@blamejs/blamejs-shop 0.4.73 → 0.4.75

package/lib/vendor/blamejs/lib/middleware/compose-pipeline.js

@@ -287,6 +287,28 @@ function composePipeline(entries, opts) {
         catch (finalErr) { return reject(finalErr); }
         resolve();
       }
+      // A middleware (or error handler) that ENDS THE RESPONSE without calling
+      // next has halted the chain: it handled the request itself. Settle the
+      // outer promise so the awaiting router is released — a never-settled
+      // promise pins its req/res closure forever — but do NOT call finalNext:
+      // the router's next-flag stays false, so it won't run the route handler
+      // on top of an already-sent response.
+      function _resolveOnce() {
+        if (finished) return;
+        finished = true;
+        resolve();
+      }
+      // Settle when the response actually finishes. This is response-driven,
+      // not return-driven: a callback-style middleware that calls next() LATER
+      // (from a timer, stream, or legacy callback) returns before next() runs,
+      // so we must NOT treat a bare return as a halt — only an ended response.
+      // The synchronous _responseEnded() check below covers a middleware that
+      // ended the response inline (and a mock res without an event emitter);
+      // this listener covers one that ends it from a deferred callback.
+      if (res && typeof res.once === "function") {
+        res.once("finish", _resolveOnce);
+        res.once("close", _resolveOnce);
+      }
       async function dispatch(err) {
         if (finished) return;
         if (idx >= resolved.length) return _finishOnce(err);
@@ -313,14 +335,19 @@ function composePipeline(entries, opts) {
         }
         try {
           if (err) {
-            // Error handler: (err, req, res, next)
+            // Error handler: (err, req, res, next). Express convention — a
+            // 4-arg handler that returns without calling next has HANDLED the
+            // error, so the chain ends cleanly; settle (without finalNext).
             await entry.mw(err, req, res, _next);
-            if (!advanced) _finishOnce();
+            if (!advanced) _resolveOnce();
           } else {
-            // Regular middleware: (req, res, next)
+            // Regular middleware: (req, res, next). Settle only if it ENDED the
+            // response (a halt). A bare return without next is NOT treated as a
+            // halt — it may be a callback-style middleware that calls next()
+            // later (timer/stream); the finish/close listener covers a deferred
+            // response end, and a deferred next() continues the chain.
             await entry.mw(req, res, _next);
-            // 3-arg middleware that doesn't call next — chain halts.
-            // The middleware presumably wrote the response itself.
+            if (!advanced && _responseEnded(res)) _resolveOnce();
           }
         } catch (syncErr) {
           // Synchronous throw OR rejected promise — route through
@@ -334,6 +361,13 @@ function composePipeline(entries, opts) {
   };
 }
 
+// True once the response has been committed/ended — the reliable "this
+// middleware handled the request" signal (vs. the function merely returning,
+// which a callback-style middleware does before its deferred next()).
+function _responseEnded(res) {
+  return !!(res && (res.writableEnded || res.finished || res.headersSent));
+}
+
 composePipeline.CANONICAL_POSITIONS = CANONICAL_POSITIONS;
 composePipeline.ComposePipelineError = ComposePipelineError;
 

package/lib/vendor/blamejs/lib/pipl-cn.js

@@ -108,14 +108,17 @@ function _requireRecordedAt(value, label) {
  * and determine the lawful mechanism the transfer requires. PIPL Art. 38(1)
  * permits three bases for moving personal information out of the PRC — the
  * CAC standard contract (SCC), a CAC security assessment (Art. 40), or
- * certification by a CAC-accredited body — but the Measures for Security
- * Assessment of Outbound Data Transfers make the security assessment
- * MANDATORY (the operator may NOT self-select the standard contract or
- * certification) when the exporter is a critical-information-infrastructure
- * operator (CIIO), exports "important data", handles personal information
- * of more than 1,000,000 individuals, or has cumulatively exported PI of
- * more than 100,000 individuals or sensitive PI of more than 10,000
- * individuals since 1 January of the preceding year.
+ * certification by a CAC-accredited body. Under the CAC Provisions on
+ * Promoting and Regulating Cross-Border Data Flows (effective 2024, which
+ * relaxed the 2022 thresholds) the security assessment is MANDATORY (the
+ * operator may NOT self-select the standard contract or certification) when
+ * the exporter is a critical-information-infrastructure operator (CIIO),
+ * exports "important data", or — counting cumulatively since 1 January of
+ * the current year — transfers the personal information of more than
+ * 1,000,000 individuals (non-sensitive) or the sensitive personal
+ * information of more than 10,000 individuals. The 100,000–1,000,000
+ * non-sensitive band is the standard-contract / certification tier, NOT a
+ * security-assessment trigger.
  *
  * The builder validates the operator-supplied facts, computes
  * `securityAssessmentRequired` against those thresholds, resolves the

