@blamejs/blamejs-shop 0.4.84 → 0.4.86

package/lib/vendor/blamejs/lib/object-store/http-request.js

@@ -36,6 +36,10 @@ function request(method, url, headers, body, opts) {
     url:              url,
     headers:          headers,
     body:             body,
+    // Both caps from the operator's configured timeout: timeoutMs bounds the
+    // whole request (no slow-trickle hold-open), idleTimeoutMs the zero-progress
+    // window. Undefined leaves httpClient's defaults unchanged.
+    timeoutMs:        opts.timeoutMs,
     idleTimeoutMs:    opts.timeoutMs,
     errorClass:       opts.errorClass || ObjectStoreError,
     allowedProtocols: opts.allowedProtocols,

package/lib/vendor/blamejs/lib/outbox.js

@@ -214,6 +214,35 @@ function create(opts) {
         throw new OutboxError("outbox/bad-externaldb",
           "outbox.create: externalDb must be the b.externalDb namespace (with transaction/query)");
       }
+      // The outbox dual-write guarantee (enqueue runs in the SAME
+      // transaction as the operator's business write) is VOID on a
+      // stateless / autocommit-per-statement backend: BEGIN / the
+      // business write / the enqueue INSERT / COMMIT each land on a
+      // different session, so a crash or rollback can drop the business
+      // row while keeping the event (or vice versa). Refuse at create()
+      // when the backend declares it cannot provide interactive
+      // transactions, rather than constructing an outbox whose core
+      // guarantee silently does not hold. supportsTransactions may be a
+      // boolean (custom externalDb object) or a function (the
+      // b.externalDb namespace probe); only an explicit false refuses —
+      // an absent flag preserves the historical stateful assumption.
+      var cap = v.supportsTransactions;
+      var atomic = true;
+      if (typeof cap === "function") {
+        try { atomic = !!cap(); } catch (_e) { atomic = true; }
+      } else if (cap === false) {
+        atomic = false;
+      }
+      if (!atomic) {
+        throw new OutboxError("outbox/non-atomic-backend",
+          "outbox.create: externalDb backend cannot provide interactive " +
+          "transactions (supportsTransactions: false — a stateless / " +
+          "autocommit-per-statement adapter). The outbox dual-write guarantee " +
+          "requires the business write and the enqueue INSERT to commit " +
+          "atomically in one transaction; on this backend they would not. " +
+          "Supply interactive beginTx / commit / rollback hooks, or a batch " +
+          "adapter, on the externalDb backend first.");
+      }
     },
     table: function (v) {
       validateOpts.requireNonEmptyString(v,

package/lib/vendor/blamejs/lib/queue-sqs.js

@@ -153,6 +153,7 @@ function create(opts) {
       url:              endpointUrl,
       headers:          signed.headers,
       body:             bodyBuf,
+      timeoutMs:        timeoutMs,
       idleTimeoutMs:    timeoutMs,
       allowedProtocols: allowedProtocols,
       errorClass:       QueueError,

