@blamejs/blamejs-shop 0.4.73 → 0.4.75

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.15.14",
-  "createdAt": "2026-06-21T06:07:03.428Z",
+  "frameworkVersion": "0.15.15",
+  "createdAt": "2026-06-22T00:16:09.227Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -49211,6 +49211,10 @@
           "type": "function",
           "arity": 1
         },
+        "ipPrefix": {
+          "type": "function",
+          "arity": 1
+        },
         "makeResourceAuditEmitter": {
           "type": "function",
           "arity": 3
@@ -50654,6 +50658,10 @@
             }
           }
         },
+        "isJsonObject": {
+          "type": "function",
+          "arity": 1
+        },
         "parse": {
           "type": "function",
           "arity": 2
@@ -54051,6 +54059,19 @@
         }
       }
     },
+    "x509Chain": {
+      "type": "object",
+      "members": {
+        "isCaCert": {
+          "type": "function",
+          "arity": 1
+        },
+        "issuerValidlyIssued": {
+          "type": "function",
+          "arity": 2
+        }
+      }
+    },
     "xmlC14n": {
       "type": "object",
       "members": {

package/lib/vendor/blamejs/examples/wiki/lib/build-app.js

@@ -24,6 +24,10 @@ var pagesRoute = require("../routes/pages");
 var symbolIndex = require("./symbol-index");
 var pagesSeeder = require("../seeders/prod/pages/_index");
 
+// Typed boot error — extends FrameworkError and carries a stable .code so a
+// caller can dispatch on the failure instead of string-matching the message.
+var BuildAppError = b.frameworkError.defineClass("BuildAppError");
+
 // Strict CSP — drops 'unsafe-inline' from style-src + script-src. All
 // assets are external; cspNonce middleware adds 'nonce-XYZ' when the
 // app actually needs an inline element.
@@ -57,7 +61,7 @@ var SCHEMA = [
 
 async function buildApp(opts) {
   opts = opts || {};
-  if (!opts.dataDir) throw new Error("buildApp: opts.dataDir is required");
+  if (!opts.dataDir) throw new BuildAppError("wiki/missing-data-dir", "buildApp: opts.dataDir is required");
 
   var dataDir = opts.dataDir;
   var port = opts.port !== undefined ? opts.port : b.constants.BYTES.bytes(3008);

package/lib/vendor/blamejs/examples/wiki/lib/harvest-vendored-deps.js

@@ -23,6 +23,11 @@
 
 var fs   = require("node:fs");
 var path = require("node:path");
+var b    = require("@blamejs/core");
+
+// Typed error — extends FrameworkError with a stable .code, so a build/CI
+// caller can dispatch on the failure rather than string-match the message.
+var HarvestError = b.frameworkError.defineClass("HarvestError");
 
 var REPO_ROOT     = path.resolve(__dirname, "..", "..", "..");
 var MANIFEST_PATH = path.join(REPO_ROOT, "lib", "vendor", "MANIFEST.json");
@@ -160,7 +165,7 @@ function harvest() {
   var raw = fs.readFileSync(MANIFEST_PATH, "utf8");
   var doc = JSON.parse(raw); // allow:bare-json-parse — reads framework's own vendor MANIFEST.json (not operator input)
   if (!doc || typeof doc !== "object" || !doc.packages || typeof doc.packages !== "object") {
-    throw new Error("harvest-vendored-deps: MANIFEST.json missing 'packages' object");
+    throw new HarvestError("wiki/harvest-bad-manifest", "harvest-vendored-deps: MANIFEST.json missing 'packages' object");
   }
   var libFiles = _walkLibJs();
   var deps     = [];

