@blamejs/blamejs-shop 0.5.5 → 0.5.7

package/lib/vendor/blamejs/test/layer-0-primitives/notify.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.notify — generic notification dispatcher.

package/lib/vendor/blamejs/test/layer-0-primitives/numeric-bounds.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * numeric-bounds — shared-validator layer-0 tests.

package/lib/vendor/blamejs/test/layer-0-primitives/oauth-callback.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.auth.oauth callback / JARM / refresh-rotation primitives (v0.8.70):

package/lib/vendor/blamejs/test/layer-0-primitives/object-store-range-header.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.objectStore conditional-GET Range header (shared across sigv4 / gcs / azure).

package/lib/vendor/blamejs/test/layer-0-primitives/object-store-versioned-delete.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * object-store versioned-delete surface — the cross-backend contract for the

package/lib/vendor/blamejs/test/layer-0-primitives/observability-tracing.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Tests for the W3C distributed tracing suite shipped in v0.7.103:
@@ -462,6 +464,25 @@ function testSpanHttpServerIgnorePaths() {
   check("spanHttpServer: instruments /api/x", typeof req3.span === "object" && n3);
 }
 
+function testSpanHttpServerRejectsReDoSIgnorePath() {
+  // ignorePaths RegExps are matched per-request against the attacker-
+  // controlled request path, so a catastrophic-backtracking (ReDoS) shape
+  // is screened at config time and refused. The wrapped nested quantifier
+  // `((a)+)+$` is the canonical ReDoS class; the matched input stays
+  // harmless so the test never actually backtracks.
+  var tracer = b.observability.tracer.create({ service: "test" });
+  var threw = false;
+  var code = null;
+  try {
+    b.middleware.spanHttpServer({
+      tracer:      tracer,
+      ignorePaths: [/((a)+)+$/],
+    });
+  } catch (e) { threw = true; code = e.code; }
+  check("spanHttpServer: ReDoS ignorePaths RegExp refused", threw);
+  check("spanHttpServer: ReDoS refusal code", code === "span-http/unsafe-pattern");
+}
+
 // ---- traceLogCorrelation middleware ----
 
 function testTraceLogCorrelation() {
@@ -666,6 +687,7 @@ async function run() {
   testTracePropagateGeneratesWhenMissing();
   testSpanHttpServer();
   testSpanHttpServerIgnorePaths();
+  testSpanHttpServerRejectsReDoSIgnorePath();
   testTraceLogCorrelation();
   testTraceLogCorrelationWithSpan();
   testTraceLogCorrelationNoTrace();

package/lib/vendor/blamejs/test/layer-0-primitives/observability.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * observability — combined metrics + tracing tap.

package/lib/vendor/blamejs/test/layer-0-primitives/openapi.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.openapi — OpenAPI 3.1 schema-document builder.

package/lib/vendor/blamejs/test/layer-0-primitives/otel-export.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.otelExport — OTLP/HTTP-JSON exporter for b.observability events.

package/lib/vendor/blamejs/test/layer-0-primitives/otlp-attr-redaction.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // The OTLP span exporter must run every attribute VALUE through the telemetry
 // redactor before serialization. Telemetry is a first-class EGRESS sink — a
@@ -22,6 +24,7 @@ var otlpLogGrpc = require("../../lib/log-stream-otlp-grpc");
 var SECRET_TOKEN = "Bearer eyJSECRETtokenABCdef.ghi.jkl";
 var SECRET_PW    = "hunter2-PLAINTEXT-PASSWORD";
 var SECRET_API   = "sk_live_PLAINTEXT_APIKEY_0001";
+var SECRET_EVT   = "boom postgres://evtuser:EVTPW-SECRET-0002@evthost:5432/db";   // value-shape secret in a span-EVENT name
 var CONTROL_VAL  = "GET-control-value-keep-me";
 