package/lib/vendor/blamejs/lib/request-helpers.js

@@ -384,6 +384,134 @@ function trustedClientIp(opts) {
   };
 }
 
+// IP-prefix masking constants — named so the bit-arithmetic stays readable.
+// /24 IPv4 is the original IP-geolocation bucket and matches the legacy
+// carrier-NAT pool stride; /64 IPv6 is the customer LAN every RIR allocates
+// (RFC 4291 §2.5.4), so tightening below it punishes IPv6 privacy-extension
+// address rotation.
+var IP_BITS_PER_BYTE      = 8;                                                                  // bits per byte; protocol constant, not a byte size
+var IPV4_OCTET_COUNT      = 4;
+var IPV4_OCTET_RANGE      = 256;                                                                // 0..255 inclusive; v4 octet domain
+var IPV4_TOTAL_BITS       = 32;                                                                 // IPv4 address width in bits
+var IPV4_DEFAULT_PREFIX   = 24;                                                                 // /24 carrier-NAT pool stride
+var IPV6_GROUP_COUNT      = 8;                                                                  // 8 16-bit groups in v6
+var IPV6_BYTE_COUNT       = 16;                                                                 // 16 bytes in v6
+var IPV6_DEFAULT_PREFIX   = 64;                                                                 // /64 customer LAN per RFC 4291 §2.5.4
+var IP_BYTE_MASK          = 0xff;
+var IP_HEX_RADIX          = 16;                                                                 // base-16 radix
+var V4_MAPPED_V6_PREFIX   = "::ffff:";
+
+function _maskIpv4(ip, prefix) {
+  // ip = "a.b.c.d"; prefix is bits to keep (1..32).
+  var parts = String(ip).split(".");
+  if (parts.length !== IPV4_OCTET_COUNT) return null;
+  var n = 0;
+  for (var i = 0; i < IPV4_OCTET_COUNT; i++) {
+    var oct = parseInt(parts[i], 10);
+    if (!Number.isInteger(oct) || oct < 0 || oct >= IPV4_OCTET_RANGE) return null;
+    n = (n * IPV4_OCTET_RANGE) + oct;
+  }
+  // Apply prefix mask.
+  var mask = prefix === 0 ? 0 : (-1 >>> (IPV4_TOTAL_BITS - prefix)) << (IPV4_TOTAL_BITS - prefix);
+  // Bitwise on 32-bit unsigned. JS coerces to 32-bit signed, so use
+  // unsigned right shift to recover.
+  var masked = (n & mask) >>> 0;
+  return ((masked >>> IP_BITS_PER_BYTE * 3) & IP_BYTE_MASK) + "." +
+         ((masked >>> IP_BITS_PER_BYTE * 2) & IP_BYTE_MASK) + "." +
+         ((masked >>> IP_BITS_PER_BYTE)     & IP_BYTE_MASK) + "." +
+         (masked & IP_BYTE_MASK) + "/" + prefix;
+}
+
+function _maskIpv6(ip, prefix) {
+  // Expand to 8 16-bit groups. Accept :: shorthand. Reject if invalid.
+  var raw = String(ip).toLowerCase();
+  // Strip an embedded zone id (fe80::1%eth0); not part of the address.
+  var pct = raw.indexOf("%");
+  if (pct !== -1) raw = raw.substring(0, pct);
+  var doubleColonAt = raw.indexOf("::");
+  var groups;
+  if (doubleColonAt === -1) {
+    groups = raw.split(":");
+    if (groups.length !== IPV6_GROUP_COUNT) return null;
+  } else {
+    var left = raw.substring(0, doubleColonAt).split(":");
+    var right = raw.substring(doubleColonAt + 2).split(":");
+    if (left.length === 1 && left[0] === "") left = [];
+    if (right.length === 1 && right[0] === "") right = [];
+    var fillCount = IPV6_GROUP_COUNT - left.length - right.length;
+    if (fillCount < 0) return null;
+    var middle = [];
