@blamejs/blamejs-shop 0.4.55 → 0.4.57

package/lib/vendor/blamejs/lib/audit-emit.js

@@ -0,0 +1,82 @@
+"use strict";
+
+// audit-emit — the stateless drop-silent audit emitter with a metadata-first,
+// success-default signature `(action, metadata, outcome?)`. Many primitives —
+// the mail servers and DAV bridge, the A2A task store, the compliance posture
+// tracker, the MCP tool registry, the idempotency-key middleware — emit audit
+// events where the per-event detail (metadata) is almost always supplied and
+// the outcome is almost always "this happened", so they pass metadata second
+// and let outcome default to "success". They route through the drop-silent
+// audit.safeEmit so a misbehaving sink never crashes the request. Unlike
+// b.audit.namespaced (gated, action-prefixed, outcome-first), this is ungated
+// and passes the action verbatim — matching what each of them hand-rolled.
+//
+// This module self-lazy-requires audit so a consumer can `require("./audit-emit")`
+// at the top of the file without re-introducing the audit load cycle that the
+// per-file `lazyRequire(() => require("./audit"))` was guarding against.
+
+var lazyRequire = require("./lazy-require");
+var audit = lazyRequire(function () { return require("./audit"); });
+
+// emit(action, metadata, outcome?) — drop-silent audit emit. `outcome` defaults
+// to "success"; `metadata` defaults to `{}`.
+function emit(action, metadata, outcome) {
+  try {
+    audit().safeEmit({
+      action:   action,
+      outcome:  outcome || "success",
+      metadata: metadata || {},
+    });
+  } catch (_e) { /* drop-silent — audit best-effort */ }
+}
+
+// emitToSink(opts, action, outcome, metadata) — drop-silent audit emit to an
+// OPERATOR-SUPPLIED sink threaded through `opts.audit`, the no-op-when-absent
+// variant the archive reader / tar-reader / writer share verbatim: forward the
+// event only when `opts.audit` exposes a `safeEmit`, otherwise stay silent.
+// Distinct from emit() (which targets the framework's GLOBAL audit()) — here the
+// caller carries the sink in opts, so a reader/writer with no audit configured
+// emits nothing. (Callers whose payload carries extra top-level fields — e.g.
+// http-client's `resource` — keep their own wrapper; this is the bare
+// action/outcome/metadata shape.)
+function emitToSink(opts, action, outcome, metadata) {
+  if (!opts || !opts.audit || typeof opts.audit.safeEmit !== "function") return;
+  try {
+    opts.audit.safeEmit({ action: action, outcome: outcome, metadata: metadata });
+  } catch (_e) { /* drop-silent — operator audit sink must never crash the caller */ }
+}
+
+// gatedReasonEmitter({ audit, sink?, extra? }) — build a gated drop-silent
+// emitter `(action, info, outcome)` that records a structured top-level `reason`
+// (hoisted from `info.reason`) alongside the audit metadata. The gated +
+// reason-hoisting sibling of emit() / b.audit.namespaced, for the primitives
+// (backup / restore / scheduler / config-drift / legal-hold) that emit a reason
+// the audit chain surfaces as a first-class field. `audit` is the gate flag
+// (false disables); `sink` is an optional operator-supplied audit target (the
+// no-op-without-safeEmit guard the hand-rolled `auditInstance || audit()`
+// pattern carried); `extra(info)` optionally returns more top-level event
+// fields (e.g. legal-hold's `resource`). Routes through b.audit.namespaced, so
+// the same redaction + drop-silent guarantees apply.
+function gatedReasonEmitter(opts) {
+  opts = opts || {};
+  var ns = audit().namespaced(null, { audit: opts.audit, sink: opts.sink });
+  var extra = typeof opts.extra === "function" ? opts.extra : null;
+  return function (action, info, outcome) {
+    var fields = { reason: (info && info.reason) || null };
+    if (extra) {
+      var more = extra(info);
+      if (more) {
+        for (var k in more) {
+          if (Object.prototype.hasOwnProperty.call(more, k)) fields[k] = more[k];
+        }
+      }
+    }
+    ns(action, outcome, info, fields);
+  };
+}
+
+module.exports = {
+  emit:               emit,
+  emitToSink:         emitToSink,
+  gatedReasonEmitter: gatedReasonEmitter,
+};

package/lib/vendor/blamejs/lib/audit-sign.js

@@ -190,6 +190,33 @@ function _computeFingerprint(publicKeyPem) {
   return sha3Hash(publicKeyPem);
 }
 
