@blamejs/blamejs-shop 0.2.15 → 0.2.18

package/lib/vendor/blamejs/lib/dual-control.js

@@ -301,27 +301,27 @@ function create(opts) {
 
   async function cancel(args) {
     if (!args || typeof args !== "object") throw _err("BAD_ARG", "cancel: args required");
-    var record = await _load(args.grantId);
-    if (!record) return { error: "grant-not-found", grantId: args.grantId };
-    if (record.consumedAt !== null) return { error: "grant-already-consumed", grantId: record.grantId };
-    if (record.revokedAt !== null)  return { error: "grant-revoked", grantId: record.grantId };
-    if (record.cancelledAt !== null) return { error: "grant-already-cancelled", grantId: record.grantId };
     var actorId = _actorIdOf(args.cancelledBy);
-    if (actorId !== record.requestedBy) {
-      // Cancellation by anyone other than the requester is a revoke,
-      // not a cancel. Surface explicitly.
-      return { error: "only-requester-can-cancel", grantId: record.grantId,
-        requestedBy: record.requestedBy };
-    }
-    record.cancelledAt = Date.now();
-    record.cancelledReason = args.reason || null;
-    var ttlRemaining = Math.max(1, record.expiresAt - Date.now());
-    await cache.set(_key(record.grantId), record, { ttlMs: ttlRemaining });
+    var outcome = await cache.update(_key(args.grantId), function (record) {
+      if (!record) return { abort: { response: { error: "grant-not-found", grantId: args.grantId } } };
+      if (record.consumedAt !== null) return { abort: { response: { error: "grant-already-consumed", grantId: record.grantId } } };
+      if (record.revokedAt !== null)  return { abort: { response: { error: "grant-revoked", grantId: record.grantId } } };
+      if (record.cancelledAt !== null) return { abort: { response: { error: "grant-already-cancelled", grantId: record.grantId } } };
+      // Cancellation by anyone other than the requester is a revoke, not a
+      // cancel — surface explicitly.
+      if (actorId !== record.requestedBy) {
+        return { abort: { response: { error: "only-requester-can-cancel", grantId: record.grantId, requestedBy: record.requestedBy } } };
+      }
+      record.cancelledAt = Date.now();
+      record.cancelledReason = args.reason || null;
+      return { value: record, expiresAt: record.expiresAt };
+    }, { ttlMs: ttlMs });
+    if (outcome.aborted) return outcome.aborted.response;
+    var rec = outcome.value;
     _emit("dual.grant.cancelled",
-      { grantId: record.grantId, action: record.action,
-        cancelledBy: actorId, reason: args.reason || null },
+      { grantId: rec.grantId, action: rec.action, cancelledBy: actorId, reason: args.reason || null },
       "success", args.req);
-    return { grantId: record.grantId, status: "cancelled" };
+    return { grantId: rec.grantId, status: "cancelled" };
   }
 