 function makeSpan() {
@@ -42,6 +45,9 @@ function makeSpan() {
     events: [
       { timeUnixNano: "1700000000050000000", name: "log",
         attributes: { "password": SECRET_PW } },
+      // A secret in the event NAME must be redacted like span.name /
+      // exception.message — not passed through verbatim.
+      { timeUnixNano: "1700000000060000000", name: SECRET_EVT, attributes: {} },
     ],
     status:   { code: 1, message: "" },
     resource: { "service.name": "svc" },
@@ -101,12 +107,14 @@ async function run() {
   check("json: password redacted on the OTLP wire",     jsonWire.indexOf(SECRET_PW) === -1);
   check("json: api key redacted on the OTLP wire",      jsonWire.indexOf(SECRET_API) === -1);
   check("json: span-EVENT attribute password redacted", jsonWire.split(SECRET_PW).length === 1);
+  check("json: span-EVENT NAME secret redacted", jsonWire.indexOf(SECRET_EVT) === -1);
   check("json: non-sensitive control attribute survives", jsonWire.indexOf(CONTROL_VAL) !== -1);
 
   var protoWire = await captureBody("protobuf");
   check("protobuf: bearer token redacted on the OTLP wire", protoWire.indexOf(SECRET_TOKEN) === -1);
   check("protobuf: password redacted on the OTLP wire",     protoWire.indexOf(SECRET_PW) === -1);
   check("protobuf: api key redacted on the OTLP wire",      protoWire.indexOf(SECRET_API) === -1);
+  check("protobuf: span-EVENT NAME secret redacted",        protoWire.indexOf(SECRET_EVT) === -1);
   check("protobuf: non-sensitive control attribute survives", protoWire.indexOf(CONTROL_VAL) !== -1);
 
   // span status.message + name are EGRESS too — the tracer's canonical

package/lib/vendor/blamejs/test/layer-0-primitives/outbox-inflight-reaper.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // #128: the outbox must reclaim a row stranded 'in-flight' by a crashed
 // publisher. A claim flips status pending → in-flight and stamps claimed_at;

package/lib/vendor/blamejs/test/layer-0-primitives/output-header-hardening.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Response-output, header, and compliance hardening — each test drives the

package/lib/vendor/blamejs/test/layer-0-primitives/pagination.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * pagination — cursor + offset helpers.

package/lib/vendor/blamejs/test/layer-0-primitives/parser-verify-hardening.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Pre-auth parse/verify hardening — each test drives the shipped consumer

package/lib/vendor/blamejs/test/layer-0-primitives/parsers-standalone.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.parsers.json(req, opts) / b.parsers.multipart(req, opts) — standalone

package/lib/vendor/blamejs/test/layer-0-primitives/passkey-real-vectors.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.auth.passkey — REAL WebAuthn signature verification.

package/lib/vendor/blamejs/test/layer-0-primitives/passkey.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.auth.passkey — WebAuthn (FIDO2) primitives.

package/lib/vendor/blamejs/test/layer-0-primitives/permissions.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.permissions — RBAC primitive.

package/lib/vendor/blamejs/test/layer-0-primitives/pipl-cn.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // b.pipl.sccFilingAssessment + b.pipl.securityAssessmentCertificate —
 // China PIPL Art. 38/40/55 cross-border transfer record-builders (pure;

package/lib/vendor/blamejs/test/layer-0-primitives/pqc-agent-curve.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.pqcAgent — ecdhCurve negotiation surface.

package/lib/vendor/blamejs/test/layer-0-primitives/pqc-software.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.pqcSoftware — pure-JS post-quantum primitives wrapper.

package/lib/vendor/blamejs/test/layer-0-primitives/privacy-pass.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Layer 0 — b.privacyPass (Privacy Pass origin side, RFC 9577 / 9578).

package/lib/vendor/blamejs/test/layer-0-primitives/privacy-vendor-review.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // b.privacy.vendorReview + b.privacy.listVendorReviewClauses — FERPA / SOPIPA
 // EdTech vendor-review attestation builder (pure; no DB).

package/lib/vendor/blamejs/test/layer-0-primitives/problem-details.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.problemDetails — RFC 9457 Problem Details for HTTP APIs.

package/lib/vendor/blamejs/test/layer-0-primitives/process-spawn.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.processSpawn — child-process launcher with default secret-stripping.