package/lib/vendor/blamejs/lib/request-helpers.js

@@ -476,7 +476,7 @@ function _maskIpv6(ip, prefix) {
 
 /**
  * @primitive b.requestHelpers.ipPrefix
- * @signature b.requestHelpers.ipPrefix(ip)
+ * @signature b.requestHelpers.ipPrefix(ip, opts?)
  * @since     0.15.15
  * @related   b.requestHelpers.clientIp, b.requestHelpers.trustedClientIp
  *
@@ -493,22 +493,41 @@ function _maskIpv6(ip, prefix) {
  * public IP within a subnet don't log a user out). Exposed so an operator who
  * drops to a function-form fingerprint field — for a custom mask width, or to
  * combine the prefix with other signals — reuses this exact algorithm instead
- * of re-deriving the /24 + /64 masking (and silently diverging).
+ * of re-deriving the /24 + /64 masking (and silently diverging). Pass
+ * <code>opts.v4Bits</code> / <code>opts.v6Bits</code> to override the mask
+ * widths (e.g. a device fingerprint that buckets at <code>/48</code> so a
+ * client roaming within its allocation but across a <code>/64</code> doesn't
+ * drift); an out-of-range or absent value falls back to the /24 + /64 default.
+ *
+ * @opts
+ *   v4Bits: number,   // IPv4 mask width in bits (default 24; valid 0..32)
+ *   v6Bits: number,   // IPv6 mask width in bits (default 64; valid 0..128)
  *
  * @example
  *   b.requestHelpers.ipPrefix("203.0.113.47");   // → "203.0.113.0/24"
  *   b.requestHelpers.ipPrefix("2001:db8::1");     // → "2001:db8:0:0/64"
  */
-function ipPrefix(ip) {
+function _resolvePrefixBits(bits, def, max) {
+  if (typeof bits !== "number" || !isFinite(bits) || bits < 0 || bits > max) return def;
+  return bits;
+}
+function ipPrefix(ip, opts) {
   if (typeof ip !== "string" || ip.length === 0) return "";
+  opts = opts || {};
+  // Configurable mask widths (default /24 + /64); an absent or out-of-range
+  // value falls back to the default. This preserves a caller's documented
+  // prefix width (e.g. a device fingerprint bucketing at /48) instead of
+  // silently forcing /64 — while still canonicalizing the address.
+  var v4 = _resolvePrefixBits(opts.v4Bits, IPV4_DEFAULT_PREFIX, 32);                            // IPv4 max prefix length in bits
+  var v6 = _resolvePrefixBits(opts.v6Bits, IPV6_DEFAULT_PREFIX, 128);                           // IPv6 max prefix length in bits
   // IPv4-mapped IPv6 (::ffff:1.2.3.4) — strip the wrapper so the v4 mask
   // applies. Same bucket regardless of how the proxy reported it.
   var lower = ip.toLowerCase();
   if (lower.indexOf(V4_MAPPED_V6_PREFIX) === 0 && lower.indexOf(".") !== -1) {
-    return _maskIpv4(lower.substring(V4_MAPPED_V6_PREFIX.length), IPV4_DEFAULT_PREFIX) || "";
+    return _maskIpv4(lower.substring(V4_MAPPED_V6_PREFIX.length), v4) || "";
   }
-  if (ip.indexOf(":") !== -1) return _maskIpv6(ip, IPV6_DEFAULT_PREFIX) || "";
-  if (ip.indexOf(".") !== -1) return _maskIpv4(ip, IPV4_DEFAULT_PREFIX) || "";
+  if (ip.indexOf(":") !== -1) return _maskIpv6(ip, v6) || "";
+  if (ip.indexOf(".") !== -1) return _maskIpv4(ip, v4) || "";
   return "";
 }
 

package/lib/vendor/blamejs/lib/session-device-binding.js

@@ -52,6 +52,14 @@
  * primitive falls back to b.session.touch metadata when the operator
  * passes session=b.session AND opts in via storeInSession=true.
  *
+ * No store at all: create() with neither bindingStore nor storeInSession
+ * still returns an instance — its stateless fingerprint(req) works (it
+ * touches no store), while bind/verify/unbind throw a clear "no store
+ * configured" error. Operators who only need the soft, store-free digest
+ * (sealed inside a self-validating cookie / JWT that compares it itself)
+ * can also skip create() entirely and call the static
+ * b.sessionDeviceBinding.fingerprint(req, opts).
+ *
  * Audit emissions:
  *
  *   session.device.bound      every successful bind()
@@ -61,7 +69,9 @@
  *
  * Validation policy:
  *   - create() opts → throw at config time
- *   - bind / verify  → throw on bad token / req shape (operator typo)
+ *   - bind / verify / unbind → throw on bad token / req shape (operator
+ *                      typo), and throw "no store configured" when called
+ *                      on a store-free instance
  *   - storage errors  → fail-CLOSED on verify (drift indistinguishable
  *                       from a wiped store, refuse rather than allow)
  *                       fail-OPEN on bind (don't lose a fresh session
@@ -135,28 +145,22 @@ function _normalizeAcceptEncoding(value) {
     .join(",");
 }
 
