@blamejs/blamejs-shop 0.4.85 → 0.4.86

package/lib/vendor/blamejs/lib/network-dns.js

@@ -28,11 +28,18 @@ var HEX_RADIX        = C.BYTES.bytes(16);   // parseInt / toString radix-16
 var observability = lazyRequire(function () { return require("./observability"); });
 var safeEnv = require("./parsers/safe-env");
 
+// Default wall-clock deadline for every lookup (resolve / DoH / DoT /
+// system). Without a non-zero default a header-then-stall or
+// slow-trickle upstream hangs the request forever (CWE-400). 10s
+// matches the resolver's default. Operators override via
+// setLookupTimeoutMs(); 0 disables the deadline (operator opt-out).
+var DEFAULT_LOOKUP_TIMEOUT_MS = C.TIME.seconds(10);
+
 var STATE = {
   servers:        null,
   resultOrder:    null,
   family:         0,
-  lookupTimeoutMs: 0,
+  lookupTimeoutMs: DEFAULT_LOOKUP_TIMEOUT_MS,
   cacheTtlMs:     0,
   cacheNegativeTtlMs: 0,
   doh:            null,
@@ -285,6 +292,19 @@ function _withTimeout(promise, ms, host) {
   });
 }
 
+// Arm a wall-clock deadline on a raw https.request so a stalled upstream
+// (headers-then-stall, slow-trickle body) tears the socket down instead
+// of leaking the fd until the process exits. The promise-level
+// _withTimeout rejects the caller, but only this destroys the underlying
+// connection. No-op when the operator has disabled the deadline (ms<=0).
+function _armRequestTimeout(req, ms, host, reject) {
+  if (ms <= 0) return;
+  req.setTimeout(ms, function () {
+    try { req.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+    reject(new DnsError("dns/lookup-timeout", "dns lookup of '" + host + "' exceeded " + ms + "ms"));
+  });
+}
+
 function _encodeDnsQuery(host, qtype) {
   var parts = host.split(".").filter(Boolean);
   var nameLen = 1;
@@ -450,6 +470,7 @@ async function _dohLookup(host, family) {
       });
     });
     req.on("error", function (e) { reject(new DnsError("dns/doh-failed", "DoH request failed: " + e.message)); });
+    _armRequestTimeout(req, STATE.lookupTimeoutMs, host, reject);
     if (usePost) req.write(enc.buf);
     req.end();
   });
@@ -511,6 +532,7 @@ async function _dohLookupSecure(host, family) {
       });
     });
     req.on("error", function (e) { reject(new DnsError("dns/doh-failed", "DoH request failed: " + e.message)); });
+    _armRequestTimeout(req, STATE.lookupTimeoutMs, host, reject);
     if (usePost) req.write(enc.buf);
     req.end();
   });
@@ -591,6 +613,17 @@ function _dotConnect() {
   // when idle — _dotLookup toggles this around its query. Calling
   // unref() unconditionally here let node exit during a normal lookup
   // when no other I/O kept the event loop alive.
+  //
+  // Wall-clock teardown: a stalled handshake or trickle-response upstream
+  // would otherwise leak the socket until the process exits (CWE-400).
+  // On inactivity past the deadline destroy the socket — the pool's
+  // error/close handlers evict it and the next lookup rebuilds. No-op
+  // when the operator has disabled the deadline (lookupTimeoutMs<=0).
+  if (STATE.lookupTimeoutMs > 0) {
+    sock.setTimeout(STATE.lookupTimeoutMs, function () {
+      try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+    });
+  }
   return sock;
 }
 
@@ -865,6 +898,7 @@ async function _dohRawQuery(host, qtype) {
       });
     });
     req.on("error", function (e) { reject(new DnsError("dns/doh-failed", "DoH request failed: " + e.message)); });
+    _armRequestTimeout(req, STATE.lookupTimeoutMs, host, reject);
     if (usePost) req.write(enc.buf);
     req.end();
   });
@@ -979,6 +1013,17 @@ async function _systemRawQuery(host, qtype) {
       try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
       if (err) reject(err); else resolve(val);
     }
+    // Wall-clock teardown: a server that accepts the TCP connection but
+    // never replies (or trickles the length-prefix) would otherwise hang
+    // the query forever (CWE-400). On inactivity past the deadline
+    // settle()'s destroy() tears the socket down. No-op when the operator
+    // has disabled the deadline (lookupTimeoutMs<=0).
+    if (STATE.lookupTimeoutMs > 0) {
+      sock.setTimeout(STATE.lookupTimeoutMs, function () {
+        settle(new DnsError("dns/lookup-timeout",
+          "system DNS TCP query of '" + host + "' exceeded " + STATE.lookupTimeoutMs + "ms"));
+      });
+    }
     sock.on("connect", function () {
       var lenBuf = Buffer.alloc(2);
       lenBuf.writeUInt16BE(enc.buf.length, 0);
@@ -1684,7 +1729,7 @@ function nodeLookup(host, options, callback) {
 function _stateForTest() { return STATE; }
 function _resetForTest() {
   STATE.servers = null; STATE.resultOrder = null; STATE.family = 0;
-  STATE.lookupTimeoutMs = 0; STATE.cacheTtlMs = 0; STATE.cacheNegativeTtlMs = 0;
+  STATE.lookupTimeoutMs = DEFAULT_LOOKUP_TIMEOUT_MS; STATE.cacheTtlMs = 0; STATE.cacheNegativeTtlMs = 0;
   STATE.doh = null; STATE.dot = null; STATE.systemResolver = false;
   _designatedResolvers = null;
   _clearCache();