package/lib/vendor/blamejs/test/layer-0-primitives/promise-pool.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.promisePool — bounded-concurrency promise pool.

package/lib/vendor/blamejs/test/layer-0-primitives/protected-resource-metadata.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // b.middleware.protectedResourceMetadata — draft-ietf-oauth-resource-metadata server.
 

package/lib/vendor/blamejs/test/layer-0-primitives/proto-shadow-allowlist.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Prototype-shadow / proto-pollution allowlist-bypass class (CWE-1321).

package/lib/vendor/blamejs/test/layer-0-primitives/protobuf-encoder.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * protobuf-encoder — proto3 wire-format encoder.

package/lib/vendor/blamejs/test/layer-0-primitives/protocol-dispatcher.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * protocol-dispatcher — pluggable protocol resolver.

package/lib/vendor/blamejs/test/layer-0-primitives/public-suffix.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.publicSuffix — Mozilla PSL substrate.
@@ -175,6 +177,32 @@ function testCaseInsensitive() {
         b.publicSuffix.organizationalDomain("EXAMPLE.CO.UK") === "example.co.uk");
 }
 
+function testCanonicalDomain() {
+  // Encoding-stable host form for identity comparison: case, trailing dot, and
+  // IDN A-label collapse; invalid/hostile input fails closed to "".
+  check("canonicalDomain lowercases + strips trailing dot",
+        b.publicSuffix.canonicalDomain("Example.COM.") === "example.com");
+  check("canonicalDomain is idempotent on an already-canonical host",
+        b.publicSuffix.canonicalDomain("example.com") === "example.com");
+  check("canonicalDomain U-label and A-label converge",
+        b.publicSuffix.canonicalDomain("bücher.de") === "xn--bcher-kva.de" &&
+        b.publicSuffix.canonicalDomain("xn--bcher-kva.de") === "xn--bcher-kva.de");
+  check("canonicalDomain fails closed to '' on an empty label",
+        b.publicSuffix.canonicalDomain("a..b") === "");
+  // domainToASCII silently TRUNCATES at a URL delimiter ("a.com/evil" -> "a.com"),
+  // which would reduce a hostile host to a trusted prefix — must fail closed.
+  check("canonicalDomain fails closed to '' on a URL delimiter (no prefix truncation)",
+        b.publicSuffix.canonicalDomain("example.com/evil") === "" &&
+        b.publicSuffix.canonicalDomain("example.com?x") === "" &&
+        b.publicSuffix.canonicalDomain("example.com#frag") === "" &&
+        b.publicSuffix.canonicalDomain("example.com\\evil") === "");
+  check("canonicalDomain fails closed to '' on a control byte",
+        b.publicSuffix.canonicalDomain("a\x00.com") === "");
+  check("canonicalDomain fails closed to '' on a non-string",
+        b.publicSuffix.canonicalDomain(123) === "" &&
+        b.publicSuffix.canonicalDomain(null) === "");
+}
+
 async function run() {
   testExactMatch();
   testInputItselfIsPublicSuffix();
@@ -187,6 +215,7 @@ async function run() {
   testInvalidInput();
   testLookupSource();
   testCaseInsensitive();
+  testCanonicalDomain();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/pubsub.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * pubsub primitive — local + cluster backends.

package/lib/vendor/blamejs/test/layer-0-primitives/queue-byo-db.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * queue — bring-your-own database for the local backend.

package/lib/vendor/blamejs/test/layer-0-primitives/queue-dlq-extend-lease.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * queue — DLQ + extendLease.
@@ -160,12 +162,54 @@ async function testQueueExtendLeaseRejectsBadArgs() {
   }
 }
 