+// Mask the client IP to its fingerprint bucket. Routes through the shared
+// canonical masker (requestHelpers.ipPrefix) so a `::`-shorthand address and
+// its fully-expanded equivalent (2001:db8::1 vs 2001:db8:0:0:0:0:0:1), or a
+// leading-zero-folded group, collapse to ONE bucket — the hand-rolled textual
+// ':'-group slice this replaced hashed them differently and logged a roaming
+// user out on a false drift. `bits === 0` is the documented "skip the IP check
+// entirely" escape hatch (mobile clients that switch networks), so it returns
+// "" before any masking. `bits` is the family-resolved configured width (cfg
+// .v4Bits for a v4 client, cfg.v6Bits for v6 — default /24 + /48); pass it as
+// BOTH v4Bits and v6Bits so the canonical masker applies the configured width
+// to whichever family it detects, instead of ipPrefix's bare /24 + /64 default
+// (which would drop the configured width AND silently tighten v6 from /48 to /64).
 function _ipPrefix(ip, bits) {
   if (typeof ip !== "string" || ip.length === 0) return "";
   if (bits === 0) return "";
-  // IPv6
-  if (ip.indexOf(":") !== -1) {
-    var v6Bits = bits;
-    var groups = ip.split(":");
-    // Naive expansion — keep the first ceil(v6Bits/16) groups intact
-    // and zero the rest. Sufficient for fingerprint stability; not a
-    // canonical IPv6 representation.
-    var keepGroups = Math.ceil(v6Bits / 16); // IPv6 group width in bits
-    var kept = groups.slice(0, keepGroups).join(":");
-    return "v6:" + kept + "/" + v6Bits;
-  }
-  // IPv4
-  var parts = ip.split(".");
-  if (parts.length !== 4) return "v4:" + ip + "/" + bits;
-  var v4Bits = bits;
-  var keepOctets = Math.floor(v4Bits / 8); // IPv4 octet width in bits
-  var maskedOctets = parts.slice(0, keepOctets);
-  while (maskedOctets.length < 4) maskedOctets.push("0");
-  return "v4:" + maskedOctets.join(".") + "/" + v4Bits;
+  return requestHelpers.ipPrefix(ip, { v4Bits: bits, v6Bits: bits });
 }
 
 // Resolve operator-supplied fingerprintExtras(req) to a stable string. A
@@ -195,6 +199,7 @@ function _computeDeviceFingerprint(req, cfg) {
   var ae = _normalizeAcceptEncoding(headers["accept-encoding"]);
   var ip = "";
   try { ip = requestHelpers.clientIp(req); } catch (_e) { ip = ""; }
+  if (typeof ip !== "string") ip = "";
   var family = ip.indexOf(":") !== -1 ? "v6" : "v4";
   var ipPart = _ipPrefix(ip, family === "v6" ? cfg.v6Bits : cfg.v4Bits);
   var keyPart = "";
@@ -291,10 +296,15 @@ function create(opts) {
   }
 
   var storeInSession = !!opts.storeInSession;
-  if (!storeInSession && !opts.bindingStore) {
-    throw new SessionDeviceBindingError("session-device-binding/bad-opt",
-      "either bindingStore (b.cache-shaped) or storeInSession=true must be set");
-  }
+  // A no-store instance is still useful: the stateless fingerprint() reads no
+  // store and is the soft device-binding building block for self-validating
+  // tokens (a sealed cookie / JWT carrying the fingerprint inside). Rather than
+  // refuse to construct (issue #330 — fingerprint() unreachable without a
+  // store), build the instance and let the persisted bind()/verify() lifecycle
+  // throw a clear "no store configured" when actually called. Operators wanting
+  // ONLY the stateless digest can also use the static
+  // b.sessionDeviceBinding.fingerprint(req, opts) with no create() at all.
+  var hasStore = !!(storeInSession || opts.bindingStore);
   if (opts.bindingStore) _requireBindingStore(opts.bindingStore);
   if (storeInSession && (!opts.session || typeof opts.session.touch !== "function")) {
     throw new SessionDeviceBindingError("session-device-binding/bad-opt",
@@ -351,8 +361,18 @@ function create(opts) {
     return { ok: true, fingerprint: r.fingerprint, components: r.components };
   }
 
+  function _requireStore(stage) {
+    if (!hasStore) {
+      throw new SessionDeviceBindingError("session-device-binding/no-store",
+        stage + ": no store configured — pass bindingStore (b.cache-shaped) or "
+        + "storeInSession=true to create(), or use the stateless "
+        + "b.sessionDeviceBinding.fingerprint(req, opts) for soft binding");
+    }
+  }
+
   async function bind(token, req) {
     _requireToken(token);
+    _requireStore("bind");
     var fp = _computeFingerprint(req);
     if (!fp.ok) {
       _emitObs("session.device.refused", { reason: fp.reason });
@@ -408,6 +428,7 @@ function create(opts) {
 
