@blamejs/blamejs-shop 0.4.32 → 0.4.37

package/lib/vendor/blamejs/lib/retention.js

@@ -614,9 +614,16 @@ var COMPLIANCE_RETENTION_FLOOR_MS = Object.freeze({
  *   // → 220752000000 (Sarbanes-Oxley §802 — 7 years)
  */
 function complianceFloor(posture, candidateTtlMs) {
+  // Optional posture: omit it to inherit the active posture recorded by
+  // applyPosture (the b.compliance.set cascade). A numeric first argument is
+  // taken as candidateTtlMs so complianceFloor(ttl) works; an explicit posture
+  // always overrides the active one.
+  if (typeof posture === "number") { candidateTtlMs = posture; posture = undefined; }
+  if (posture === undefined || posture === null) { posture = STATE.activePosture; }
   if (typeof posture !== "string") {
     throw new RetentionError("retention/bad-posture",
-      "complianceFloor: posture must be a string, got " + JSON.stringify(posture));
+      "complianceFloor: posture must be a string (pass one, or set the active " +
+      "posture via applyPosture / b.compliance.set), got " + JSON.stringify(posture));
   }
   var floor = COMPLIANCE_RETENTION_FLOOR_MS[posture];
   if (floor === undefined) {
@@ -660,7 +667,14 @@ function complianceFloor(posture, candidateTtlMs) {
  *   // → "hipaa"
  */
 function applyPosture(posture) {
-  if (typeof posture !== "string" || posture.length === 0) return null;
+  if (typeof posture !== "string" || posture.length === 0) {
+    // Clear the active posture (the inverse of a set) so b.compliance.clear
+    // and operators can reset the inherited floor; complianceFloor then falls
+    // back to requiring an explicit posture again.
+    STATE.activePosture = null;
+    STATE.activeFloorMs = null;
+    return null;
+  }
   var floor = COMPLIANCE_RETENTION_FLOOR_MS[posture];
   STATE.activePosture = posture;
   STATE.activeFloorMs = (typeof floor === "number") ? floor : null;

package/lib/vendor/blamejs/lib/scheduler.js

@@ -488,6 +488,10 @@ function create(opts) {
       lastError: null,
       running:   false,
       runningSince: 0,
+      // Monotonic run tag. The watchdog and each fire bump it, so a run the
+      // watchdog abandoned can't clobber state / emit a stale settle event
+      // when its slow promise finally resolves.
+      runGeneration: 0,
       fires:     0,
       misses:    0,    // skipped because previous run still in-flight
       nonLeaderSkips: 0,
@@ -540,6 +544,8 @@ function create(opts) {
             (maxJobMs / C.TIME.seconds(1)) + "s — forcing reset");
         } catch (_e) { /* logger best-effort */ }
         _emit("system.scheduler.task.watchdog", { name: task.name }, "failure");
+        // Supersede the abandoned run so its late settle is ignored.
+        task.runGeneration++;
         task.running = false;
       } else {
         task.misses++;
@@ -665,6 +671,10 @@ function create(opts) {
     task.runningSince = Date.now();
     task.lastRun = new Date().toISOString();
     var startedAt = Date.now();
+    // Tag this run. The settle handlers below only write back if the tag still
+    // matches — so a run the watchdog reset (or a newer fire) can't clobber the
+    // current run's state or emit a stale success/failure when it settles late.
+    var gen = (task.runGeneration = (task.runGeneration || 0) + 1);
 
     var promise;
     try {
@@ -678,6 +688,7 @@ function create(opts) {
     }
 
     Promise.resolve(promise).then(function (_v) {
+      if (task.runGeneration !== gen) return;   // watchdog/newer fire superseded this run
       task.running = false;
       task.runningSince = 0;
       task.lastFinish = new Date().toISOString();
@@ -689,6 +700,7 @@ function create(opts) {
         viaJob:     !!task.job,
       });
     }, function (e) {
+      if (task.runGeneration !== gen) return;   // watchdog/newer fire superseded this run
       task.running = false;
       task.runningSince = 0;
       task.lastFinish = new Date().toISOString();