+// A stale completer/failer whose lease expired and whose job was re-leased
+// to another worker must NOT mark the new worker's in-progress job done or
+// re-queue it. queue-local fences complete()/fail()/extendLease() on the
+// leased `attempts` value (bumped once per lease), mirroring the redis
+// backend's COMPLETE_LUA/FAIL_LUA fence. Drive the backend directly so the
+// interleaving is deterministic (no slow-handler timing).
+async function testQueueLocalLeaseFence() {
+  var localProto = require("../../lib/queue-local");
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-qlfence-"));
+  try {
+    await setupTestDb(tmpDir);
+    var ql = localProto.create({});
+    var enq = await ql.enqueue("qlf", { work: 1 }, { maxAttempts: 5 });
+
+    // Worker A leases on a short lease; it expires; sweepExpired re-queues it.
+    var leaseA = await ql.lease("qlf", 1, 1);
+    check("ql-fence: A leased at attempts=1", leaseA.length === 1 && leaseA[0].attempts === 1);
+    var attemptA = leaseA[0].attempts;
+    await helpers.waitUntil(async function () {
+      var n = await ql.sweepExpired();
+      return n >= 1 ? n : false;
+    }, { label: "queue-local fence: A's lease expired + swept" });
+    // Worker B re-leases (attempts → 2) and is STILL RUNNING.
+    var leaseB = await ql.lease("qlf", 60000, 1);
+    check("ql-fence: B re-leased at attempts=2",
+          leaseB.length === 1 && leaseB[0].jobId === enq.jobId && leaseB[0].attempts === 2);
+
+    // A finishes late: complete() with A's leased attempts must NOT win.
+    var compA = await ql.complete(enq.jobId, { attempt: attemptA });
+    check("ql-fence: stale A complete() does not steal the re-leased job", compA === false);
+    // A fails late: fail() with A's leased attempts must NOT re-queue/DLQ.
+    var failA = await ql.fail(enq.jobId, "late", { attempt: attemptA });
+    check("ql-fence: stale A fail() does not clobber the re-leased job", failA === false);
+    // B (current holder) can still complete its own job.
+    var compB = await ql.complete(enq.jobId, { attempt: 2 });
+    check("ql-fence: B (current lease holder) can still complete", compB === true);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function run() {
   await testQueueDlqSurface();
   await testQueueExtendLeaseBackend();
   await testQueueDlqLifecycle();
   await testQueueDlqRetryUnknownReturnsFalse();
   await testQueueExtendLeaseRejectsBadArgs();
+  await testQueueLocalLeaseFence();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/queue-flow-repeat.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * v0.4.21 queue — repeat-in-queue (cron) + parent-child Flows.

package/lib/vendor/blamejs/test/layer-0-primitives/queue-priority-rate-progress.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * v0.4.20 queue + jobs — priority on enqueue, consume rate-limit,

package/lib/vendor/blamejs/test/layer-0-primitives/queue-sqs.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * AWS SQS queue adapter — wire-shape + lifecycle tests against an HTTP

package/lib/vendor/blamejs/test/layer-0-primitives/rate-limit-cluster.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * rate-limit — cluster-shared backend.

package/lib/vendor/blamejs/test/layer-0-primitives/rate-limit-memory-getorinsert.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Memory rate-limit backends — get-or-insert routing regression guard.

package/lib/vendor/blamejs/test/layer-0-primitives/rate-limit-registry.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.middleware._modules.rateLimit.instances() / resetAll() — module-level

package/lib/vendor/blamejs/test/layer-0-primitives/rate-limit-xff-spoofing.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.middleware.rateLimit — X-Forwarded-For spoofing of the rate-limit key

package/lib/vendor/blamejs/test/layer-0-primitives/redact-dlp.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.redact.installOutboundDlp + b.redact.classifyDefaults — outbound

package/lib/vendor/blamejs/test/layer-0-primitives/redis-client.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * RESP protocol parser + URL parsing tests. These cover the bespoke
@@ -109,6 +111,20 @@ async function run() {
   check("parse: nested array", Array.isArray(v7) && Array.isArray(v7[0]) &&
                                  v7[0][0].toString() === "a" && v7[1] === 7);
 