+// ---- Store-independent chain anchor (the checkpoint protocol lifted off the
+// framework audit_log / audit_checkpoints store so a consumer can anchor THEIR
+// OWN hash chain) ----
+
+// Domain-separation magic for a consumer anchor's signed bytes. DISTINCT from
+// the framework audit-checkpoint format on purpose: a checkpoint signature can
+// never be replayed as an anchor (or vice versa), and the framework
+// audit_checkpoints wire format stays byte-stable (b.audit.checkpoint is
+// untouched). Changing this invalidates every prior anchor.
+var ANCHOR_FORMAT = "blamejs-chain-anchor-v1";
+
+// Build the canonical signed bytes for one anchor. Fixed multi-line layout (no
+// JSON serializer quirks). prevTipHash IS part of the signed payload, so the
+// link between consecutive anchors is tamper-evident — an attacker cannot
+// rewrite the linkage without breaking the signature. `format` lets a consumer
+// domain-separate their own anchors from any other anchored chain.
+function anchorPayload(counter, tipHash, prevTipHash, createdAt, format) {
+  return Buffer.from(
+    (format || ANCHOR_FORMAT) + "\n" +
+    String(counter) + "\n" +
+    tipHash + "\n" +
+    (prevTipHash || "") + "\n" +
+    String(createdAt),
+    "utf8"
+  );
+}
+
 // ---- Passphrase sourcing (delegates to lib/passphrase-source.js with
 // audit-signing-specific env var names) ----
 
