@blamejs/blamejs-shop 0.4.74 → 0.4.75

package/lib/vendor/blamejs/release-notes/v0.15.15.json

@@ -0,0 +1,73 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.15",
+  "date": "2026-06-21",
+  "headline": "A focused correctness and hardening release: more authentication and signature verifiers fail closed (JWT issuer, SAML recipient binding, OAuth nonce, CIBA token binding, FIDO certification level), the WebSocket client bounds a fragmented message before it completes, DMARC resolves the From domain before the policy lookup, and the CSP builder refuses a directive-injecting source; fixes a middleware pipeline promise that never settled on a write-and-halt, and exposes the X.509 CA-bit issuer test, an IP-prefix helper, and a reverse-proxy-aware session fingerprint option",
+  "summary": "This release continues to tighten existing protections without adding opt-ins on the request path. A further set of authentication and signature verifiers now refuse malformed or unbound credentials: JWT verify rejects an array-valued issuer claim (an any-match bypass, CVE-2025-30144 class), SAML requires the mandatory Recipient on a Bearer or holder-of-key confirmation and enforces every AudienceRestriction, OAuth no longer skips the ID-token nonce check on an empty nonce, CIBA binds the returned ID token to its auth_req_id, the FIDO MDS3 certification level reflects the authenticator's current status rather than its historical maximum, and a JOSE header that decodes to a non-object is a typed error rather than an uncaught throw. The WebSocket client now bounds a fragmented incoming message by its running total instead of only at the final frame, DMARC validates the From-header domain before the policy lookup, the data-residency write gate compares the residency column case-insensitively, and the SQL builder refuses an equality against NULL and validates every IN-list element. The CSP builder refuses a source token containing whitespace or a semicolon (directive injection). A middleware pipeline that a request handler halted by writing the response without calling next() left its promise pending forever, retaining the request closure — it now settles. New surface is additive and backward compatible: the basicConstraints-enforcing X.509 issuer test is exposed publicly, the session device fingerprint can resolve the client IP through a trusted-proxy allowlist, and the /24+/64 IP-prefix masking it uses is exposed for reuse.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.x509Chain — the CA-bit-enforcing X.509 issuer test",
+          "body": "isCaCert(cert) and issuerValidlyIssued(issuer, subject) are now public. Node's X509Certificate.checkIssued() does not enforce the basicConstraints cA bit (CVE-2002-0862 class), so a non-CA leaf can be accepted as an issuer; these helpers require cA:TRUE and verify the signature, fail closed on any malformed input, and are the same test the framework's own chain walkers use. A consumer validating a chain outside a TLS handshake (an operator-uploaded CA bundle, a non-handshake PQ-signed certificate) can now use the hardened path instead of raw checkIssued()."
+        },
+        {
+          "title": "Reverse-proxy-aware session device fingerprint",
+          "body": "b.session.create / verify / rotate accept { trustedProxies } (CIDRs) or { clientIpResolver } so the built-in clientIp / clientIpPrefix fingerprint fields resolve the real client IP behind a trusted proxy, consistent with b.requestHelpers.trustedClientIp. Without the option the fingerprint still binds to the bare socket peer (unchanged default), so existing fingerprints keep matching; pass the same option to create, verify, and rotate. The /24 (IPv4) + /64 (IPv6) subnet masking is exposed as b.requestHelpers.ipPrefix for an operator using a function-form fingerprint field."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "More authentication and signature verifiers fail closed",
+          "body": "JWT verify rejects an array-valued iss claim (it had passed through a generic any-match built for the legitimately-array aud claim, so a multi-issuer array satisfied a single-issuer expectation — CVE-2025-30144 class), matching the external JWT and OIDC verifiers. SAML verifyResponse requires the Recipient attribute on a Bearer or holder-of-key SubjectConfirmation and confirms it equals the ACS URL (an absent Recipient was silently skipped), and enforces every AudienceRestriction (AND-combined per SAML core). OAuth no longer fails open and skips the ID-token nonce replay check when the supplied nonce is empty. CIBA binds the polled / notified ID token to its auth_req_id so a token minted for another request can't be accepted. The FIDO MDS3 certification level reflects the authenticator's current status, not the highest level it ever held, so a later decertification or downgrade is honored by a step-up policy. A JOSE header or payload that decodes to JSON null or a non-object now raises a typed authentication error instead of an uncaught TypeError."
+        },
+        {
+          "title": "WebSocket fragmented-message reassembly is bounded before completion",
+          "body": "The client enforced maxMessageBytes only when a fragmented message's final frame arrived, so a peer could stream unbounded continuation frames and exhaust memory before the limit was ever checked. The running reassembly total is now enforced per frame, and a frame arriving after close is ignored."
+        },
+        {
+          "title": "DMARC resolves the From domain before the policy lookup",
+          "body": "The From-header bare addr-spec domain extraction did not reject RFC 5322 group syntax or a trailing semicolon, so a crafted From header could yield a corrupted domain that defeated the DMARC alignment / policy lookup. The domain is now validated (length-bounded, rejecting the group and punctuation forms) before it is used."
+        },
+        {
+          "title": "Data-residency and SQL builder correctness",
+          "body": "The per-row data-residency write gate compares the residency column name case-insensitively, so a raw UPDATE that spells the column in a different letter case can no longer slip the cross-border transfer check. The SQL builder refuses an equality against NULL (col = NULL is always false; use IS NULL) and validates every element of an IN-list on the Postgres = ANY(?) path, matching the sqlite / MySQL path."
+        },
+        {
+          "title": "CSP builder refuses a directive-injecting source",
+          "body": "A CSP source is a single non-whitespace token. build() and mergeDirectives() now reject a source containing whitespace or a semicolon — because the emitter space-joins sources and semicolon-joins directives, a value like \"https://x; script-src https://evil\" injected a live directive."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "DKIM l= is counted over the canonicalized body",
+          "body": "On verify, the l= body-length tag was applied to the raw body before canonicalization, so a legitimate relaxed/relaxed signature whose l= matched the canonicalized length was rejected with a body-hash mismatch whenever relaxed canonicalization changed the byte count within the first l= octets. The body is now canonicalized first and the canonicalized octet stream truncated to l= (RFC 6376 §3.4.5)."
+        },
+        {
+          "title": "PIPL cross-border security-assessment threshold documentation corrected",
+          "body": "The b.pipl.sccFilingAssessment contract stated the CAC security assessment becomes mandatory above 100,000 cumulative PI subjects (the superseded 2022 figure). The builder enforces the current CAC Provisions on Promoting and Regulating Cross-Border Data Flows — a security assessment above 1,000,000 non-sensitive PI subjects or 10,000 sensitive, with the 100,000–1,000,000 band in the standard-contract / certification tier. The documentation now matches the enforced thresholds."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "composePipeline settles its promise when a middleware halts",
+          "body": "A regular middleware that wrote the response and returned without calling next() — the intended way to halt the chain from an auth / rate-limit / bot block — left the promise returned by b.middleware.composePipeline pending forever, retaining its request/response closure (an unbounded leak under sustained blocked traffic). The halt path now settles the promise without advancing to the route handler; the same applies to an error handler that consumes the error without calling next()."
+        },
+        {
+          "title": "Quality-list header parsing is quote-aware",
+          "body": "parseQualityList mis-read a q= substring that appeared inside a quoted media-range or Accept-* parameter, mis-weighting content negotiation. It now parses the q parameter with quote-aware splitting."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/00-primitives.js