package/lib/vendor/blamejs/lib/self-update.js

@@ -676,7 +676,7 @@ async function swap(opts) {
   // don't silently lose both binaries (the prior best-effort comment
   // swallowed the rollback exception — SSDF RV.1 violation).
   try {
-    nodeFs.renameSync(from, to);
+    atomicFile.renameWithRetry(from, to);
   } catch (e) {
     if (e && e.code === "EXDEV") {
       // Cross-device — copy + unlink. Use atomicFile.copy for the safety

package/lib/vendor/blamejs/lib/session.js

@@ -65,6 +65,9 @@ var { SessionError } = require("./framework-error");
 // the cookie-side sid so the wire token is ciphertext rather than
 // plaintext (sealed-cookie default since v0.8.61).
 var vault = lazyRequire(function () { return require("./vault"); });
+// Lazy — b.session.logout composes the Clear-Site-Data header builder; keep it
+// out of the boot require graph (no cycle, but session is a low-level primitive).
+var clearSiteData = lazyRequire(function () { return require("./middleware/clear-site-data"); });
 
 // Pluggable session-storage backend. Default uses cluster-storage (which
 // in turn dispatches to the framework's main DB or external DB). An
@@ -705,6 +708,66 @@ async function destroy(token) {
   return await _deleteBySidHash(_hashSid(sid));
 }
 
+/**
+ * @primitive b.session.logout
+ * @signature b.session.logout(res, token, opts?)
+ * @since     0.15.9
+ * @status    stable
+ * @related   b.session.destroy, b.middleware.clearSiteData
+ *
+ * Secure logout in one call: destroy the server-side session AND tell the
+ * browser to wipe its client-side state. It emits an RFC 9527 Clear-Site-Data
+ * response header (cookies + storage + cache + executionContexts by default)
+ * and expires the session cookie, then destroys the session row. `destroy()`
+ * alone is a store operation with no `res`, so it cannot wipe the browser's
+ * cached pages / storage / any stale tab still holding the now-revoked cookie;
+ * this composes the secure-default logout the middleware otherwise had to be
+ * mounted by hand. Returns whether a session was destroyed. Leader-only.
+ *
+ * @opts
+ *   cookieName: string,    // default: "sid" — the session cookie to expire
+ *   types:      string[],  // default: the RFC 9527 Clear-Site-Data directive set
+ *
+ * @example
+ *   app.post("/logout", async function (req, res) {
+ *     await b.session.logout(res, req.cookies.sid);
+ *     res.end("logged out");
+ *   });
+ *   // → emits Clear-Site-Data + expires the sid cookie + destroys the session
+ */
+async function logout(res, token, opts) {
+  if (!res || typeof res.setHeader !== "function") {
+    throw new SessionError("session/bad-res",
+      "b.session.logout: res must be an HTTP response with setHeader()");
+  }
+  opts = opts || {};
+  var cookieName = opts.cookieName === undefined ? "sid" : opts.cookieName;
+  if (typeof cookieName !== "string" || cookieName.length === 0) {
+    throw new SessionError("session/bad-cookie-name",
+      "b.session.logout: opts.cookieName must be a non-empty string");
+  }
+  var csd = clearSiteData();
+  var types = opts.types === undefined ? csd.DEFAULT_TYPES : opts.types;
+  // Build (and validate) the RFC 9527 header BEFORE any side effect — an
+  // unknown directive throws here, queuing nothing.
+  var clearSiteDataValue = csd.headerValue(types, "b.session.logout");
+
+  // Revoke the server-side session FIRST. If destroy() throws (a follower
+  // failing cluster.requireLeader(), or a store/DB error), no client-wipe
+  // headers have been queued — an error response can't then expire the
+  // browser cookie + Clear-Site-Data while the session row is still live,
+  // which would leave a copied token usable server-side.
+  var destroyed = await destroy(token);
+
+  // Now wipe the client-side state: RFC 9527 Clear-Site-Data (cookies /
+  // storage / cache) + expire the session cookie (belt-and-suspenders with the
+  // "cookies" directive, and effective even if the client ignores the header).
+  res.setHeader("Clear-Site-Data", clearSiteDataValue);
+  res.setHeader("Set-Cookie",
+    cookieName + "=; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=0");
+  return destroyed;
+}
+
 async function _deleteBySidHash(sidHash) {
   var built = sql.delete(_sessionSqlTable(), _sessionSqlOpts())
     .where("sidHash", sidHash)
@@ -1245,6 +1308,7 @@ module.exports = {
   create:               create,
   verify:               verify,
   destroy:              destroy,
+  logout:               logout,
   destroyAllForUser:    destroyAllForUser,
   touch:                touch,
   rotate:               rotate,

