@blamejs/blamejs-shop 0.1.37 → 0.2.0

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.6",
-      "tag": "v0.13.6",
+      "version": "0.13.12",
+      "tag": "v0.13.12",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,18 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.12 (2026-05-27) — **Inbound MX listener now runs the connection-level gate cascade it documented — HELO identity, DNS blocklist, and greylisting.** b.mail.server.mx.create documented helo / rbl / greylist gate options, but the listener never invoked them — an operator who wired them got silent acceptance of mail those gates would have rejected. They are now wired into the live SMTP state machine: the HELO-identity gate evaluates at HELO/EHLO and refuses a spoofed or malformed identity with 550; the DNS-blocklist gate evaluates the connecting IP once per connection and refuses a listed source with 554; the greylisting gate defers a first-seen (ip, sender, recipient) tuple with a 450 tempfail so legitimate senders retry and pass. Each gate is skipped when the operator doesn't wire it. Because these gates do DNS and store lookups, the per-connection command pump was reworked to process commands asynchronously and strictly in arrival order, so pipelined commands (RFC 2920) cannot overtake a gate still resolving and the existing SMTP-smuggling and STARTTLS-stripping defenses are unchanged. The message-authentication gate (SPF/DKIM/DMARC alignment via b.guardEnvelope) needs the inbound SPF + DKIM verification results as inputs; that inbound-auth pipeline lands as a follow-up, and the documentation no longer implies that gate is active today. **Added:** *HELO-identity / RBL / greylist gates wired into `b.mail.server.mx`* — When wired, `opts.helo` (FCrDNS / HELO-shape / self-name checks) refuses a bad HELO identity at HELO/EHLO with 550; `opts.rbl` refuses a connecting IP found on a DNS blocklist with 554 (evaluated once per connection); `opts.greylist` defers a first-seen (ip, sender, recipient) tuple with 450 4.7.1. Their verdicts surface on the `rcpt_to` event (`rblListed`, `greylist`) and the `helo` event (`heloVerdict`), with dedicated `helo_gate_refused` / `rbl_refused` / `greylist_deferred` audit events. A gate the operator doesn't supply is skipped, never synthesized. **Changed:** *MX command pump processes commands asynchronously and in arrival order* — Gate evaluation involves DNS and store lookups, so the per-connection command pump now awaits each command before the next. Pipelined commands are serialized so a gate resolving cannot let a later command answer ahead of an earlier one; reply ordering, the bare-LF SMTP-smuggling refusal, and the STARTTLS-stripping defense are unchanged. No change to the listener's external behaviour when no gates are wired. **Deprecated:** *SPF/DKIM/DMARC-alignment gate documentation corrected to match what is active* — The `envelope` (SPF/DKIM/DMARC alignment) and `dmarc` gate options were documented as wireable but require inbound SPF + DKIM verification results the listener does not yet produce. They are removed from the documented option set until the inbound-authentication pipeline (composing `b.mail.spf` + `b.mail.dmarc` + DKIM verification) lands; run those checks on the delivered message via the agent handoff in the meantime.
+
+- v0.13.11 (2026-05-27) — **Test-suite reliability: replaced fixed-delay waits in the rate-limiter and scheduler suites with condition polling.** No runtime behaviour changes. The rate-limiter, scheduler, and websocket-channel test suites waited for asynchronous work to settle by draining a fixed number of event-loop ticks before asserting. Under heavily parallel CI that budget was occasionally too short, so an assertion read state before the async work (a cluster-backend counter update, a scheduler tick-claim) had landed — an intermittent failure unrelated to the code under test. Those waits now poll the observable condition (helpers.waitUntil) and exit as soon as it holds, with a generous upper bound, so they pass quickly on fast machines and reliably under load. A build gate is added so the fixed-tick-drain shape cannot be reintroduced. **Fixed:** *Flaky fixed-budget waits in the rate-limiter / scheduler / sandbox test suites made contention-tolerant* — The rate-limit-cluster and scheduler-exactly-once suites drained a fixed count of event-loop ticks before asserting on asynchronously-updated state; under contended CI the budget could expire before the work settled, producing intermittent failures. They now wait on the actual observable condition (a written response, a settled counter). The sandbox suite's success-path cases gave the worker a 5 s execution budget that cold worker-thread startup under heavily parallel Windows CI could just exceed; those are raised to the framework's 10 s ceiling. Affects test code only — no change to shipped framework behaviour. The unused tick-drain helper in the websocket-channel suite was removed. **Detectors:** *Build gate rejects the fixed-tick-drain wait shape in tests* — A new test-suite lint rule flags the counted microtask/tick-drain idiom (reassigning a promise to its own `.then()` in a loop to wait a fixed number of ticks), the sibling of the existing fixed-`setTimeout`-sleep rule. A single event-loop yield is unaffected; only the drain-as-wait shape is rejected, directing the wait to condition polling instead.
+
+- v0.13.10 (2026-05-27) — **Documented-but-inert options wired up, a non-existent CVE reference removed, and a silent iCalendar cap-bypass fixed.** A sweep for places where a documented option or citation did not match what the code does. The most operator-relevant fix: b.calendar.fromIcal documented a safeIcalOpts option that forwards parser caps (byte size, RRULE limits, nesting depth) to b.safeIcal.parse, but the value was never forwarded — so an operator who set tight caps through it got the default profile instead, silently. That is corrected; the nested options now reach the parser. b.archive.read.zip documented an AbortSignal option that was never honored; it now aborts the read at the entry boundary. b.auth.fal documented a bearerOnly alias that had no effect; it now forces the no-proof-of-possession path and refuses the contradictory combination of bearerOnly:true with a holder-of-key binding. Separately, the auth verification paths cited CVE-2026-23993 (13 places) for the "reject an unknown alg before key lookup" guard — that CVE id does not exist (the registry has no record of it); the citation is replaced with the weakness class (CWE-347 / CWE-757) and the real, verifiable neighboring CVEs. The circuit-breaker error-code note that promised a rename "in v0.10" is corrected to the actual plan (v1.0), and the build gate that catches overdue version promises now also catches two-part version numbers. **Changed:** *`b.auth.fal` `bearerOnly` is now a real alias and refuses contradictions* — `bearerOnly: true` now forces the no-proof-of-possession path (equivalent to `hokBinding: null`), as documented. Passing `bearerOnly: true` together with a non-null `hokBinding` is a contradictory assurance request and is now refused at the call rather than silently resolved one way. **Fixed:** *`b.calendar.fromIcal` now forwards `safeIcalOpts` to the parser* — The documented `safeIcalOpts` option (parser caps: max bytes, RRULE COUNT/BYxxx limits, nesting depth) was not being passed to `b.safeIcal.parse` — when supplied under the documented nested key it was silently ignored and the parser ran with its default profile. Both forms now reach the parser: the documented nested `{ safeIcalOpts: { ... } }` and the top-level `{ profile, ... }` that earlier releases accepted, with the nested form winning on conflict. No caller regresses. · *`b.archive.read.zip` honors the documented `signal` (AbortSignal)* — The `signal` option was documented but never read. A large or slow archive read can now be aborted cooperatively — the reader checks the signal at each entry boundary (`inspect`, `entries`, `extractEntries`, `extract`) and rejects with an `archive-read/aborted` error. · *Removed a non-existent CVE reference from the JWT/JWE verification paths* — The "reject an unknown/unsupported `alg` before any key lookup" guard in `b.auth.jwt.verifyExternal`, `b.auth.oauth.verifyIdToken`, `b.auth.oid4vci`, and `b.auth.sd-jwt-vc` cited a CVE id that the registry has no record of. The behaviour is unchanged; the citation is now the weakness class it defends (CWE-347 improper signature verification / CWE-757 algorithm downgrade) alongside the real, verifiable alg-confusion / JWE-bypass CVEs already cited beside it. **Detectors:** *Overdue-version-promise gate now catches two-part version numbers* — The build gate that flags a deferral whose promised landing version has already shipped previously matched only three-part versions (`vN.N.N`); a two-part promise (`vN.N`) slipped past it. It now matches both. The `b.circuitBreaker` `CIRCUIT_OPEN` error-code note that pointed at a passed version is corrected to its actual plan (rename at v1.0, with a deprecation warning a minor ahead).
