@blamejs/blamejs-shop 0.5.5 → 0.5.7

package/lib/vendor/blamejs/lib/parsers/safe-xml.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Security-focused XML parser. Same security defaults blamejs's json

package/lib/vendor/blamejs/lib/parsers/safe-yaml.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Security-focused YAML parser (safe subset of YAML 1.2).

package/lib/vendor/blamejs/lib/permissions.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.permissions

package/lib/vendor/blamejs/lib/pick.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.pick — mass-assignment (CWE-915 / OWASP API3:2023) defense.

package/lib/vendor/blamejs/lib/pipl-cn.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.pipl

package/lib/vendor/blamejs/lib/pqc-agent.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.pqcAgent

package/lib/vendor/blamejs/lib/pqc-gate.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * pqc-gate — TCP-level enforcement of post-quantum key exchange.

package/lib/vendor/blamejs/lib/pqc-software.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.pqcSoftware

package/lib/vendor/blamejs/lib/privacy-pass.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.privacyPass

package/lib/vendor/blamejs/lib/privacy.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.privacy

package/lib/vendor/blamejs/lib/problem-details.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.problemDetails

package/lib/vendor/blamejs/lib/process-spawn.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.processSpawn

package/lib/vendor/blamejs/lib/promise-pool.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.promisePool

package/lib/vendor/blamejs/lib/protobuf-encoder.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * protobuf-encoder — minimal proto3 wire-format encoder.

package/lib/vendor/blamejs/lib/protocol-dispatcher.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * protocol-dispatcher — pluggable protocol resolver with deferred-protocol

package/lib/vendor/blamejs/lib/public-suffix.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.publicSuffix
@@ -97,14 +99,19 @@ function _normalizeInput(domain) {
         "publicSuffix: domain must not be a bare dot");
     }
   }
-  // Reject control / null / whitespace bytes outright. domainToASCII
-  // would silently rewrite some of them; we want hostile inputs to
-  // throw, not be coerced.
+  // Reject control / null / whitespace bytes AND the URL-structural delimiters
+  // domainToASCII silently TRUNCATES at — "/" (0x2F), "?" (0x3F), "#" (0x23),
+  // "\" (0x5C) reduce "example.com/evil" to "example.com" rather than failing,
+  // which would let a hostile host masquerade as a trusted prefix. ":" / "@" /
+  // "[" / "]" already make domainToASCII return "" (caught below), but reject
+  // them here too so every non-host character fails closed, not silently.
   for (var i = 0; i < s.length; i += 1) {
     var cp = s.charCodeAt(i);
-    if (cp < 0x21 || cp === 0x7f) {
+    if (cp < 0x21 || cp === 0x7f ||
+        cp === 0x2f || cp === 0x3f || cp === 0x23 || cp === 0x5c ||   // / ? # \
+        cp === 0x3a || cp === 0x40 || cp === 0x5b || cp === 0x5d) {   // : @ [ ]
       throw _err("public-suffix/invalid-domain",
-        "publicSuffix: domain contains control / whitespace byte");
+        "publicSuffix: domain contains a control byte or URL delimiter");
     }
   }
   // IDN-normalize — non-ASCII labels become xn--… via Node's UTS #46
@@ -395,9 +402,42 @@ function lookupSource() {
   return _sourceMeta;
 }
 
