
@@ -95,6 +216,9 @@ async function run() {
   testEvaluateNonSuccessful();
   testEvaluateMalformed();
   await testRequireGoodRequiresIssuerPem();
+  testCertIdIssuerMatchAccepted();
+  testCrossIssuerCertIdRefused();
+  testNoIssuerCertDerStaysSerialBound();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/tls-pinset-drift.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.network.tls.pinsetDriftMonitor — periodic check that emits

package/lib/vendor/blamejs/test/layer-0-primitives/tls-preferred-groups.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.network.tls.preferredGroups + b.network.tls.pqc.* — RFC 9794

package/lib/vendor/blamejs/test/layer-0-primitives/tracing.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * tracing — OpenTelemetry seam.

package/lib/vendor/blamejs/test/layer-0-primitives/tsa.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Layer 0 — b.tsa (RFC 3161 timestamp client) over b.cms + asn1-der.

package/lib/vendor/blamejs/test/layer-0-primitives/uri-template.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Layer 0 — b.uriTemplate (RFC 6570).

package/lib/vendor/blamejs/test/layer-0-primitives/uuid.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.uuid — RFC 4122 v4 + RFC 9562 v7 generation, parse/validate.

package/lib/vendor/blamejs/test/layer-0-primitives/validate-opts-port.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // b.validateOpts.optionalPort — RFC 6335 §6 port-range validator — plus the
 // representative connection entry-point wiring (ntpCheck.querySingle; the other

package/lib/vendor/blamejs/test/layer-0-primitives/validate-opts-shape.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * validateOpts.shape — declarative opts validator that collapses the

package/lib/vendor/blamejs/test/layer-0-primitives/vault-aad.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.vault.aad — AAD-bound sealed columns.

package/lib/vendor/blamejs/test/layer-0-primitives/vault-default-store.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.vault.getDefaultStore — the default sealed-storage Store ({ seal, unseal })

package/lib/vendor/blamejs/test/layer-0-primitives/vault-rotate-aad.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.vaultRotate.rotate — AAD round-trip.

package/lib/vendor/blamejs/test/layer-0-primitives/vault-seal-pem-file.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var fs = require("fs");

package/lib/vendor/blamejs/test/layer-0-primitives/vc.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Layer 0 — b.vc (W3C Verifiable Credentials 2.0, VC-JOSE-COSE).
@@ -232,9 +234,32 @@ async function testPresentation() {
   check("verifyPresentation: non-array verifiableCredential refused (no bypass)", e7 && e7.code === "vc/bad-presentation");
 }
 
+async function testAlgKeyBinding() {
+  // RFC 7518 §3.4: ES384 is bound to curve P-384. A JWS whose header claims
+  // ES384 but is keyed with a P-256 key must be refused BEFORE the signature
+  // verify — the verifier must not let the attacker pick an alg independent of
+  // the key's curve (ECDSA curve/type confusion, CWE-347).
+  var mismatched = _rawJose({ alg: "ES384", typ: "vc+jwt" }, _cred());
+  var e1 = null;
+  try { await b.vc.verify(mismatched, { algorithms: ["ES384"], publicKey: EC.publicKey }); } catch (e) { e1 = e; }
+  check("jose verify: ES384 header on a P-256 key throws alg-key-mismatch",
+    e1 && /vc\/alg-key-mismatch/.test(e1.code || ""));
+  // EdDSA alg with an EC key is likewise refused.
+  var mismatched2 = _rawJose({ alg: "EdDSA", typ: "vc+jwt" }, _cred());
+  var e2 = null;
+  try { await b.vc.verify(mismatched2, { algorithms: ["EdDSA"], publicKey: EC.publicKey }); } catch (e) { e2 = e; }
+  check("jose verify: EdDSA header on an EC key throws alg-key-mismatch",
+    e2 && /vc\/alg-key-mismatch/.test(e2.code || ""));
+  // The matched pair (ES256 + P-256) still verifies — no over-rejection.
+  var okTok = await b.vc.issue(_cred(), { securing: "jose", alg: "ES256", privateKey: EC.privateKey });
+  var okOut = await b.vc.verify(okTok, { algorithms: ["ES256"], publicKey: EC.publicKey, expectedIssuer: "did:example:issuer123" });
+  check("jose verify: matched ES256 + P-256 still verifies", okOut.securing === "jose");
+}
+
 async function run() {
   testSurface();
   await testJoseRoundTrip();
+  await testAlgKeyBinding();
   await testCoseRoundTrip();
   await testRefusals();
   await testTemporalAndStructural();