@@ -1356,6 +1356,17 @@ async function testAuthJwtIssuerAudienceSubject() {
   check("issuer mismatch throws auth-jwt/iss-mismatch",
         threw && threw.code === "auth-jwt/iss-mismatch");
 
+  // Array-valued iss must NOT any-of match a single-issuer expectation
+  // (CVE-2025-30144 / fast-jwt class): iss is StringOrURI, not a list.
+  var arrIssTok = await j.sign({ iss: ["https://evil.example", "https://blamejs.example.com"], sub: "u" }, {
+    privateKey: k.privateKey, algorithm: "ML-DSA-87",
+  });
+  threw = null;
+  try { await j.verify(arrIssTok, Object.assign({}, verifyOpts, { issuer: "https://blamejs.example.com" })); }
+  catch (e) { threw = e; }
+  check("array-valued iss refused (no any-of issuer bypass)",
+        threw && threw.code === "auth-jwt/iss-mismatch");
+
   // Audience mismatch
   threw = null;
   try { await j.verify(token, Object.assign({}, verifyOpts, { audience: "api-c" })); }
@@ -7363,6 +7374,37 @@ async function testOAuthExchangeCodeRequiresVerifier() {
   check("exchangeCode: empty opts rejected",       threw && threw.code === "auth-oauth/no-code");
 }
 