+/**
+ * @primitive b.publicSuffix.canonicalDomain
+ * @signature b.publicSuffix.canonicalDomain(domain)
+ * @since     0.15.50
+ * @status    stable
+ * @related   b.publicSuffix.organizationalDomain, b.publicSuffix.publicSuffix
+ *
+ * Returns the bare canonical host form of `domain` for identity
+ * comparison: lowercase, a single trailing dot stripped, and IDN
+ * labels normalized to their A-label (punycode) form. Unlike
+ * `organizationalDomain` it does NOT walk the public-suffix list — it
+ * returns the input host itself in canonical form.
+ *
+ * Two values that denote the same host in different encodings (case,
+ * trailing dot, U-label vs A-label) return the SAME string, so an
+ * equality compare is encoding-stable — the building block for DMARC
+ * alignment and certificate SAN-vs-domain authorization checks, where
+ * one side normalizing differently from the other is a bypass.
+ *
+ * Non-throwing: returns `""` for any input that is not a valid host
+ * (control bytes, empty labels, over the 253-octet limit), so a
+ * hostile or garbage value canonicalizes to `""` and matches nothing.
+ *
+ * @example
+ *   var b = require("@blamejs/core");
+ *   b.publicSuffix.canonicalDomain("Example.COM.");   // → "example.com"
+ *   b.publicSuffix.canonicalDomain("a..b");             // → ""
+ */
+function canonicalDomain(domain) {
+  try { return _normalizeInput(domain); } catch (_e) { return ""; }
+}
+
 module.exports = {
   publicSuffix:         publicSuffix,
   organizationalDomain: organizationalDomain,
+  canonicalDomain:      canonicalDomain,
   isPublicSuffix:       isPublicSuffix,
   lookupSource:         lookupSource,
 };

package/lib/vendor/blamejs/lib/pubsub-cluster.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * pubsub-cluster — table-polling backend for `lib/pubsub.js`.

package/lib/vendor/blamejs/lib/pubsub-redis.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * pubsub-redis — Redis PUB/SUB backend for `lib/pubsub.js`.

package/lib/vendor/blamejs/lib/pubsub.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.pubsub

package/lib/vendor/blamejs/lib/queue-local.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Local-protocol queue adapter — DB-backed, dialect-portable.
@@ -436,23 +438,27 @@ function create(config) {
   // Handler context exposes this as `ctx.extendLease(ms)`. The job must
   // still be in 'inflight' status (i.e. not yet swept by sweepExpired);
   // otherwise the call no-ops and returns false.
-  async function extendLease(jobId, additionalMs) {
+  async function extendLease(jobId, additionalMs, opts) {
     cluster.requireLeader();
     if (typeof additionalMs !== "number" || additionalMs <= 0) {
       throw _err("INVALID_LEASE_EXTENSION",
         "extendLease: additionalMs must be a positive number", true);
     }
     var newExpiry = Date.now() + additionalMs;
-    var built = _update()
+    var extUpd = _update()
       .set("leaseExpiresAt", newExpiry)
       .where("_id", jobId)
-      .where("status", "inflight")
-      .toSql();
+      .where("status", "inflight");
+    // Lease fencing: only the current lease holder (matching attempts) may
+    // extend. attempts is unchanged by an extend, so a worker can extend
+    // repeatedly (mirrors the redis EXTEND_LUA fence).
+    if (opts && opts.attempt != null) extUpd = extUpd.where("attempts", opts.attempt);
+    var built = extUpd.toSql();
     var result = await store.execute(built.sql, built.params);
     return (result.rowCount || 0) > 0;
   }
 
-  async function complete(jobId) {
+  async function complete(jobId, opts) {
     cluster.requireLeader();
     var nowMs = Date.now();
     // Read the row first so we can act on repeat / flow metadata after
@@ -467,13 +473,20 @@ function create(config) {
     var rowRes = await store.execute(rowBuilt.sql, rowBuilt.params);
     var row = (rowRes && rowRes.rows && rowRes.rows[0]) || null;
 