   async function _load(grantId) {
@@ -334,156 +334,152 @@ function create(opts) {
 
   async function approve(args) {
     if (!args || typeof args !== "object") throw _err("BAD_ARG", "approve: args required");
-    var record = await _load(args.grantId);
-    if (!record) {
-      return { error: "grant-not-found", grantId: args.grantId };
-    }
-    if (record.consumedAt !== null) {
-      return { error: "grant-already-consumed", grantId: record.grantId };
-    }
-    if (record.revokedAt !== null) {
-      return { error: "grant-revoked", grantId: record.grantId, revokedReason: record.revokedReason };
-    }
-    if (record.cancelledAt !== null) {
-      return { error: "grant-cancelled", grantId: record.grantId };
-    }
-    if (record.expiresAt < Date.now()) {
-      _emit("dual.grant.expired", { grantId: record.grantId, action: record.action },
-        "failure", args.req);
-      await cache.del(_key(record.grantId));
-      return { error: "grant-expired", grantId: record.grantId };
-    }
     var approverId = _actorIdOf(args.approver);
     if (!approverId) throw _err("BAD_ARG", "approve: args.approver must be an actor with a stable id");
-    if (forbidSelfApprove && approverId === record.requestedBy) {
-      _emit("dual.grant.self_approval_denied",
-        { grantId: record.grantId, action: record.action, approver: approverId },
-        "denied", args.req);
-      return { error: "self-approval-forbidden", grantId: record.grantId };
-    }
-    if (!_approverRoleOk(args.approver)) {
-      _emit("dual.grant.role_denied",
-        { grantId: record.grantId, action: record.action, approver: approverId,
-          requiredRoles: approverRoles,
-          actorRoles: (args.approver && Array.isArray(args.approver.roles)) ? args.approver.roles : [] },
-        "denied", args.req);
-      return { error: "approver-role-required", grantId: record.grantId,
-        requiredRoles: approverRoles };
-    }
-    if (record.approvedBy.indexOf(approverId) !== -1) {
-      return { error: "already-approved-by-this-actor", grantId: record.grantId,
-        approvedBy: record.approvedBy };
-    }
+    // Pre-compute the pure, record-independent checks so the mutator stays
+    // side-effect-free (it may re-run under cluster CAS contention).
+    var roleOk = _approverRoleOk(args.approver);
     var reasonProblem = _checkReason(args.reason, "approve");
-    if (reasonProblem) {
-      return Object.assign({ grantId: record.grantId }, reasonProblem);
-    }
-    record.approvedBy.push(approverId);
-    record.approvalsAt.push(Date.now());
-    record.approvalReasons.push(args.reason || null);
-    if (approverRoles && args.approver && Array.isArray(args.approver.roles)) {
-      // Record which of the required roles satisfied the approval —
-      // useful when an audit reviewer needs to confirm the actor
-      // approved as e.g. their security-officer role and not their
-      // engineer role.
-      var hits = args.approver.roles.filter(function (r) { return approverRoles.indexOf(r) !== -1; });
-      record.approverRoleHits.push(hits);
-    }
-    var status = "pending";
-    if (record.approvedBy.length >= record.minApprovers) {
-      status = "approved";
-      if (record.quorumReachedAt === null) record.quorumReachedAt = Date.now();
+    var roleHits = (approverRoles && args.approver && Array.isArray(args.approver.roles))
+      ? args.approver.roles.filter(function (r) { return approverRoles.indexOf(r) !== -1; })
+      : null;
+
+    // Atomic read-modify-write: the duplicate-approver guard and the
+    // approvedBy append commit together, so two concurrent approvals (or a
+    // retried one) cannot each read a stale snapshot and append the same
+    // approver twice — the quorum-bypass the get/set version allowed.
+    var outcome = await cache.update(_key(args.grantId), function (record) {
+      if (!record) return { abort: { response: { error: "grant-not-found", grantId: args.grantId } } };
+      if (record.consumedAt !== null) return { abort: { response: { error: "grant-already-consumed", grantId: record.grantId } } };
+      if (record.revokedAt !== null) return { abort: { response: { error: "grant-revoked", grantId: record.grantId, revokedReason: record.revokedReason } } };
+      if (record.cancelledAt !== null) return { abort: { response: { error: "grant-cancelled", grantId: record.grantId } } };
+      if (record.expiresAt < Date.now()) {
+        return { abort: { response: { error: "grant-expired", grantId: record.grantId },
+          event: "dual.grant.expired", meta: { grantId: record.grantId, action: record.action }, outcome: "failure" } };
+      }
+      if (forbidSelfApprove && approverId === record.requestedBy) {
+        return { abort: { response: { error: "self-approval-forbidden", grantId: record.grantId },
+          event: "dual.grant.self_approval_denied",
+          meta: { grantId: record.grantId, action: record.action, approver: approverId }, outcome: "denied" } };
+      }
+      if (!roleOk) {
+        return { abort: { response: { error: "approver-role-required", grantId: record.grantId, requiredRoles: approverRoles },
+          event: "dual.grant.role_denied",
+          meta: { grantId: record.grantId, action: record.action, approver: approverId, requiredRoles: approverRoles,
+            actorRoles: (args.approver && Array.isArray(args.approver.roles)) ? args.approver.roles : [] }, outcome: "denied" } };
+      }
+      if (record.approvedBy.indexOf(approverId) !== -1) {
+        return { abort: { response: { error: "already-approved-by-this-actor", grantId: record.grantId, approvedBy: record.approvedBy.slice() } } };
+      }
+      if (reasonProblem) return { abort: { response: Object.assign({ grantId: record.grantId }, reasonProblem) } };
+      record.approvedBy.push(approverId);
+      record.approvalsAt.push(Date.now());
+      record.approvalReasons.push(args.reason || null);
+      // Record which required role satisfied the approval — an audit
+      // reviewer can confirm the actor approved as e.g. security-officer.
+      if (roleHits) record.approverRoleHits.push(roleHits);
+      if (record.approvedBy.length >= record.minApprovers && record.quorumReachedAt === null) {
+        record.quorumReachedAt = Date.now();
+      }
+      return { value: record, expiresAt: record.expiresAt };
+    }, { ttlMs: ttlMs });
+
+    if (outcome.aborted) {
+      var ab = outcome.aborted;
+      if (ab.event) _emit(ab.event, ab.meta, ab.outcome, args.req);
+      return ab.response;
     }
-    var ttlRemaining = Math.max(1, record.expiresAt - Date.now());
-    await cache.set(_key(record.grantId), record, { ttlMs: ttlRemaining });
+    var rec = outcome.value;
+    var status = (rec.approvedBy.length >= rec.minApprovers) ? "approved" : "pending";
+    var consumeUnlockAt = rec.quorumReachedAt !== null ? rec.quorumReachedAt + rec.consumeLockMs : null;
     _emit("dual.grant.approved",
-      { grantId: record.grantId, action: record.action, approver: approverId,
-        approverCount: record.approvedBy.length, needs: record.minApprovers,
-        status: status, reason: args.reason || null,
-        consumeUnlockAt: record.quorumReachedAt !== null
-          ? record.quorumReachedAt + record.consumeLockMs : null },
+      { grantId: rec.grantId, action: rec.action, approver: approverId,
+        approverCount: rec.approvedBy.length, needs: rec.minApprovers,
+        status: status, reason: args.reason || null, consumeUnlockAt: consumeUnlockAt },
       "success", args.req);
     return {
-      grantId:    record.grantId,
+      grantId:    rec.grantId,
       status:     status,
-      approvedBy: record.approvedBy.slice(),
-      needs:      record.minApprovers,
-      expiresAt:  record.expiresAt,
-      consumeUnlockAt: record.quorumReachedAt !== null
-        ? record.quorumReachedAt + record.consumeLockMs : null,
+      approvedBy: rec.approvedBy.slice(),
+      needs:      rec.minApprovers,
+      expiresAt:  rec.expiresAt,
+      consumeUnlockAt: consumeUnlockAt,
     };
   }
 