+async function testOAuthExchangeCodeRejectsFalsyNonce() {
+  // OIDC nonce enforcement must require a NON-EMPTY nonce, not merely a defined
+  // one. A falsy nonce (null / "") would slip a `=== undefined` guard and the
+  // downstream ID-token nonce check is truthiness-gated, so the check would be
+  // silently skipped and a token captured from another session replayed. The
+  // guard fires before the token endpoint, so no network is needed.
+  var oa = b.auth.oauth.create({
+    clientId: "x", redirectUri: "https://app/cb",
+    authorizationEndpoint: "https://example.com/auth",
+    tokenEndpoint:         "https://example.com/token",
+    issuer:                "https://example.com",
+    isOidc: true,
+  });
+  var args = { code: "abc", state: "s", verifier: "v" };
+  var threwEmpty = null;
+  try { await oa.exchangeCode(Object.assign({ nonce: "" }, args)); } catch (e) { threwEmpty = e; }
+  check("exchangeCode: empty-string nonce rejected on OIDC",
+        threwEmpty && threwEmpty.code === "auth-oauth/no-nonce");
+  var threwNull = null;
+  try { await oa.exchangeCode(Object.assign({ nonce: null }, args)); } catch (e) { threwNull = e; }
+  check("exchangeCode: null nonce rejected on OIDC",
+        threwNull && threwNull.code === "auth-oauth/no-nonce");
+  // A non-empty nonce passes the guard (then fails later on the unreachable
+  // endpoint — NOT with no-nonce), confirming the guard isn't over-broad.
+  var threwValid = null;
+  try { await oa.exchangeCode(Object.assign({ nonce: "real-nonce-value" }, args)); }
+  catch (e) { threwValid = e; }
+  check("exchangeCode: non-empty nonce passes the nonce guard",
+        threwValid && threwValid.code !== "auth-oauth/no-nonce");
+}
+
 async function testOAuthExchangeCodeRoundTrip() {
   // Spin a fake IdP that accepts a code + verifier and returns tokens.
   var receivedBody = null;
@@ -13448,6 +13490,16 @@ function testJsonModuleSurface() {
   check("safeJson.validate is a function",   typeof b.safeJson.validate === "function");
   check("safeJson.canonical is a function",  typeof b.safeJson.canonical === "function");
   check("safeJson.SafeJsonError exists",     typeof b.safeJson.SafeJsonError === "function");
+  // isJsonObject — only a plain object is true; null / arrays / scalars (all
+  // valid JSON documents parse() accepts) are not, so a parsed header / claims
+  // set must be re-checked before its fields are dereferenced.
+  check("safeJson.isJsonObject is a function", typeof b.safeJson.isJsonObject === "function");
+  check("safeJson.isJsonObject true for a plain object", b.safeJson.isJsonObject({ a: 1 }) === true);
+  check("safeJson.isJsonObject false for null",  b.safeJson.isJsonObject(null) === false);
+  check("safeJson.isJsonObject false for an array", b.safeJson.isJsonObject([1, 2]) === false);
+  check("safeJson.isJsonObject false for a scalar", b.safeJson.isJsonObject("x") === false);
+  check("safeJson.isJsonObject false for a parsed JSON null",
+    b.safeJson.isJsonObject(b.safeJson.parse("null")) === false);
 }
 
 function testJsonParse() {
@@ -18441,6 +18493,7 @@ async function run() {
   await testOAuthAuthorizationUrlGenericPreset();
   await testOAuthAuthorizationUrlExtraParams();
   await testOAuthExchangeCodeRequiresVerifier();
+  await testOAuthExchangeCodeRejectsFalsyNonce();
   await testOAuthExchangeCodeRoundTrip();
   await testOAuthRefreshAccessToken();
   await testOAuthFetchUserInfo();
@@ -19169,6 +19222,7 @@ module.exports = {
   testOAuthAuthorizationUrlGenericPreset:    testOAuthAuthorizationUrlGenericPreset,
   testOAuthAuthorizationUrlExtraParams:      testOAuthAuthorizationUrlExtraParams,
   testOAuthExchangeCodeRequiresVerifier:     testOAuthExchangeCodeRequiresVerifier,
+  testOAuthExchangeCodeRejectsFalsyNonce:    testOAuthExchangeCodeRejectsFalsyNonce,
   testOAuthExchangeCodeRoundTrip:            testOAuthExchangeCodeRoundTrip,
   testOAuthRefreshAccessToken:               testOAuthRefreshAccessToken,
   testOAuthFetchUserInfo:                    testOAuthFetchUserInfo,

package/lib/vendor/blamejs/test/layer-0-primitives/auth-jwt-defenses.test.js

@@ -330,7 +330,29 @@ function testDpopMiddlewareShutdownExposed() {
   check("AUTH-36 — shutdown/revoke run without throwing", true);
 }
 