package/lib/vendor/blamejs/test/layer-0-primitives/vendor-currency-classify.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Vendor-currency content classifier — the logic that makes Public Suffix

package/lib/vendor/blamejs/test/layer-0-primitives/vendor-data.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.vendorData — packaging-mode-invariant + signed + canary-guarded

package/lib/vendor/blamejs/test/layer-0-primitives/vendor-manifest.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * vendor-manifest.test.js

package/lib/vendor/blamejs/test/layer-0-primitives/vex.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.vex — OASIS CSAF 2.1 VEX statement / document builder.

package/lib/vendor/blamejs/test/layer-0-primitives/watcher.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.watcher — recursive fs.watch wrapper with cross-platform event

package/lib/vendor/blamejs/test/layer-0-primitives/web-push-vapid.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.webPush — RFC 8292 VAPID JWT signer + RFC 8030 push request shape.

package/lib/vendor/blamejs/test/layer-0-primitives/webhook-dispatcher.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * webhook-dispatcher — durable signed-webhook delivery store
@@ -72,6 +74,45 @@ function _stubTransport() {
   return fn;
 }
 
+// A Postgres-dialect externalDb that reproduces the competing-consumer claim
+// race that ONLY exists on a real row-locking backend (Postgres / MySQL at
+// READ COMMITTED) — never on sqlite's single writer. Scenario: one delivery
+// row is pending-and-due, but a CONCURRENT poller is mid-claim on it. A
+// correct claim uses SELECT ... FOR UPDATE SKIP LOCKED, so this poller's SELECT
+// skips the row the other poller locked and claims nothing. A claim that omits
+// SKIP LOCKED still sees the row as pending under READ COMMITTED (the other
+// txn is uncommitted at SELECT time), selects it, then its gated UPDATE matches
+// zero rows (the other txn committed the flip first), and the reselect-by-id
+// re-reads the now-in-flight row and hands it back — so BOTH pollers attempt
+// the same delivery in one cycle.
+function _contendedPgDb(dueId, dialect) {
+  dialect = dialect || "postgres";
+  function _run(sqlText) {
+    var isClaimSelect = /select/i.test(sqlText)
+      && /status\s*=\s*'pending'/i.test(sqlText)
+      && /next_attempt_at/i.test(sqlText);
+    if (isClaimSelect) {
+      // SKIP LOCKED ⇒ the contended row is locked by the other poller ⇒ skipped.
+      if (/for\s+update\s+skip\s+locked/i.test(sqlText)) return { rows: [] };
+      return { rows: [{ delivery_id: dueId }] };          // no SKIP LOCKED: selected
+    }
+    // this poller's gated pending→in-flight UPDATE loses (the other poller
+    // committed the claim first), so it matches zero rows.
+    if (/^\s*update/i.test(sqlText) && /'in-flight'/i.test(sqlText)) return { rows: [], changes: 0 };
+    // the buggy reselect re-reads the row the OTHER poller already flipped.
+    if (/select/i.test(sqlText) && /status\s*=\s*'in-flight'/i.test(sqlText)) return { rows: [{ delivery_id: dueId }] };
+    return { rows: [], changes: 0 };
+  }
+  // dialect carries the operator-supplied string (incl. the `postgresql` alias)
+  // so the test exercises the dialect-normalization path the claim depends on.
+  var xdb = { dialect: dialect, query: async function (s) { return _run(s); } };
+  return {
+    dialect: dialect,
+    query: async function (s) { return _run(s); },
+    transaction: async function (fn) { return await fn(xdb); },
+  };
+}
+
 // Public IP literals — ssrfGuard classifies these without DNS, so the SSRF
 // gate runs offline. The stub transport means no real POST is attempted.
 var PUBLIC_URL  = "https://1.1.1.1/hooks";
@@ -106,6 +147,7 @@ async function _runAll() {
   await testThrownTransportErrorBacksOff();
   await testMysqlSchemaNoPartialIndex();
   await testInlineDeliveryNotDoubleClaimed();
+  await testPostgresClaimUsesSkipLockedDisjoint();
   await testMaxAttemptsDeadLetters();
   await testDlqReplay();
   await testDeliveriesRetry();
@@ -298,6 +340,41 @@ async function testInlineDeliveryNotDoubleClaimed() {
   check("inline delivery not double-claimed by a concurrent poller", calls === 1);
 }
 