+
+- v0.13.9 (2026-05-26) — **Corrected CVE citations in source threat annotations + a build gate that refuses malformed CVE identifiers.** Several source-comment threat annotations cited CVE identifiers that were rejected by the numbering authority (never assigned to a real issue), attributed to the wrong product, or structurally malformed (a placeholder with a non-numeric sequence). The annotated defenses are unchanged — every cap, refusal, and constant-time comparison behaves exactly as before; only the reference labels were corrected, each to a verifiable CVE or to the underlying weakness class (CWE / RFC) where no single CVE fits. Notable corrections: the S/MIME SHA-1 / MD5 certificate-signature refusal now cites the SHAttered collision and RFC 8551 §2.5 instead of a rejected candidate id; decompression-output caps cite CWE-409 and CVE-2025-0725 instead of a fabricated placeholder; the iCalendar RRULE / nesting / byte caps describe the calendar-bomb recursion-DoS class instead of an unrelated SSRF advisory; and the SAML signature-wrapping (XSW) defense now cites the actively-exploited CVE-2024-45409 (ruby-saml, CVSS 10.0) and CVE-2025-25291 / -25292 that the duplicate-element refusal defeats. A new build-time detector refuses any CVE token whose sequence number is not all-numeric, so a placeholder identifier can never reach a release again. **Fixed:** *Corrected rejected / misattributed / malformed CVE references in source threat annotations* — Threat-annotation comments across the mail, crypto, auth, guard, and safe modules carried CVE identifiers that were rejected by the CVE numbering authority, attributed to the wrong product, or written as non-numeric placeholders. Each was corrected to a verifiable CVE or to the weakness class (CWE / RFC) it defends. No runtime behaviour changed — the defenses these comments describe are unchanged. The S/MIME certificate check's SHA-1 / MD5 refusal message now names the SHAttered collision and RFC 8551 §2.5; the SAML XSW defense now names CVE-2024-45409 and CVE-2025-25291 / -25292. **Detectors:** *`malformed-cve-identifier` — refuses structurally-invalid CVE tokens at build time* — A CVE identifier's sequence number is always numeric (`CVE-<year>-<digits>`). The new detector refuses any CVE token whose post-year segment contains a letter — the placeholder shape that lets a fabricated reference slip past review. It cannot verify that a well-formed id is real or correctly attributed (that stays a review responsibility), but it makes the structurally-invalid class impossible to ship.
+
+- v0.13.8 (2026-05-26) — **In-memory archive extraction for read-only / serverless filesystems.** Archive readers gain an in-memory extraction path so an uploaded archive can be opened and its contents read without writing anything to disk — the case a read-only or ephemeral serverless filesystem requires. b.archive.read.zip(...).extractEntries() and b.archive.read.tar(...).extractEntries() are async generators that yield each regular file entry as { name, bytes, size }, applying the same bomb-policy caps, b.guardArchive metadata cascade (which refuses a Zip-Slip / traversal archive wholesale), and entry-type-policy refusals as the disk extract() — only the disk realpath agreement check is omitted, since nothing is written and the caller owns where the returned bytes land. Directory and link entries carry no content and are not yielded. The guard cascade is factored into one shared path so disk and in-memory extraction refuse identically. Also a documentation fix: b.archive.gz no longer claims a b.archive.zip().toGzip() convenience exists — a ZIP is already DEFLATE-compressed per entry, so gzip-wrapping it gains nothing; gzip the uncompressed tar stream (the canonical .tar.gz) instead. **Added:** *`extractEntries()` — in-memory archive extraction (ZIP + tar)* — `b.archive.read.zip(source).extractEntries(opts?)` and `b.archive.read.tar(source).extractEntries(opts?)` are async generators yielding `{ name, bytes, size }` per regular file entry, never touching disk — for serverless / read-only filesystems where the disk `extract({ destination })` path cannot run. Same bomb-policy, guard-archive cascade, and entry-type-policy refusals as disk extraction; the bytes are byte-identical to what `extract()` writes. **Fixed:** *Removed the inaccurate `b.archive.zip().toGzip()` doc claim* — The `b.archive.gz` documentation described a `b.archive.zip().toGzip()` convenience method that does not (and should not) exist: a ZIP is already DEFLATE-compressed per entry, so gzip-wrapping it would compress already-compressed data for no benefit. `b.archive.tar().toGzip()` (the real `.tar.gz`) is unchanged.
+
+- v0.13.7 (2026-05-26) — **Documentation accuracy — several primitives described shipped features as deferred.** A documentation sweep corrected primitive descriptions that still called features deferred after they shipped, so the wiki and inline docs now match the code. b.mdoc documents that device authentication (the ISO 18013-5 §9.1.3 signature variant, verifyDeviceAuth) is verified, not deferred — only the COSE_Mac0 device-auth variant remains refused. b.network.dns.dnssec documents that the root-to-zone chain walk against the IANA trust anchors (verifyChain) and NSEC / NSEC3 denial of existence (verifyDenial / nsec3Hash) ship, where the card previously said they were deferred. b.cose lists COSE_Mac0 and COSE_Encrypt0 among what it ships. The JMAP server documents its push channel, blob upload/download, and EmailSubmission handlers as present, and the submission server documents CHUNKING / BDAT as supported. A new test detector keeps this class of drift from recurring: it fails the build when a comment promises a feature lands in a version that has already shipped. **Fixed:** *Corrected `deferred`/`does-not-ship` docs for features that have shipped* — `b.mdoc` (device authentication, §9.1.3), `b.network.dns.dnssec` (chain walk + NSEC/NSEC3), `b.cose` (COSE_Mac0 + COSE_Encrypt0), the JMAP server (push, blob, EmailSubmission), and the submission server (BDAT/CHUNKING) all carried `@card`/`@intro` text describing shipped capabilities as deferred or not-shipped. The descriptions now match the implemented surface; genuinely-deferred items (the mdoc MAC variant, DNSSEC in-RDATA name canonicalization, COSE multi-signer/multi-recipient) remain documented as such. **Detectors:** *Overdue-defer detector in the codebase-pattern gate* — A new check fails the build when a comment promises a feature "lands in" / is "deferred to" / is "not supported in" a version that the package has already reached — catching stale deferral notes (a feature that shipped but whose comment still says otherwise, or a missed deadline) before they reach a release. An allowlist records the deliberate defer-with-condition exceptions.
+
 - v0.13.6 (2026-05-26) — **`b.ai.frontierModelProtocol` — California SB 53 frontier-AI obligations.** b.ai.frontierModelProtocol assesses a developer's obligations under California's Transparency in Frontier Artificial Intelligence Act — SB 53, Cal. Bus. & Prof. Code §22757.10, effective 2026-01-01 — from a model's training compute and the developer's revenue. It reports whether the model crosses the frontier threshold (more than 10^26 training FLOPs), whether the developer is a large frontier developer (prior-year revenue, with affiliates, above $500M), and the resulting obligations: every frontier developer must report critical safety incidents and publish a transparency report, and a large frontier developer must additionally publish an annual safety framework and disclose its catastrophic-risk assessment. Passing a candidate safety framework reports which required elements (risk identification, mitigation, governance, cybersecurity, standards alignment) are missing. b.ai.frontierModelProtocol.incidentReport validates a critical-incident type against the Act's four categories and computes the notification deadline to the California Office of Emergency Services — 15 days from discovery, or 24 hours when there is an imminent risk of death or serious physical injury. The ca-tfaia compliance posture was already in the catalog. **Added:** *`b.ai.frontierModelProtocol` — SB 53 threshold classification, obligations, and incident reporting* — `b.ai.frontierModelProtocol({ trainingFlops, annualRevenueUsd, framework? })` returns `isFrontierModel`, `isLargeFrontierDeveloper`, the `obligations` list, and (when a framework is supplied) its `frameworkGaps`. `b.ai.frontierModelProtocol.incidentReport({ type, discoveredAt, imminentRiskToLife? })` builds a critical-safety-incident report with the California OES recipient and a `dueAt` / `deadlineHours` computed from the 15-day (or 24-hour imminent-risk) statutory window; `type` must be one of the four categories in `INCIDENT_TYPES`. Throws `FrontierProtocolError` on malformed input.
 