+// A JOSE header segment of base64url("null") parses to JSON null; the verifier
+// must reject it with a typed malformed error, not dereference null and throw a
+// raw TypeError (broken error contract — a consumer branching on .code or
+// expecting AuthError gets an unhandled TypeError instead).
+async function testNullJoseHeaderTypedError() {
+  var _b = function (o) { return Buffer.from(typeof o === "string" ? o : JSON.stringify(o)).toString("base64url"); };
+  var nullHeaderTok = _b("null") + "." + _b({ sub: "x" }) + "." + _b("sig");
+
+  var jwtThrew = null;
+  try { b.auth.jwt.decode(nullHeaderTok); } catch (e) { jwtThrew = e; }
+  check("jwt.decode null header → typed auth-jwt/malformed (not TypeError)",
+        jwtThrew && jwtThrew.code === "auth-jwt/malformed");
+
+  var dpopThrew = null;
+  try {
+    await b.auth.dpop.verify(nullHeaderTok, { htm: "POST", htu: "https://api.example.com/token" });
+  } catch (e) { dpopThrew = e; }
+  check("dpop.verify null header → typed auth-dpop/malformed (not TypeError)",
+        dpopThrew && dpopThrew.code === "auth-dpop/malformed");
+}
+
 async function run() {
+  await testNullJoseHeaderTypedError();
   await testAlgKtyMismatchRsaWithEs256();
   await testAlgKtyMismatchEcCurveConfusion();
   await testCrossRealmIssRefused();

package/lib/vendor/blamejs/test/layer-0-primitives/ciba-authreqid-binding.test.js