   async function revoke(args) {
     if (!args || typeof args !== "object") throw _err("BAD_ARG", "revoke: args required");
-    var record = await _load(args.grantId);
-    if (!record) return { error: "grant-not-found", grantId: args.grantId };
-    if (record.consumedAt !== null) {
-      return { error: "grant-already-consumed", grantId: record.grantId };
-    }
-    record.revokedAt = Date.now();
-    record.revokedReason = args.reason || null;
-    var ttlRemaining = Math.max(1, record.expiresAt - Date.now());
-    await cache.set(_key(record.grantId), record, { ttlMs: ttlRemaining });
+    var revokedById = _actorIdOf(args.revokedBy);
+    var outcome = await cache.update(_key(args.grantId), function (record) {
+      if (!record) return { abort: { response: { error: "grant-not-found", grantId: args.grantId } } };
+      if (record.consumedAt !== null) return { abort: { response: { error: "grant-already-consumed", grantId: record.grantId } } };
+      record.revokedAt = Date.now();
+      record.revokedReason = args.reason || null;
+      return { value: record, expiresAt: record.expiresAt };
+    }, { ttlMs: ttlMs });
+    if (outcome.aborted) return outcome.aborted.response;
+    var rec = outcome.value;
     _emit("dual.grant.denied",
-      { grantId: record.grantId, action: record.action,
-        revokedBy: _actorIdOf(args.revokedBy), reason: args.reason || null },
+      { grantId: rec.grantId, action: rec.action, revokedBy: revokedById, reason: args.reason || null },
       "denied", args.req);
-    return { grantId: record.grantId, status: "revoked" };
+    return { grantId: rec.grantId, status: "revoked" };
   }
 