package/lib/vendor/blamejs/examples/wiki/test/codebase-patterns.test.js

@@ -469,12 +469,16 @@ function testNoHandrolledDeepClone() {
 
 function testNoBareErrorThrows() {
   // class: bare-error-throw
-  // Wiki routes that throw plain Error skip the framework's structured
-  // error contract. Rare in operator code but worth catching.
+  // Wiki code that throws a plain Error skips the framework's structured
+  // error contract (a typed FrameworkError carries a stable .code a caller
+  // can dispatch on). This is a hard gate: use b.frameworkError.defineClass
+  // (see lib/build-app.js BuildAppError / lib/harvest-vendored-deps.js
+  // HarvestError), or add an `// allow:bare-error-throw` marker with a reason
+  // for a genuinely throwaway script throw.
   var matches = _scan(/\bthrow\s+new\s+Error\s*\(/);
   matches = _filterMarkers(matches, "bare-error-throw");
-  _reportAdvisory("throw new Error(string) → consider a typed error " +
-    "(b.framework-error.defineClass) when callers dispatch on .code",
+  _report("throw new Error(string) → use a typed error " +
+    "(b.frameworkError.defineClass) so callers can dispatch on .code",
     matches);
 }
 

package/lib/vendor/blamejs/index.js

@@ -400,6 +400,7 @@ var authBotChallenge = require("./lib/auth-bot-challenge");
 var sessionDeviceBinding = require("./lib/session-device-binding");
 var acme = require("./lib/acme");
 var cert = require("./lib/cert");
+var x509Chain = require("./lib/x509-chain");
 var watcher = require("./lib/watcher");
 var localDbThin = require("./lib/local-db-thin");
 var daemon = require("./lib/daemon");
@@ -750,6 +751,7 @@ module.exports = {
   sessionDeviceBinding: sessionDeviceBinding,
   acme:             acme,
   cert:             cert,
+  x509Chain:        x509Chain,
   ntpCheck:         ntpCheck,
   tlsExporter:      tlsExporter,
   watcher:          watcher,

package/lib/vendor/blamejs/lib/auth/ciba.js

@@ -162,6 +162,10 @@ function create(opts) {
     tokenEndpoint:                     opts.tokenEndpoint,
     httpClientOpts:                    opts.httpClientOpts,
     allowHttp:                         opts.allowHttp === true,
+    // Thread the SSRF opt-in through to the inner client's discovery / JWKS /
+    // token fetches — an operator with an internal-network IdP needs it, and
+    // dropping it silently made allowInternal an accepted-but-ignored option.
+    allowInternal:                     opts.allowInternal,
     isOidc:                            true,
   });
 
@@ -456,10 +460,11 @@ function create(opts) {
   // returning its verified claims, or null when no id_token was supplied. A
   // present-but-invalid id_token throws (fail-closed) so a forged token's
   // sub/acr/amr can never be returned as trusted.
-  async function _verifyIdTokenIfPresent(idToken, auditKey, op) {
+  async function _verifyIdTokenIfPresent(idToken, auditKey, op, expectedAuthReqId) {
     if (!idToken) return null;
+    var verified;
     try {
-      return await inner.verifyIdToken(idToken);
+      verified = await inner.verifyIdToken(idToken);
     } catch (e) {
       _emitAudit("id_token_verify_fail", "failure",
         auditKey ? { authReqIdHash: sha3Hash(auditKey) } : {});
@@ -467,6 +472,27 @@ function create(opts) {
         "ciba." + op + ": id_token failed verification: " +
         ((e && e.code) || (e && e.message) || String(e)));
     }
+    // OpenID CIBA Core §7.3 / §10.1: the ID Token MUST carry the
+    // urn:openid:params:jwt:claim:auth_req_id claim and the RP MUST verify it
+    // equals the auth_req_id this flow used. Without it, an id_token minted for
+    // a DIFFERENT auth_req_id (another user's CIBA flow at the same RP) could be
+    // substituted — cross-user token substitution. verifyIdToken returns
+    // { header, claims }, so the claim lives on `.claims`. Constant-time compare.
+    // idToken is present (we returned early if not), so the binding is
+    // MANDATORY and ALWAYS checked — never gated behind a truthiness test that
+    // an empty string could slip. Both call sites pass a non-empty auth_req_id
+    // (validated at the parseNotification / pollToken entry), so a falsy value
+    // can't reach here to skip the comparison.
+    var payload = verified && verified.claims;
+    var boundId = payload && payload["urn:openid:params:jwt:claim:auth_req_id"];
+    if (typeof boundId !== "string" || !timingSafeEqual(boundId, expectedAuthReqId)) {
+      _emitAudit("id_token_authreqid_mismatch", "failure",
+        auditKey ? { authReqIdHash: sha3Hash(auditKey) } : {});
+      throw new AuthError("auth-ciba/id-token-authreqid-mismatch",
+        "ciba." + op + ": id_token urn:openid:params:jwt:claim:auth_req_id does not " +
+        "match the expected auth_req_id (cross-user token-substitution defense)");
+    }
+    return verified;
   }
 