@@ -0,0 +1,130 @@
+"use strict";
+/**
+ * b.auth.ciba.client — the ID Token returned by a CIBA token response /
+ * push notification MUST carry urn:openid:params:jwt:claim:auth_req_id, and the
+ * RP MUST verify it equals the auth_req_id this flow used (OpenID CIBA Core
+ * §7.3 / §10.1). Without it, an id_token minted for a DIFFERENT auth_req_id
+ * (another user's CIBA flow at the same RP) can be substituted.
+ *
+ * Drives the real parseNotification (push) consumer path against a local OIDC
+ * discovery + JWKS server, with an ES256-signed id_token.
+ */
+
+var http       = require("http");
+var nodeCrypto = require("crypto");
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+var CLIENT_ID = "rp-ciba";
+var KID       = "test-es256";
+var CNT       = "client-notification-token-very-long-and-opaque-enough-for-ciba-min-entropy-padding";
+
+var _kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+var _pubJwk = _kp.publicKey.export({ format: "jwk" });
+_pubJwk.kid = KID; _pubJwk.alg = "ES256"; _pubJwk.use = "sig";
+
+function _b64url(x) { return Buffer.from(x).toString("base64url"); }
+
+function _mintIdToken(issuer, authReqIdClaim) {
+  var header  = { alg: "ES256", kid: KID, typ: "JWT" };
+  var now     = Math.floor(Date.now() / 1000);
+  var payload = {
+    iss: issuer, aud: CLIENT_ID, sub: "user-1", iat: now, exp: now + 3600,
+  };
+  if (authReqIdClaim !== undefined) payload["urn:openid:params:jwt:claim:auth_req_id"] = authReqIdClaim;
+  var input = _b64url(JSON.stringify(header)) + "." + _b64url(JSON.stringify(payload));
+  var sig   = nodeCrypto.sign("sha256", Buffer.from(input), { key: _kp.privateKey, dsaEncoding: "ieee-p1363" });
+  return input + "." + _b64url(sig);
+}
+
+async function _withIdp(fn) {
+  var holder = { issuer: null };
+  var server = http.createServer(function (req, res) {
+    var u = new URL(req.url, "http://localhost");
+    if (u.pathname === "/.well-known/openid-configuration") {
+      var doc = JSON.stringify({
+        issuer: holder.issuer, authorization_endpoint: holder.issuer + "/auth",
+        token_endpoint: holder.issuer + "/token", jwks_uri: holder.issuer + "/jwks",
+      });
+      res.writeHead(200, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(doc) });
+      res.end(doc); return;
+    }
+    if (u.pathname === "/jwks") {
+      var jwks = JSON.stringify({ keys: [_pubJwk] });
+      res.writeHead(200, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(jwks) });
+      res.end(jwks); return;
+    }
+    res.writeHead(404); res.end();
+  });
+  await new Promise(function (r) { server.listen(0, "127.0.0.1", r); });
+  holder.issuer = "http://127.0.0.1:" + server.address().port;
+  try { return await fn(holder.issuer); }
+  finally { await new Promise(function (r) { server.close(function () { r(); }); }); }
+}
+
+function _cibaClient(issuer) {
+  return b.auth.ciba.client.create({
+    issuer: issuer, clientId: CLIENT_ID,
+    clientSecret: "ciba-client-secret-very-long-and-opaque-enough-for-min-entropy-guard-padding-xx",
+    tokenEndpoint: issuer + "/token",
+    backchannelAuthenticationEndpoint: issuer + "/bc-auth",
+    deliveryMode: "push", clientNotificationToken: CNT,
+    allowHttp: true, allowInternal: true,
+  });
+}
+
+function _push(idToken, bodyAuthReqId) {
+  return {
+    req:  { headers: { authorization: "Bearer " + CNT } },
+    opts: { body: { auth_req_id: bodyAuthReqId, access_token: "at", id_token: idToken } },
+  };
+}
+
+async function run() {
+  await _withIdp(async function (issuer) {
+    var ciba = _cibaClient(issuer);
+
+    // Matching auth_req_id claim → accepted.
+    var okPush = _push(_mintIdToken(issuer, "req-AAA"), "req-AAA");
+    var okInfo = await ciba.parseNotification(okPush.req, okPush.opts);
+    check("parseNotification: id_token bound to the notification's auth_req_id is accepted",
+          okInfo && okInfo.authReqId === "req-AAA" && okInfo.claims && okInfo.claims.claims &&
+          okInfo.claims.claims["urn:openid:params:jwt:claim:auth_req_id"] === "req-AAA");
+
+    // id_token minted for a DIFFERENT auth_req_id → refused (substitution).
+    var badPush = _push(_mintIdToken(issuer, "req-BBB"), "req-AAA");
+    var threwMismatch = null;
+    try { await ciba.parseNotification(badPush.req, badPush.opts); }
+    catch (e) { threwMismatch = e; }
+    check("parseNotification: id_token for a different auth_req_id refused",
+          threwMismatch && threwMismatch.code === "auth-ciba/id-token-authreqid-mismatch");
+
+    // id_token with no auth_req_id claim → refused (MUST be present).
+    var noClaimPush = _push(_mintIdToken(issuer, undefined), "req-AAA");
+    var threwAbsent = null;
+    try { await ciba.parseNotification(noClaimPush.req, noClaimPush.opts); }
+    catch (e) { threwAbsent = e; }
+    check("parseNotification: id_token missing the auth_req_id claim refused",
+          threwAbsent && threwAbsent.code === "auth-ciba/id-token-authreqid-mismatch");
+
+    // An EMPTY auth_req_id in the notification body must be refused outright —
+    // otherwise it reaches the binding helper as a falsy expected value and the
+    // substitution defense is skipped, so an id_token minted for ANOTHER flow
+    // would be returned as trusted.
+    var emptyPush = _push(_mintIdToken(issuer, "req-attacker"), "");
+    var threwEmpty = null;
+    try { await ciba.parseNotification(emptyPush.req, emptyPush.opts); }
+    catch (e) { threwEmpty = e; }
+    check("parseNotification: empty auth_req_id in the body is refused",
+          threwEmpty && threwEmpty.code === "auth-ciba/no-auth-req-id-in-body");
+  });
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK ciba-authreqid-binding — " + helpers.getChecks() + " checks"); })
+       .catch(function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -3061,6 +3061,7 @@ async function testNoDuplicateCodeBlocks() {
         "lib/archive-tar-read.js:_assertGuardMetadata",
         "lib/archive-tar-read.js:extract",
         "lib/auth/ciba.js:_registerInitialInterval",
+        "lib/auth/ciba.js:_verifyIdTokenIfPresent",
         "lib/auth/ciba.js:pollToken",
         "lib/auth/oauth.js:exchangeToken",
         "lib/auth/oauth.js:pollDeviceCode",
@@ -5144,6 +5145,42 @@ var KNOWN_ANTIPATTERNS = [
     allowlist: ["lib/x509-chain.js"],
     reason: "basicConstraints cA:TRUE enforcement is owned by x509Chain.issuerValidlyIssued / x509Chain.isCaCert; tsa/mail-bimi/mail-crypto-smime route through it. Any lib file calling X.checkIssued(Y) (Y!=X) directly bypasses the cA check and must use x509Chain instead. lib/x509-chain.js is the home of the primitive.",
   },
+  {
+    id: "compose-pipeline-settle-on-response-ended-not-return",
+    primitive: "b.middleware.composePipeline",
+    scanScope: "lib",
+    skipCommentLines: true,
+    // The REGULAR (3-arg) middleware branch must settle on a HALT (the
+    // response ended), never merely because the middleware FUNCTION returned —
+    // a callback-style middleware that calls next() later (timer/stream/legacy)
+    // returns with advanced===false but is NOT halted; a bare `if (!advanced)`
+    // resolve there marks the pipeline finished so the deferred next() is
+    // ignored and the chain stalls (Codex PR#357). The fix gates on the
+    // response: `if (!advanced && _responseEnded(res))`. Anchored on the 3-arg
+    // call `entry.mw(req, res, _next)` so it targets ONLY the regular branch —
+    // the error-handler branch (`entry.mw(err, req, res, _next)`) legitimately
+    // settles on a bare `if (!advanced)` per the Express "no next = handled"
+    // convention and must not be flagged.
+    regex: /entry\.mw\(req, res, _next\)[\s\S]{0,200}?if \(\s*!advanced\s*\)\s*_resolveOnce/,
+    allowlist: [],
+    reason: "the REGULAR-middleware settle in compose-pipeline must be response-gated (`if (!advanced && _responseEnded(res))`), not a bare `if (!advanced) _resolveOnce()` — the bare form breaks callback-style deferred-next middleware (Codex PR#357). The behavioral guard is testDeferredNextContinuesChain; this detector anchors on the 3-arg entry.mw(req, res, _next) call so the error-handler branch's legitimate bare settle is not matched.",
+  },
+  {
+    id: "ciba-authreqid-binding-not-truthiness-gated",
+    primitive: "b.auth.ciba",
+    scanScope: "lib",
+    skipCommentLines: true,
+    // The CIBA id_token auth_req_id binding must not be guarded by a bare
+    // truthiness test: an empty-string auth_req_id (a valid-typed but falsy
+    // value reaching the helper from a push notification body) would skip the
+    // substitution defense entirely (Codex PR#357 — same class as the oauth
+    // empty-nonce fail-open). The fixed form fails closed:
+    // `if (typeof expectedAuthReqId !== "string" || expectedAuthReqId.length === 0)`.
+    // `expectedAuthReqId` is unique to ciba.js, so no allowlist is needed.
+    regex: /if\s*\(\s*expectedAuthReqId\s*\)/,
+    allowlist: [],
+    reason: "the CIBA auth_req_id binding must fail closed on an empty/missing id (`typeof x !== 'string' || x.length === 0`), never skip behind a bare `if (expectedAuthReqId)` — a falsy auth_req_id otherwise bypasses the cross-user token-substitution defense (Codex PR#357).",
+  },
   {
     id: "trusted-proxy-cidr-must-canonicalize-peer",
     primitive: "b.requestHelpers.trustedClientIp",