package/lib/vendor/blamejs/lib/ssrf-guard.js

@@ -335,14 +335,32 @@ function canonicalizeHost(host) {
     return bare.toLowerCase();
   }
   if (family === 6) {
-    return _ipv6BytesToString(_ipv6ToBytes(bare));
-  }
-  // Not an IP literal — DNS name. Lowercase + strip a single trailing dot
-  // (the root-label dot is DNS-equivalent but breaks string comparison).
-  var name = bare.toLowerCase();
-  if (name.length > 1 && name.charAt(name.length - 1) === ".") {
-    name = name.slice(0, name.length - 1);
+    var v6bytes = _ipv6ToBytes(bare);
+    // An IPv4-mapped IPv6 address (::ffff:a.b.c.d, the ::ffff:0:0/96 block) IS
+    // the IPv4 address a.b.c.d for routing / access control — classify() already
+    // re-classifies it by the embedded v4, and a dual-stack peer arriving on
+    // ::ffff:1.2.3.4 reaches the same host as 1.2.3.4. Fold it to the dotted
+    // IPv4 form so a dual-stack peer and an operator's IPv4 allowlist entry
+    // canonicalize equal. ONLY the IPv4-mapped block (::ffff:0:0/96) folds,
+    // because classify(::ffff:x) === classify(x) — its classify branch returns
+    // the embedded-v4 verdict with no reserved fallback, so folding can't change
+    // an SSRF verdict. NAT64 (64:ff9b::/96) and 6to4 (2002::/16) are NOT folded:
+    // classify treats a NAT64 literal as `classify(v4) || "reserved"`, so a
+    // public NAT64 address classifies as "reserved" while its embedded v4 is
+    // null — folding would flip a blocked verdict to an allowed public IPv4.
+    // classify still reaches the embedded v4 for the deny side; the canonical
+    // form keeps NAT64 / 6to4 as IPv6 so canonicalize-then-classify agrees with
+    // classify alone.
+    if (_ipv6PrefixMatch(IPV6_V4_MAPPED_PREFIX, C.BYTES.bytes(96), v6bytes)) {
+      return v6bytes[12] + "." + v6bytes[13] + "." + v6bytes[14] + "." + v6bytes[15];
+    }
+    return _ipv6BytesToString(v6bytes);
   }
+  // Not an IP literal — DNS name. Lowercase + strip ALL trailing dots: a
+  // hostname's trailing-dot count is not significant for identity (the root
+  // label is empty), so host / host. / host.. must collapse to one form or a
+  // trailing-dot count bypasses a host allow/deny comparison.
+  var name = bare.toLowerCase().replace(/\.+$/, "");
   return name;
 }
 

package/lib/vendor/blamejs/lib/vault/passphrase-ops.js

@@ -169,7 +169,7 @@ async function seal(opts) {
   }
 
   // Step 3: atomic rename sealed.tmp → sealed
-  nodeFs.renameSync(p.sealedTmp, p.sealed);
+  atomicFile.renameWithRetry(p.sealedTmp, p.sealed);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 4: delete plaintext (unless keepPlaintext)
@@ -220,7 +220,7 @@ async function unseal(opts) {
   }
 