+    for (var fi = 0; fi < fillCount; fi++) middle.push("0");
+    groups = left.concat(middle).concat(right);
+  }
+  // Each group is 1–4 hex chars.
+  var bytes = [];
+  for (var gi = 0; gi < IPV6_GROUP_COUNT; gi++) {
+    var g = groups[gi];
+    if (typeof g !== "string" || g.length === 0 || g.length > 4 || /[^0-9a-f]/.test(g)) return null;
+    var v = parseInt(g, IP_HEX_RADIX);
+    if (!Number.isInteger(v) || v < 0 || v > 0xffff) return null;
+    bytes.push((v >> IP_BITS_PER_BYTE) & IP_BYTE_MASK);
+    bytes.push(v & IP_BYTE_MASK);
+  }
+  // Apply prefix in bits.
+  var keepBytes = Math.floor(prefix / IP_BITS_PER_BYTE);
+  var keepBits  = prefix % IP_BITS_PER_BYTE;
+  for (var bi = 0; bi < IPV6_BYTE_COUNT; bi++) {
+    if (bi < keepBytes) continue;
+    if (bi === keepBytes && keepBits > 0) {
+      var m = (IP_BYTE_MASK << (IP_BITS_PER_BYTE - keepBits)) & IP_BYTE_MASK;
+      bytes[bi] = bytes[bi] & m;
+    } else {
+      bytes[bi] = 0;
+    }
+  }
+  // Re-emit as colon-hex (no compression — deterministic for hashing).
+  var out = [];
+  for (var oi = 0; oi < IPV6_BYTE_COUNT; oi += 2) {
+    out.push(((bytes[oi] << IP_BITS_PER_BYTE) | bytes[oi + 1]).toString(IP_HEX_RADIX));
+  }
+  return out.join(":") + "/" + prefix;
+}
+
+/**
+ * @primitive b.requestHelpers.ipPrefix
+ * @signature b.requestHelpers.ipPrefix(ip)
+ * @since     0.15.15
+ * @related   b.requestHelpers.clientIp, b.requestHelpers.trustedClientIp
+ *
+ * Mask a client IP to its subnet bucket: a <code>/24</code> for IPv4 (the
+ * carrier-NAT pool stride) and a <code>/64</code> for IPv6 (the customer-LAN
+ * prefix RIRs allocate, RFC 4291 §2.5.4). Returns the canonical
+ * <code>"network/prefix"</code> string, or <code>""</code> for a non-string /
+ * empty / unparseable input. An IPv4-mapped IPv6 address
+ * (<code>::ffff:1.2.3.4</code>) folds to its dotted form so it buckets the
+ * same regardless of how a proxy reported it.
+ *
+ * This is the masking the session device-fingerprint's built-in
+ * <code>clientIpPrefix</code> field hashes (so roaming carriers that flip the
+ * public IP within a subnet don't log a user out). Exposed so an operator who
+ * drops to a function-form fingerprint field — for a custom mask width, or to
+ * combine the prefix with other signals — reuses this exact algorithm instead
+ * of re-deriving the /24 + /64 masking (and silently diverging).
+ *
+ * @example
+ *   b.requestHelpers.ipPrefix("203.0.113.47");   // → "203.0.113.0/24"
+ *   b.requestHelpers.ipPrefix("2001:db8::1");     // → "2001:db8:0:0/64"
+ */
+function ipPrefix(ip) {
+  if (typeof ip !== "string" || ip.length === 0) return "";
+  // IPv4-mapped IPv6 (::ffff:1.2.3.4) — strip the wrapper so the v4 mask
+  // applies. Same bucket regardless of how the proxy reported it.
+  var lower = ip.toLowerCase();
+  if (lower.indexOf(V4_MAPPED_V6_PREFIX) === 0 && lower.indexOf(".") !== -1) {
+    return _maskIpv4(lower.substring(V4_MAPPED_V6_PREFIX.length), IPV4_DEFAULT_PREFIX) || "";
+  }
+  if (ip.indexOf(":") !== -1) return _maskIpv6(ip, IPV6_DEFAULT_PREFIX) || "";
+  if (ip.indexOf(".") !== -1) return _maskIpv4(ip, IPV4_DEFAULT_PREFIX) || "";
+  return "";
+}
+
 /**
  * @primitive b.requestHelpers.trustedProtocol
  * @signature b.requestHelpers.trustedProtocol(opts?)
@@ -787,8 +915,6 @@ function captureResponseStatus(res, onEnd) {
   return origEnd;
 }
 