@@ -798,6 +825,233 @@ async function rotateSigningKey(rotOpts) {
   };
 }
 
+// Defensive coercion of an operator-supplied tip into the canonical fields.
+// Config-time tier: throws a typed AuditSignError on a malformed tip so the
+// consumer catches the bug at the call site, not as an opaque "signature
+// failed" later. prevTipHash is OPTIONAL (absent for the genesis anchor).
+function _normalizeTip(tip, fnLabel) {
+  if (!tip || typeof tip !== "object") {
+    throw _err("ANCHOR_BAD_TIP",
+      "auditSign." + fnLabel + ": tip must be an object { counter, tipHash }");
+  }
+  var counter = tip.counter;
+  if (typeof counter !== "number" || !isFinite(counter) || counter < 0 || Math.floor(counter) !== counter) {
+    throw _err("ANCHOR_BAD_COUNTER",
+      "auditSign." + fnLabel + ": tip.counter must be a non-negative integer (got: " + counter + ")");
+  }
+  if (typeof tip.tipHash !== "string" || tip.tipHash.length === 0) {
+    throw _err("ANCHOR_BAD_TIPHASH",
+      "auditSign." + fnLabel + ": tip.tipHash must be a non-empty string");
+  }
+  if (tip.prevTipHash != null && typeof tip.prevTipHash !== "string") {
+    throw _err("ANCHOR_BAD_PREV",
+      "auditSign." + fnLabel + ": tip.prevTipHash, when present, must be a string");
+  }
+  return {
+    counter:     counter,
+    tipHash:     tip.tipHash,
+    prevTipHash: tip.prevTipHash != null ? tip.prevTipHash : null,
+  };
+}
+
+/**
+ * @primitive  b.auditSign.anchor
+ * @signature  b.auditSign.anchor(tip, opts?)
+ * @since      0.15.13
+ * @status     stable
+ * @compliance hipaa, pci-dss, gdpr, soc2, sox-404
+ * @related    b.auditSign.verifyAnchor, b.auditSign.verifyAnchorChain, b.audit.checkpoint
+ *
+ * Sign a hash-chain tip with the in-memory PQC key, returning a
+ * self-describing anchor object the consumer persists in THEIR OWN store. This
+ * is the `b.audit.checkpoint()` protocol lifted off the framework `audit_log` /
+ * `audit_checkpoints` tables: a consumer running their own append-only chain
+ * anchors its tip the same tamper-evident way, with no framework table, no
+ * `clusterStorage`, and no leader requirement. A full-chain rewrite that
+ * recomputes every row hash still cannot forge the signature without the
+ * audit-signing private key, so a later `verifyAnchorChain` detects it.
+ *
+ * `tip.prevTipHash` (optional) is bound into the signed bytes, so truncation /
+ * reorder of a stored anchor sequence is caught by the signature, not just a
+ * plaintext compare. `opts.format` domain-separates a consumer's anchors
+ * (default `"blamejs-chain-anchor-v1"`).
+ *
+ * Verification resolves the public key from the recorded fingerprint via the
+ * key-history file under the `init({ dataDir })` directory, so it is bound to
+ * that key store (not fully store-free) — keep the history with the anchors.
+ *
+ * Throws `AuditSignError` (`ANCHOR_BAD_TIP` / `ANCHOR_BAD_COUNTER` /
+ * `ANCHOR_BAD_TIPHASH` / `ANCHOR_BAD_PREV`) on a malformed tip;
+ * `audit-sign/not-initialized` when `init()` has not been awaited.
+ *
+ * @opts
+ *   format:    string,   // default "blamejs-chain-anchor-v1" — domain-separation magic in the signed payload
+ *   createdAt: number,   // default Date.now() — the anchor timestamp (also signed)
+ *
+ * @example
+ *   await b.auditSign.init({ dataDir: "/var/lib/blamejs/data" });
+ *   var a = b.auditSign.anchor({ counter: 42, tipHash: "9f4e", prevTipHash: "1b7d" },
+ *                              { format: "my-app-ledger-v1" });
+ *   // → { format, counter, tipHash, prevTipHash, createdAt, algorithm,
+ *   //     publicKeyFingerprint, signature }
+ */
+function anchor(tip, opts) {
+  _requireInit();
+  opts = opts || {};
+  var t = _normalizeTip(tip, "anchor");
+  var format = (typeof opts.format === "string" && opts.format.length > 0) ? opts.format : ANCHOR_FORMAT;
+  var createdAt = (typeof opts.createdAt === "number" && isFinite(opts.createdAt)) ? opts.createdAt : Date.now();
+  var payload = anchorPayload(t.counter, t.tipHash, t.prevTipHash, createdAt, format);
+  var sigBuf = sign(payload);
+  return {
+    format:               format,
+    counter:              t.counter,
+    tipHash:              t.tipHash,
+    prevTipHash:          t.prevTipHash,
+    createdAt:            createdAt,
+    algorithm:            keys.algorithm,
+    publicKeyFingerprint: keys.fingerprint,
+    signature:            sigBuf.toString("hex"),
+  };
+}
+
+// Resolve + verify ONE anchor's signature. Returns { ok, reason? }. Never
+// throws on a forgery / unknown key (defensive-reader tier) — the caller
+// branches on ok.
+function _verifyOneAnchor(a) {
+  if (!a || typeof a !== "object") return { ok: false, reason: "anchor is not an object" };
+  if (typeof a.tipHash !== "string" || typeof a.signature !== "string" ||
+      typeof a.publicKeyFingerprint !== "string") {
+    return { ok: false, reason: "anchor missing tipHash / signature / publicKeyFingerprint" };
+  }
+  if (typeof a.counter !== "number" || !isFinite(a.counter)) {
+    return { ok: false, reason: "anchor counter is not a finite number" };
+  }
+  var pub = getPublicKeyByFingerprint(a.publicKeyFingerprint);
+  if (!pub) {
+    return { ok: false, reason: "no audit-signing key on record for this anchor's fingerprint" };
+  }
+  var format = (typeof a.format === "string" && a.format.length > 0) ? a.format : ANCHOR_FORMAT;
+  // prevTipHash is part of the signed payload — rebuild it the same way anchor()