   // Step 3: atomic rename plaintext.tmp → plaintext
-  nodeFs.renameSync(p.plaintextTmp, p.plaintext);
+  atomicFile.renameWithRetry(p.plaintextTmp, p.plaintext);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 4: delete sealed file
@@ -293,7 +293,7 @@ async function rotate(opts) {
   }
 
   // Step 3: atomic rename — swap in the new sealed file
-  nodeFs.renameSync(p.sealedTmp, p.sealed);
+  atomicFile.renameWithRetry(p.sealedTmp, p.sealed);
   atomicFile.fsyncDir(opts.dataDir);
 
   return { sealedPath: p.sealed };

package/lib/vendor/blamejs/lib/watcher.js

@@ -316,6 +316,14 @@ function create(opts) {
   _validateOpts(opts);
 
   var root        = nodePath.resolve(opts.root);
+  // Canonicalize to the real long path. On Windows a path with an 8.3
+  // short-name component (os.tmpdir() commonly resolves to C:\Users\RUNNER~1\…)
+  // makes the native recursive backend (ReadDirectoryChangesW) deliver
+  // long-name event paths that no longer prefix-match the watched root, which
+  // trips a libuv fs-event assertion and aborts the process on some Node builds.
+  // realpathSync.native expands short names and resolves symlinks; guarded so a
+  // non-existent root still falls through to the watcher's own not-found error.
+  try { root = nodeFs.realpathSync.native(root); } catch (_e) { /* keep resolved path */ }
   var debounceMs  = (opts.debounceMs !== undefined) ? opts.debounceMs : DEFAULT_DEBOUNCE_MS;
   var maxPending  = (opts.maxPending !== undefined) ? opts.maxPending : DEFAULT_MAX_PENDING;
   var requestedMode = opts.mode || "fs";

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.6",
+  "version": "0.15.9",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -54,7 +54,7 @@
     "owns-its-stack"
   ],
   "engines": {
-    "node": ">=24.14.1"
+    "node": ">=24.16.0"
   },
   "files": [
     "index.js",