-var Q_VALUE_RE = /(?:^|;|\s)q\s*=\s*([0-9]*\.?[0-9]+)/i;
-
 /**
  * @primitive b.requestHelpers.parseQualityList
  * @signature b.requestHelpers.parseQualityList(headerValue, opts?)
@@ -831,24 +957,30 @@ function parseQualityList(headerValue, opts) {
   if (typeof headerValue !== "string" || headerValue.length === 0) return [];
   opts = opts || {};
   var caseSensitive = opts.caseSensitive === true;
-  var parts = headerValue.split(",");
+  // Quote-aware split: a parameter value may be a quoted-string containing ','
+  // or ';' or 'q=' (RFC 7231 §5.3.1 / RFC 9110), which must not split an element
+  // or be mis-read as the q-value. splitUnquoted respects double-quoted runs.
+  var parts = structuredFields.splitUnquoted(headerValue, ",");
   var out = [];
   for (var i = 0; i < parts.length; i++) {
     var p = parts[i].trim();
     if (p.length === 0) continue;
-    var semi = p.indexOf(";");
-    var value, q;
-    if (semi === -1) {
-      value = caseSensitive ? p : p.toLowerCase();
-      q = 1;
-    } else {
-      var head = p.slice(0, semi).trim();
-      value = caseSensitive ? head : head.toLowerCase();
-      var rest = p.slice(semi + 1).trim();
-      var qm = rest.match(Q_VALUE_RE);
+    var segs = structuredFields.splitUnquoted(p, ";");
+    var head = segs[0].trim();
+    var value = caseSensitive ? head : head.toLowerCase();
+    var q = 1;
+    // The q parameter is the named token `q` separating media-type params from
+    // accept-ext; the FIRST `q` parameter is the quality. Only a parameter
+    // literally named `q` counts — never a `q=`-shaped substring of another
+    // parameter's name or quoted value.
+    for (var s = 1; s < segs.length; s++) {
+      var kv = structuredFields.parseKeyValuePiece(segs[s], "=", true);
+      if (kv.key !== "q") continue;
+      var qm = String(kv.value).trim().match(/^([0-9]*\.?[0-9]+)/);
       q = qm ? parseFloat(qm[1]) : 1;
       if (isNaN(q) || q < 0) q = 0;
       if (q > 1) q = 1;
+      break;
     }
     out.push({ value: value, q: q });
   }
@@ -1067,6 +1199,7 @@ module.exports = {
   // proxy-trust primitives (default refuses forwarded headers)
   clientIp:                  clientIp,
   trustedClientIp:           trustedClientIp,
+  ipPrefix:                  ipPrefix,
   requestProtocol:           requestProtocol,
   trustedProtocol:           trustedProtocol,
   appendVary:                appendVary,

package/lib/vendor/blamejs/lib/safe-json.js

@@ -969,9 +969,35 @@ function _capInt(value, defaultValue, ceiling) {
  *   });
  */
 
+/**
+ * @primitive b.safeJson.isJsonObject
+ * @signature b.safeJson.isJsonObject(value)
+ * @since     0.15.14
+ * @status    stable
+ * @related   b.safeJson.parse
+ *
+ * True iff <code>value</code> is a plain JSON object — not <code>null</code>,
+ * not an array, not a scalar. <code>safeJson.parse</code> accepts the literal
+ * <code>null</code> and scalars / arrays (all valid JSON documents), so a
+ * parsed JWS header, claims set, or document must be re-checked before its
+ * fields are dereferenced. This is that check, shared so the
+ * <code>!x || typeof x !== "object" || Array.isArray(x)</code> idiom isn't
+ * re-rolled (and silently varied) at every call site.
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   b.safeJson.isJsonObject(b.safeJson.parse('{"a":1}'));   // → true
+ *   b.safeJson.isJsonObject(b.safeJson.parse("null"));      // → false
+ *   b.safeJson.isJsonObject(b.safeJson.parse("[1,2]"));     // → false
+ */
+function isJsonObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
 module.exports = {
   parse:          parse,
   parseOrDefault: parseOrDefault,
+  isJsonObject:   isJsonObject,
   stringify:      stringify,
   stringifyForScript: stringifyForScript,
   canonical:      canonical,

package/lib/vendor/blamejs/lib/session.js

@@ -256,130 +256,48 @@ function _sealForInsert(row) {
 var DEFAULT_FINGERPRINT_FIELDS = ["clientIp", "userAgent", "acceptLanguage"];
 