+async function testPostgresClaimUsesSkipLockedDisjoint() {
+  // RED before the fix: on Postgres / MySQL the retry claim was a mark-then-
+  // reselect with no FOR UPDATE SKIP LOCKED, so the reselect-by-id re-read any
+  // in-flight row in the batch — including one a concurrent poller had just
+  // claimed — and two pollers double-delivered the same row in one cycle. This
+  // drives the postgres dialect because sqlite's single writer can't reproduce
+  // it (the wrong-config gap that let it ship: testInlineDeliveryNotDoubleClaimed
+  // runs on sqlite). The fix mirrors b.outbox's canonical competing-consumer
+  // claim: FOR UPDATE SKIP LOCKED on Postgres / MySQL so concurrent pollers see
+  // disjoint sets; the row another poller locked is skipped, so this poller
+  // claims — and attempts — nothing.
+  var pg = _contendedPgDb("d_contended");
+  var wd = b.webhook.dispatcher({
+    externalDb: pg, httpRequest: _stubTransport(), maxAttempts: 3,
+    retryBackoff: { initialMs: 1000, maxMs: 5000, factor: 2 },
+    now: function () { return 1700000000000; },
+  });
+  var res = await wd.processRetries();
+  check("processRetries claims nothing a concurrent poller already locked (Postgres SKIP LOCKED disjointness)",
+        res.attempted === 0);
+
+  // The `postgresql` alias normalizes to Postgres for SQL rendering, so the
+  // SKIP LOCKED decision must follow the same normalization — otherwise the
+  // dispatcher emits Postgres SQL but falls back to the mark-then-reselect race.
+  var pgAlias = _contendedPgDb("d_contended_alias", "postgresql");
+  var wdAlias = b.webhook.dispatcher({
+    externalDb: pgAlias, httpRequest: _stubTransport(), maxAttempts: 3,
+    retryBackoff: { initialMs: 1000, maxMs: 5000, factor: 2 },
+    now: function () { return 1700000000000; },
+  });
+  var resAlias = await wdAlias.processRetries();
+  check("processRetries honors SKIP LOCKED under the 'postgresql' dialect alias",
+        resAlias.attempted === 0);
+}
+
 async function testMaxAttemptsDeadLetters() {
   var now = 1700000000000;
   var clock = function () { return now; };

package/lib/vendor/blamejs/test/layer-0-primitives/webhook-verify-nonce-atomic.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.webhook.verify — replay nonceStore is atomic, not check-then-set (#328).

package/lib/vendor/blamejs/test/layer-0-primitives/webhook.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.webhook — outbound signing + inbound verification.

package/lib/vendor/blamejs/test/layer-0-primitives/websocket-channels.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * websocket-channels — channel/room hub layered over lib/websocket.js.

package/lib/vendor/blamejs/test/layer-0-primitives/websocket-extension-header.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * websocket _parseExtensionHeader — Sec-WebSocket-Extensions parser

package/lib/vendor/blamejs/test/layer-0-primitives/worker-pool-recycle-race.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // #127: a task queued behind a timing-out (or erroring) task must not be
 // dropped by slot recycling. _onTaskTimeout / _onWorkerError called

package/lib/vendor/blamejs/test/layer-0-primitives/worker-pool.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * worker-pool primitive — layer-0 tests for b.workerPool.create.

package/lib/vendor/blamejs/test/layer-0-primitives/worm.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Layer 0 — b.worm (write-once-read-many retention).

package/lib/vendor/blamejs/test/layer-0-primitives/ws-client.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.wsClient — outbound WebSocket client (RFC 6455).