+  // did (absent / null → "") so the bytes are byte-identical on a clean anchor.
+  var prevTipHash = (a.prevTipHash != null && typeof a.prevTipHash === "string") ? a.prevTipHash : "";
+  var payload = anchorPayload(Number(a.counter), a.tipHash, prevTipHash, Number(a.createdAt), format);
+  // Buffer.from(hex) silently truncates on non-hex / odd-length; reject when
+  // the parsed bytes don't round-trip to the original lowercased hex.
+  var sigBuf = Buffer.from(a.signature, "hex");
+  if (sigBuf.toString("hex") !== String(a.signature).toLowerCase()) {
+    return { ok: false, reason: "anchor signature is not valid hex" };
+  }
+  if (!verify(payload, sigBuf, pub)) {
+    return { ok: false, reason: "post-quantum signature failed" };
+  }
+  return { ok: true };
+}
+
+/**
+ * @primitive  b.auditSign.verifyAnchor
+ * @signature  b.auditSign.verifyAnchor(anchor)
+ * @since      0.15.13
+ * @status     stable
+ * @compliance hipaa, pci-dss, gdpr, soc2, sox-404
+ * @related    b.auditSign.anchor, b.auditSign.verifyAnchorChain
+ *
+ * Verify a single anchor produced by `b.auditSign.anchor`. Resolves the public
+ * key by the anchor's recorded fingerprint (live key or a rotated-out key from
+ * the unsealed history), rebuilds the canonical payload, and checks the
+ * post-quantum signature. Returns `{ ok: true }` when valid, or
+ * `{ ok: false, reason }` for a forgery, an unknown signing key, malformed hex,
+ * or a missing field. Never throws on adversarial content.
+ *
+ * @example
+ *   var a = b.auditSign.anchor({ counter: 1, tipHash: "ab12" });
+ *   b.auditSign.verifyAnchor(a);   // → { ok: true }
+ */
+function verifyAnchor(a) {
+  _requireInit();
+  return _verifyOneAnchor(a);
+}
+
+/**
+ * @primitive  b.auditSign.verifyAnchorChain
+ * @signature  b.auditSign.verifyAnchorChain(anchors, opts?)
+ * @since      0.15.13
+ * @status     stable
+ * @compliance hipaa, pci-dss, gdpr, soc2, sox-404
+ * @related    b.auditSign.anchor, b.auditSign.verifyAnchor, b.audit.verifyCheckpoints
+ *
+ * Walk an ordered array of anchors (oldest first) and verify each one's
+ * signature AND that the sequence is internally consistent: counters strictly
+ * increase, and each anchor's `prevTipHash` equals the previous anchor's
+ * `tipHash`. This catches the two attacks a single-anchor check cannot — a
+ * stored-anchor truncation / reorder (link break) and a full-chain rewrite
+ * (signature break). Returns `{ ok: true, anchorsVerified }`, or
+ * `{ ok: false, anchorsVerified, breakAt, reason }` at the first break.
+ *
+ * `requireLinkage` (default true) makes a non-genesis anchor that omits
+ * `prevTipHash` a break, so an attacker can't drop the link to bypass the
+ * check. Pass `requireLinkage: false` for unlinked anchors.
+ *
+ * @opts
+ *   requireLinkage: boolean,   // default true — every non-genesis anchor must carry a matching prevTipHash
+ *
+ * @example
+ *   var a1 = b.auditSign.anchor({ counter: 1, tipHash: "h1" });
+ *   var a2 = b.auditSign.anchor({ counter: 2, tipHash: "h2", prevTipHash: "h1" });
+ *   b.auditSign.verifyAnchorChain([a1, a2]);   // → { ok: true, anchorsVerified: 2 }
+ */
+function verifyAnchorChain(anchors, opts) {
+  _requireInit();
+  opts = opts || {};
+  var requireLinkage = opts.requireLinkage !== false;
+  if (!Array.isArray(anchors)) {
+    return { ok: false, anchorsVerified: 0, breakAt: 0, reason: "anchors must be an array" };
+  }
+  if (anchors.length === 0) return { ok: true, anchorsVerified: 0 };
+
+  var prev = null;
+  for (var i = 0; i < anchors.length; i += 1) {
+    var a = anchors[i];
+    var sigResult = _verifyOneAnchor(a);
+    if (!sigResult.ok) {
+      return { ok: false, anchorsVerified: i, breakAt: i, reason: sigResult.reason };
+    }
+    if (prev === null) {
+      // Genesis: a prevTipHash on the FIRST anchor means a predecessor was
+      // dropped — fail closed.
+      if (a.prevTipHash != null) {
+        return {
+          ok: false, anchorsVerified: i, breakAt: i,
+          reason: "non-genesis anchor missing predecessor (prevTipHash set on first anchor)",
+        };
+      }
+    } else {
+      if (!(Number(a.counter) > Number(prev.counter))) {
+        return {
+          ok: false, anchorsVerified: i, breakAt: i,
+          reason: "anchor counter not strictly increasing",
+        };
+      }
+      if (requireLinkage) {
+        if (a.prevTipHash == null) {
+          return {
+            ok: false, anchorsVerified: i, breakAt: i,
+            reason: "non-genesis anchor missing prevTipHash linkage",
+          };
+        }
+        if (a.prevTipHash !== prev.tipHash) {
+          return {
+            ok: false, anchorsVerified: i, breakAt: i,
+            reason: "anchor prevTipHash does not match the previous tipHash (truncation / reorder)",
+          };
+        }
+      }
+    }
+    prev = a;
+  }
+  return { ok: true, anchorsVerified: anchors.length };
+}
+
 function _resetForTest() {
   keys = null;
   initialized = false;
@@ -810,6 +1064,9 @@ module.exports = {
   init:                     init,
   sign:                     sign,
   verify:                   verify,
+  anchor:                   anchor,
+  verifyAnchor:             verifyAnchor,
+  verifyAnchorChain:        verifyAnchorChain,
   rotateSigningKey:         rotateSigningKey,
   reSignAll:                reSignAll,
   getPublicKey:             getPublicKey,