   async function consume(grantId, args) {
     args = args || {};
-    var record = await _load(grantId);
-    if (!record) return { ready: false, reason: "grant-not-found" };
-    if (record.revokedAt !== null) {
-      return { ready: false, reason: "revoked" };
-    }
-    if (record.cancelledAt !== null) {
-      return { ready: false, reason: "cancelled" };
-    }
-    if (record.consumedAt !== null) {
-      return { ready: false, reason: "already-consumed" };
-    }
-    if (record.expiresAt < Date.now()) {
-      _emit("dual.grant.expired", { grantId: record.grantId, action: record.action },
-        "failure", args.req);
-      await cache.del(_key(record.grantId));
-      return { ready: false, reason: "expired" };
-    }
-    if (record.approvedBy.length < record.minApprovers) {
-      return { ready: false, reason: "not-enough-approvers",
-        approvedBy: record.approvedBy.slice(), needs: record.minApprovers };
-    }
-    // Cooling-off lock: ANY approval-quorum-reached grant can't consume
-    // until consumeLockMs has passed since the final approval. Defends
-    // against rapid-burst compromise of requester+approver.
-    if ((record.consumeLockMs || 0) > 0 && record.quorumReachedAt !== null) {
-      var unlockAt = record.quorumReachedAt + record.consumeLockMs;
-      if (Date.now() < unlockAt) {
-        _emit("dual.grant.consume_locked",
-          { grantId: record.grantId, action: record.action,
-            unlockAt: unlockAt, waitMs: unlockAt - Date.now() },
-          "denied", args.req);
-        return { ready: false, reason: "consume-locked", unlockAt: unlockAt,
-          waitMs: unlockAt - Date.now() };
+    // Atomic read-modify-write: the consumedAt check and the consumedAt set
+    // commit together (compare-and-set), so two concurrent consumes cannot
+    // both observe consumedAt === null and both proceed — exactly one wins
+    // and runs the destructive operation. The get/set version let a
+    // single-use grant be consumed twice.
+    var outcome = await cache.update(_key(grantId), function (record) {
+      if (!record) return { abort: { response: { ready: false, reason: "grant-not-found" } } };
+      if (record.revokedAt !== null) return { abort: { response: { ready: false, reason: "revoked" } } };
+      if (record.cancelledAt !== null) return { abort: { response: { ready: false, reason: "cancelled" } } };
+      if (record.consumedAt !== null) return { abort: { response: { ready: false, reason: "already-consumed" } } };
+      if (record.expiresAt < Date.now()) {
+        return { abort: { response: { ready: false, reason: "expired" }, del: true,
+          event: "dual.grant.expired", meta: { grantId: record.grantId, action: record.action }, outcome: "failure" } };
       }
+      if (record.approvedBy.length < record.minApprovers) {
+        return { abort: { response: { ready: false, reason: "not-enough-approvers",
+          approvedBy: record.approvedBy.slice(), needs: record.minApprovers } } };
+      }
+      // Cooling-off lock: a quorum-reached grant can't consume until
+      // consumeLockMs has passed since the final approval — defends against
+      // rapid-burst compromise of requester + approver.
+      if ((record.consumeLockMs || 0) > 0 && record.quorumReachedAt !== null) {
+        var unlockAt = record.quorumReachedAt + record.consumeLockMs;
+        if (Date.now() < unlockAt) {
+          return { abort: { response: { ready: false, reason: "consume-locked", unlockAt: unlockAt, waitMs: unlockAt - Date.now() },
+            event: "dual.grant.consume_locked",
+            meta: { grantId: record.grantId, action: record.action, unlockAt: unlockAt, waitMs: unlockAt - Date.now() }, outcome: "denied" } };
+        }
+      }
+      record.consumedAt = Date.now();
+      return { value: record, expiresAt: record.expiresAt };
+    }, { ttlMs: ttlMs });
+
+    if (outcome.aborted) {
+      var ab = outcome.aborted;
+      if (ab.event) _emit(ab.event, ab.meta, ab.outcome, args.req);
+      if (ab.del) { try { await cache.del(_key(grantId)); } catch (_e) { /* sweep handles it */ } }
+      return ab.response;
     }
-    record.consumedAt = Date.now();
-    // Drop the grant from the cache after consume — single-use by design.
-    await cache.del(_key(record.grantId));
+    var rec = outcome.value;
+    // Single-use by design — drop the (now consumed) grant from the cache.
+    await cache.del(_key(rec.grantId));
     _emit("dual.grant.consumed",
-      { grantId: record.grantId, action: record.action,
-        approvedBy: record.approvedBy.slice(),
-        approvalReasons: record.approvalReasons.slice() },
+      { grantId: rec.grantId, action: rec.action,
+        approvedBy: rec.approvedBy.slice(), approvalReasons: rec.approvalReasons.slice() },
       "success", args.req);
     return {
       ready:      true,
-      grantId:    record.grantId,
-      action:     record.action,
-      resource:   record.resource,
-      approvedBy: record.approvedBy.slice(),
-      requestedBy:record.requestedBy,
+      grantId:    rec.grantId,
+      action:     rec.action,
+      resource:   rec.resource,
+      approvedBy: rec.approvedBy.slice(),
+      requestedBy:rec.requestedBy,
     };
   }
 