-    var doneBuilt = _update()
+    // Lease fencing: when the caller supplies the `attempts` value it
+    // leased at, gate the status flip on it. `attempts` is bumped once per
+    // lease, so a stale completer whose lease expired and whose job was
+    // re-leased to another worker (a higher attempts) matches 0 rows and
+    // does not mark the new worker's in-progress job done. Matches the
+    // redis backend's COMPLETE_LUA fence and SQS's receiptHandle binding.
+    var doneUpd = _update()
       .set("status", "done")
       .set("finishedAt", nowMs)
       .set("leaseExpiresAt", null)
       .where("_id", jobId)
-      .where("status", "inflight")
-      .toSql();
+      .where("status", "inflight");
+    if (opts && opts.attempt != null) doneUpd = doneUpd.where("attempts", opts.attempt);
+    var doneBuilt = doneUpd.toSql();
     var doneRes = await store.execute(doneBuilt.sql, doneBuilt.params);
     // Only run the post-completion side effects if THIS call actually flipped
     // the row inflight→done. If the status guard matched 0 rows the job was
@@ -579,7 +592,7 @@ function create(config) {
     // prior 'pending'/'failed' SQL literals now bind, which keeps the raw
     // fragment literal-free).
     var attemptsLt = _qc("attempts") + " < " + _qc("maxAttempts");
-    var failBuilt = _update()
+    var failUpd = _update()
       .setRaw("status", "CASE WHEN " + attemptsLt + " THEN ? ELSE ? END", ["pending", "failed"])
       .set("lastError", sealedErr)
       .set("leaseExpiresAt", null)
@@ -587,8 +600,12 @@ function create(config) {
               [nowMs + retryDelayMs])
       .setRaw("finishedAt", "CASE WHEN " + attemptsLt + " THEN NULL ELSE ? END", [nowMs])
       .where("_id", jobId)
-      .where("status", "inflight")          // lease-ownership guard — a stale fail() must not clobber a job re-leased to another worker after this one's lease expired (mirrors complete()/extendLease)
-      .toSql();
+      .where("status", "inflight");         // lease-ownership guard — a stale fail() must not clobber a job re-leased to another worker after this one's lease expired (mirrors complete()/extendLease)
+    // Lease fencing: when the caller leased at a specific attempts value,
+    // gate on it too, so a stale fail() whose job was re-leased (higher
+    // attempts) matches 0 rows (mirrors the redis FAIL_LUA fence).
+    if (opts.attempt != null) failUpd = failUpd.where("attempts", opts.attempt);
+    var failBuilt = failUpd.toSql();
     var failRes = await store.execute(failBuilt.sql, failBuilt.params);
     return (failRes.rowCount || 0) > 0;
   }

package/lib/vendor/blamejs/lib/queue-redis.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Redis-protocol queue adapter — backs b.queue with Redis instead of
@@ -144,15 +146,31 @@ var SWEEP_LUA = [
 // COMPLETE_LUA — atomically remove from inflight zset, flip status to
 // done, set finishedAt. Returns 1 if the job was inflight, 0 otherwise.
 //
+// Lease fencing: ARGV[3] is the caller's leased `attempts` value (the
+// inflight `attempts` at the time it leased), or "" to skip the check.
+// `attempts` is HINCRBY'd once per lease, so it uniquely identifies a
+// lease generation. If the stored attempts no longer matches, the caller
+// no longer owns the lease — its lease expired, was swept, and the job was
+// re-leased to another worker (whose lease incremented attempts) — so a
+// late completion from the stale holder returns 0 without marking the
+// in-progress job done. (The ZREM-removed gate alone can't catch this: the
+// inflight member is just the jobId, present again under the new lease.)
+//
 // KEYS[1] = inflight zset
 // KEYS[2] = job hash key
 // ARGV[1] = jobId (member to ZREM)
 // ARGV[2] = nowMs
+// ARGV[3] = expected leased attempts ("" = no fence)
 var COMPLETE_LUA = [
   'local inflightKey = KEYS[1]',
   'local jobKey = KEYS[2]',
   'local jobId = ARGV[1]',
   'local nowMs = tonumber(ARGV[2])',
+  'local fenceAttempt = ARGV[3]',
+  'if fenceAttempt ~= "" then',
+  '  local cur = redis.call("HGET", jobKey, "attempts")',
+  '  if cur == false or tostring(cur) ~= fenceAttempt then return 0 end',
+  'end',
   'local removed = redis.call("ZREM", inflightKey, jobId)',
   'if removed == 1 then',
   '  redis.call("HSET", jobKey, "status", "done", "finishedAt", nowMs, "leaseExpiresAt", "")',
@@ -161,9 +179,11 @@ var COMPLETE_LUA = [
 ].join("\n");
 