package/lib/vendor/blamejs/release-notes/v0.15.7.json

@@ -0,0 +1,43 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.7",
+  "date": "2026-06-13",
+  "headline": "Hardens the new URL canonicalizer against an IPv4-mapped allowlist bypass, enforces the OIDC azp authorized-party check, and closes a set of audited correctness gaps in retention, credential rehashing, the scheduler, and SD-JWT key binding",
+  "summary": "This release deepens the URL/host canonicalizer shipped in 0.15.6 and clears a batch of audited correctness gaps. The canonicalizer now folds an IPv4-mapped IPv6 address (::ffff:1.2.3.4) to its embedded IPv4 and strips every trailing dot from a host, so a dual-stack peer can no longer slip past an operator's dotted-IPv4 allowlist and host./host.. no longer evade a host comparison. (NAT64 and 6to4 hosts are deliberately kept as IPv6 so canonicalizing then classifying agrees with the SSRF classifier, which treats them as reserved.) On the OIDC side, verifyIdToken now enforces OIDC Core 3.1.3.7: a multi-audience ID token must carry an azp (authorized party) and a present azp must equal the client_id, closing a confused-deputy hole where a token minted for a different client but listing this RP in its audience array verified clean. The rest are audited fixes: retention.complianceFloor now honors the active posture set via applyPosture (the documented inheritance was unimplemented); credentialHash.needsRehash now drives the advertised SHAKE256 length-rotation (raising the output length now triggers a rehash, upgrade-only); the task scheduler no longer lets a run abandoned by its watchdog clobber the next run's state or emit a stale success when its slow promise settles late; and the SD-JWT key-binding JWT compares its audience and nonce in constant time.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "The URL canonicalizer folds IPv4-mapped IPv6 addresses to IPv4",
+          "body": "`b.safeUrl.canonicalize` / `b.ssrfGuard.canonicalizeHost` now fold an IPv4-mapped IPv6 address (`::ffff:1.2.3.4`, the `::ffff:0:0/96` block) to its embedded IPv4 dotted form. Previously it canonicalized to an IPv6 string, so a dual-stack peer never unified with an operator's `1.2.3.4` allow/deny entry — an allowlist bypass. Only the IPv4-mapped block folds, because the SSRF classifier maps it to the embedded v4 verdict directly; NAT64 (`64:ff9b::/96`) and 6to4 (`2002::/16`) are deliberately kept as IPv6, since the classifier treats a NAT64 literal as reserved and folding it would turn a blocked verdict into an allowed public IPv4. The host canonicalizer also now strips every trailing dot, so `host`, `host.`, and `host..` collapse to one form."
+        },
+        {
+          "title": "verifyIdToken enforces the OIDC azp (authorized party) check",
+          "body": "`b.auth.oauth`'s `verifyIdToken` validated only that its `client_id` was present in the token's `aud`, ignoring `azp`. Per OIDC Core 3.1.3.7, a multi-audience ID token must carry an `azp` and a present `azp` must equal the RP's `client_id`. Without it, a token whose authorized party is a different client — but whose `aud` array also lists this RP — verified clean (a confused-deputy / token-substitution hole). The verifier now rejects a multi-audience token with no `azp` (`auth-oauth/azp-required`) and any token whose `azp` is not the `client_id` (`auth-oauth/azp-mismatch`). A single-audience token with no `azp` (the common case) is unaffected."
+        },
+        {
+          "title": "SD-JWT key-binding audience and nonce compare in constant time",
+          "body": "`b.auth.sdJwtVc.verify` compared the key-binding JWT's `aud` and `nonce` with a short-circuiting `!==`, while the adjacent `sd_hash` check already used a constant-time compare. The `nonce` is a verifier-issued replay-defense value, so a non-constant-time compare leaks a matching-prefix timing oracle; both checks now use the constant-time helper."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "retention.complianceFloor honors the active compliance posture",
+          "body": "`b.retention.complianceFloor` required an explicit posture and never read the active posture set by `applyPosture` (the `b.compliance.set` cascade), so the documented inheritance was unimplemented dead state. It now inherits the active posture when none is passed — `complianceFloor(candidateTtlMs)` uses the active posture, an explicit posture still overrides it — and `applyPosture(null)` now clears the active posture (it was a silent no-op, so `b.compliance.clear` could not reset it)."
+        },
+        {
+          "title": "credentialHash.needsRehash drives the SHAKE256 length-rotation",
+          "body": "`b.credentialHash.needsRehash` never compared the stored SHAKE256 digest length against the configured length, so raising the output length never triggered a rehash and the advertised length-rotation was a silent no-op. It now flags a digest shorter than the configured/default length for rehash (upgrade-only — a longer-than-target digest is never shortened, matching the Argon2 convention)."
+        },
+        {
+          "title": "The scheduler no longer lets a watchdog-abandoned run corrupt the next run",
+          "body": "`b.scheduler`'s watchdog force-clears a task's running flag after `maxJobMs` so a hung handler can't lock out future fires, and the next tick re-fires. The original slow promise then settled late and unconditionally overwrote the task's running / lastFinish / lastError state and emitted a `system.scheduler.task.success`|`failure` for a run the watchdog had already given up on — clobbering the new run and double-counting. Each run is now tagged with a generation that the watchdog and every fire bump; a settle whose tag is stale is ignored."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.15.8.json