package/lib/vendor/blamejs/lib/i18n.js

@@ -64,6 +64,15 @@ var requestHelpers = require("./request-helpers");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var { I18nError } = require("./framework-error");
+var { boundedMap } = require("./bounded-map");
+
+// Per-instance formatter caches are keyed on (locale, JSON.stringify
+// formatOpts). A fixed `locales` set bounds the locale axis, but operators
+// can pass fresh formatOpts shapes per call (and `Intl` options are open-
+// ended), so the key space is request-influenced — cap it so it can't grow
+// without limit. Evict-oldest is free here: a formatter is pure-derived and
+// re-created on the next miss.
+var FORMATTER_CACHE_MAX_ENTRIES = 512;
 
 var observability = lazyRequire(function () { return require("./observability"); });
 
@@ -353,7 +362,7 @@ function _interpolate(template, vars, interpolation) {
 // only with operators handing in fresh literals every call (they
 // usually pass the same shape).
 function _makeFormatterCache(make, kind, emitObs) {
-  var cache = new Map();
+  var cache = boundedMap({ maxEntries: FORMATTER_CACHE_MAX_ENTRIES, policy: "evict-oldest" });
   return function getFormatter(locale, formatOpts) {
     var optsKey = formatOpts ? JSON.stringify(formatOpts) : "";
     var cacheKey = locale + "\x1f" + optsKey;

package/lib/vendor/blamejs/lib/mail-crypto-smime.js

@@ -386,6 +386,25 @@ function _verifySignerInfo(si, msgBytes, signerPublicKey, auditHandle) {
   return { sigAlg: sigAlg, digestAlg: digestAlg };
 }
 