 - v0.13.5 (2026-05-26) — **`b.ai.aedtBiasAudit` — NYC Local Law 144 bias audit.** b.ai.aedtBiasAudit computes the bias-audit figures New York City Local Law 144 requires before an Automated Employment Decision Tool may screen candidates (NYC Admin. Code §20-870 et seq.; DCWP rules 6 RCNY §5-300). Given the per-category counts an independent auditor collected — selected/total for a pass-fail tool, or scored-above-the-overall-median/total for a continuous-score tool — it returns the selection (or scoring) rate, the impact ratio (each group's rate divided by the most-selected group's rate), and an adverse-impact flag (impact ratio below the EEOC four-fifths threshold of 0.8) for every group, across the sex, race/ethnicity, and intersectional dimensions, plus the most-selected group per dimension and an overall flag. Categories under 2% of the audited data are marked excluded per DCWP discretion. It is a pure calculation that produces exactly the figures the annual published summary must contain — the law mandates the calculation, not any particular remediation. The relevant compliance postures (nyc-ll144, and ca-tfaia for California SB 53) were already in the catalog. **Added:** *`b.ai.aedtBiasAudit` — Local Law 144 selection/scoring rates and four-fifths impact ratios* — `b.ai.aedtBiasAudit({ type, metadata, categories, minCategoryShare? })` where `type` is `"selection"` (group entries `{ selected, total }`) or `"scoring"` (`{ scoredAboveMedian, total }`). Returns per-group rate, impact ratio, and `adverseImpact` flag across the `sex`, `raceEthnicity`, and `intersectional` dimensions, plus the most-selected group per dimension and an `anyAdverseImpact` summary. Categories below `minCategoryShare` (2% default) are excluded from the impact-ratio basis. Throws `AedtBiasAuditError` on malformed input.

package/lib/vendor/blamejs/README.md

@@ -169,7 +169,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **Mail (outbound)** — multipart + attachments + DKIM + calendar invites; bounce intake (`b.mail`, `b.mailBounce`)
 - **Mail (outbound delivery)** — turnkey MX-lookup → MTA-STS-fetch → DANE-TLSA → REQUIRETLS handshake → SMTP wire layer → RFC 3464 DSN-on-permanent-failure → deferred-retry scheduling, all wired once (`b.mail.send.deliver`)
 - **Mail (inbound auth)** — SPF / DMARC / ARC verify + ARC chain signing for relays (`b.mail.spf`, `b.mail.dmarc`, `b.mail.arc`)
-- **Mail server listeners** — RFC 5321 MX inbound (`b.mail.server.mx`), RFC 6409 submission with SASL + identity-binding (`b.mail.server.submission`), RFC 9051 IMAP4rev2 with CONDSTORE / QRESYNC / NOTIFY / METADATA / CATENATE (`b.mail.server.imap`), RFC 8620 + RFC 8621 JMAP Core + Mail over HTTP/SSE/WebSocket (`b.mail.server.jmap`), POP3 (`b.mail.server.pop3`), ManageSieve (`b.mail.server.managesieve`)
+- **Mail server listeners** — RFC 5321 MX inbound with connection-level gate cascade (HELO identity / DNS blocklist / greylisting) (`b.mail.server.mx`), RFC 6409 submission with SASL + identity-binding (`b.mail.server.submission`), RFC 9051 IMAP4rev2 with CONDSTORE / QRESYNC / NOTIFY / METADATA / CATENATE (`b.mail.server.imap`), RFC 8620 + RFC 8621 JMAP Core + Mail over HTTP/SSE/WebSocket (`b.mail.server.jmap`), POP3 (`b.mail.server.pop3`), ManageSieve (`b.mail.server.managesieve`)
 - **JMAP EmailSubmission reference** — composes `b.mail.send.deliver` to land the RFC 8621 §7.5 surface end-to-end (`b.mail.server.jmap.emailSubmissionSetHandler`)
 - **Mail crypto** — PQC-first S/MIME via CMS (`b.mail.crypto.cms`) + OpenPGP encrypt/decrypt + WKD key discovery with IDN-homograph defense (`b.mail.crypto.pgp`)
 - **Mail-stack agent** — multi-threaded worker pool + queue dispatch + sealed mail-store backed by SQLite FTS5 (`b.mail.agent`, `b.mailStore`)
@@ -228,7 +228,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **i18n** — CLDR plural rules, Accept-Language negotiation, Intl formatters, RTL (`b.i18n`)
 - **CSV** — RFC 4180 with Excel formula-injection prevention (`b.csv`)
 - **IDs + slugs** — RFC 9562 UUID v4 + v7 (`b.uuid`); URL-safe slugs (`b.slug`)
-- **Time + archive** — TZ-aware datetime (`b.time`); ZIP creation + adversarial-safe read with bomb caps + path-traversal + LFH/CD-skew defense (`b.archive` + `b.archive.read.zip`); one-liner quarantine extraction (`b.safeArchive.extract`); fs / objectStore / http / buffer / trusted-stream adapter contract (`b.archive.adapters`)
+- **Time + archive** — TZ-aware datetime (`b.time`); ZIP creation + adversarial-safe read with bomb caps + path-traversal + LFH/CD-skew defense (`b.archive` + `b.archive.read.zip`); one-liner quarantine extraction (`b.safeArchive.extract`); in-memory extraction with no disk write for read-only / serverless filesystems (`b.archive.read.zip(...).extractEntries()` / `.tar`); fs / objectStore / http / buffer / trusted-stream adapter contract (`b.archive.adapters`)
 - **Pagination + forms** — HMAC-signed cursor pagination (`b.pagination`); HTML form rendering + validation + CSRF (`b.forms`)
 