   async function verify(token, req) {
     _requireToken(token);
+    _requireStore("verify");
     var fpResult = _computeFingerprint(req);
     if (!fpResult.ok) {
       _emitObs("session.device.refused", { reason: fpResult.reason });
@@ -444,6 +465,7 @@ function create(opts) {
 
   async function unbind(token) {
     _requireToken(token);
+    _requireStore("unbind");
     if (bindingStore) {
       try { await bindingStore.del(token); } catch (_e) { /* drop-silent */ }
     }

package/lib/vendor/blamejs/lib/session.js

@@ -182,6 +182,49 @@ function _validFromConflictRefs(dialect, table) {
   };
 }
 
+// CREATE TABLE IF NOT EXISTS for the valid-from boundary, matching the
+// framework schema in db.js (single-node) / framework-schema.js (cluster mode):
+// subjectHash PRIMARY KEY, validFromEpoch + updatedAt NOT NULL. The pluggable
+// store is always a dedicated node:sqlite file (b.session.stores.localDbThin —
+// see session-stores.js), so the dialect is the literal "sqlite". Used to
+// provision the table on demand in a store-backed-only deployment (a
+// b.session.useStore consumer that never ran b.db.init(), so the framework db
+// — the default home of this table — is not initialized).
+function _validFromSchemaSql() {
+  return sql.createTable(_validFromSqlTable(), [
+    { name: "subjectHash",    type: "text", primaryKey: true },
+    { name: "validFromEpoch", type: "int",  notNull: true },
+    { name: "updatedAt",      type: "int",  notNull: true },
+  ], { dialect: "sqlite" }).sql;
+}
+
+// Run a valid-from boundary operation (bump write / validFrom read / check
+// read) against the correct backend. The boundary lives in the FRAMEWORK db
+// (clusterStorage) — it is a stateless-token revocation primitive shared across
+// every issuer, not per-session data — so that is always the first choice and a
+// present db is never silently bypassed. ONLY when the framework db is not
+// initialized (single-node, b.db.init() never awaited) AND an operator store is
+// configured (b.session.useStore) does the boundary fall back to that store, so
+// a store-backed-only deployment's logout-everywhere still raises (and honors)
+// the stateless boundary instead of 500ing on db/not-initialized (#340). With
+// neither a framework db nor a store, db/not-initialized is a real
+// misconfiguration and propagates unchanged (fail closed — the boundary is
+// never silently dropped). The store provisions the table on demand because a
+// session-data store (localDbThin) does not ship the valid-from DDL.
+async function _runValidFrom(runner) {
+  try {
+    return await runner(clusterStorage);
+  } catch (e) {
+    if (e && e.code === "db/not-initialized" && _store) {
+      // Framework db absent, operator store present: route through the store,
+      // provisioning the boundary table first (idempotent CREATE IF NOT EXISTS).
+      await _store.execute(_validFromSchemaSql(), []);
+      return await runner(_store);
+    }
+    throw e;
+  }
+}
+
 // Column order used for INSERT — kept as a constant so the placeholders
 // list and the values list stay in sync. Must match the session table's
 // schema in db.js (single-node) and framework-schema.js (cluster mode).
@@ -786,21 +829,23 @@ async function destroyAllForUser(userId) {
   var result = await _currentStore().execute(built.sql, built.params);
   // Also raise the stateless valid-from boundary so a "logout everywhere"
   // revokes the operator's stateless tokens (sealed cookies / JWTs checked via
-  // b.session.check) too, not only the store-backed rows just deleted. This
-  // bump writes to the FRAMEWORK db (clusterStorage); a pluggable-store consumer
-  // (b.session.useStore) who never ran b.db.init() would otherwise surface the
-  // opaque "db/not-initialized" here, after the store delete already succeeded.
-  // Rethrow it as a session-specific, actionable error.