 // FAIL_LUA — decide retry vs DLQ based on the row's current attempts
-// vs maxAttempts (read from HASH for race-freedom). Retry: ZADD ready
-// at score=nextAvailableAt, status=pending. DLQ: ZADD dlq at
-// score=nowMs, status=failed.
+// vs maxAttempts (read from HASH for race-freedom). Gated on the job
+// still being inflight (ZREM removed == 1): a stale fail() on a job that
+// is no longer inflight returns -1 and mutates nothing. Retry: ZADD ready
+// at score=nextAvailableAt, status=pending, return 0. DLQ: ZADD dlq at
+// score=nowMs, status=failed, return 1.
 //
 // KEYS[1] = inflight zset
 // KEYS[2] = ready zset
@@ -173,6 +193,7 @@ var COMPLETE_LUA = [
 // ARGV[2] = nowMs
 // ARGV[3] = sealedErr (string; "" if no error)
 // ARGV[4] = nextAvailableAt
+// ARGV[5] = expected leased attempts ("" = no fence) — see COMPLETE_LUA
 var FAIL_LUA = [
   'local inflightKey = KEYS[1]',
   'local readyKey = KEYS[2]',
@@ -182,9 +203,23 @@ var FAIL_LUA = [
   'local nowMs = tonumber(ARGV[2])',
   'local sealedErr = ARGV[3]',
   'local nextAvailableAt = tonumber(ARGV[4])',
+  'local fenceAttempt = ARGV[5]',
   'local attempts = tonumber(redis.call("HGET", jobKey, "attempts")) or 0',
   'local maxAttempts = tonumber(redis.call("HGET", jobKey, "maxAttempts")) or 5',
-  'redis.call("ZREM", inflightKey, jobId)',
+  // Lease fencing: a stale fail() from a worker whose lease expired and whose
+  // job was re-leased to another worker (which incremented attempts) must not
+  // re-queue or DLQ the job the new worker is still running. If the stored
+  // attempts no longer matches the caller's leased attempts, return -1 and
+  // mutate nothing — same fence as COMPLETE_LUA.
+  'if fenceAttempt ~= "" and tostring(attempts) ~= fenceAttempt then return -1 end',
+  // Lease-ownership guard: only act if THIS call removed the job from inflight.
+  // A stale fail() — the worker's lease expired, sweepExpired re-queued the job,
+  // and another worker completed it — must not re-queue a job that is no longer
+  // inflight (it would resurrect a completed job for re-execution). Mirrors
+  // queue-local fail()'s `WHERE status='inflight'` guard. Returns -1 so the
+  // caller can report "did not act" rather than a retry/dlq outcome.
+  'local removed = redis.call("ZREM", inflightKey, jobId)',
+  'if removed ~= 1 then return -1 end',
   'if sealedErr ~= "" then redis.call("HSET", jobKey, "lastError", sealedErr) end',
   'redis.call("HSET", jobKey, "leaseExpiresAt", "")',
   'if attempts < maxAttempts then',
@@ -198,19 +233,30 @@ var FAIL_LUA = [
   'end',
 ].join("\n");
 