 ### Production

package/lib/vendor/blamejs/SECURITY.md

@@ -332,6 +332,7 @@ This is the minimum-viable security posture for a production deployment. The fra
 - [ ] For routes that accept YAML (config uploads, CI/CD pipelines, infra-as-code, document-import flows — ANY operator-supplied YAML the server parses): `b.guardYaml.gate({ profile: "strict" })` is wired by default into `b.fileUpload` + `b.staticServe` as of v0.7.12. For inbound YAML bodies that don't go through those primitives, wire `b.guardYaml.parse(body, { profile: "strict" })` before passing the parsed structure to operator handlers — strict refuses deserialization-tag RCE (defends CVE-2026-24009 Docling/PyYAML, CVE-2022-1471 SnakeYAML, CVE-2017-18342 PyYAML class), billion-laughs alias recursion (CVE-2026-27807 MarkUs class), Norway-problem implicit booleans, multi-document streams, leading-zero octals, duplicate keys, merge-key anchor-chains, bidi/null/control chars. Unlike JSON, YAML's threat surface includes language-specific deserialization triggers — `!!python/object/new:...` / `!!java.util.HashMap` / `!!ruby/object` etc. — which the source-level scan catches before any downstream parser (PyYAML / SnakeYAML / js-yaml) sees them
 - [ ] For routes that accept JSON bodies (REST APIs / webhook receivers / config uploads — ANY operator-supplied JSON the server parses): `b.guardJson.gate({ profile: "strict" })` is wired by default into `b.fileUpload` + `b.staticServe` as of v0.7.12. For inbound JSON request bodies that don't go through those primitives, wire `b.guardJson.parse(body, { profile: "strict" })` before passing the parsed structure to operator handlers — strict refuses prototype pollution at source level (catches `__proto__` / `constructor` / `prototype` keys before any parser sees the input — defends CVE-2025-55182 React Server Functions RCE class), duplicate keys (RFC 8259 SHOULD-unique smuggling), NaN/Infinity, comments, JSON5 syntax, BOM, bidi/null/control chars, numeric precision-loss, depth + breadth + array-length + string-length caps. Pair with `topLevelKeyAllowlist: [...]` for routes with a known shape so unauthorized keys refuse before validation
 - [ ] For routes that accept email (inbound webhooks from mail providers, .eml uploads, mailbox imports, message-archival flows, customer-support-ticket-by-email — ANY operator-supplied RFC 822/5322 message the server processes): `b.guardEmail.gate({ profile: "strict" })` is wired by default into `b.fileUpload` + `b.staticServe` as of v0.7.17. For inbound message bytes that don't go through those primitives, wire `b.guardEmail.validateMessage(bytes, { profile: "strict" })` BEFORE the parser sees the message — strict refuses SMTP smuggling (bare CR / bare LF outside CRLF pairs combined with embedded SMTP verbs `MAIL FROM`/`RCPT TO`/`DATA`/`EHLO`/`HELO`/`RSET`/`QUIT` — defends CVE-2023-51764 Postfix / CVE-2023-51765 Sendmail / CVE-2023-51766 Exim / CVE-2026-32178 .NET System.Net.Mail class), CRLF header injection in single-line headers (defends From/Bcc/body smuggling), IDN homograph mixed-script domains in address-bearing headers (Cyrillic / Greek / Armenian / Cherokee codepoints overlapping Latin — operator opts in to legitimate non-Latin via `allowedScripts: ["latin", "cyrillic"]`), Punycode `xn--` labels, display-name spoofing (`"support@apple.com" <attacker@evil>` — display contains @-address that doesn't match envelope domain), IP-literal addresses (`user@[1.2.3.4]` — bypasses DNS/DMARC alignment), RFC 5322 comment syntax in addresses, multiple @ characters, RFC 5321 length caps (local-part 64 / domain 255 / address 320), RFC 5322 line cap (998), BOM injection, bidi/null/control chars in addresses + headers. For per-address validation outside a full message context (form-submitted email, signup, MX-host validation), wire `b.guardEmail.validateAddress(addr, { profile: "strict" })`. Pair with operator's DMARC / SPF / DKIM verifier for envelope-alignment checks — guardEmail is the source-level gate, not the authentication-result interpreter
+- [ ] For an inbound `b.mail.server.mx` listener, wire the connection-level gate cascade so the anti-abuse controls actually run: `helo: b.mail.helo` (FCrDNS / HELO-shape / self-name spoofing → 550), `rbl: b.mail.rbl.create({ providers: [...] })` (connecting-IP DNS blocklist → 554, evaluated once per connection), and `greylist: b.mail.greylist.create({ store })` (first-seen (ip, sender, recipient) → 450 tempfail). A gate you don't wire is skipped, not synthesized — so an unwired RBL is no protection, not a default-allow surprise. SPF/DKIM/DMARC alignment is performed on the delivered message via the agent handoff until the inbound-authentication pipeline lands
 - [ ] For routes that accept markdown (rich-text editors, comment systems, README rendering, documentation submission, GitHub-style wikis, mail-rendered markdown, document-import flows — ANY operator-supplied markdown the server renders): `b.guardMarkdown.gate({ profile: "strict" })` is wired by default into `b.fileUpload` + `b.staticServe` as of v0.7.16. For inbound markdown bodies that don't go through those primitives, wire `b.guardMarkdown.validate(body, { profile: "strict" })` BEFORE passing the source to any markdown renderer (marked / markdown-it / commonmark / remark / parsedown — all of them) — strict refuses dangerous URL schemes in inline links + images + autolinks + reference-link definitions (defends CVE-2025-9540 Markup Markdown class, CVE-2025-24981 MDC class, NuGetGallery GHSA-gwjh-c548-f787, Joplin GHSA-hff8-hjwv-j9q7), whitespace-tolerant dangerous-tag matching (`<script\n>` / `<script\t>` — defends CVE-2026-30838 CommonMark DisallowedRawHtml bypass class), HTML-entity scheme bypass (`&#x6A;avascript:` / `&#106;avascript:` decoded BEFORE scheme matching), reference-link smuggling (`[label]: javascript:...`), front-matter YAML/TOML blocks, HTML comments, code-fence language injection (language tag containing `<>"' `` blocks attribute breakout), catastrophic emphasis runs (CVE-2025-6493 CodeMirror Markdown class, CVE-2025-7969 markdown-it class), inline DOCTYPE, bidi/null/control chars, total-bytes + line + link + image + autolink + ref-def + list-depth + blockquote-depth caps. **Layer with `b.guardHtml`**: source-level guardMarkdown then render then output-level guardHtml together close the residual bypass surface that either alone misses (markdown engines surprise; sanitizers also surprise — defense in depth)
 - [ ] For routes that accept XML (SOAP endpoints, sitemap submissions, RSS / Atom feeds, OAI-PMH harvesters, SAML / WS-Federation receivers, document-import flows — ANY operator-supplied XML the server parses): `b.guardXml.gate({ profile: "strict" })` is wired by default into `b.fileUpload` + `b.staticServe` as of v0.7.15. For inbound XML bodies that don't go through those primitives, wire `b.guardXml.validate(body, { profile: "strict" })` before passing the document to any XML parser — strict refuses DOCTYPE declarations unconditionally (XXE + billion-laughs vector — defends CVE-2026-24400 AssertJ class, CVE-2024-8176 libexpat recursive-entity stack-overflow class), `<!ENTITY>` declarations including parameter entities (out-of-band exfiltration vector), external entity references (SYSTEM / PUBLIC with file:// / http:// / ftp:// schemes — local file read + SSRF), `<xi:include>` remote inclusion (CVE-2024-25062 libxml2 use-after-free class), `xsi:schemaLocation` operator-controlled schema fetch, processing instructions (`<?xml-stylesheet ?>` CSS-injection vector), CDATA sections (often used to hide payloads from naive scanners), XML signature wrapping (xmldsig surface), bidi/null/control chars in element text + attribute values, and applies depth + element + per-attribute-value caps. DOCTYPE remains refused at every profile level (strict / balanced / permissive) because billion-laughs is universal. Operators integrating with legacy SOAP that requires DTDs must instead route through a separately-firewalled XML processor with explicit allowlist — the gate has no knob to relax DOCTYPE
 - [ ] **For ZIP-shaped uploads specifically**, reach for `b.safeArchive.extract({ source, destination, guardProfile: "strict" })` — the one-liner composes `b.archive.read.zip`'s random-access reader (LFH/CD skew defense + CD-walk validation), `b.guardArchive.zipBombPolicy` defaults (per-entry + per-archive + ratio caps), `b.guardArchive.entryTypePolicy` defaults (symlink / hardlink / device / fifo / socket entries refused), and `b.guardFilename.verifyExtractionPath`'s dual-check (string-normalize + `fs.realpath`-agreement; refuses pre-resolve names exceeding PATH_MAX=4096 to defend the CVE-2025-4517 TOCTOU class). The fs-coupled realpath check is the depth above `b.guardArchive.checkExtractionPath`'s portable string-only gate; operators with their own extract loop call both. Default refuses ZIP encrypted entries (v0.12.10/11 add the encryption read paths). For tar / gzip / 7z / rar / zstd, the read-side primitives land in v0.12.8 / v0.12.9; until then use the legacy guard-only path below