   async function pollToken(popts) {
@@ -536,7 +562,7 @@ function create(opts) {
     // accepted-algorithms and enforces signature + iss/aud/exp. Returning an
     // unverified id_token let a forged token's sub/acr/amr be trusted.
     var pollClaims = await _verifyIdTokenIfPresent(rv.id_token,
-      "auth-ciba:" + popts.authReqId, "pollToken");
+      "auth-ciba:" + popts.authReqId, "pollToken", popts.authReqId);
     _emitAudit("token_received", "success", {
       authReqIdHash: sha3Hash("auth-ciba:" + popts.authReqId),
     });
@@ -631,10 +657,8 @@ function create(opts) {
       throw new AuthError("auth-ciba/no-notification-body",
         "ciba.parseNotification: body required (Buffer/string parsed by middleware)");
     }
-    if (typeof body.auth_req_id !== "string") {
-      throw new AuthError("auth-ciba/no-auth-req-id-in-body",
-        "ciba.parseNotification: body missing auth_req_id");
-    }
+    validateOpts.requireNonEmptyString(body.auth_req_id,
+      "ciba.parseNotification: auth_req_id", AuthError, "auth-ciba/no-auth-req-id-in-body");
     // Verify the pushed ID token (CIBA §10.2 / OIDC Core MUST) via the
     // composed inner OAuth client before returning it as trusted. The
     // notification-token bearer authenticates the CALLER, not the token; a
@@ -642,7 +666,7 @@ function create(opts) {
     // arbitrary id_token claims the RP would trust on the documented
     // "no follow-up call" push path.
     var pushClaims = await _verifyIdTokenIfPresent(body.id_token,
-      "auth-ciba:" + body.auth_req_id, "parseNotification");
+      "auth-ciba:" + body.auth_req_id, "parseNotification", body.auth_req_id);
     _emitAudit("notification_received", "success", {
       authReqIdHash: sha3Hash("auth-ciba:" + body.auth_req_id),
       mode:          deliveryMode,

package/lib/vendor/blamejs/lib/auth/dpop.js

@@ -317,6 +317,15 @@ async function verify(proof, opts) {
   catch (_e) { throw new AuthError("auth-dpop/malformed", "header is not valid base64url-JSON"); }
   try { payload = safeJson.parse(_b64urlDecode(parts[1]).toString("utf8")); }
   catch (_e) { throw new AuthError("auth-dpop/malformed", "payload is not valid base64url-JSON"); }
+  // safeJson.parse accepts the literal `null` / scalars, so a header segment of
+  // base64url("null") would otherwise reach `header.typ` and throw a raw
+  // TypeError rather than the typed malformed error. Require JSON objects.
+  if (!safeJson.isJsonObject(header)) {
+    throw new AuthError("auth-dpop/malformed", "header is not a JSON object");
+  }
+  if (!safeJson.isJsonObject(payload)) {
+    throw new AuthError("auth-dpop/malformed", "payload is not a JSON object");
+  }
 