package/lib/vendor/blamejs/test/layer-0-primitives/csp-builder.test.js

@@ -50,6 +50,26 @@ function testRefusesUnsafeKeywords() {
   check("csp.build refuses 'unsafe-inline'", threw === "csp/unsafe-keyword");
 }
 
+function testRefusesDirectiveInjectionInSource() {
+  // A CSP source is a single non-whitespace token. A ';' or whitespace inside a
+  // source value would inject a new directive (the emitter ';'-joins directives,
+  // space-joins sources) — refuse both in build() and mergeDirectives().
+  var threwSemi = null;
+  try { b.csp.build({ "img-src": ["https://evil.com; script-src https://attacker.example"] }); }
+  catch (e) { threwSemi = e.code; }
+  check("csp.build refuses ';' in a source (directive injection)", threwSemi === "csp/bad-source");
+
+  var threwWs = null;
+  try { b.csp.build({ "img-src": ["https://evil.com script-src"] }); }
+  catch (e) { threwWs = e.code; }
+  check("csp.build refuses whitespace in a source", threwWs === "csp/bad-source");
+
+  var threwMerge = null;
+  try { b.csp.mergeDirectives(undefined, { "img-src": ["https://evil.com; script-src https://x"] }); }
+  catch (e) { threwMerge = e.code; }
+  check("csp.mergeDirectives refuses ';' in an added source", threwMerge === "csp/bad-source");
+}
+
 function testRefusesCatchAll() {
   var threw = null;
   try { b.csp.build({ "default-src": ["*"] }); }
@@ -155,6 +175,7 @@ function run() {
   testWebrtcDirective();
   testBuild();
   testRefusesUnsafeKeywords();
+  testRefusesDirectiveInjectionInSource();
   testRefusesCatchAll();
   testRefusesDataInImg();
   testRefusesUnknownDirective();

package/lib/vendor/blamejs/test/layer-0-primitives/db-raw-residency-gate.test.js

@@ -177,6 +177,28 @@ async function run() {
     });
     check("read-only WITH...SELECT is not gated (no residency error)", cteReadErr === null);
 
+    // RAW PATH 7: SQL unquoted identifiers are case-insensitive. An INSERT /
+    // UPDATE that spells the residency column in a different case (DATAREGION /
+    // DataRegion) must still engage the gate — a case-sensitive lookup let the
+    // column miss the `residencyColumn: "dataRegion"` declaration and admitted a
+    // cross-border write (CWE-178 / CWE-863).
+    var ciInsertCode = codeOf(function () {
+      b.db.runSql(
+        "INSERT INTO residents (_id, name, DATAREGION) VALUES ('raw-ci', 'x', 'us-east-1')");
+    });
+    check("differently-cased residency column on INSERT is still gated",
+      ciInsertCode === "db-query/row-residency-local-mismatch");
+    check("case-bypass INSERT cross-border row did not persist",
+      b.db.from("residents").where({ _id: "raw-ci" }).first() === null);
+
+    var ciUpdateCode = codeOf(function () {
+      b.db.runSql("UPDATE residents SET DataRegion='us-east-1' WHERE _id='raw-eu'");
+    });
+    check("differently-cased residency column on UPDATE is still gated",
+      ciUpdateCode === "db-query/row-residency-local-mismatch");
+    check("case-bypass UPDATE did not move the row cross-border",
+      (b.db.from("residents").where({ _id: "raw-eu" }).first() || {}).dataRegion === "eu-west-1");
+
     // A writable-CTE write to a NON-residency table is not over-rejected.
     b.db.runSql("CREATE TABLE IF NOT EXISTS notes (_id TEXT PRIMARY KEY, body TEXT)");
     b.db.runSql("WITH s AS (SELECT 'hi' AS b) INSERT INTO notes (_id, body) SELECT 'n1', b FROM s");