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.6",
-  "createdAt": "2026-05-27T02:34:13.690Z",
+  "frameworkVersion": "0.13.12",
+  "createdAt": "2026-05-27T10:09:34.345Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/ai-disclosure.js

@@ -187,9 +187,8 @@ function chatbot(session, opts) {
  * machine-readable manner. This primitive returns the disclosure
  * payload (visible label + structured metadata) the operator wires
  * into the encoder / response pipeline. C2PA manifest emission is
- * deferred to v0.12.21 `b.contentCredentials` — this primitive
- * supplies the label markup and the metadata schema that the C2PA
- * adapter consumes when it lands.
+ * handled by `b.contentCredentials`; this primitive supplies the label
+ * markup and the metadata schema that the C2PA adapter consumes.
  *
  * @opts
  *   contentType:   "image" | "audio" | "video" | "text",        // required

package/lib/vendor/blamejs/lib/archive-gz.js

@@ -47,9 +47,11 @@ function _isGzipMagic(buf) {
  * `toAdapter(adapter)` / `digest()` — so gzip slots into the same
  * downstream sinks (object-store + filesystem + http adapters).
  *
- * Composes `b.archive.tar().toGzip(adapter)` / `b.archive.zip().
- * toGzip(adapter)` indirectly: those convenience methods call this
- * primitive after materializing their archive bytes.
+ * `b.archive.tar().toGzip(adapter)` composes this primitive after
+ * materializing the tar bytes (the canonical `.tar.gz`). There is no
+ * `zip().toGzip()` — a ZIP is already DEFLATE-compressed per entry, so
+ * gzip-wrapping it would compress already-compressed data for no gain;
+ * gzip the uncompressed tar stream instead.
  *
  * @opts
  *   level:  number,    // 0-9, default 6 (zlib default).

package/lib/vendor/blamejs/lib/archive-read.js

@@ -503,6 +503,18 @@ function zip(adapter, opts) {
   var entryTypePolicy = _normalizeEntryTypePolicy(opts.entryTypePolicy);
   var cdCache         = null;
 
+  // Cooperative cancellation — operators pass an AbortSignal to bound a
+  // large/slow archive read. Checked between entries (the natural yield
+  // point); a long single-entry decompress is already bounded by the
+  // bomb policy.
+  function _throwIfAborted() {
+    if (opts.signal && opts.signal.aborted) {
+      throw new ArchiveReadError("archive-read/aborted",
+        "archive read aborted via opts.signal" +
+        (opts.signal.reason !== undefined ? ": " + String(opts.signal.reason) : ""));
+    }
+  }
+
   async function _loadCD() {
     if (cdCache) return cdCache;
     var eocd = await _locateEocd(adapter);
@@ -512,6 +524,7 @@ function zip(adapter, opts) {
   }
 
   async function inspect() {
+    _throwIfAborted();
     var loaded = await _loadCD();
     _enforceBombPolicy(loaded.entries, bombPolicy);
     _emitAudit(opts, "archive.read.inspect", "success", {
@@ -539,28 +552,22 @@ function zip(adapter, opts) {
   }
 
   async function* entries() {
+    _throwIfAborted();
     var loaded = await _loadCD();
     _enforceBombPolicy(loaded.entries, bombPolicy);
     for (var i = 0; i < loaded.entries.length; i += 1) {
+      _throwIfAborted();
       yield loaded.entries[i];
     }
   }
 