-// EXTEND_LUA — push leaseExpiresAt forward iff the job is still inflight.
+// EXTEND_LUA — push leaseExpiresAt forward iff the job is still inflight
+// AND the caller still owns the lease. ARGV[3] is the caller's leased
+// attempts ("" = no fence); a stale extend from a worker whose job was
+// re-leased (attempts moved on) returns 0 without touching the new
+// holder's lease — same fence as COMPLETE_LUA. Note `attempts` is not
+// changed by an extend, so a worker can extend its own lease repeatedly.
 //
 // KEYS[1] = inflight zset
 // KEYS[2] = job hash key
 // ARGV[1] = jobId
 // ARGV[2] = newExpiry
+// ARGV[3] = expected leased attempts ("" = no fence)
 var EXTEND_LUA = [
   'local inflightKey = KEYS[1]',
   'local jobKey = KEYS[2]',
   'local jobId = ARGV[1]',
   'local newExpiry = tonumber(ARGV[2])',
+  'local fenceAttempt = ARGV[3]',
   'local score = redis.call("ZSCORE", inflightKey, jobId)',
   'if score == false then return 0 end',
+  'if fenceAttempt ~= "" then',
+  '  local cur = redis.call("HGET", jobKey, "attempts")',
+  '  if cur == false or tostring(cur) ~= fenceAttempt then return 0 end',
+  'end',
   'redis.call("ZADD", inflightKey, newExpiry, jobId)',
   'redis.call("HSET", jobKey, "leaseExpiresAt", newExpiry)',
   'return 1',
@@ -432,12 +478,13 @@ function create(opts) {
     return leased;
   }
 
-  async function extendLease(jobId, additionalMs) {
+  async function extendLease(jobId, additionalMs, opts) {
     await _ensureConnected();
     if (typeof additionalMs !== "number" || additionalMs <= 0) {
       throw _err("INVALID_LEASE_EXTENSION",
         "extendLease: additionalMs must be a positive number", true);
     }
+    var fence = (opts && opts.attempt != null) ? String(opts.attempt) : "";
     var newExpiry = Date.now() + additionalMs;
     // We don't know which queue the job belongs to without a HGET, so
     // fetch queueName first (avoids storing inflight by queue, which
@@ -448,14 +495,15 @@ function create(opts) {
     var rv = await client.runScript(
       EXTEND_LUA, 2,
       _inflightKey(queueName), _jobKey(jobId),
-      jobId, String(newExpiry)
+      jobId, String(newExpiry), fence
     );
     return rv === 1;
   }
 
-  async function complete(jobId) {
+  async function complete(jobId, opts) {
     await _ensureConnected();
     var nowMs = Date.now();
+    var fence = (opts && opts.attempt != null) ? String(opts.attempt) : "";
     // Read row first to act on cron-repeat metadata. Same shape as
     // queue-local: SELECT row → flip status → if repeatCron, enqueue
     // next firing.
@@ -464,11 +512,18 @@ function create(opts) {
     if (!raw) return false;
     var queueName = raw.queueName || "unknown";
 
-    await client.runScript(
+    var removed = await client.runScript(
       COMPLETE_LUA, 2,
       _inflightKey(queueName), _jobKey(jobId),
-      jobId, String(nowMs)
+      jobId, String(nowMs), fence
     );
+    // Only the completer that won the inflight->done transition (removed === 1)
+    // runs the post-completion side effects. If the ZREM matched nothing the
+    // job was already completed, or its lease expired and sweepExpired re-queued
+    // it (possibly re-leased to another worker) — a stale completer must NOT
+    // re-enqueue the cron repeat (duplicate firing) or release flow children
+    // twice. Mirrors queue-local's `WHERE status='inflight'` rowcount guard.
+    if (Number(removed) !== 1) return false;
 
     if (raw.repeatCron) {
       try {
@@ -589,13 +644,17 @@ function create(opts) {
   async function fail(jobId, errorMessage, retryDelayMs) {
     await _ensureConnected();
     var nowMs = Date.now();
-    // b.queue.consume passes the object form `{ retryDelayMs }` (matching
-    // the queue-local backend); accept it as well as a bare-number third
-    // arg. Without this the object failed the `typeof === "number"` test
+    // b.queue.consume passes the object form `{ retryDelayMs, attempt }`
+    // (matching the queue-local backend); accept it as well as a bare-number
+    // third arg. Without this the object failed the `typeof === "number"` test
     // below and the delay was forced to 0, so the documented exponential
     // backoff was silently discarded and a failing job re-leased
-    // immediately on the redis backend (retry storm).
+    // immediately on the redis backend (retry storm). `attempt` is the
+    // caller's leased attempts value, used to fence a stale fail() (see
+    // FAIL_LUA).
+    var fence = "";
     if (retryDelayMs && typeof retryDelayMs === "object") {
+      if (retryDelayMs.attempt != null) fence = String(retryDelayMs.attempt);
       retryDelayMs = retryDelayMs.retryDelayMs;
     }
     if (typeof retryDelayMs !== "number" || !isFinite(retryDelayMs) || retryDelayMs < 0) {
@@ -609,12 +668,15 @@ function create(opts) {
 