@@ -0,0 +1,48 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.8",
+  "date": "2026-06-13",
+  "headline": "Redacts OTLP log-sink attributes to close a secret/PII egress the span fix missed, adds EU DSA and China PIPL cross-border compliance record-builders, ships an SSDF producer self-attestation with every release, and makes the published tarball reproducible",
+  "summary": "This release closes a telemetry egress hole, adds two compliance record-builder namespaces, and hardens the release supply chain. The OTLP log sinks (HTTP-JSON and gRPC) shipped a log record's meta attributes and the resource attributes to the collector unredacted — a log line carrying a bearer token, password, or API key reached the wire verbatim (CWE-532). The 0.15.4 fix wired the telemetry redactor into the span and metric exporters but the log sinks were missed; both now run record and resource attributes through the same redactor before serialization. New b.dsa builds the EU Digital Services Act (Reg 2022/2065) records an intermediary or platform must keep — Art. 16 notice-and-action, Art. 17 statement of reasons, and the Art. 15 / 24(3) transparency report. New b.pipl builds the China PIPL cross-border transfer records — an Art. 38/40 assessment that determines whether a CAC security assessment is mandatory (CIIO, important data, or the volume / sensitive-PI thresholds), and an Art. 40 security-assessment certificate. On the supply-chain side, every release now ships ssdf-attestation.json, a machine-readable NIST SP 800-218 / OMB M-22-18 producer self-attestation mapping each secure-development practice to its implementing control, and the published tarball is now packed with SOURCE_DATE_EPOCH so an operator can rebuild it byte-for-byte from the release commit.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.dsa — EU Digital Services Act compliance record-builders",
+          "body": "`b.dsa` builds the dated, frozen records the EU Digital Services Act (Regulation (EU) 2022/2065) requires an online intermediary or platform to keep: `b.dsa.noticeAndAction` (Art. 16) records a notice against a piece of content and computes the action-due window; `b.dsa.statementOfReasons` (Art. 17) records a moderation decision with its legal or contractual ground (exactly one is required), the facts, whether it was automated, and the redress routes offered; `b.dsa.transparencyReport` (Art. 15 / 24(3)) aggregates the period counts into a report with the next-due date. The builders perform no network I/O and emit a best-effort audit event; they map to the `dsa` compliance posture."
+        },
+        {
+          "title": "b.pipl — China PIPL cross-border transfer record-builders",
+          "body": "`b.pipl.sccFilingAssessment` builds a PIPL Art. 38/40/55 cross-border transfer assessment and determines the lawful mechanism: it forces a CAC security assessment (over a self-selected standard contract or certification) when the exporter is a critical-information-infrastructure operator, exports important data, handles personal information of more than 1,000,000 individuals, or crosses the cumulative volume / sensitive-PI thresholds. `b.pipl.securityAssessmentCertificate` records an Art. 40 security-assessment self-declaration with a 3-year validity clock. Both return frozen dated records and map to the `pipl-cn` posture."
+        },
+        {
+          "title": "SSDF producer self-attestation shipped with every release",
+          "body": "Every release now attaches `ssdf-attestation.json` — a machine-readable NIST SP 800-218 (SSDF v1.1) / OMB M-22-18 producer self-attestation. It maps each secure-software-development practice to its implementing control in the tree (SLSA L3 provenance, SSH-signed tags, vendored zero-runtime-dep supply chain, OSV-Scanner gating, coordinated disclosure) and is deterministic from the release commit. Its sha256 is a subject of the SLSA L3 provenance, so verifying the provenance verifies the attestation has not been tampered with. Downstream consumers who require SSDF supplier-compliance evidence can download it from the release page."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "OTLP log sinks redact record and resource attributes before export",
+          "body": "`b.logStream`'s OTLP log sinks (HTTP-JSON and gRPC) shipped a log record's `meta` attributes and the sink's resource attributes to the collector UNREDACTED, so a log line whose meta carried a bearer token, password, or API key — or a credential placed in a resource attribute — reached the OTLP wire verbatim (CWE-532). The 0.15.4 change baked the telemetry redactor into the span and metric exporters but its detector was anchored on the span/metric encoder function names, leaving the log sinks uncovered. Both log sinks now run record and resource attributes through `b.observability.redactAttrs` before serialization, the same egress contract the span and metric exporters already hold."
+        },
+        {
+          "title": "Reproducible published tarball (SOURCE_DATE_EPOCH)",
+          "body": "The release workflow now exports `SOURCE_DATE_EPOCH` (derived from the tagged commit's author date) before `npm pack`, so the mtime stamped into every tar header is deterministic. An operator can re-pack the package from the same commit and match the published tarball's sha256 byte-for-byte, strengthening the source-to-artifact verification path alongside the existing SLSA L3 provenance and PQC signatures."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "otlp-log-sink-encodes-attrs-without-redactor",
+          "body": "Fires when an OTLP log-sink encoder hands a raw `record.meta` or resource-attribute map to serialization without routing it through `observability.redactAttrs` — the class the span/metric detector could not see because the log sinks carry the OTLP-logs schema function names."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.15.9.json