 // Subnet binding: roaming carriers (T-Mobile / Verizon / etc.) flip the
-// public client IP every few requests as the device hops cells, so a
-// strict full-IP fingerprint logs out healthy mobile users. The
-// "clientIpPrefix" field hashes a /24 mask for IPv4 (256-address bucket
-// — same Class C-shaped neighborhood) and a /64 mask for IPv6 (the IPv6
-// "site" prefix the RIRs allocate to every ISP customer). Drift across
-// /24 OR /64 is meaningfully suspicious; drift within is not.
-//
-// Per the IPv6 addressing architecture (RFC 4291 §2.5.4) every customer
-// LAN is assigned at least a /64; tightening below /64 punishes IPv6
-// privacy-extension address rotation. /24 IPv4 is the original
-// IP-geolocation bucket size and matches the legacy carrier-NAT pool
-// stride. Operators with stricter needs pass a function-form
-// fingerprint field for custom mask widths.
-//
-// Protocol constants — named so the bit-arithmetic stays readable.
-var IP_BITS_PER_BYTE      = 8;                                                                  // bits per byte; protocol constant, not a byte size
-var IPV4_OCTET_COUNT      = 4;
-var IPV4_OCTET_RANGE      = 256;                                                                // 0..255 inclusive; v4 octet domain
-var IPV4_TOTAL_BITS       = 32;                                                                 // IPv4 address width in bits
-var IPV4_DEFAULT_PREFIX   = 24;                                                                 // /24 carrier-NAT pool stride
-var IPV6_GROUP_COUNT      = 8;                                                                  // 8 16-bit groups in v6
-var IPV6_BYTE_COUNT       = 16;                                                                 // 16 bytes in v6
-var IPV6_DEFAULT_PREFIX   = 64;                                                                 // /64 customer LAN per RFC 4291 §2.5.4
-var BYTE_MASK             = 0xff;
-var HEX_RADIX             = 16;                                                                 // base-16 radix
-var V4_MAPPED_V6_PREFIX   = "::ffff:";
-
-function _maskIpv4(ip, prefix) {
-  // ip = "a.b.c.d"; prefix is bits to keep (1..32).
-  var parts = String(ip).split(".");
-  if (parts.length !== IPV4_OCTET_COUNT) return null;
-  var n = 0;
-  for (var i = 0; i < IPV4_OCTET_COUNT; i++) {
-    var oct = parseInt(parts[i], 10);
-    if (!Number.isInteger(oct) || oct < 0 || oct >= IPV4_OCTET_RANGE) return null;
-    n = (n * IPV4_OCTET_RANGE) + oct;
-  }
-  // Apply prefix mask.
-  var mask = prefix === 0 ? 0 : (-1 >>> (IPV4_TOTAL_BITS - prefix)) << (IPV4_TOTAL_BITS - prefix);
-  // Bitwise on 32-bit unsigned. JS coerces to 32-bit signed, so use
-  // unsigned right shift to recover.
-  var masked = (n & mask) >>> 0;
-  return ((masked >>> IP_BITS_PER_BYTE * 3) & BYTE_MASK) + "." +
-         ((masked >>> IP_BITS_PER_BYTE * 2) & BYTE_MASK) + "." +
-         ((masked >>> IP_BITS_PER_BYTE)     & BYTE_MASK) + "." +
-         (masked & BYTE_MASK) + "/" + prefix;
-}
-
-function _maskIpv6(ip, prefix) {
-  // Expand to 8 16-bit groups. Accept :: shorthand. Reject if invalid.
-  var raw = String(ip).toLowerCase();
-  // Strip an embedded zone id (fe80::1%eth0); not part of the address.
-  var pct = raw.indexOf("%");
-  if (pct !== -1) raw = raw.substring(0, pct);
-  var doubleColonAt = raw.indexOf("::");
-  var groups;
-  if (doubleColonAt === -1) {
-    groups = raw.split(":");
-    if (groups.length !== IPV6_GROUP_COUNT) return null;
-  } else {
-    var left = raw.substring(0, doubleColonAt).split(":");
-    var right = raw.substring(doubleColonAt + 2).split(":");
-    if (left.length === 1 && left[0] === "") left = [];