-  async function extract(extractOpts) {
-    extractOpts = extractOpts || {};
-    if (typeof extractOpts.destination !== "string" || extractOpts.destination.length === 0) {
-      throw new ArchiveReadError("archive-read/no-destination",
-        "extract: opts.destination must be a non-empty string (target directory)");
-    }
-    var destination = nodePath.resolve(extractOpts.destination);
-    if (!nodeFs.existsSync(destination)) {
-      nodeFs.mkdirSync(destination, { recursive: true });
-    }
-    var loaded = await _loadCD();
-    _enforceBombPolicy(loaded.entries, bombPolicy);
-    // Compose b.guardArchive on the metadata pass — operators with a
-    // posture set declared via opts.guardProfile get the cascade.
-    var guardEntries = loaded.entries.map(function (e) {
+  // Run the b.guardArchive metadata cascade and refuse the whole archive on
+  // any critical issue. Shared by disk `extract` and in-memory `extractEntries`
+  // so both apply the identical posture-aware refusal. `auditAction` names the
+  // audit row for the refusal path.
+  function _assertGuardMetadata(loadedEntries, auditAction) {
+    if (opts.guardProfile === false) return;
+    var guardEntries = loadedEntries.map(function (e) {
       return {
         name:           e.name,
         size:           e.uncompressedSize,
@@ -573,29 +580,87 @@ function zip(adapter, opts) {
         attrs:          { externalAttrs: e.externalAttrs },
       };
     });
-    if (opts.guardProfile !== false) {
-      var profile = opts.guardProfile || "balanced";
-      var guardResult = guardArchive().validateEntries(guardEntries, { profile: profile });
-      if (guardResult && Array.isArray(guardResult.issues) && guardResult.issues.length > 0) {
-        // Refuse the whole archive when any entry trips a critical
-        // guard issue; collect every issue for the audit trail.
-        var critical = guardResult.issues.filter(function (i) { return i.severity === "critical"; });
-        if (critical.length > 0) {
-          _emitAudit(opts, "archive.read.extract.refused", "refused", {
-            entries: loaded.entries.length,
-            issues:  critical.map(function (i) { return i.ruleId; }),
-          });
-          throw new ArchiveReadError("archive-read/guard-refused",
-            "extract refused — " + critical.length + " critical guard issue(s): " +
-            critical.map(function (i) { return i.ruleId + " (" + i.snippet + ")"; }).join("; "));
-        }
+    var profile = opts.guardProfile || "balanced";
+    var guardResult = guardArchive().validateEntries(guardEntries, { profile: profile });
+    if (!guardResult || !Array.isArray(guardResult.issues) || guardResult.issues.length === 0) return;
+    var critical = guardResult.issues.filter(function (i) { return i.severity === "critical"; });
+    if (critical.length === 0) return;
+    _emitAudit(opts, auditAction, "refused", {
+      entries: loadedEntries.length,
+      issues:  critical.map(function (i) { return i.ruleId; }),
+    });
+    throw new ArchiveReadError("archive-read/guard-refused",
+      "extract refused — " + critical.length + " critical guard issue(s): " +
+      critical.map(function (i) { return i.ruleId + " (" + i.snippet + ")"; }).join("; "));
+  }
+
+  // In-memory extraction: yields each file entry's decompressed bytes WITHOUT
+  // writing to disk — for read-only / serverless filesystems. Applies the same
+  // bomb-policy, guard cascade, entry-type policy, and per-entry filename
+  // safety as `extract`; directory entries are skipped (no bytes). The realpath
+  // agreement check is disk-specific and intentionally omitted (no extraction
+  // root); the caller owns where, if anywhere, the bytes land.
+  async function* extractEntries(extractOpts) {
+    extractOpts = extractOpts || {};
+    var loaded = await _loadCD();
+    _enforceBombPolicy(loaded.entries, bombPolicy);
+    _assertGuardMetadata(loaded.entries, "archive.read.extractEntries.refused");
+    var totalDecompressed = 0;
+    var yielded = 0;
+    for (var i = 0; i < loaded.entries.length; i += 1) {
+      _throwIfAborted();
+      var entry = loaded.entries[i];
+      if (entry.isEncrypted && !extractOpts.allowEncrypted) {
+        throw new ArchiveReadError("archive-read/encrypted-entry",
+          "entry " + JSON.stringify(entry.name) + " is encrypted — not decrypted on the in-memory path");
+      }
+      var typeRefusal = _enforceEntryTypePolicy(entry, entryTypePolicy);
+      if (typeRefusal) {
+        throw new ArchiveReadError("archive-read/entry-type-refused",
+          "entry " + JSON.stringify(entry.name) + " is a " + typeRefusal +
+          " — refused by entryTypePolicy");
       }
+      if (_isDirectoryEntry(entry.name, entry.externalAttrs)) continue;
+      // Archive-level name threats (Zip-Slip traversal, etc.) are refused for
+      // the whole archive by the guardArchive cascade above. The caller owns
+      // final placement of the returned bytes; we deliberately do NOT apply the
+      // disk-write filename policy (shell-exec extensions / reserved names) here
+      // — nothing is written, and over-filtering would drop legitimate names.
+      var lfhResult = await _verifyLfhMatchesCd(adapter, entry);
+      var body = await _decompressEntry(adapter, entry, lfhResult.dataStart, bombPolicy);
+      totalDecompressed += body.length;
+      if (totalDecompressed > bombPolicy.maxTotalDecompressedBytes) {
+        throw new ArchiveReadError("archive-read/total-too-large",
+          "cumulative uncompressed=" + totalDecompressed +
+          " exceeds maxTotalDecompressedBytes during extractEntries");
+      }
+      yielded += 1;
+      yield { name: entry.name, bytes: body, size: body.length };
+    }
+    _emitAudit(opts, "archive.read.extractEntries.completed", "success", { entries: yielded });
+  }
+
+  async function extract(extractOpts) {
+    extractOpts = extractOpts || {};
+    if (typeof extractOpts.destination !== "string" || extractOpts.destination.length === 0) {
+      throw new ArchiveReadError("archive-read/no-destination",
+        "extract: opts.destination must be a non-empty string (target directory)");
     }
+    var destination = nodePath.resolve(extractOpts.destination);
+    if (!nodeFs.existsSync(destination)) {
+      nodeFs.mkdirSync(destination, { recursive: true });
+    }
+    var loaded = await _loadCD();
+    _enforceBombPolicy(loaded.entries, bombPolicy);
+    // Compose b.guardArchive on the metadata pass — operators with a
+    // posture set declared via opts.guardProfile get the cascade.
+    _assertGuardMetadata(loaded.entries, "archive.read.extract.refused");
     var written = [];
     var bytesExtracted = 0;
     var totalDecompressed = 0;
     try {
       for (var i = 0; i < loaded.entries.length; i += 1) {
+        _throwIfAborted();
         var entry = loaded.entries[i];
         // Skip directory + dangerous-by-default entry types unless the
         // entry-type policy opts in.
@@ -693,10 +758,11 @@ function zip(adapter, opts) {
   }
 
   return {
-    kind:    "zip-random-access",
-    inspect: inspect,
-    entries: entries,
-    extract: extract,
+    kind:           "zip-random-access",
+    inspect:        inspect,
+    entries:        entries,
+    extract:        extract,
+    extractEntries: extractEntries,
   };
 }
 