package/lib/vendor/blamejs/lib/audit.js

@@ -424,6 +424,13 @@ var FRAMEWORK_NAMESPACES = [
   "bootgates",        // b.bootGates (bootgates.passed / bootgates.failed / bootgates.onfail_threw — boot-invariant runner)
   "metrics",          // b.metrics.snapshot.shadowRegistry (metrics.shadow.cardinality_dropped — namespaced metrics export)
   "jose",             // b.jose.jwe.experimental (jose.jwe.experimental.encrypt / .decrypt — ML-KEM-JWE pre-IANA)
+  "ai",               // b.ai.adverseDecision (ai.adverse_decision.* — FCRA adverse-action decisioning)
+  "breach",           // b.breachDeadline (breach.report.* — breach-notification deadline clock)
+  "cra",              // b.craReport (cra.report.* — EU Cyber Resilience Act conformity)
+  "gdpr",             // b.gdprRopa (gdpr.ropa.* — GDPR Art. 30 Records of Processing Activities)
+  "incident",         // b.incidentReport (incident.report.* — incident lifecycle)
+  "middleware",       // b.middleware.ageGate / dailyByteQuota (middleware.age_gate.* / middleware.daily_byte_quota.*)
+  "nis2",             // b.nis2Report (nis2.report.* — NIS2 Directive incident reporting)
 ];
 var registeredNamespaces = new Set(FRAMEWORK_NAMESPACES);
 
@@ -944,6 +951,13 @@ async function checkpoint(opts) {
   cluster.requireLeader();
   opts = opts || {};
 
+  // Bind this checkpoint to the database it reads the tip from. checkpoint()
+  // spans async boundaries (tip read → sign → insert); a fire-and-forget call
+  // launched by db.close() can have its insert resume AFTER the database it
+  // read closed and a fresh one opened, anchoring the old tip into the wrong
+  // database. Capture the live db generation now and re-check before the write.
+  var dbGenAtEntry = db()._dbGeneration();
+
   var tipReadBuilt = sql.select("audit_log", _sqlOpts())
     .columns(["_id", "monotonicCounter", "rowHash"])
     .orderBy("monotonicCounter", "desc")
@@ -972,6 +986,12 @@ async function checkpoint(opts) {
   var signature = auditSign.sign(payload);
   var pubFp = auditSign.getPublicKeyFingerprint();
 
+  // Fail closed if the database changed under us between the tip read and here
+  // (e.g. a close()-launched checkpoint resuming after a fresh db opened). The
+  // tip we signed belongs to a database that is gone; anchoring it into the
+  // current one would forge a checkpoint. Write nothing.
+  if (db()._dbGeneration() !== dbGenAtEntry) return null;
+
   var ckptId = generateToken(TRACE_ID_BYTES);
   var fencingToken = cluster.fencingToken();
   await _insertCheckpoint(
@@ -1445,6 +1465,69 @@ function safeEmit(event) {
   } catch (_e) { /* audit best-effort — never break the caller */ }
 }
 