-    if (right.length === 1 && right[0] === "") right = [];
-    var fillCount = IPV6_GROUP_COUNT - left.length - right.length;
-    if (fillCount < 0) return null;
-    var middle = [];
-    for (var fi = 0; fi < fillCount; fi++) middle.push("0");
-    groups = left.concat(middle).concat(right);
-  }
-  // Each group is 1–4 hex chars.
-  var bytes = [];
-  for (var gi = 0; gi < IPV6_GROUP_COUNT; gi++) {
-    var g = groups[gi];
-    if (typeof g !== "string" || g.length === 0 || g.length > 4 || /[^0-9a-f]/.test(g)) return null;
-    var v = parseInt(g, HEX_RADIX);
-    if (!Number.isInteger(v) || v < 0 || v > 0xffff) return null;
-    bytes.push((v >> IP_BITS_PER_BYTE) & BYTE_MASK);
-    bytes.push(v & BYTE_MASK);
-  }
-  // Apply prefix in bits.
-  var keepBytes = Math.floor(prefix / IP_BITS_PER_BYTE);
-  var keepBits  = prefix % IP_BITS_PER_BYTE;
-  for (var bi = 0; bi < IPV6_BYTE_COUNT; bi++) {
-    if (bi < keepBytes) continue;
-    if (bi === keepBytes && keepBits > 0) {
-      var m = (BYTE_MASK << (IP_BITS_PER_BYTE - keepBits)) & BYTE_MASK;
-      bytes[bi] = bytes[bi] & m;
-    } else {
-      bytes[bi] = 0;
-    }
-  }
-  // Re-emit as colon-hex (no compression — deterministic for hashing).
-  var out = [];
-  for (var oi = 0; oi < IPV6_BYTE_COUNT; oi += 2) {
-    out.push(((bytes[oi] << IP_BITS_PER_BYTE) | bytes[oi + 1]).toString(HEX_RADIX));
-  }
-  return out.join(":") + "/" + prefix;
-}
-
-function _ipPrefix(ip) {
-  if (typeof ip !== "string" || ip.length === 0) return "";
-  // IPv4-mapped IPv6 (::ffff:1.2.3.4) — strip the wrapper so the v4
-  // mask applies. Same bucket regardless of how the proxy reported it.
-  var lower = ip.toLowerCase();
-  if (lower.indexOf(V4_MAPPED_V6_PREFIX) === 0 && lower.indexOf(".") !== -1) {
-    return _maskIpv4(lower.substring(V4_MAPPED_V6_PREFIX.length), IPV4_DEFAULT_PREFIX) || "";
+// public client IP every few requests as the device hops cells, so a strict
+// full-IP fingerprint logs out healthy mobile users. The "clientIpPrefix"
+// field hashes the /24 (IPv4) + /64 (IPv6) subnet bucket instead — drift
+// across the bucket is meaningfully suspicious, drift within is not. The
+// masking lives in requestHelpers.ipPrefix (the IP-utilities home, next to
+// clientIp / trustedClientIp); operators with stricter needs pass a
+// function-form fingerprint field and reuse requestHelpers.ipPrefix for a
+// custom mask width.
+
+// Resolve the per-call client-IP function for the clientIp / clientIpPrefix
+// fingerprint fields. With { trustedProxies } (an array/string of CIDRs) or a
+// custom { clientIpResolver }, the IP is peer-gated through
+// requestHelpers.trustedClientIp so a deployment behind a trusted proxy binds
+// the session to the real client and not the proxy address (which silently
+// defeats the IP component of the fingerprint). With neither, it falls back to
+// the bare-socket peer — the historical default, preserved so existing
+// fingerprints don't change and log users out. The SAME option must be passed
+// to create / verify / rotate (exactly like fingerprintFields) or the
+// fingerprint won't match across the session lifecycle. An invalid CIDR throws
+// at the call (config-time entry-point validation).
+function _clientIpResolver(opts) {
+  if (opts && (opts.trustedProxies != null || typeof opts.clientIpResolver === "function")) {
+    return requestHelpers.trustedClientIp({
+      trustedProxies:   opts.trustedProxies,
+      clientIpResolver: opts.clientIpResolver,
+    }).resolve;
   }
-  if (ip.indexOf(":") !== -1) return _maskIpv6(ip, IPV6_DEFAULT_PREFIX) || "";
-  if (ip.indexOf(".") !== -1) return _maskIpv4(ip, IPV4_DEFAULT_PREFIX) || "";
-  return "";
+  return requestHelpers.clientIp;
 }
 