+// Does this cert's public key match the raw signer key that verified the
+// signature? signerBytes is the key passed to the PQC/classical verify; a
+// cert exposes its key as SPKI DER. The raw subjectPublicKey is the tail of
+// the SPKI (its last element), so a suffix match catches the raw-key form
+// while a full-length compare catches a caller who passed the SPKI itself.
+// If the key can't be exported (an algorithm this Node build can't parse),
+// the cert can't be bound — return false so the caller fails closed rather
+// than trusting an unverifiable binding.
+function _certKeyMatches(cert, signerBytes) {
+  var spki;
+  try { spki = Buffer.from(cert.publicKey.export({ format: "der", type: "spki" })); }
+  catch (_e) { return false; }
+  if (spki.length === signerBytes.length) return Buffer.compare(spki, signerBytes) === 0;
+  if (signerBytes.length < spki.length) {
+    return Buffer.compare(spki.subarray(spki.length - signerBytes.length), signerBytes) === 0;
+  }
+  return false;
+}
+
 function _verifyTrustChain(sd, trustAnchorCertsPem, signerPublicKey, auditHandle) {
   if (sd.certificates.length === 0) {
     throw new MailCryptoError("mail-crypto/smime/no-certs",
@@ -411,13 +430,24 @@ function _verifyTrustChain(sd, trustAnchorCertsPem, signerPublicKey, auditHandle
         "trustAnchorCertsPem[" + idx + "] parse failed: " + ((e && e.message) || String(e)));
     }
   });
-  // Pick the leaf — the cert whose public key matches the verified
-  // signature. signerPublicKey is the PQC raw bytes; we compare
-  // against each chain cert's exported jwk x / SPKI. Hardest path:
-  // PQC isn't in node:crypto X509Certificate yet, so the leaf might
-  // be ECDSA / RSA. Fall back to picking the first cert when no
-  // other comparison applies (operator's chain is operator-curated).
-  var leaf = chain[0];
+  // Bind the leaf to the key that ACTUALLY verified the signature
+  // (signerPublicKey). Without this, a validly-chained certificate for a
+  // DIFFERENT identity would pass chain validation while the signature was
+  // verified under an unrelated key — chainVerified would assert a binding
+  // the code never made. Find the chain cert whose public key matches
+  // signerPublicKey; if none does, the supplied chain does not correspond
+  // to the verified signer, so fail closed.
+  var signerBytes = Buffer.from(signerPublicKey);
+  var leaf = null;
+  for (var lci = 0; lci < chain.length; lci += 1) {
+    if (_certKeyMatches(chain[lci], signerBytes)) { leaf = chain[lci]; break; }
+  }
+  if (!leaf) {
+    throw new MailCryptoError("mail-crypto/smime/signer-not-in-chain",
+      "trust-chain validation: no certificate in SignedData.certificates carries the " +
+      "public key that verified the signature — the supplied chain does not correspond " +
+      "to the verified signer");
+  }
   // Validity window check (RFC 5280 §4.1.2.5) — every cert in chain
   // must be within validFrom..validTo at the current wall-clock.
   var nowMs = Date.now();
@@ -444,8 +474,8 @@ function _verifyTrustChain(sd, trustAnchorCertsPem, signerPublicKey, auditHandle
       if (current.issuer === r.subject) {
         try {
           if (current.verify(r.publicKey)) {
-            void signerPublicKey; void auditHandle;
-            return;   // chain validates
+            void auditHandle;
+            return;   // chain validates (and the leaf is the verified signer)
           }
         } catch (_e) { /* fall through to next root */ }
       }
@@ -787,4 +817,8 @@ module.exports = {
   ALLOWED_HASHES:      ALLOWED_HASHES,
   REFUSED_HASHES:      REFUSED_HASHES,
   RSA_MIN_BITS:        RSA_MIN_BITS,
+  // Exposed for tests — the leaf↔signer-key binding used by trust-chain
+  // validation (a cert matches the verified signer key iff its SPKI public
+  // key equals, or has as a suffix, the raw signer key bytes).
+  _certKeyMatches:     _certKeyMatches,
 };

package/lib/vendor/blamejs/lib/network-dns.js

@@ -13,6 +13,7 @@ var safeBuffer = require("./safe-buffer");
 var safeUrl = require("./safe-url");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
+var { boundedMap } = require("./bounded-map");
 
 var DnsError = defineClass("DnsError", { alwaysPermanent: false });
 
@@ -89,8 +90,15 @@ function _ensureSecureDefault() {
   STATE.doh = { url: DEFAULT_DOH_URL, method: null, ca: null };
 }
 
-var POSITIVE_CACHE = new Map();
-var NEGATIVE_CACHE = new Map();
+// Resolver caches are keyed on (hostname, family). Hostnames reaching the
+// resolver are request-influenced (outbound HTTP targets, mail MX lookups,
+// operator-supplied URLs), and expired entries are only reclaimed lazily on
+// a re-query of the SAME key — so a stream of unique hostnames would grow
+// these without bound. Cap them; evict-oldest is free (DNS re-resolves on
+// the next miss). The cap bounds peak memory even with no periodic sweep.
+var DNS_CACHE_MAX_ENTRIES = 4096;
+var POSITIVE_CACHE = boundedMap({ maxEntries: DNS_CACHE_MAX_ENTRIES, policy: "evict-oldest" });
+var NEGATIVE_CACHE = boundedMap({ maxEntries: DNS_CACHE_MAX_ENTRIES, policy: "evict-oldest" });
 