+/**
+ * @primitive b.audit.namespaced
+ * @signature b.audit.namespaced(prefix, opts?)
+ * @since     0.15.13
+ * @status    stable
+ * @compliance hipaa, pci-dss, gdpr, soc2
+ * @related   b.audit.safeEmit, b.audit.emit, b.observability.namespaced
+ *
+ * Build a drop-silent emitter bound to one action namespace — the shape every
+ * framework primitive hand-rolled as a private `_emitAudit(action, outcome,
+ * metadata)` closure (or inline) (`if (!on) return; try { safeEmit({ action:
+ * "ns." + action, outcome, metadata }); } catch {}`). The returned function
+ * prefixes `action` with `prefix + "."`, fills `metadata` with `{}` when
+ * omitted, and routes through `safeEmit` (so the same redaction + outcome
+ * normalization applies).
+ *
+ * Every caller drives the SAME 4-argument emitter `(action, outcome, metadata,
+ * extra?)`: `extra` is an object whose fields are merged onto the event, which
+ * carries the only per-emit variations seen across the framework — `actor`
+ * (constant `{ type: "system" }` for an unattended worker, or a per-request
+ * `ctx.actor`) and `resource`. So a hand-rolled emitter with extra event fields
+ * is never an exception — pass them through `extra`. `opts` is the gate flag for
+ * the common case OR `{ audit, sink }`, where `sink` emits to an
+ * operator-supplied audit object instead of the framework chain (the emitter is
+ * a no-op if that sink has no `safeEmit`, matching the hand-rolled sink guard).
+ *
+ * A falsy `prefix` (`null` / `""`) builds the no-namespace variant: `action`
+ * passes through verbatim (no `prefix + "."`). This serves the primitives whose
+ * audit actions are already fully-qualified at the call site (`emitAudit(
+ * "system.outbox.started", …)`) — the same gated drop-silent passthrough,
+ * without re-homing the qualifier.
+ *
+ * @opts
+ *   audit:  boolean,   // false disables the emitter (default on); passing a bare boolean === { audit }
+ *   sink:   object,    // alternate audit target with a .safeEmit(event) (defaults to b.audit)
+ *
+ * @example
+ *   var emitAudit = b.audit.namespaced("gdpr.ropa", opts.audit);
+ *   emitAudit("activity_added", "success", { activityId: id });
+ *   // → safeEmit({ action: "gdpr.ropa.activity_added", outcome: "success",
+ *   //             metadata: { activityId: id } })
+ *
+ *   var emitGate = b.audit.namespaced("guardSql.gate");
+ *   emitGate("refused", "denied", { route: r }, { actor: ctx.actor });  // per-call actor
+ */
+function namespaced(prefix, opts) {
+  // Back-compat: a bare boolean/undefined is the gate; an object carries the
+  // gate plus the sink axis.
+  var cfg = (opts && typeof opts === "object") ? opts : { audit: opts };
+  var on = cfg.audit !== false;
+  return function (action, outcome, metadata, extra) {
+    if (!on) return;
+    // module.exports.safeEmit (late-bound) so a test that stubs b.audit.safeEmit
+    // still observes the emit; cfg.sink routes to an operator-supplied audit
+    // object (no-op if it lacks safeEmit, matching the hand-rolled sink guard).
+    var sink = cfg.sink || module.exports;
+    if (!sink || typeof sink.safeEmit !== "function") return;
+    var evt = { action: prefix ? prefix + "." + action : action, outcome: outcome, metadata: metadata || {} };
+    if (extra) { for (var k in extra) { if (Object.prototype.hasOwnProperty.call(extra, k)) evt[k] = extra[k]; } }
+    try { sink.safeEmit(evt); } catch (_e) { /* drop-silent — audit is best-effort */ }
+  };
+}
+
 /**
  * @primitive b.audit.flush
  * @signature b.audit.flush()
@@ -1814,6 +1897,7 @@ module.exports = {
   useStore:             useStore,
   emit:                 emit,
   safeEmit:             safeEmit,
+  namespaced:           namespaced,
   applyPosture:         applyPosture,
   activePosture:        activePosture,
   bindActor:            bindActor,

package/lib/vendor/blamejs/lib/auth/access-lock.js

@@ -41,6 +41,7 @@
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var requestHelpers = require("../request-helpers");
 