package/lib/vendor/blamejs/test/layer-0-primitives/fido-mds3.test.js

@@ -184,10 +184,48 @@ function testVerifyAuthenticatorClean() {
   check("verifyAuthenticator ok=true on clean entry", rv.ok === true);
   check("verifyAuthenticator surfaces statement",
         rv.statement && rv.statement.description === "Test A");
-  check("verifyAuthenticator certifiedLevel reflects highest report",
+  check("verifyAuthenticator certifiedLevel reflects the latest report",
         rv.certifiedLevel.level === 2 && rv.certifiedLevel.plus === false);
 }
 
+function testVerifyAuthenticatorDecertified() {
+  // A later NOT_FIDO_CERTIFIED decertifies the authenticator: certifiedLevel
+  // must reset to 0, not report the historical max — otherwise a step-up / risk
+  // policy that requires L2 accepts a now-uncertified authenticator.
+  var blob = {
+    entries: [{
+      aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+      metadataStatement: { description: "Test A" },
+      statusReports: [
+        { status: "FIDO_CERTIFIED_L2",  effectiveDate: "2020-01-01" },
+        { status: "NOT_FIDO_CERTIFIED", effectiveDate: "2023-01-01" },
+      ],
+    }],
+  };
+  var rv = b.auth.fidoMds3.verifyAuthenticator(blob, {
+    aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+  });
+  check("verifyAuthenticator: later NOT_FIDO_CERTIFIED resets certifiedLevel to 0",
+        rv.certifiedLevel.level === 0 && rv.certifiedLevel.plus === false);
+
+  // A downgrade (L3 then L1) reports the CURRENT L1, not the historical L3.
+  var blob2 = {
+    entries: [{
+      aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+      metadataStatement: { description: "Test B" },
+      statusReports: [
+        { status: "FIDO_CERTIFIED_L3", effectiveDate: "2019-01-01" },
+        { status: "FIDO_CERTIFIED_L1", effectiveDate: "2024-01-01" },
+      ],
+    }],
+  };
+  var rv2 = b.auth.fidoMds3.verifyAuthenticator(blob2, {
+    aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+  });
+  check("verifyAuthenticator: certifiedLevel is the latest report, not the historical max",
+        rv2.certifiedLevel.level === 1);
+}
+
 function testVerifyAuthenticatorRevoked() {
   var blob = {
     entries: [
@@ -412,6 +450,7 @@ async function run() {
   testLookupAaguid();
   testVerifyAuthenticatorClean();
   testVerifyAuthenticatorRevoked();
+  testVerifyAuthenticatorDecertified();
   testVerifyAuthenticatorPhysicalCompromise();
   testVerifyAuthenticatorRemoteCompromise();
   testVerifyAuthenticatorUnknownAaguid();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-auth.test.js

@@ -165,6 +165,34 @@ async function testInboundVerifySpoofRejected() {
   check("inbound.verify: no authservId → no A-R header", v.authResults === null);
 }
 