   // Header checks
   if (header.typ !== "dpop+jwt") {

package/lib/vendor/blamejs/lib/auth/fido-mds3.js

@@ -550,24 +550,37 @@ function lookupAaguid(blob, aaguid) {
   return null;
 }
 
-// Pull the certified-level token out of a list of status reports. The
-// most recent FIDO_CERTIFIED_L{N}[_PLUS] report wins; if none exist,
-// the authenticator is uncertified (level 0).
+// Resolve the CURRENT certified level from the status-report history. FIDO MDS3
+// status reports are chronological; the level is whatever the MOST RECENT
+// certification-status report says — a FIDO_CERTIFIED_L{N}[_PLUS], or 0 when the
+// latest such report is NOT_FIDO_CERTIFIED (a decertification). Taking the
+// highest-ever level instead let a step-up / risk policy that requires L{N}
+// accept an authenticator that was later decertified or downgraded (the
+// certifiedLevel is the policy input, so a stale max is an authenticator-
+// assurance bypass). Ordering is by effectiveDate (ISO YYYY-MM-DD, so lexical ==
+// chronological); ties and missing dates fall back to array order (append
+// order, which the spec defines as chronological).
 function _certifiedLevel(statusReports) {
   if (!Array.isArray(statusReports)) return { level: 0, plus: false };
-  var best = { level: 0, plus: false };
+  var latest = null;
+  var latestDate = null;
   for (var i = 0; i < statusReports.length; i++) {
     var sr = statusReports[i];
-    if (!sr || typeof sr.status !== "string") continue;
-    var m = CERT_LEVEL_RE.exec(sr.status);
-    if (!m) continue;
-    var level = parseInt(m[1], 10);
-    var plus = !!m[2];
-    if (level > best.level || (level === best.level && plus && !best.plus)) {
-      best = { level: level, plus: plus };
+    // Only certification-status reports move the level: a level grant, or its
+    // explicit revocation (NOT_FIDO_CERTIFIED). Other statuses (UPDATE_AVAILABLE,
+    // REVOKED, …) are handled elsewhere and must not be read as a level. The
+    // status length is bounded before the regex test below — FIDO status tokens
+    // are short enums; bounding input before any .test() is the convention.
+    if (!sr || typeof sr.status !== "string" || sr.status.length > 64) continue;
+    if (!CERT_LEVEL_RE.test(sr.status) && sr.status !== "NOT_FIDO_CERTIFIED") continue;
+    var d = typeof sr.effectiveDate === "string" ? sr.effectiveDate : "";
+    if (latest === null || d >= latestDate) {
+      latest = sr; latestDate = d;
     }
   }
-  return best;
+  if (!latest || latest.status === "NOT_FIDO_CERTIFIED") return { level: 0, plus: false };
+  var m = CERT_LEVEL_RE.exec(latest.status);
+  return { level: parseInt(m[1], 10), plus: !!m[2] };
 }
 
 /**

package/lib/vendor/blamejs/lib/auth/jwt.js

@@ -193,6 +193,16 @@ function decode(token) {
   catch (_e) { throw new AuthError("auth-jwt/malformed", "header is not valid base64url-JSON"); }
   try { payload = safeJson.parse(_b64urlDecode(parts[1])); }
   catch (_e) { throw new AuthError("auth-jwt/malformed", "payload is not valid base64url-JSON"); }
+  // The JOSE header and the claims set MUST each be a JSON object. safeJson.parse
+  // accepts the literal `null` (a valid JSON document) and scalars/arrays, so a
+  // header segment of base64url("null") would otherwise survive to a `.crit` /
+  // `.kid` dereference and throw a raw TypeError instead of a typed AuthError.
+  if (!safeJson.isJsonObject(header)) {
+    throw new AuthError("auth-jwt/malformed", "header is not a JSON object");
+  }
+  if (!safeJson.isJsonObject(payload)) {
+    throw new AuthError("auth-jwt/malformed", "payload is not a JSON object");
+  }
   var signature;
   try { signature = _b64urlDecode(parts[2]); }
   catch (_e) { throw new AuthError("auth-jwt/malformed", "signature is not valid base64url"); }
@@ -351,10 +361,16 @@ async function verify(token, opts) {
       "token not yet valid: nbf=" + p.nbf + " (now=" + nowSec + ", tolerance=" + tol + "s)");
   }
 