+  // b.session.check) too, not only the store-backed rows just deleted. bump()
+  // writes to the framework db when one is initialized, otherwise to the
+  // configured store (b.session.useStore) — so a store-backed-only consumer who
+  // never ran b.db.init() still raises the boundary here instead of 500ing on
+  // db/not-initialized (#340). The only state in which bump still surfaces
+  // db/not-initialized is the default store (no useStore) with an uninitialized
+  // framework db — but the store DELETE above (also via clusterStorage) would
+  // have already thrown, so this rewrap is defensive belt-and-suspenders.
   try {
     await bump(userId);
   } catch (e) {
     if (e && e.code === "db/not-initialized") {
       throw _err("MISCONFIGURED",
         "session.destroyAllForUser raises the stateless valid-from boundary (so a " +
-        "logout-everywhere also revokes sealed-cookie / JWT sessions), which requires " +
-        "b.db.init() — call it at boot even when session data lives in a pluggable " +
-        "store (b.session.useStore). The store-backed rows were already deleted; rerun " +
-        "after b.db.init() to also raise the stateless boundary.", true);
+        "logout-everywhere also revokes sealed-cookie / JWT sessions). No storage is " +
+        "available: call b.db.init() at boot, OR configure a session store via " +
+        "b.session.useStore. The store-backed rows were already deleted.", true);
     }
     throw e;
   }
@@ -1340,21 +1385,27 @@ async function bump(subjectId, opts) {
     .returning(["validFromEpoch"])
     .toSql();
   // The valid-from boundary is a FRAMEWORK table (FRAMEWORK_SCHEMA / cluster
-  // DDL), NOT session data — it must execute against clusterStorage (the
-  // framework db), never _currentStore(): a pluggable session-data store
-  // (b.session.useStore / localDbThin) does not provision this table, so
-  // routing the bump through it throws "no such table".
-  var row;
-  if (built.readbackSql) {
-    // MySQL: ON DUPLICATE KEY UPDATE has no RETURNING — run the upsert, then
-    // the readback SELECT b.sql emits (keyed on subjectHash).
-    await clusterStorage.execute(built.sql, built.params);
-    var readback = await clusterStorage.execute(built.readbackSql.sql, built.readbackSql.params);
-    row = readback.rows && readback.rows[0];
-  } else {
-    var result = await clusterStorage.execute(built.sql, built.params);
-    row = result.rows && result.rows[0];
-  }
+  // DDL), NOT session data — it executes against clusterStorage (the framework
+  // db) whenever one is initialized, never _currentStore(). When the framework
+  // db is NOT initialized but an operator store IS configured (a store-backed-
+  // only b.session.useStore deployment that never ran b.db.init()), the boundary
+  // falls back to that store — provisioned on demand — so logout-everywhere
+  // still raises the stateless boundary instead of throwing db/not-initialized
+  // (#340). _runValidFrom resolves the target; never silently drops the boundary
+  // when a db is present, and propagates db/not-initialized when neither exists.
+  var row = await _runValidFrom(async function (target) {
+    if (built.readbackSql) {
+      // MySQL: ON DUPLICATE KEY UPDATE has no RETURNING — run the upsert, then
+      // the readback SELECT b.sql emits (keyed on subjectHash). MySQL only ever
+      // runs against the framework cluster db; the localDbThin fallback store is
+      // sqlite (RETURNING), so this branch never routes through it.
+      await target.execute(built.sql, built.params);
+      var readback = await target.execute(built.readbackSql.sql, built.readbackSql.params);
+      return readback.rows && readback.rows[0];
+    }
+    var result = await target.execute(built.sql, built.params);
+    return result.rows && result.rows[0];
+  });
   var effective = row ? Number(row.validFromEpoch) : epochMs;
 