package/lib/vendor/blamejs/lib/archive-tar-read.js

@@ -276,6 +276,87 @@ function tar(adapter, opts) {
     });
   }
 
+  // Shared b.guardArchive metadata cascade — disk `extract` + in-memory
+  // `extractEntries` refuse the whole archive identically on a critical issue.
+  function _assertGuardMetadata(entries, auditAction) {
+    if (opts.guardProfile === false) return;
+    var profile = opts.guardProfile || "balanced";
+    var guardEntries = entries.map(function (e) {
+      return {
+        name:           e.name,
+        size:           e.size,
+        compressedSize: e.size,
+        isSymlink:      e.typeflag === TF_SYMLINK,
+        isHardlink:     e.typeflag === TF_HARDLINK,
+        linkTarget:     e.linkname,
+        isDirectory:    e.typeflag === TF_DIRECTORY,
+        isEncrypted:    false,
+        attrs:          { mode: e.mode },
+      };
+    });
+    var guardResult = guardArchive().validateEntries(guardEntries, { profile: profile });
+    if (!guardResult || !Array.isArray(guardResult.issues)) return;
+    var critical = guardResult.issues.filter(function (i) { return i.severity === "critical"; });
+    if (critical.length === 0) return;
+    _emitAudit(opts, auditAction, "refused", {
+      entries: entries.length,
+      issues:  critical.map(function (i) { return i.ruleId; }),
+    });
+    throw new TarError("archive-tar/guard-refused",
+      "extract refused — " + critical.length + " critical guard issue(s)");
+  }
+
+  // In-memory extraction: yields each regular file entry's bytes without
+  // writing to disk (read-only / serverless filesystems). Same guard cascade,
+  // type-policy refusals, filename safety, and bomb cap as `extract`; directory
+  // and (validated) link entries carry no content and are not yielded.
+  async function* extractEntries(extractOpts) {
+    extractOpts = extractOpts || {};
+    var allowDangerous = extractOpts.allowDangerous || {};
+    var walked = await _walk();
+    var entries = walked.entries;
+    var bytes = walked.bytes;
+    _assertGuardMetadata(entries, "archive.read.tar.extractEntries.refused");
+    var totalDecompressed = 0;
+    var yielded = 0;
+    for (var i = 0; i < entries.length; i += 1) {
+      var entry = entries[i];
+      var type = _classifyTypeflag(entry.typeflag);
+      if (type === "device" || type === "fifo" || type === "socket") {
+        throw new TarError("archive-tar/entry-type-refused",
+          "entry " + JSON.stringify(entry.name) + " is a " + type + " — refused unconditionally");
+      }
+      if (type === "symlink" && !(allowDangerous.symlinks || entryTypePolicy.symlinks)) {
+        throw new TarError("archive-tar/entry-type-refused",
+          "entry " + JSON.stringify(entry.name) + " is a symlink — refused by entryTypePolicy");
+      }
+      if (type === "hardlink" && !(allowDangerous.hardlinks || entryTypePolicy.hardlinks)) {
+        throw new TarError("archive-tar/entry-type-refused",
+          "entry " + JSON.stringify(entry.name) + " is a hardlink — refused by entryTypePolicy");
+      }
+      // Directories + (now-permitted) links carry no content bytes.
+      if (type === "directory" || type === "symlink" || type === "hardlink") continue;
+      // Archive-level name threats are refused by the guardArchive cascade
+      // above; the caller owns placement of the returned bytes, so the
+      // disk-write filename policy is intentionally not applied here.
+      // COPY the slice — bytes.subarray/slice shares the full collected-archive
+      // backing store, so a caller retaining one entry would pin the whole
+      // archive in memory, defeating the serverless memory goal. Buffer.from
+      // gives the entry its own backing store (matching the ZIP path, whose
+      // _decompressEntry already returns a fresh buffer).
+      var body = Buffer.from(bytes.subarray(entry._bodyStart, entry._bodyStart + entry.size));
+      totalDecompressed += body.length;
+      if (totalDecompressed > bombPolicy.maxTotalDecompressedBytes) {
+        throw new TarError("archive-tar/total-too-large",
+          "cumulative uncompressed=" + totalDecompressed +
+          " exceeds maxTotalDecompressedBytes during extractEntries");
+      }
+      yielded += 1;
+      yield { name: entry.name, bytes: body, size: body.length };
+    }
+    _emitAudit(opts, "archive.read.tar.extractEntries.completed", "success", { entries: yielded });
+  }
+
   async function extract(extractOpts) {
     extractOpts = extractOpts || {};
     if (typeof extractOpts.destination !== "string" || extractOpts.destination.length === 0) {
@@ -290,34 +371,7 @@ function tar(adapter, opts) {
     var walked = await _walk();
     var entries = walked.entries;
     var bytes = walked.bytes;
-    if (opts.guardProfile !== false) {
-      var profile = opts.guardProfile || "balanced";
-      var guardEntries = entries.map(function (e) {
-        return {
-          name:           e.name,
-          size:           e.size,
-          compressedSize: e.size,
-          isSymlink:      e.typeflag === TF_SYMLINK,
-          isHardlink:     e.typeflag === TF_HARDLINK,
-          linkTarget:     e.linkname,
-          isDirectory:    e.typeflag === TF_DIRECTORY,
-          isEncrypted:    false,
-          attrs:          { mode: e.mode },
-        };
-      });
-      var guardResult = guardArchive().validateEntries(guardEntries, { profile: profile });
-      if (guardResult && Array.isArray(guardResult.issues)) {
-        var critical = guardResult.issues.filter(function (i) { return i.severity === "critical"; });
-        if (critical.length > 0) {
-          _emitAudit(opts, "archive.read.tar.extract.refused", "refused", {
-            entries: entries.length,
-            issues:  critical.map(function (i) { return i.ruleId; }),
-          });
-          throw new TarError("archive-tar/guard-refused",
-            "extract refused — " + critical.length + " critical guard issue(s)");
-        }
-      }
-    }
+    _assertGuardMetadata(entries, "archive.read.tar.extract.refused");
     var written = [];
     var bytesExtracted = 0;
     var totalDecompressed = 0;
@@ -405,9 +459,10 @@ function tar(adapter, opts) {
   }
 
   return {
-    kind:    "tar-reader",
-    inspect: inspect,
-    extract: extract,
+    kind:           "tar-reader",
+    inspect:        inspect,
+    extract:        extract,
+    extractEntries: extractEntries,
   };
 }
 

package/lib/vendor/blamejs/lib/archive-tar.js

@@ -56,11 +56,10 @@
  *     - CVE-2024-12905 / CVE-2025-48387 (tar-fs path traversal).
  *     - CVE-2025-4138 / 4330 (Python tarfile data filter bypass).
  *
- *   Out of scope (v1):
+ *   Compression is via `b.archive.gz` composition (tar.gz). Out of scope
+ *   (v1):
  *     - Sparse-file emission (read reconstructs them; write doesn't
  *       produce sparse).
- *     - Compression (tar.gz lands v0.12.9 via `b.archive.gz`
- *       composition).
  *     - BSD-tar extensions beyond pax.
  *
  * @card