-function _buildFingerprintInputs(req, fields) {
+function _buildFingerprintInputs(req, fields, resolveIp) {
   if (!req) return null;
+  resolveIp = resolveIp || requestHelpers.clientIp;
   var headers = req.headers || {};
   var inputs = {};
   for (var i = 0; i < fields.length; i++) {
     var f = fields[i];
     if (f === "clientIp") {
-      inputs.clientIp = requestHelpers.clientIp(req) || "";
+      inputs.clientIp = resolveIp(req) || "";
     } else if (f === "clientIpPrefix") {
-      // /24 v4 + /64 v6 — see _ipPrefix() commentary.
-      inputs.clientIpPrefix = _ipPrefix(requestHelpers.clientIp(req) || "");
+      // /24 v4 + /64 v6 — see requestHelpers.ipPrefix commentary.
+      inputs.clientIpPrefix = requestHelpers.ipPrefix(resolveIp(req) || "");
     } else if (f === "userAgent") {
       inputs.userAgent = String(headers["user-agent"] || "");
     } else if (f === "acceptLanguage") {
@@ -482,7 +400,7 @@ async function create(opts) {
   var dataObj = opts.data ? Object.assign({}, opts.data) : null;
   var fpFields = Array.isArray(opts.fingerprintFields) && opts.fingerprintFields.length > 0
     ? opts.fingerprintFields : DEFAULT_FINGERPRINT_FIELDS;
-  var fpInputs = _buildFingerprintInputs(opts.req, fpFields);
+  var fpInputs = _buildFingerprintInputs(opts.req, fpFields, _clientIpResolver(opts));
   if (fpInputs) {
     if (!dataObj) dataObj = {};
     dataObj.__bj_fingerprint = _hashFingerprint(sid, fpInputs);
@@ -660,7 +578,7 @@ async function verify(token, verifyOpts) {
   if (storedFingerprint && verifyOpts.req) {
     var fpFields = Array.isArray(verifyOpts.fingerprintFields) && verifyOpts.fingerprintFields.length > 0
       ? verifyOpts.fingerprintFields : DEFAULT_FINGERPRINT_FIELDS;
-    var currentInputs = _buildFingerprintInputs(verifyOpts.req, fpFields);
+    var currentInputs = _buildFingerprintInputs(verifyOpts.req, fpFields, _clientIpResolver(verifyOpts));
     var currentHash = _hashFingerprint(sid, currentInputs);
     if (currentHash !== storedFingerprint) {
       fingerprintDrift = true;
@@ -1058,7 +976,7 @@ async function rotate(oldToken, opts) {
           "so the device binding can be re-keyed to the new session id", true);
       }
       if (!newDataObj) newDataObj = {};
-      newDataObj.__bj_fingerprint = _hashFingerprint(newSid, _buildFingerprintInputs(opts.req, fpFields));
+      newDataObj.__bj_fingerprint = _hashFingerprint(newSid, _buildFingerprintInputs(opts.req, fpFields, _clientIpResolver(opts)));
     }
 