   // Best-effort audit — matches the file's emit convention (safeEmit is
@@ -1393,10 +1444,16 @@ async function validFrom(subjectId) {
     .columns(["validFromEpoch"])
     .where("subjectHash", _hashSubjectId(subjectId))
     .toSql();
-  // Framework valid-from table — read from clusterStorage (the framework db),
-  // not _currentStore(), so a pluggable session-data store cannot divert it (it
-  // does not provision this table). See bump() for the full rationale.
-  var row = await clusterStorage.executeOne(built.sql, built.params);
+  // Framework valid-from table — read from clusterStorage (the framework db)
+  // when one is initialized, falling back to the configured store only when it
+  // is not (the same store bump() wrote the boundary to in a store-backed-only
+  // deployment). _runValidFrom keeps the read on the SAME backend the write
+  // chose, so a boundary raised via destroyAllForUser/bump is the one read back
+  // here. See bump() for the full rationale (#340).
+  var row = await _runValidFrom(async function (target) {
+    var result = await target.execute(built.sql, built.params);
+    return result.rows && result.rows.length > 0 ? result.rows[0] : null;
+  });
   return row ? Number(row.validFromEpoch) : 0;
 }
 

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.15",
+  "version": "0.15.16",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.16.json

@@ -0,0 +1,94 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.16",
+  "date": "2026-06-22",
+  "headline": "A correctness and hardening release: a broad set of credential and certificate verifiers now fail closed on a present-but-unparseable timestamp instead of silently skipping the check, outbound network clients gain an overall wall-clock timeout and a bounded framing buffer, DMARC refuses a record with no usable policy, append-only log sinks refuse a symlinked path, and the interactive-transaction and replay-store contracts refuse a backend that cannot honor them",
+  "summary": "This release closes a family of fail-open and resource-exhaustion gaps without adding opt-ins to the request path. A recurring pattern across the verifiers — a timestamp parsed with a lenient parser, then gated by isFinite() so an unparseable value disables the check — is converted to fail-closed everywhere it appears: DKIM x=/t=/l=, ARC AMS/AS t=/x=, SAML Bearer and holder-of-key NotBefore, and the FIDO MDS3 / BIMI / S/MIME certificate validity windows now refuse a malformed value rather than accepting the credential. DMARC now validates and requires a usable p= policy and never recommends delivery for a failing message with an absent or unrecognized policy. Outbound clients that exposed a single timeout but applied it only as an idle (zero-progress) timer now also enforce it as an overall wall-clock cap, so a peer that trickles bytes within the idle window can no longer hold a request open indefinitely: the encrypted HTTP client, the object-store and SQS request paths, the CloudWatch / OTLP / webhook log sinks, and the password breach check. The DNS resolver and the lower-level DNS client gain a per-query wall-clock deadline that also tears the socket down, the SMTP client and the proxy CONNECT tunnel bound their framing buffers and add an overall deadline, and the NTS key-establishment handshake bounds its accumulator. The append-only local log sink and the daemon log open with O_NOFOLLOW so a symlink planted at the path is refused rather than followed. b.externalDb.transaction and b.outbox now refuse a backend that declares it cannot provide an interactive transaction instead of silently running a non-atomic block, and the GraphQL-federation replay store adopts the framework's atomic check-and-insert contract.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Certificate and credential verifiers fail closed on an unparseable timestamp",
+          "body": "A present-but-unparseable date no longer silently disables a validity check. DKIM x= / t= (signature expiry, future-date, ordering) and l= (body-length cap), ARC AMS/AS t= / x=, SAML Bearer and holder-of-key SubjectConfirmationData NotBefore, and the FIDO MDS3, BIMI, and S/MIME certificate validity windows previously parsed the value, then guarded the comparison with isFinite() — so a value that did not parse (NaN) skipped the check and the credential was accepted. Each now refuses a present-but-unparseable value (a permerror / not-valid result) and only an absent optional field is ignored, matching the existing fail-closed handling of the SAML Conditions block."
+        },
+        {
+          "title": "DMARC refuses a record with no usable policy",
+          "body": "The DMARC policy tag p= (and the subdomain sp=) were taken verbatim with no validation and p= was never required, so the disposition mapped a null or typo'd policy to the catch-all \"deliver\". A failing, unaligned message against a domain whose record omitted p= or carried an unrecognized value was therefore delivered. p= and sp= are now validated against none|quarantine|reject, p= is required for a record to carry a policy at all, an invalid record is a permerror (not a transient temperror), and the disposition is an explicit fail-closed mapping that never delivers a failing message on an absent or unrecognized policy."
+        },
+        {
+          "title": "Outbound clients enforce an overall wall-clock timeout, not only an idle timeout",
+          "body": "Several clients exposed a single timeout but forwarded it to the underlying request only as idleTimeoutMs (a zero-progress cap that resets on every received byte), leaving no overall bound — a peer that trickles one byte inside each idle window holds the call open indefinitely. b.httpClient.encrypted (which dropped timeoutMs entirely, and now also forwards the caller's AbortSignal), the object-store request path and Azure/GCS bucket operations, the SQS queue client, the CloudWatch / OTLP / webhook log sinks, and the password HIBP breach check now set the overall wall-clock timeout alongside the idle timeout."
+        },
+        {
+          "title": "DNS lookups gain a default wall-clock deadline and tear the socket down",
+          "body": "The DNS resolver's DoH transport had no time bound of any kind and the lower-level DNS client defaulted its lookup timeout to zero (no deadline). A non-responsive or slow-trickle upstream — reachable while resolving DKIM/SPF/BIMI records for inbound mail — held the lookup pending forever. The resolver now takes a per-query timeout (default 10s) wrapping every query and CNAME hop, the DNS client defaults its lookup timeout to 10s (operators opt out with a zero timeout), and the raw DoH/DoT request paths arm a socket timeout that destroys the connection on a stall rather than leaking the descriptor."
+        },
+        {