@@ -0,0 +1,58 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.9",
+  "date": "2026-06-13",
+  "headline": "Raises the Node floor to 24.16, adds SQLite parse-time resource caps, retries Windows rename locks on every atomic write and download, and ships a one-call secure logout that wipes client-side state",
+  "summary": "This release moves the engines floor to the current Node 24 LTS patch level and adds three hardening primitives. node:sqlite handles now construct with SQLITE_LIMIT_* caps: a statement over 1 MiB is rejected at parse time (a DoS floor on the raw-SQL surface, complementary to the existing row-count gate) and ATTACH DATABASE is denied. Every final temp-to-destination rename — the file written by an atomic write, a downloaded file, a sealed vault key, a rotated log, an extracted archive entry — now routes through a single retry that rides out a transient Windows lock (antivirus, the search indexer, or a file-sync client briefly holding the destination), instead of surfacing the lock as a hard failure; the retry, previously hand-rolled and unreachable, is now the reusable b.atomicFile.renameWithRetry. And b.session.logout destroys a session and tells the browser to wipe its client-side state in one call: it emits an RFC 9527 Clear-Site-Data header and expires the session cookie before destroying the row, the secure-default logout that previously had to be assembled by hand.",
+  "sections": [
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Node engines floor raised to >=24.16.0",
+          "body": "The minimum supported Node is now 24.16.0 (the current Node 24 LTS patch level), up from 24.14.1. This is an LTS-currency bump — there are no Node CVE fixes between 24.14.1 and 24.16.0 (24.14.1 already carried the CVE-2026-21713 HMAC fix); it keeps the framework on the latest patched LTS and makes the node:sqlite resource-cap hardening below available everywhere. Pre-1.0, operators upgrade across the floor; Node 26 continues to satisfy it."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "SQLite parse-time statement-size cap",
+          "body": "Every node:sqlite database the framework opens — the main db handle and the CLI's handle — now constructs with a SQLITE_LIMIT_LENGTH cap: a SQL statement over 1 MiB is rejected at parse time. Because the query builder parameterizes every value, the size cap guards the raw-SQL surface (`b.db.runSql`) against an attacker-influenced megaquery the parser would otherwise process (SQLite's default is 1 GB); it is a parse-time DoS floor complementary to the existing row-count gate. Legitimate framework and operator statements are far under the cap."
+        },
+        {
+          "title": "Windows rename-lock retry on every atomic rename and download",
+          "body": "On Windows a freshly-written file's destination is briefly held by antivirus, the search indexer, or a file-sync client (Dropbox, OneDrive), surfacing as a transient EPERM / EACCES / EBUSY on rename even though the temp file is fine. `b.atomicFile.writeSync` already retried this, but `b.httpClient.downloadStream` did not — a download into a cloud-synced or AV-scanned directory could fail hard on the lock. The retry is now the reusable `b.atomicFile.renameWithRetry`, and every final temp-to-destination rename in the framework routes through it: downloads, sealed vault keys, CA key/cert writes, log rotation, archive extraction, config-drift sidecars, the self-update binary swap, and restore/rollback moves. A non-transient error still throws immediately; POSIX renames are unaffected."
+        }
+      ]
+    },
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.session.logout — one-call secure logout",
+          "body": "`b.session.logout(res, token, opts?)` destroys the server-side session AND tells the browser to wipe its client-side state in one call: it emits an RFC 9527 Clear-Site-Data response header (cookies + storage + cache + execution contexts by default) and expires the session cookie, then destroys the session row. `b.session.destroy` alone is a store operation with no response object, so it could not wipe the browser's cached pages, storage, or a stale tab still holding the now-revoked cookie — that wiring previously had to be mounted by hand. Pass `cookieName` to match a non-default cookie and `types` to choose the Clear-Site-Data directives."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "b.watcher canonicalizes its root on Windows",
+          "body": "`b.watcher.create` now resolves its `root` to the real long path before watching. On Windows a root with an 8.3 short-name component (the system temp directory commonly resolves to one) made the native recursive backend deliver long-name event paths that no longer prefix-matched the watched root, which could abort the process under a strict libuv fs-event assertion. The watcher now canonicalizes the root (expanding short names and resolving symlinks), so events match the watched directory on Windows."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Rename-retry, SQLite-limits, and Clear-Site-Data guards",
+          "body": "Three recurrence detectors ship with the fixes: a bare `nodeFs.renameSync` final rename that doesn't route through `atomicFile.renameWithRetry`; a main `DatabaseSync` handle constructed without the SQLITE_LIMIT_LENGTH `limits`; and a hand-rolled Clear-Site-Data header value that skips the shared RFC 9527 builder."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/scripts/gen-migrating.js