     var dataJson = newDataObj ? JSON.stringify(newDataObj) : null;

package/lib/vendor/blamejs/lib/sql.js

@@ -798,6 +798,17 @@ class Predicate {
       return this._add(joiner, qc + " " + op + " NULL", []);
     }
 
+    // `col = NULL` / `col != NULL` is UNKNOWN in SQL — never true. Emitting it
+    // (e.g. from where({ col: null })) silently matches zero rows; worse, a null
+    // accidentally passed where a real value was expected (where({ ownerId }))
+    // would, if rewritten to `IS NULL`, return orphan rows — an authorization
+    // footgun. Refuse it and direct the caller to the explicit NULL predicates.
+    if (value === null && (op === "=" || op === "!=" || op === "<>")) {
+      throw _err("where(" + JSON.stringify(col) + ", '" + op + "', null) is never true in SQL " +
+        "(col " + op + " NULL is UNKNOWN); use whereNull(col) / whereNotNull(col) to test for NULL",
+        "sql-builder/null-equality");
+    }
+
     if ((op === "LIKE" || op === "NOT LIKE") && typeof value === "string") {
       return this._add(joiner, qc + " " + op + " ? ESCAPE '~'", [_escapeLike(value)]);
     }
@@ -948,6 +959,17 @@ class Predicate {
     if (!Array.isArray(values) || values.length === 0) {
       throw _err("whereInArray requires a non-empty array of values", "sql-builder/empty-in");
     }
+    // Validate each element is a bindable parameter. On the non-Postgres IN-list
+    // path every element is its own `?`, so the driver rejects an undefined at
+    // execute; the Postgres `= ANY(?)` path binds the WHOLE array as one param,
+    // where an undefined is silently coerced to NULL — diverging per dialect.
+    // Reject undefined here so every backend fails the same way, at build.
+    for (var vi = 0; vi < values.length; vi += 1) {
+      if (values[vi] === undefined) {
+        throw _err("whereInArray value[" + vi + "] is undefined (not a bindable parameter)",
+          "sql-builder/bad-in-value");
+      }
+    }
     this._gate(col);
     var qc = _qualifiedColumn(col, this._dialect());
     if (this._dialect() === "postgres") {

package/lib/vendor/blamejs/lib/ws-client.js

@@ -585,6 +585,7 @@ class WsClient extends EventEmitter {
     this._reconnectAttempt = 0;
     this._fragmentChunks = [];
     this._fragmentOpcode = null;
+    this._fragmentBytes = 0;
 
     this._startHeartbeat();
     if (this._opts.auditOn) {
@@ -623,6 +624,14 @@ class WsClient extends EventEmitter {
   }
 
   _handleFrame(frame) {
+    // Once the connection has been torn down (e.g. a prior frame in the same
+    // parsed batch tripped maxMessageBytes and called _teardown, which sets
+    // _closed synchronously), drop any remaining buffered frames — processing
+    // them would emit a spurious cascade of protocol errors (a stray
+    // continuation after the fragment state reset). A graceful close keeps
+    // _closed false until the handshake completes, so the peer's CLOSE frame
+    // is still processed and the normal close code surfaces.
+    if (this._closed) return;
     // RFC 6455 §5.5: control frames MUST be <= 125 bytes AND non-fragmented.
     var isControl = frame.opcode === OPCODE_PING ||
                     frame.opcode === OPCODE_PONG ||
@@ -692,6 +701,7 @@ class WsClient extends EventEmitter {
       this._fragmentOpcode = frame.opcode;
       this._fragmentRsv1   = frame.rsv1 === true;
       this._fragmentChunks = [frame.payload];
+      this._fragmentBytes  = safeBuffer.byteLengthOf(frame.payload);
     } else if (frame.opcode === OPCODE_CONT) {
       if (this._fragmentOpcode == null) {
         this._handleSocketError(new WsClientError("ws-client/protocol-error",
@@ -699,6 +709,21 @@ class WsClient extends EventEmitter {
         return;
       }
       this._fragmentChunks.push(frame.payload);
+      this._fragmentBytes += safeBuffer.byteLengthOf(frame.payload);
+    }
+    // Enforce maxMessageBytes on the RUNNING fragment total, not only at FIN:
+    // a peer that streams continuation frames and never sets FIN would
+    // otherwise grow _fragmentChunks without bound, one maxFrameBytes-sized
+    // frame at a time (CWE-770 / CWE-400). The per-frame parser cap bounds a
+    // single frame, never the sum.
+    if (this._fragmentOpcode != null && this._fragmentBytes > this._opts.maxMessageBytes) {
+      this._fragmentChunks = [];
+      this._fragmentOpcode = null;
+      this._fragmentRsv1   = false;
+      this._fragmentBytes  = 0;
+      this._handleSocketError(new WsClientError("ws-client/message-too-big",
+        "incoming message exceeds maxMessageBytes (" + this._opts.maxMessageBytes + ")"));
+      return;
     }
     if (frame.fin) {
       var fullPayload = Buffer.concat(this._fragmentChunks);                              // allow:handrolled-buffer-collect — bounded by maxMessageBytes below
@@ -712,6 +737,7 @@ class WsClient extends EventEmitter {
       this._fragmentChunks = [];
       this._fragmentOpcode = null;
       this._fragmentRsv1 = false;
+      this._fragmentBytes = 0;
       if (this._negotiatedDeflate && firstFrameRsv1) {
         try {
           var zlib = require("node:zlib");                                                     // allow:inline-require — zlib only on deflate-negotiated path