     var sealedErr = errorMessage ? vault().seal(String(errorMessage)) : "";
 
-    await client.runScript(
+    var rv = await client.runScript(
       FAIL_LUA, 4,
       _inflightKey(queueName), _readyKey(queueName), _dlqKey(queueName), _jobKey(jobId),
-      jobId, String(nowMs), sealedErr, String(nextAvailableAt)
+      jobId, String(nowMs), sealedErr, String(nextAvailableAt), fence
     );
-    return true;
+    // -1 = stale fail() on a job no longer inflight (already completed or
+    // re-leased) — it did not retry or DLQ. 0 = retried, 1 = landed in dlq.
+    // Mirrors queue-local fail()'s `rowCount > 0`.
+    return Number(rv) !== -1;
   }
 
   async function sweepExpired() {

package/lib/vendor/blamejs/lib/queue-sqs.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * AWS SQS queue adapter — backs `b.queue` with Amazon SQS so multi-replica

package/lib/vendor/blamejs/lib/queue.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.queue
@@ -479,7 +481,7 @@ function consume(queueName, handler, opts) {
                   "queue backend '" + b.name + "' does not support extendLease",
                   true);
               }
-              return b.extendLease(job.jobId, additionalMs).then(function (ok) {
+              return b.extendLease(job.jobId, additionalMs, { attempt: job.attempts }).then(function (ok) {
                 if (ok) {
                   _emit("system.queue.lease.extended", {
                     metadata: { queue: queueName, backend: b.name, jobId: job.jobId, additionalMs: additionalMs },
@@ -514,7 +516,7 @@ function consume(queueName, handler, opts) {
               return Promise.resolve()
                 .then(function () { return handler(job, ctx); })
                 .then(function () {
-                  return b.complete(job.jobId).then(function () {
+                  return b.complete(job.jobId, { attempt: job.attempts }).then(function () {
                     _emit("system.queue.consume.success", {
                       metadata: { queue: queueName, backend: b.name, jobId: job.jobId, attempt: job.attempts, traceId: job.traceId },
                     });
@@ -523,7 +525,7 @@ function consume(queueName, handler, opts) {
                 }, function (err) {
               var msg = (err && err.message) || String(err);
               var willRetry = job.attempts < job.maxAttempts;
-              return b.fail(job.jobId, msg, { retryDelayMs: _backoffDelay(job.attempts) })
+              return b.fail(job.jobId, msg, { retryDelayMs: _backoffDelay(job.attempts), attempt: job.attempts })
                 .then(function () {
                   observability.event("queue.fail", 1, { queueName: queueName, willRetry: willRetry });
                   _emit("system.queue.consume.failure", {

package/lib/vendor/blamejs/lib/redact.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.redact