 var audit = lazyRequire(function () { return require("../audit"); });
 var observability = lazyRequire(function () { return require("../observability"); });
@@ -77,7 +78,6 @@ function create(opts) {
   }
   var passthroughPaths = Array.isArray(opts.passthroughPaths)
     ? opts.passthroughPaths.slice() : [];
-  var auditOn = opts.audit !== false;
   var getRole = typeof opts.getRole === "function" ? opts.getRole : null;
   var errorMessage = typeof opts.errorMessage === "string" && opts.errorMessage.length > 0
     ? opts.errorMessage : "service in restricted access mode";
@@ -87,33 +87,11 @@ function create(opts) {
   var modeSetBy   = "boot";
   var modeReason  = "initial mode at boot";
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "auth.access_lock." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit is best-effort */ }
-  }
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("auth.access_lock." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("auth.access_lock", opts.audit);
+  var _emitMetric = observability().namespaced("auth.access_lock");
 
-  function _isPassthrough(req) {
-    if (passthroughPaths.length === 0) return false;
-    var p = req.url || "";
-    var qpos = p.indexOf("?");
-    if (qpos !== -1) p = p.slice(0, qpos);
-    for (var i = 0; i < passthroughPaths.length; i++) {
-      var entry = passthroughPaths[i];
-      if (typeof entry === "string" && (p === entry || p.indexOf(entry + "/") === 0)) return true;
-      if (entry instanceof RegExp && entry.test(p)) return true;
-    }
-    return false;
-  }
+  var _isPassthrough = requestHelpers.makeSkipMatcher(
+    { skipPaths: passthroughPaths }, "auth.accessLock");
 
   function _hasUnlockRole(req) {
     if (!getRole || unlockRoles.length === 0) return false;

package/lib/vendor/blamejs/lib/auth/dpop.js

@@ -29,9 +29,11 @@
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("../crypto");
 var jwk = require("../jwk");
+var jwtExternal = require("./jwt-external");
 var safeJson = require("../safe-json");
 var safeUrl = require("../safe-url");
 var validateOpts = require("../validate-opts");
+var nonceStore = require("../nonce-store");
 var C = require("../constants");
 var { AuthError } = require("../framework-error");
 
@@ -74,16 +76,12 @@ var REFUSED_ALGS = ["HS256", "HS384", "HS512", "none"];
 
 function _b64urlEncode(buf) { return bCrypto.toBase64Url(buf); }
 
-function _b64urlDecode(s) {
-  if (typeof s !== "string") {
-    throw new AuthError("auth-dpop/bad-base64", "expected base64url string");
-  }
-  try { return bCrypto.fromBase64Url(s); }
-  catch (_e) {
-    throw new AuthError("auth-dpop/bad-base64",
-      "DPoP segment is not valid base64url");
-  }
-}
+var _b64urlDecode = bCrypto.makeBase64UrlDecoder({
+  errorClass:  AuthError,
+  code:        "auth-dpop/bad-base64",
+  typeMessage: "expected base64url string",
+  badMessage:  "DPoP segment is not valid base64url",
+});
 
 // Asymmetric key types DPoP accepts (its proof model relies on a
 // signature, so symmetric "oct" keys are refused). AKP is the IANA key
@@ -128,16 +126,10 @@ function _normalizeHtu(htu) {
 // Pick alg-specific node:crypto verify params. PQC algs use
 // signWithoutAlgorithm shape (`null` algorithm).
 function _signParamsForAlg(alg) {
-  if (alg === "RS256") return { hash: "sha256", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
-  if (alg === "RS384") return { hash: "sha384", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
-  if (alg === "RS512") return { hash: "sha512", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
-  if (alg === "PS256") return { hash: "sha256", padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 32 };  // RFC 7518 PS256 salt length
-  if (alg === "PS384") return { hash: "sha384", padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 48 };  // RFC 7518 PS384 salt length
-  if (alg === "PS512") return { hash: "sha512", padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 64 };  // RFC 7518 PS512 salt length
-  if (alg === "ES256") return { hash: "sha256", dsaEncoding: "ieee-p1363" };
-  if (alg === "ES384") return { hash: "sha384", dsaEncoding: "ieee-p1363" };
-  if (alg === "ES512") return { hash: "sha512", dsaEncoding: "ieee-p1363" };
-  if (alg === "EdDSA") return { hash: null };
+  // Classical-JOSE params (RS/PS/ES/EdDSA) from the shared table; DPoP layers
+  // PQC ML-DSA-87 on top (the only verifier that accepts it).
+  var params = jwtExternal.algParams(alg);
+  if (params) return params;
   if (alg === "ML-DSA-87") return { hash: null, pqc: true };
   throw new AuthError("auth-dpop/unsupported-alg",
     "alg '" + alg + "' is not supported by DPoP");
@@ -195,11 +187,11 @@ function _detectAlgFromKey(key) {
 }
 