+  // Pathologically deep nesting — a hostile/compromised server can stream
+  // an arbitrarily deep nest of single-element arrays to overflow the V8
+  // stack out of the socket 'data' handler. The decoder now caps nesting
+  // and throws a typed PROTOCOL error rather than recursing to a crash.
+  var deepResp = _bytes("*1\r\n".repeat(2000) + ":0\r\n");
+  var deepErr = null;
+  try { redis._parseFrame(deepResp, 0); } catch (e) { deepErr = e; }
+  check("parse: deep RESP nesting throws typed PROTOCOL (not RangeError)",
+        deepErr && deepErr.code === "PROTOCOL" && /nesting/.test(deepErr.message || ""));
+  // A legitimately nested array (well under the cap) still parses.
+  var shallow = redis._parseFrame(_bytes("*1\r\n*1\r\n*1\r\n:9\r\n"), 0);
+  check("parse: shallow nested array still parses",
+        shallow.type === "array" && shallow.value[0].type === "array");
+
   // Incomplete frame (mid-bulk)
   var f8 = redis._parseFrame(_bytes("$10\r\nabc"), 0);
   check("parse: incomplete bulk", f8.type === "incomplete");

package/lib/vendor/blamejs/test/layer-0-primitives/request-helpers.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * request-helpers — resolveRoute + captureResponseStatus.
@@ -618,6 +620,11 @@ function testMakeSkipMatcher() {
   check("makeSkipMatcher: non-function skip throws",
         (function () { try { b.requestHelpers.makeSkipMatcher({ skip: "x" }); return false; }
                        catch (e) { return e instanceof TypeError; } })());
+  // A ReDoS-shaped skip RegExp (wrapped nested quantifier) is screened at
+  // build time, never reaching the per-request .test() on attacker paths.
+  check("makeSkipMatcher: ReDoS-shaped skipPaths RegExp refused",
+        (function () { try { b.requestHelpers.makeSkipMatcher({ skipPaths: [/((a)+)+$/] }); return false; }
+                       catch (e) { return e instanceof Error; } })());
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/request-id-async-context.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.middleware.requestId({ asyncContext: true }) — #353.

package/lib/vendor/blamejs/test/layer-0-primitives/request-log.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.middleware.requestLog — HTTP access-log middleware.
@@ -75,6 +77,7 @@ async function run() {
   rejects("missing logger",          function () { b.middleware.requestLog(); }, /logger must be/);
   rejects("non-logger logger",       function () { b.middleware.requestLog({ logger: {} }); }, /logger must be/);
   rejects("bad skipPaths entry",     function () { b.middleware.requestLog({ logger: _captureLogger(), skipPaths: [42] }); }, /skipPaths/);
+  rejects("ReDoS skipPaths RegExp",  function () { b.middleware.requestLog({ logger: _captureLogger(), skipPaths: [/((a)+)+$/] }); }, /./);
 
   // ---- Happy path: 200 → info ----
   var logger = _captureLogger();

package/lib/vendor/blamejs/test/layer-0-primitives/require-auth-cache-control.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * RFC 9111 §5.2.2.5 — Cache-Control: no-store on auth-gated 401

package/lib/vendor/blamejs/test/layer-0-primitives/require-mtls.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 var helpers = require("../helpers");
 var b = helpers.b;

package/lib/vendor/blamejs/test/layer-0-primitives/resource-access-lock.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.resourceAccessLock — three-mode (open / read-only / locked)

package/lib/vendor/blamejs/test/layer-0-primitives/restore-blob-remap.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.restore — blob-remap / signature-enforcement integrity (CWE-347).

package/lib/vendor/blamejs/test/layer-0-primitives/retention-dryrun-no-vacuum.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // #120: a retention dry-run / preview must NOT touch the database. Under a
 // regulated posture (gdpr / hipaa / …) whose POSTURE_DEFAULTS sets

package/lib/vendor/blamejs/test/layer-0-primitives/retention-floor.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.retention.complianceFloor — operator-audit accessor for the

package/lib/vendor/blamejs/test/layer-0-primitives/retention-sweep-termination.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // B8a: the retention sweep loop must TERMINATE even when a full batch of rows is
 // not removed from the candidate set by its action. The loop paged LIMIT-from-

package/lib/vendor/blamejs/test/layer-0-primitives/retry.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.retry — withRetry, CircuitBreaker, isRetryable, backoffDelay.

package/lib/vendor/blamejs/test/layer-0-primitives/router-body-validation.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.router — request-body schema validation must run even when no body was