-  // String-claim assertions
-  if (opts.issuer !== undefined && !_matchClaim(p.iss, opts.issuer, "iss")) {
+  // String-claim assertions. `iss` is StringOrURI (RFC 7519 §4.1.1) — a single
+  // value, not a list: reject a non-string iss before matching. Routing it
+  // through the aud-style any-of _matchClaim let an attacker-influenced
+  // multi-issuer array (iss:["evil","trusted"]) satisfy a single-issuer
+  // expectation (CVE-2025-30144 / fast-jwt iss-array class) — the same defense
+  // jwtExternal.verifyExternal and oauth.verifyIdToken already apply.
+  if (opts.issuer !== undefined &&
+      (typeof p.iss !== "string" || !_matchClaim(p.iss, opts.issuer, "iss"))) {
     throw new AuthError("auth-jwt/iss-mismatch",
-      "iss='" + p.iss + "' does not match expected " + JSON.stringify(opts.issuer));
+      "iss=" + JSON.stringify(p.iss) + " does not match expected " + JSON.stringify(opts.issuer));
   }
   if (opts.audience !== undefined && !_matchClaim(p.aud, opts.audience, "aud")) {
     throw new AuthError("auth-jwt/aud-mismatch",

package/lib/vendor/blamejs/lib/auth/oauth.js

@@ -1276,9 +1276,15 @@ function create(opts) {
     // browser session could be replayed without detection. Throw
     // loudly so the operator sees the bug at config time, not at
     // first-replay-attempt time.
-    if (isOidc && eopts.nonce === undefined && eopts.skipNonceCheck !== true) {
+    // Require a NON-EMPTY STRING nonce, not merely a defined one: a falsy
+    // nonce (null / "" — e.g. a session field that was never set) would slip a
+    // strict `=== undefined` guard, and the downstream verifier only checks the
+    // nonce when vopts.nonce is truthy, so the ID-token nonce check would be
+    // silently skipped and a token captured from another session replayed.
+    if (isOidc && eopts.skipNonceCheck !== true &&
+        (typeof eopts.nonce !== "string" || eopts.nonce.length === 0)) {
       throw new OAuthError("auth-oauth/no-nonce",
-        "exchangeCode: nonce is required on OIDC flows. Pass the " +
+        "exchangeCode: a non-empty nonce is required on OIDC flows. Pass the " +
         "value returned from authorizationUrl() through to exchangeCode " +
         "({ code, state, verifier, nonce }). Operators with a deliberate " +
         "no-nonce flow must pass `skipNonceCheck: true` (audited reason).");

package/lib/vendor/blamejs/lib/auth/saml.js

@@ -695,7 +695,7 @@ function create(opts) {
         if (nbHok && isFinite(Date.parse(nbHok) / 1000) &&                                          // ms→s
             Date.parse(nbHok) / 1000 > nowSec + clockSkewSec) continue;                             // ms→s
         var recipHok = _attr(scdHok, "Recipient");
-        if (recipHok && recipHok !== opts.assertionConsumerServiceUrl) continue;
+        if (!recipHok || recipHok !== opts.assertionConsumerServiceUrl) continue;   // §3.1→§4.1.4.2 — Recipient is mandatory; absent fails the endpoint binding
         hokOk = true;
         break;
       }
@@ -711,8 +711,11 @@ function create(opts) {
         var nb = Date.parse(notBefore) / 1000;                                                  // ms→s
         if (isFinite(nb) && nb > nowSec + clockSkewSec) continue;
       }
+      // §4.1.4.2 — a Bearer SubjectConfirmationData delivered to an ACS MUST
+      // carry a Recipient equal to this SP's ACS URL. Absent Recipient fails
+      // the endpoint binding (treated as a mismatch), not silently skipped.
       var recipient = _attr(scd, "Recipient");
-      if (recipient && recipient !== opts.assertionConsumerServiceUrl) {
+      if (!recipient || recipient !== opts.assertionConsumerServiceUrl) {
         continue;
       }
       var inResponseTo = _attr(scd, "InResponseTo");
@@ -774,17 +777,24 @@ function create(opts) {
     // SP). Fail closed when an audience is configured; opt out only via
     // vopts.requireAudienceRestriction === false.
     if (audience && vopts.requireAudienceRestriction !== false) {
-      var ar = conditions && _findChild(conditions, "AudienceRestriction", SAML_NS.assertion);
-      if (!ar) {
+      var ars = conditions
+        ? _findAllChildren(conditions, "AudienceRestriction", SAML_NS.assertion) : [];
+      if (ars.length === 0) {
         throw new AuthError("auth-saml/no-audience-restriction",
           "verifyResponse: assertion has no AudienceRestriction binding it to \"" +
           audience + "\" (audience-confusion defense; set requireAudienceRestriction:false to opt out)");
       }
-      var audiences = _findAllChildren(ar, "Audience", SAML_NS.assertion).map(_textContent);
-      if (audiences.indexOf(audience) === -1) {
-        throw new AuthError("auth-saml/wrong-audience",
-          "Audience \"" + audience + "\" not in assertion's AudienceRestriction (got " +
-          JSON.stringify(audiences) + ")");
+      // SAML core §2.5.1.4: multiple <AudienceRestriction> elements are
+      // AND-combined — the SP must be a member of the Audience set of EVERY
+      // one. Checking only the first let an IdP that narrowed the assertion to
+      // a DIFFERENT audience in a later restriction be accepted here.
+      for (var ari = 0; ari < ars.length; ari += 1) {
+        var audiences = _findAllChildren(ars[ari], "Audience", SAML_NS.assertion).map(_textContent);
+        if (audiences.indexOf(audience) === -1) {
+          throw new AuthError("auth-saml/wrong-audience",
+            "Audience \"" + audience + "\" not in AudienceRestriction #" + (ari + 1) +
+            " of " + ars.length + " (got " + JSON.stringify(audiences) + ")");
+        }
       }
     }
 