 function _now() { return Date.now(); }
 

package/lib/vendor/blamejs/lib/nonce-store.js

@@ -45,10 +45,18 @@ var clusterStorage = require("./cluster-storage");
 var C = require("./constants");
 var safeAsync = require("./safe-async");
 var { defineClass } = require("./framework-error");
+var { boundedMap } = require("./bounded-map");
 
 var NonceStoreError = defineClass("NonceStoreError");
 
 var DEFAULT_SWEEP_INTERVAL_MS = C.TIME.minutes(5);
+// Memory-backend ceiling. Each request carries an attacker-choosable unique
+// nonce, so between sweeps the store would otherwise grow without bound (a
+// memory-amplification DoS). Capped — but a replay-protection store must
+// NOT evict a live nonce to admit a new one (that reopens a replay window
+// for the evicted nonce), so the cap uses the "reject" policy and the
+// backend fails CLOSED at capacity (see checkAndInsert).
+var DEFAULT_MAX_ENTRIES = 1000000;
 
 function _err(code, message) {
   return new NonceStoreError(code, message, true);
@@ -58,14 +66,22 @@ function _err(code, message) {
 
 function _memoryBackend(opts) {
   var sweepIntervalMs = opts.sweepIntervalMs || DEFAULT_SWEEP_INTERVAL_MS;
-  var seen = new Map();   // nonce -> expireAt
+  var maxEntries = opts.maxEntries || DEFAULT_MAX_ENTRIES;
+  // policy "reject" — never evict a live nonce (that would reopen a replay
+  // window for the dropped one). At capacity the backend fails closed.
+  var seen = boundedMap({ maxEntries: maxEntries, policy: "reject" });
+  var capacityRejects = 0;
 
-  var sweepTimer = safeAsync.repeating(function () {
+  function _purgeExpiredSync() {
     var now = Date.now();
+    var removed = 0;
     for (var entry of seen) {
-      if (entry[1] <= now) seen.delete(entry[0]);
+      if (entry[1] <= now) { seen.delete(entry[0]); removed++; }
     }
-  }, sweepIntervalMs, { name: "nonce-sweep" });
+    return removed;
+  }
+
+  var sweepTimer = safeAsync.repeating(_purgeExpiredSync, sweepIntervalMs, { name: "nonce-sweep" });
 
   function checkAndInsert(nonce, expireAt) {
     if (typeof nonce !== "string" || nonce.length === 0) {
@@ -78,17 +94,26 @@ function _memoryBackend(opts) {
     if (existing !== undefined && existing > Date.now()) {
       return Promise.resolve(false);   // replay
     }
-    seen.set(nonce, expireAt);
+    var stored = seen.set(nonce, expireAt);
+    if (!stored) {
+      // At capacity. Reclaim expired entries inline, then retry once.
+      _purgeExpiredSync();
+      stored = seen.set(nonce, expireAt);
+    }
+    if (!stored) {
+      // Still full of LIVE nonces — a genuine flood. FAIL CLOSED: we
+      // cannot record this nonce, so we cannot prove it is first-seen.
+      // Refuse it (report as "seen") rather than admit an unprotected
+      // request. Evicting a live nonce to make room would reopen a replay
+      // window, so we never evict — the request is rejected instead.
+      capacityRejects += 1;
+      return Promise.resolve(false);
+    }
     return Promise.resolve(true);
   }
 
   function purgeExpired() {
-    var now = Date.now();
-    var removed = 0;
-    for (var entry of seen) {
-      if (entry[1] <= now) { seen.delete(entry[0]); removed++; }
-    }
-    return Promise.resolve(removed);
+    return Promise.resolve(_purgeExpiredSync());
   }
 
   function close() {
@@ -101,8 +126,10 @@ function _memoryBackend(opts) {
     checkAndInsert:  checkAndInsert,
     purgeExpired:    purgeExpired,
     close:           close,
-    // Test hook — direct read of the underlying Map size
+    // Test hooks — underlying entry count + count of capacity fail-closed
+    // rejections (a nonce flood that hit the ceiling).
     _size:           function () { return seen.size; },
+    _capacityRejects: function () { return capacityRejects; },
   };
 }
 