 function _jwkToKeyObject(jwk) {
-  try { return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }
-  catch (e) {
-    throw new AuthError("auth-dpop/bad-jwk",
-      "could not import jwk: " + ((e && e.message) || String(e)));
-  }
+  return bCrypto.importPublicJwk(jwk, {
+    errorClass:    AuthError,
+    code:          "auth-dpop/bad-jwk",
+    messagePrefix: "could not import jwk: ",
+  });
 }
 
 // ---- buildProof ----
@@ -460,16 +452,12 @@ async function verify(proof, opts) {
       "verify: replayStore", AuthError, "auth-dpop/bad-replay-store",
       "must expose checkAndInsert(jti, expireAtMs) — use b.nonceStore.create()");
     var expireAtMs = nowMs + iatWindowSec * C.TIME.seconds(1) * 2;
-    var inserted;
-    try { inserted = await opts.replayStore.checkAndInsert(payload.jti, expireAtMs); }
-    catch (e) {
-      throw new AuthError("auth-dpop/replay-store-failed",
-        "replayStore.checkAndInsert threw: " + ((e && e.message) || String(e)));
-    }
-    if (inserted === false) {
-      throw new AuthError("auth-dpop/replay",
-        "DPoP proof jti='" + payload.jti + "' has been seen before — replay refused");
-    }
+    await nonceStore.enforceReplay(opts.replayStore, payload.jti, expireAtMs, {
+      errorClass:      AuthError,
+      storeFailedCode: "auth-dpop/replay-store-failed",
+      replayCode:      "auth-dpop/replay",
+      tokenLabel:      "DPoP proof",
+    });
   }
 
   return { header: header, payload: payload, jkt: jkt };

package/lib/vendor/blamejs/lib/auth/fido-mds3.js

@@ -43,6 +43,7 @@ var safeJson     = require("../safe-json");
 var safeBuffer   = require("../safe-buffer");
 var lazyRequire  = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var jwtExternal  = require("./jwt-external");
 var _wa          = require("../vendor/simplewebauthn-server.cjs");
 var { FidoMds3Error } = require("../framework-error");
 
@@ -141,21 +142,14 @@ function _parseJws(token) {
 // in practice; PS* and EdDSA are listed for completeness so future
 // BLOBs over the same surface validate without a code edit.
 function _verifyParamsForAlg(alg) {
-  switch (alg) {
-    case "RS256": return { hash: "sha256", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
-    case "RS384": return { hash: "sha384", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
-    case "RS512": return { hash: "sha512", padding: nodeCrypto.constants.RSA_PKCS1_PADDING };
-    case "PS256": return { hash: "sha256", padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 32 };  // SHA-256 hash length
-    case "PS384": return { hash: "sha384", padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 48 };  // SHA-384 hash length
-    case "PS512": return { hash: "sha512", padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: 64 };  // SHA-512 hash length
-    case "ES256": return { hash: "sha256", dsaEncoding: "ieee-p1363" };
-    case "ES384": return { hash: "sha384", dsaEncoding: "ieee-p1363" };
-    case "ES512": return { hash: "sha512", dsaEncoding: "ieee-p1363" };
-    case "EdDSA": return { hash: null };
-    default:
-      throw new FidoMds3Error("fido-mds3/unsupported-alg",
-        "JWS alg '" + alg + "' is not supported");
-  }
+  // Classical-JOSE alg→crypto params (RS/PS/ES/EdDSA) shared with the rest of
+  // the JOSE verifiers — jwtExternal.algParams owns the single table.
+  var params = jwtExternal.algParams(alg);
+  if (!params) {
+    throw new FidoMds3Error("fido-mds3/unsupported-alg",
+      "JWS alg '" + alg + "' is not supported");
+  }
+  return params;
 }
 
 // Resolve the trust roots. Operator override via caCertificate lets