package/lib/vendor/blamejs/lib/crypto-field.js

@@ -1747,9 +1747,27 @@ function assertColumnResidency(table, row, args) {
   var entry = columnResidency[table];
   if (!entry || !row || !args) return null;
   var backendTag = args.backendTag || "unrestricted";
+  // SQL unquoted identifiers are case-insensitive; a raw-SQL-parsed row keeps
+  // the column token's case, so resolve each mapped column case-insensitively
+  // (a case-sensitive `row[col]` let a differently-cased column skip the gate —
+  // CWE-178). Lazily index the row's keys by lowercase; exact match wins first.
+  var rowLcIndex = null;
+  function _rowVal(c) {
+    if (Object.prototype.hasOwnProperty.call(row, c)) return row[c];
+    if (rowLcIndex === null) {
+      rowLcIndex = {};
+      var ks = Object.keys(row);
+      for (var i = 0; i < ks.length; i++) {
+        var lk = ks[i].toLowerCase();
+        if (!Object.prototype.hasOwnProperty.call(rowLcIndex, lk)) rowLcIndex[lk] = row[ks[i]];
+      }
+    }
+    return rowLcIndex[String(c).toLowerCase()];
+  }
   for (var col in entry) {
     var want = entry[col];
-    if (row[col] === undefined || row[col] === null) continue;
+    var cellVal = _rowVal(col);
+    if (cellVal === undefined || cellVal === null) continue;
     if (want === "global" || want === "unrestricted") continue;
     if (backendTag === "unrestricted") continue;
     if (backendTag !== want) {

package/lib/vendor/blamejs/lib/csp.js

@@ -210,6 +210,15 @@ function build(directives, opts) {
         throw new CspError("csp/header-injection",
           "csp.build: source '" + src + "' contains CR/LF/NUL");
       }
+      // A CSP source-expression is a single non-whitespace token. The emitter
+      // space-joins sources within a directive and ';'-joins directives, so a
+      // source containing ';' or ASCII whitespace would inject a brand-new live
+      // directive (e.g. "https://x; script-src https://evil") — refuse both.
+      if (/[\s;]/.test(src)) {
+        throw new CspError("csp/bad-source",
+          "csp.build: source '" + src + "' contains whitespace or ';' — a CSP source " +
+          "must be a single token (directive-injection defense)");
+      }
       if (!acknowledgeUnsafe && SCRIPT_DIRECTIVES.indexOf(name) !== -1 &&
           UNSAFE_KEYWORDS.indexOf(src) !== -1) {
         throw new CspError("csp/unsafe-keyword",