package/lib/vendor/blamejs/lib/queue-local.js

@@ -88,7 +88,7 @@ function _shapeLeasedRow(raw) {
   return {
     jobId:          unsealed._id,
     queueName:      unsealed.queueName,
-    payload:        unsealed.payload ? safeJson.parse(unsealed.payload) : null,
+    payload:        unsealed.payload ? safeJson.parse(unsealed.payload, { maxBytes: C.BYTES.mib(64) }) : null,
     attempts:       Number(unsealed.attempts),
     maxAttempts:    Number(unsealed.maxAttempts),
     traceId:        unsealed.traceId,
@@ -270,7 +270,7 @@ function create(_config) {
         var cron = scheduler.parseCron(unsealedRow.repeatCron);
         var nextMs = scheduler.nextCronFire(cron, new Date(nowMs), unsealedRow.repeatTimezone || null);
         await enqueue(unsealedRow.queueName,
-          unsealedRow.payload ? safeJson.parse(unsealedRow.payload) : null,
+          unsealedRow.payload ? safeJson.parse(unsealedRow.payload, { maxBytes: C.BYTES.mib(64) }) : null,
           {
             // availableAt is the precise next-fire ms — pass it alone.
             // Don't also pass delaySeconds (the v0.6.22 / v0.6.23 fix

package/lib/vendor/blamejs/lib/redis-client.js

@@ -182,6 +182,11 @@ function create(opts) {
   var connected = false;
   var connecting = false;
   var closing = false;
+  // Tracked + unref'd reconnect timer. Tracked so close() can cancel a
+  // pending backoff (otherwise a reconnect scheduled before close fires
+  // after it and opens a fresh socket); unref'd so a backoff window doesn't
+  // by itself keep the event loop alive (the process-won't-exit class).
+  var reconnectTimer = null;
   var rxBuffer = Buffer.alloc(0);
   // FIFO of in-flight commands awaiting a response
   var pending = [];
@@ -210,7 +215,11 @@ function create(opts) {
     }
     reconnectAttempt++;
     var delay = Math.min(C.TIME.seconds(30), 100 * Math.pow(2, reconnectAttempt - 1));
-    setTimeout(function () { _connect().catch(function () { /* will reschedule */ }); }, delay);
+    reconnectTimer = setTimeout(function () {
+      reconnectTimer = null;
+      _connect().catch(function () { /* will reschedule */ });
+    }, delay);
+    if (typeof reconnectTimer.unref === "function") reconnectTimer.unref();
   }
 
   function _drainPending(err) {
@@ -290,6 +299,9 @@ function create(opts) {
   }
 
   async function _connect() {
+    // A reconnect timer scheduled before close() can still fire afterward;
+    // refuse to re-open once closing so it doesn't leak a fresh socket.
+    if (closing) return;
     if (connected) return;
     if (connecting) {
       // Wait until current connect attempt resolves
@@ -423,6 +435,7 @@ function create(opts) {
 
   async function close() {
     closing = true;
+    if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
     var err = _err("CLOSED", "redis client closed");
     _drainPending(err);
     if (socket) {

package/lib/vendor/blamejs/lib/subject.js

@@ -257,6 +257,11 @@ function rectify(subjectId, opts) {
  * override an active hold (FRCP Rule 26/37(e), GDPR Art 17(3)(e),
  * SEC Rule 17a-4, HIPAA §164.530(j)(2)).
  *
+ * Security: any `actor` recorded here is an audit-record field, NOT
+ * authentication. This primitive gates the deletion on acknowledgements
+ * and the legal-hold registry, not on caller identity — the caller MUST be
+ * authenticated and authorized by your route before invoking.
+ *
  * Returns `{ rowsDeleted, perTable }`. Use `b.subject.eraseHard` when
  * residual ciphertext in WAL / replicas / backups must also be made
  * undecryptable.
@@ -383,7 +388,9 @@ function erase(subjectId, opts) {
  * Art. 17 erasure shape the framework offers.
  *
  * Same legal-hold + acknowledgement gates as `b.subject.erase`.
- * Leader-only. Returns `{ rowsDeleted, perRowKeysDestroyed, perTable }`.
+ * Security: the `actor` is an audit-record field, not authentication —
+ * authorize the caller upstream. Leader-only.
+ * Returns `{ rowsDeleted, perRowKeysDestroyed, perTable }`.
  *
  * @opts
  *   reason:           string,    // ticket reference recorded in the audit event