+async function testInboundVerifyGroupSyntaxFromRejected() {
+  // DMARC bypass via RFC 5322 group syntax: `From: Recipients:alice@victim;`
+  // carries no whitespace or comma but is not a bare addr-spec — the group
+  // `name:` prefix and trailing ';' would corrupt the extracted domain
+  // ("victim.example;"), which misses the real _dmarc.victim.example policy and
+  // would let the spoof through as "none". The From must be unparsable so the
+  // verdict fails closed (permerror → reject), not a silent pass.
+  var dnsLookup = _inboundDns({
+    "_dmarc.victim.example/TXT": [["v=DMARC1; p=reject"]],
+  });
+  var clean = await b.mail.inbound.verify({
+    ip: "203.0.113.9", helo: "evil.host", mailFrom: "x@evil.example",
+    message: "From: alice@victim.example\r\nSubject: hi\r\n\r\nbody\r\n",
+    dnsLookup: dnsLookup,
+  });
+  check("control: a clean From resolves the victim domain",
+        clean.from.domain === "victim.example");
+  var spoof = await b.mail.inbound.verify({
+    ip: "203.0.113.9", helo: "evil.host", mailFrom: "x@evil.example",
+    message: "From: Recipients:alice@victim.example;\r\nSubject: hi\r\n\r\nbody\r\n",
+    dnsLookup: dnsLookup,
+  });
+  check("group-syntax From yields no parsable domain (no corrupted hostname)",
+        spoof.from.domain === null);
+  check("group-syntax From fails closed (permerror → reject, not a silent pass)",
+        spoof.dmarc.result === "permerror" && spoof.dmarc.recommendedAction === "reject");
+}
+
 async function testInboundVerifyFromHeaderDiscipline() {
   var dnsLookup = _inboundDns({});
   // Two From fields — the header-duplication spoofing shape.
@@ -1439,6 +1467,7 @@ async function run() {
   await testDmarcEvaluateNpPolicy();
   await testInboundVerifyAlignedPass();
   await testInboundVerifySpoofRejected();
+  await testInboundVerifyGroupSyntaxFromRejected();
   await testInboundVerifyFromHeaderDiscipline();
   await testInboundVerifyTemperrorPrecedence();
   await testInboundVerifyValidation();

package/lib/vendor/blamejs/test/layer-0-primitives/mail-dkim.test.js

@@ -626,6 +626,51 @@ function testDkimStripBTagValueAnchored() {
         "v=1; pub=KEYDATA; b=");
 }
 
+// RFC 6376 §3.4.5 — the l= body-length count is octets of the body AFTER
+// canonicalization. A legitimate relaxed/relaxed sender that sets
+// l=<canonicalized-body-length> over a body whose raw form is longer (a WSP run
+// the relaxed canon collapses) must verify. Slicing the RAW body to l= octets
+// before canonicalizing yields a different body hash and wrongly rejects it.
+async function testDkimVerifyLTagCountsCanonicalizedOctets() {
+  var dkim = b.mail.dkim;
+  dkim._resetDkimKeyCacheForTest();                            // unique key — don't collide with a cached selector
+  var kp = _rsaKeypair();
+  var pubB64 = _spkiPemToB64(kp.publicKey);
+  var DOMAIN = "ltag.example", SELECTOR = "ltag1";
+
+  // Raw body carries a 10-space WSP run; relaxed canon collapses it to one SP,
+  // so the canonicalized octet count (l=) is smaller than the raw length.
+  var rawBody = "A          B\r\n";
+  var canon = dkim._canonBodyRelaxedForTest(rawBody);          // "A B\r\n"
+  var canonBuf = Buffer.from(canon, "utf8");
+  var lcap = canonBuf.length;                                  // octets of the CANONICALIZED body
+  var bh = nodeCrypto.createHash("sha256").update(canonBuf.subarray(0, lcap)).digest("base64");
+
+  var fromValue = " Alice <alice@example.com>";
+  var unsignedSigValue = [
+    "v=1", "a=rsa-sha256", "c=relaxed/relaxed",
+    "d=" + DOMAIN, "s=" + SELECTOR, "h=from", "bh=" + bh, "l=" + lcap, "b=",
+  ].join("; ");
+  // Reconstruct exactly what the verifier signs: each h= header, then the
+  // DKIM-Signature header with an empty b=, trailing CRLF stripped (§3.7).
+  var canonHeaders =
+    dkim._canonHeaderRelaxedForTest("From", fromValue) +
+    dkim._canonHeaderRelaxedForTest("DKIM-Signature", unsignedSigValue).replace(/\r\n$/, "");
+  var sig = nodeCrypto.createSign("RSA-SHA256").update(canonHeaders)
+    .sign(kp.privateKey).toString("base64");
+  var finalSigValue = unsignedSigValue.replace(/b=$/, "b=" + sig);
+
+  var message =
+    "From:" + fromValue + "\r\n" +
+    "DKIM-Signature: " + finalSigValue + "\r\n" +
+    "\r\n" + rawBody;
+
+  var dnsLookup = async function () { return [["v=DKIM1; k=rsa; p=" + pubB64]]; };
+  var rv = await dkim.verify(message, { dnsLookup: dnsLookup });
+  check("verify: l= over the canonicalized octet count passes (RFC 6376 §3.4.5)",
+        rv[0] && rv[0].result === "pass");
+}
+
 async function run() {
   testDkimSurfaceAndValidation();
   testDkimCanonicalization();
@@ -651,6 +696,7 @@ async function run() {
   await testDkimVerifySignatureCountCapped();
   await testDkimKeyCacheLru();
   testDkimStripBTagValueAnchored();
+  await testDkimVerifyLTagCountsCanonicalizedOctets();
 }
 
 module.exports = { run: run };