+          "title": "SMTP, proxy-CONNECT, and NTS clients bound their read buffers and add deadlines",
+          "body": "The SMTP client accumulated the server's reply without a byte cap and relied on an idle timer alone; a hostile or broken MX that never sent a line terminator could exhaust memory, and a slow trickle held the transaction open. It now caps the accumulated reply (refusing once it exceeds the response ceiling) and enforces an overall transaction deadline. The proxy CONNECT-tunnel client, which accumulated the proxy's reply unbounded with no socket timeout, now caps the header buffer and times out the connect. The NTS key-establishment handshake reader caps its record accumulator so a server streaming non-terminating records cannot exhaust memory before the handshake timer fires."
+        },
+        {
+          "title": "Append-only log sinks refuse a symlinked path",
+          "body": "The local log sink and the daemon log opened the active file in append mode without O_NOFOLLOW, so a symlink planted at the log path (including one re-planted in the race window after a caller's pre-check) was followed, redirecting log writes to an attacker-chosen file. Both now open with O_NOFOLLOW via the new b.atomicFile.openAppendNoFollowSync, refusing a symlinked final path component."
+        },
+        {
+          "title": "Transaction and replay-store contracts refuse a backend that cannot honor them",
+          "body": "b.externalDb.transaction and b.outbox.create now refuse a backend that declares it cannot provide an interactive transaction (a stateless / autocommit-per-statement adapter) instead of silently running BEGIN, the body, and COMMIT on different sessions — no isolation, no rollback — while reporting success. b.graphqlFederation.guardSdl now consults its replay nonce store through the framework's atomic checkAndInsert(nonce, expireAt) contract (the same one b.webhook and b.nonceStore use) rather than a non-atomic has()-then-remember() check that raced concurrent redeliveries; a store lacking checkAndInsert is refused at construction."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "b.session.destroyAllForUser works for pluggable-store consumers",
+          "body": "A consumer configuring sessions through b.session.useStore without calling b.db.init() got a db/not-initialized error from destroyAllForUser — every \"log out everywhere\" / suspend / delete path rejected with a 500 after the store rows had already been deleted, because the stateless valid-from boundary write was routed only to the framework database. The boundary now prefers the framework database when one is initialized and otherwise falls back to the configured session store (provisioning its table on demand), so store-backed deployments raise the stateless boundary successfully; it still fails closed when neither a framework database nor a store is available."
+        }
+      ]
+    },
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.atomicFile.openAppendNoFollowSync — symlink-refusing append open",
+          "body": "Opens a long-lived append target (an active log file kept open across appends and reopened on rotation) with O_WRONLY | O_APPEND | O_CREAT | O_NOFOLLOW: the file is created or appended normally, but a symlink at the final path component fails the open closed (ELOOP) rather than redirecting writes. The append-sink counterpart to openNoFollowSync (read) and the exclusive-create temp open."
+        },
+        {
+          "title": "b.externalDb.supportsTransactions() and stateless-adapter declaration",
+          "body": "A backend adapter may declare supportsTransactions: false (a stateless / autocommit-per-statement adapter) and/or provide a batch(client, statements) hook for an atomic multi-statement path. b.externalDb.supportsTransactions() reports whether the picked backend can provide an interactive transaction, so a consumer built on the dual-write guarantee can refuse a non-atomic backend up front."
+        },
+        {
+          "title": "Store-free device fingerprint",
+          "body": "b.sessionDeviceBinding.fingerprint(req, opts) is now a static entry point returning the request-shape digest with no store, and b.sessionDeviceBinding.create() with neither a bindingStore nor storeInSession returns an instance whose stateless fingerprint() works while bind()/verify() throw a clear \"no store configured\". Soft device binding for self-validating tokens (a sealed cookie or JWT carrying the fingerprint) no longer needs a fabricated no-op store."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Device fingerprint IP masking is canonical",
+          "body": "b.sessionDeviceBinding masked the client IP into its prefix bucket by textual group slicing with no IPv6 normalization, so equivalent forms of one address (a ::-compressed form vs its fully-expanded form) hashed to different fingerprints and a roaming client could be logged out on a false drift. It now masks through the same canonical prefix helper b.session uses, preserving the configured prefix width (the IPv6 default stays /48, and ipPrefixBits is honored). b.requestHelpers.ipPrefix accepts { v4Bits, v6Bits } to override the /24 + /64 default for a function-form fingerprint or other reuse."
+        }
+      ]
+    },
+    {
+      "heading": "Migration",
+      "items": [
+        {
+          "title": "DNS lookups now time out by default",
+          "body": "The lower-level DNS client's lookup timeout previously defaulted to zero (no deadline); it now defaults to 10 seconds. A deployment that intentionally ran DNS lookups with no wall-clock bound must set the lookup timeout to zero explicitly to restore the old behavior. The b.network.dns.resolver default timeout is also 10 seconds and is configurable via its timeoutMs option."
+        },
+        {
+          "title": "b.graphqlFederation.guardSdl nonceStore contract",
+          "body": "guardSdl's optional replay nonceStore now requires the atomic checkAndInsert(nonce, expireAt) contract (b.nonceStore.create is the reference store) and refuses the previous { has, remember } shape at construction. Operators using the old shape should pass b.nonceStore.create(...) or an adapter exposing checkAndInsert."
+        },
+        {
+          "title": "Interactive transactions on a stateless backend are refused",
+          "body": "If an externalDb backend adapter declares supportsTransactions: false, b.externalDb.transaction and b.outbox.create now throw rather than running a silently non-atomic block. Existing stateful adapters (Postgres / MySQL / SQLite, and any adapter that supplies beginTx/commit/rollback or omits the flag) are unaffected. A stateless / autocommit-per-statement adapter should supply interactive transaction hooks or a batch adapter."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/api-encrypt.test.js