package/lib/vendor/blamejs/lib/redis-client.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Bespoke RESP2 Redis client — zero npm runtime deps.
@@ -78,7 +80,20 @@ function _encodeCommand(args) {
 //   { type: "int",    value, consumed }   — integer (:42)
 //   { type: "bulk",   value, consumed }   — bulk string buffer (or null)
 //   { type: "array",  value, consumed }   — array of decoded items
-function _parseFrame(buf, offset) {
+//
+// RESP arrays nest (an array whose elements are arrays), so the decoder
+// recurses. A hostile or compromised server can stream an arbitrarily deep
+// nest of `*1\r\n` headers to overflow the V8 stack with an uncaught
+// RangeError out of the socket 'data' handler — a crash. Cap the nesting
+// well above any real reply (cluster-slots / XRANGE replies nest a handful
+// deep) and throw a typed PROTOCOL error, which _onData turns into a socket
+// teardown + reconnect instead of a process crash.
+var MAX_RESP_DEPTH = 64;
+function _parseFrame(buf, offset, depth) {
+  depth = depth || 0;
+  if (depth > MAX_RESP_DEPTH) {
+    throw _err("PROTOCOL", "reply nesting exceeds " + MAX_RESP_DEPTH + " levels");
+  }
   if (offset >= buf.length) return { type: "incomplete" };
   var marker = buf[offset];
   // Find next CRLF after the marker
@@ -121,7 +136,7 @@ function _parseFrame(buf, offset) {
     var items = [];
     var cursor = crlf + 2;
     for (var i = 0; i < arrLen; i++) {
-      var sub = _parseFrame(buf, cursor);
+      var sub = _parseFrame(buf, cursor, depth + 1);
       if (sub.type === "incomplete") return { type: "incomplete" };
       items.push(sub);
       cursor += sub.consumed;
@@ -299,9 +314,19 @@ function create(opts) {
   function _onData(chunk) {
     rxBuffer = rxBuffer.length === 0 ? chunk : Buffer.concat([rxBuffer, chunk]);
     while (rxBuffer.length > 0) {
-      var frame = _parseFrame(rxBuffer, 0);
-      if (frame.type === "incomplete") return;
-      var value = _frameToValue(frame);
+      var frame, value;
+      try {
+        frame = _parseFrame(rxBuffer, 0);
+        if (frame.type === "incomplete") return;
+        value = _frameToValue(frame);
+      } catch (parseErr) {
+        // A malformed or hostilely-nested RESP frame must not throw out of
+        // the socket 'data' handler and crash the host. Treat it as a fatal
+        // connection fault: reject in-flight commands and tear the socket
+        // down for a reconnect, the same as any other lost-socket path.
+        _teardownSocket(parseErr);
+        return;
+      }
       rxBuffer = rxBuffer.slice(frame.consumed);
 
       // Pub/sub push detection — server-initiated arrays beginning with

package/lib/vendor/blamejs/lib/render.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.render

package/lib/vendor/blamejs/lib/request-helpers.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.requestHelpers
@@ -49,6 +51,9 @@ var lazyRequire = require("./lazy-require");
 // required very early in the boot graph. Only touched at middleware-construction
 // time by trustedClientIp(), never on the hot path.
 var _ssrfGuard = lazyRequire(function () { return require("./ssrf-guard"); });
+// Lazy for the same boot-graph reason — only touched at middleware-construction
+// time by makeSkipMatcher() to screen operator-supplied skip RegExps for ReDoS.
+var _guardRegex = lazyRequire(function () { return require("./guard-regex"); });
 
 var HTTP_STATUS = Object.freeze({
   OK:                            0xC8,
@@ -991,6 +996,12 @@ function makeSkipMatcher(opts, label) {
       throw new TypeError(label + ": skipPaths[" + i + "] must be a string prefix or RegExp, got " +
         typeof skipPaths[i]);
     }
+    // Screen operator-supplied skip RegExps for catastrophic-backtracking
+    // shapes once at construction time — they later run .test() against
+    // attacker-controlled request paths on the hot path.
+    if (skipPaths[i] instanceof RegExp) {
+      _guardRegex().assertSafe(skipPaths[i], label + ": skipPaths[" + i + "]");
+    }
   }
   var skipFn = opts.skip;
   if (skipFn !== undefined && skipFn !== null && typeof skipFn !== "function") {

package/lib/vendor/blamejs/lib/resource-access-lock.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.resourceAccessLock — three-mode access-lock for arbitrary