@@ -277,6 +277,22 @@ var OUT_OF_BAND_BREAKS = [
       "- If you pinned, cached, or asserted on the raw signature bytes of this library's ES256 / ES384 output, update the fixture — the bytes are now `ieee-p1363`. EdDSA / ML-DSA signatures are unchanged.",
     ].join("\n"),
   },
+  {
+    release:  "v0.15.7",
+    surface:  "b.auth.oauth verifyIdToken — azp (authorized party) is now enforced",
+    summary:  "verifyIdToken now applies OIDC Core 3.1.3.7: a multi-audience ID token (aud is an array with more than one entry) MUST carry an azp claim, and a present azp MUST equal the configured client_id. A token whose azp is a different client, or a multi-audience token with no azp, now throws (auth-oauth/azp-mismatch / auth-oauth/azp-required). Previously only `aud contains client_id` was checked, so a token authorized for a different party but also listing this RP verified clean.",
+    migration: [
+      "No change for the common single-audience ID token with no azp. If your IdP issues multi-audience ID tokens, ensure it sets azp to your client_id (it should, per the spec) — otherwise verifyIdToken will now reject them. This is a security fix; a token that fails the new check was authorized for a different client.",
+    ].join("\n"),
+  },
+  {
+    release:  "v0.15.7",
+    surface:  "b.safeUrl.canonicalize — IPv4-mapped hosts fold to IPv4",
+    summary:  "b.safeUrl.canonicalize / b.ssrfGuard.canonicalizeHost now fold an IPv4-mapped IPv6 host (::ffff:1.2.3.4) to its embedded IPv4 dotted form, and strip every trailing dot from a host. In 0.15.6 it canonicalized to an IPv6 string and only one trailing dot was stripped. NAT64 / 6to4 hosts stay IPv6.",
+    migration: [
+      "No code change is needed — this makes a dual-stack / NAT64 peer unify with a dotted-IPv4 allow/deny entry as intended. If you persisted canonical host strings produced by 0.15.6 (e.g. as cache or dedup keys) and compare them against freshly-canonicalized hosts, recompute them: an IPv4-mapped host now yields the dotted IPv4 instead of the bracketed IPv6, and a multi-trailing-dot host yields the bare name.",
+    ].join("\n"),
+  },
   {
     release:  "v0.15.6",
     surface:  "b.auth.oauth verifyIdToken — skipExpCheck is restricted to logout tokens",