package/lib/vendor/blamejs/lib/db-query.js

@@ -89,6 +89,19 @@ function _postureState() {
 //
 // Unregulated postures audit (drop-silent) and pass; tables with no
 // declaration are untouched.
+// Resolve a column in a raw-SQL-parsed row case-insensitively (SQL unquoted
+// identifiers fold case; the parser preserves the token). Exact match wins
+// first so a structured-builder row (keys already canonical) is unaffected.
+function _ciColumn(row, col) {
+  if (Object.prototype.hasOwnProperty.call(row, col)) return { present: true, value: row[col] };
+  var lc = String(col).toLowerCase();
+  var keys = Object.keys(row);
+  for (var i = 0; i < keys.length; i++) {
+    if (keys[i].toLowerCase() === lc) return { present: true, value: row[keys[i]] };
+  }
+  return { present: false, value: undefined };
+}
+
 function _assertLocalResidency(table, plaintextRow, op) {
   var spec = cryptoField.getPerRowResidency(table);
   var colMap = cryptoField.getColumnResidency(table);
@@ -106,9 +119,16 @@ function _assertLocalResidency(table, plaintextRow, op) {
   var regulated = state.regulated;
 
   if (spec) {
-    var tag = plaintextRow[spec.residencyColumn];
+    // SQL unquoted identifiers are case-insensitive, and the raw-SQL parser
+    // preserves the column token's case — so resolve the residency column
+    // case-insensitively. A case-sensitive lookup let `UPDATE t SET REGION=...`
+    // miss a `residencyColumn: "region"` declaration, skipping the gate and
+    // admitting a cross-border write (CWE-178 / CWE-863). Fail-safe: any
+    // spelling that could be the residency column engages the gate.
+    var resolved = _ciColumn(plaintextRow, spec.residencyColumn);
+    var tag = resolved.value;
     var tagPresent = tag !== undefined && tag !== null;
-    var colInChangeSet = Object.prototype.hasOwnProperty.call(plaintextRow, spec.residencyColumn);
+    var colInChangeSet = resolved.present;
     if (op === "insert" && !tagPresent) {
       throw new DbQueryError("db-query/row-residency-tag-missing",
         op + ": table '" + table + "' declares per-row residency on column '" +
@@ -368,6 +388,17 @@ class Query {
     return this.where(field, "IN", values);
   }
 
+  // whereNull / whereNotNull — explicit NULL predicates (IS NULL / IS NOT
+  // NULL). `where({ field: null })` / `where(field, "=", null)` is refused
+  // because `col = NULL` is UNKNOWN in SQL (never true); these are the
+  // intended way to test a column for NULL.
+  whereNull(field) {
+    return this.where(field, "IS", null);
+  }
+  whereNotNull(field) {
+    return this.where(field, "IS NOT", null);
+  }
+
   // Resolve a (field, op, value) predicate through the framework gates
   // (JSONB value guard, sealed-field → derived-hash rewrite, column
   // membership) and return the post-rewrite { field, op, value } that

package/lib/vendor/blamejs/lib/mail-auth.js

@@ -2173,15 +2173,38 @@ function _extractFromHeaders(headerBlock) {
     // one of several authors (the §6.6.1 forbidden move), so the
     // field is treated as unparsable instead.
     address = value.trim();
-    if (/[\s,]/.test(address)) address = null;
+    // An RFC 5322 addr-spec cannot contain whitespace, commas, or the
+    // group / route markers ; : < > — their presence means a list, a
+    // display-name, or RFC 5322 group syntax (`display-name: mailbox ;`),
+    // not a single bare addr-spec.
+    if (/[\s,;:<>]/.test(address)) address = null;
   }
   var at = address ? address.lastIndexOf("@") : -1;
   var domain = (at > 0 && address && at < address.length - 1)
     ? address.slice(at + 1).toLowerCase()
     : null;
+  // The domain drives the DMARC policy lookup + alignment check. A value that
+  // is not a syntactically valid DNS hostname (a trailing ';', group-syntax
+  // soup, or other bytes that slipped the filters) would silently miss the
+  // policy record and defeat DMARC (CWE-290). Require a real hostname;
+  // otherwise treat From as unparsable — the caller fails closed (permerror →
+  // reject).
+  if (domain && !_isValidFromHostname(domain)) domain = null;
   return { count: count, address: address || null, domain: domain };
 }
 