@@ -1508,6 +1508,7 @@ async function run() {
   await testApiEncryptDerivedPruneInterval();
   await testApiEncryptHttpClientHelperShape();
   await testApiEncryptHttpClientRoundTrip();
+  await testApiEncryptHttpClientWallClockTimeout();
   await testApiEncryptEncryptedErrorReadback();
 
   // v0.7.3 — per-session keying mode
@@ -1530,6 +1531,56 @@ async function run() {
   await testApiEncryptObservabilityCounters();
 }
 
+// #355 — b.httpClient.encrypted must forward timeoutMs (overall wall-clock cap),
+// not only idleTimeoutMs. A peer that trickles bytes within the idle window
+// (never tripping the idle timeout) but never completes the response would
+// otherwise hold the encrypted call open indefinitely. RED before the fix
+// (timeoutMs absent from the passable forwarding set): the request never settles
+// inside the wall-clock bound. GREEN after: it rejects at ~timeoutMs.
+async function testApiEncryptHttpClientWallClockTimeout() {
+  var http = require("http");
+  var keypair = _serverKeypair();
+  var timer = null;
+  var server = http.createServer(function (req, res) {
+    req.on("data", function () {});
+    req.on("end", function () {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      // Trickle one byte every 50ms forever — socket never idle long enough to
+      // trip idleTimeoutMs, response never ends → only a wall-clock cap bounds it.
+      timer = setInterval(function () { try { res.write("x"); } catch (_e) { /* socket gone */ } }, 50);
+      res.on("close", function () { if (timer) { clearInterval(timer); timer = null; } });
+    });
+  });
+  var port = await helpers.listenOnRandomPort(server);
+  try {
+    var enc = b.httpClient.encrypted({
+      pubkey:  keypair,
+      baseUrl: "http://127.0.0.1:" + port,
+      method:  "POST",
+    });
+    var started = Date.now();
+    var rejected = false;
+    try {
+      await enc.request({
+        path:             "/slow",
+        body:             { user: "alice" },
+        timeoutMs:        400,                       // overall wall-clock cap
+        allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL,
+        allowInternal:    true,
+      });
+    } catch (_e) {
+      rejected = true;
+    }
+    var elapsed = Date.now() - started;
+    check("httpClient.encrypted: slow-trickle request is bounded (rejects)", rejected === true);
+    check("httpClient.encrypted: bounded by the wall-clock cap (~timeoutMs, not idle)",
+          elapsed < 3000);
+  } finally {
+    if (timer) clearInterval(timer);
+    server.close();
+  }
+}
+
 module.exports = { run: run };
 
 if (require.main === module) {