package/lib/vendor/blamejs/lib/auth/fal.js

@@ -155,6 +155,18 @@ function fromAssertion(opts) {
       "fal.fromAssertion: channel must be 'front' or 'back'");
   }
   var hokBinding = opts.hokBinding;
+  // `bearerOnly: true` is the explicit alias for "no proof-of-possession
+  // binding" (hokBinding === null). It contradicts a non-null hokBinding;
+  // refuse the contradiction at the entry point rather than silently
+  // picking one — an operator who sets both has a config bug.
+  if (opts.bearerOnly === true) {
+    if (hokBinding !== undefined && hokBinding !== null) {
+      throw new AuthError("auth/bad-fal-opts",
+        "fal.fromAssertion: bearerOnly:true conflicts with hokBinding '" + hokBinding +
+        "' (bearerOnly forces no proof-of-possession binding)");
+    }
+    hokBinding = null;
+  }
   if (hokBinding !== undefined && hokBinding !== null) {
     if (hokBinding !== "mtls" && hokBinding !== "dpop" && hokBinding !== "saml-hok") {
       throw new AuthError("auth/bad-fal-opts",

package/lib/vendor/blamejs/lib/auth/jwt-external.js

@@ -28,8 +28,8 @@
  *
  * Defenses against the well-known JWT pitfalls:
  *
- *   - alg confusion (CVE-2024-54150 / CVE-2025-30144 / CVE-2026-22817
- *     Hono class) — `algorithms` is REQUIRED with no default; `none`,
+ *   - alg confusion (CVE-2024-54150 / CVE-2026-22817 Hono class) —
+ *     `algorithms` is REQUIRED with no default; `none`,
  *     `HS256` cannot be accepted unless the operator explicitly listed
  *     them, and even then the verifier refuses HS* algs in
  *     verifyExternal because HMAC + a public-key JWKS is the canonical
@@ -175,8 +175,8 @@ function _assertAlgKtyMatch(alg, jwk) {
   else if   (alg === "ML-DSA-65" || alg === "ML-DSA-87") { expectedKty = "AKP"; }
   else {
     // Unknown alg — caller's alg allowlist should have rejected first;
-    // refuse here defensively (CVE-2026-23993 class — unknown-alg paths
-    // that skip downstream verification).
+    // refuse here defensively (CWE-347 alg-confusion class — unknown-alg
+    // paths that skip downstream verification; cf. CVE-2026-22817).
     throw new AuthError("auth-jwt-external/unsupported-alg",
       "_assertAlgKtyMatch: alg '" + alg + "' has no defined key-type binding");
   }
@@ -336,7 +336,7 @@ async function verifyExternal(token, opts) {
 
   // Decode header + payload.
   var parts = token.split(".");
-  // CVE-2026-29000 / CVE-2026-23993 / CVE-2026-22817 / CVE-2026-34950 —
+  // CVE-2026-29000 / CVE-2026-22817 / CVE-2026-34950 —
   // JWE-bypass + alg-confusion. A 5-segment compact serialization is a
   // JWE (RFC 7516); accepting it on a JWS verifier is the canonical
   // confused-deputy shape. verifyExternal is JWS-only; refuse JWE
@@ -350,7 +350,7 @@ async function verifyExternal(token, opts) {
     }); } catch (_e) { /* audit best-effort */ }
     throw new AuthError("auth-jwt-external/jwe-refused",
       "5-segment JWE token refused — verifyExternal only handles JWS " +
-      "(JWE bypass class — CVE-2026-29000 / CVE-2026-23993 / CVE-2026-22817 / CVE-2026-34950)");
+      "(JWE bypass class — CVE-2026-29000 / CVE-2026-22817 / CVE-2026-34950)");
   }
   if (parts.length !== 3) {
     throw new AuthError("auth-jwt-external/malformed-jwt",
@@ -371,8 +371,9 @@ async function verifyExternal(token, opts) {
     throw new AuthError("auth-jwt-external/unknown-crit",
       "token declares 'crit' header — verifyExternal does not support critical extensions");
   }
-  // CVE-2026-23993 — refuse alg values outside the accepted list BEFORE
-  // any key lookup. The early refusal closes the class where an
+  // Alg-allowlist gate (CWE-347 improper-sig-verification / CWE-757
+  // algorithm-downgrade) — refuse alg values outside the accepted list
+  // BEFORE any key lookup. The early refusal closes the class where an
   // unknown / unsupported alg slips through to a downstream code path
   // that interprets it permissively. The per-listed algorithm check
   // above in the opts-validation loop refuses the OPERATOR'S allowlist
@@ -381,11 +382,11 @@ async function verifyExternal(token, opts) {
   if (opts.algorithms.indexOf(header.alg) === -1) {
     throw new AuthError("auth-jwt-external/alg-not-allowed",
       "token alg='" + header.alg + "' not in allowed list [" + opts.algorithms.join(", ") +
-      "] (CVE-2026-23993 — refused before key lookup)");
+      "] (alg-allowlist gate — refused before key lookup)");
   }
   if (SUPPORTED_CLASSICAL_ALGS.indexOf(header.alg) === -1) {
     throw new AuthError("auth-jwt-external/unsupported-alg",
-      "token alg='" + header.alg + "' is not in the verifier's supported set (CVE-2026-23993)");
+      "token alg='" + header.alg + "' is not in the verifier's supported set (alg-allowlist gate)");
   }
 
   // Resolve key.
@@ -480,7 +481,10 @@ async function verifyExternal(token, opts) {
     // weak iss validation. Constant-time compare defeats prefix-timing
     // narrowing; emit a DISTINCT audit event (separate from sig-verify-
     // fail) so detection signals lights up on the cross-realm shape
-    // independently of generic verification failures.
+    // independently of generic verification failures. The `typeof ... !==
+    // "string"` guard also rejects an array-valued iss (CVE-2025-30144,
+    // fast-jwt — an iss array `["attacker", "valid"]` passed an any-match
+    // check); only a single string iss is accepted.
     if (typeof payload.iss !== "string" ||
         !_issuerMatches(payload.iss, opts.issuer)) {
       try { audit().safeEmit({

package/lib/vendor/blamejs/lib/auth/jwt.js

@@ -234,8 +234,8 @@ async function verify(token, opts) {
   // SECURITY: when the resolver uses header.kid as a filename / map
   // key / cache index, it MUST sanitize the kid first. Path-traversal
   // (`../etc/passwd`), null-byte (`key\0..`), control chars, and
-  // similar shapes turn a kid lookup into an arbitrary-file-read
-  // primitive (CVE-2018-0114 java-jwt class). Use
+  // similar shapes turn a kid lookup into an arbitrary-file-read or
+  // SQLi primitive (the PortSwigger JWT "kid" injection / LFI class). Use
   // `b.guardJwt.kidSafe(header.kid)` — throws on traversal indicators
   // and control bytes, returns the validated kid on success.
   var key;