+// Strict, bounded DNS-hostname check (ASCII / A-label form, as DMARC lookups
+// use). Anchored with a length lookahead and tempered labels — linear time, no
+// catastrophic backtracking. Requires at least two labels (a dot).
+var _FROM_HOSTNAME_RE =
+  /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
+function _isValidFromHostname(host) {
+  // Bound the length before the regex test (max DNS name is 253 octets) — the
+  // pattern is already anchored + tempered, but bounding untrusted input before
+  // any .test() is the framework convention.
+  return typeof host === "string" && host.length <= 253 && _FROM_HOSTNAME_RE.test(host);
+}
+
 async function inboundVerify(opts) {
   validateOpts.requireObject(opts, "inbound.verify", MailAuthError, "mail-auth/inbound-bad-input");
   validateOpts(opts, ["ip", "helo", "mailFrom", "message", "dnsLookup", "domainExists",

package/lib/vendor/blamejs/lib/mail-dkim.js

@@ -167,13 +167,24 @@ function _parseHeaders(rawHeaders) {
 
 // ---- Hashing + signing ----
 
-function _bodyHashB64(body, algorithm, canonBody) {
+function _bodyHashB64(body, algorithm, canonBody, lcap) {
   var canonicalized = canonBody === "simple"
     ? _canonBodySimple(body)
     : _canonBodyRelaxed(body);
   var hashName = "sha256";  // both rsa-sha256 and ed25519-sha256 hash with sha256
-  return nodeCrypto.createHash(hashName)
-    .update(canonicalized).digest("base64");
+  var hash = nodeCrypto.createHash(hashName);
+  // RFC 6376 §3.4.5 — the l= body-length count is octets of the body AFTER
+  // canonicalization. Canonicalize first, then truncate the canonicalized
+  // octet stream to lcap (slicing the raw body before canonicalizing diverges
+  // whenever relaxed canon changes the byte count within the first lcap
+  // octets — WSP-run collapse, trailing-WSP strip, CRLF normalization).
+  if (typeof lcap === "number" && isFinite(lcap) && lcap >= 0) {
+    var buf = Buffer.from(canonicalized, "utf8");
+    hash.update(lcap < buf.length ? buf.subarray(0, lcap) : buf);
+  } else {
+    hash.update(canonicalized);
+  }
+  return hash.digest("base64");
 }
 
 function _signString(strToSign, privateKey, algorithm) {
@@ -674,15 +685,17 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
 
   var split = _splitHeadersBody(rfc822);
   var body = split.body;
+  var lcap;
   if (sigTags.l !== undefined) {
     // The framework refuses l= at SIGN-time per the M3AAWG / Gmail /
     // Microsoft 365 guidance (v0.7.18). On VERIFY, an `l=` tag on an
     // inbound signature signals append-after-signature exposure —
     // operators decide acceptance. Honor the cap for the body hash so
     // the signature still validates against legitimate senders that
-    // use l=, but flag in the result.
-    var lcap = parseInt(sigTags.l, 10);
-    if (isFinite(lcap) && lcap >= 0) body = body.slice(0, lcap);
+    // use l=, but flag in the result. The cap is octets of the
+    // CANONICALIZED body (RFC 6376 §3.4.5), applied inside _bodyHashB64.
+    var parsedL = parseInt(sigTags.l, 10);
+    if (isFinite(parsedL) && parsedL >= 0) lcap = parsedL;
   }
 
   // 1. Body-hash check.
@@ -690,7 +703,7 @@ function _verifySingleSignature(rfc822, parsedHeaders, sigHeader, keyTags, sigTa
   if (typeof expectedBh !== "string") {
     return { result: "permerror", errors: ["DKIM-Signature missing bh="] };
   }
-  var actualBh = _bodyHashB64(body, algorithm, canonBody);
+  var actualBh = _bodyHashB64(body, algorithm, canonBody, lcap);
   if (actualBh !== expectedBh) {
     return { result: "fail", errors: ["body hash mismatch"] };
   }