package/lib/vendor/blamejs/lib/network-nts.js

@@ -7,12 +7,20 @@ var nodeCrypto = require("node:crypto");
 var C = require("./constants");
 var { timingSafeEqual } = require("./crypto");
 var validateOpts = require("./validate-opts");
+var safeBuffer = require("./safe-buffer");
 var { defineClass } = require("./framework-error");
 
 var NtsError = defineClass("NtsError", { alwaysPermanent: false });
 
 var NTS_KE_DEFAULT_PORT = 4460;
 var NTPV4_DEFAULT_PORT  = 123;
+// Upper bound on accumulated NTS-KE handshake bytes before a REC_END
+// record terminates the exchange. A conformant NTS-KE response is a few
+// hundred bytes (RFC 8915 §4); 64 KiB is generous. Without this ceiling
+// a malicious or buggy server that streams non-END records fast enough
+// OOMs the process before the wall-clock timer fires (it bounds time,
+// not memory). Mirrors the ws-client handshake header cap.
+var NTS_KE_HANDSHAKE_MAX_BYTES = C.BYTES.kib(64);
 // RFC 5905 §6 — seconds between 1900-01-01T00:00Z (NTP epoch) and
 // 1970-01-01T00:00Z (Unix epoch). Protocol-fixed (not a tunable).
 var NTP_TO_UNIX_OFFSET_SECONDS = 2208988800;
@@ -284,6 +292,14 @@ function performKeHandshake(opts) {
     var warnings = [];
     sock.on("data", function (chunk) {
       got = Buffer.concat([got, chunk]);
+      if (safeBuffer.byteLengthOf(got) > NTS_KE_HANDSHAKE_MAX_BYTES) {
+        clearTimeout(timer);
+        try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+        done(new NtsError("nts/ke-too-large",
+          "NTS-KE handshake exceeded " + NTS_KE_HANDSHAKE_MAX_BYTES +
+          " bytes before a REC_END record"));
+        return;
+      }
       try {
         var records = _decodeRecords(got);
         var endRec = records.find(function (r) { return r.type === REC_END; });

package/lib/vendor/blamejs/lib/network-proxy.js

@@ -7,6 +7,7 @@ var nodeTls = require("node:tls");
 
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
+var safeBuffer = require("./safe-buffer");
 var safeUrl = require("./safe-url");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -19,6 +20,23 @@ var IPV4_PREFIX_MAX_BITS = C.BYTES.bytes(32);   // RFC 791 §3.1 IPv4 address bi
 var DEFAULT_HTTPS_PORT   = 443;                 // RFC 9110 §4.2.2
 var DEFAULT_HTTP_PORT    = C.BYTES.bytes(80);   // RFC 9110 §4.2.1
 
+// Bound the CONNECT-reply framing buffer (mirrors ws-client's handshake
+// cap). A proxy that streams bytes without ever sending the CRLFCRLF
+// header terminator would otherwise grow `buf` without limit and OOM the
+// process; CONNECT replies are tiny, 64 KiB is generous headroom.
+var TUNNEL_HEADER_MAX_BYTES = C.BYTES.kib(64);
+// Wall-clock bound on the proxy connect + CONNECT handshake. Without it a
+// proxy that accepts the socket but never replies (or trickles forever)
+// hangs the tunnel indefinitely.
+var TUNNEL_CONNECT_TIMEOUT_MS = C.TIME.seconds(30);
+// Test-only override of the connect deadline so a unit test can prove the
+// absolute-timeout behavior without a 30s wall-clock wait. null = use the
+// real default. Cleared by _resetForTest.
+var _testConnectTimeoutMs = null;
+function _connectTimeoutMs() {
+  return typeof _testConnectTimeoutMs === "number" ? _testConnectTimeoutMs : TUNNEL_CONNECT_TIMEOUT_MS;
+}
+
 var observability = lazyRequire(function () { return require("./observability"); });
 // Lazy so pqc-agent's TLS/audit graph isn't pulled into every process that
 // imports network-proxy but never proxies an https upstream. Used only to audit
@@ -169,7 +187,27 @@ function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
       })
     : net.connect({ host: proxyUrl.hostname, port: proxyPort });
   var settled = false;
-  function done(err, sock) { if (settled) return; settled = true; callback(err, sock); }
+  var connectDeadline = null;
+  function done(err, sock) {
+    if (settled) return;
+    settled = true;
+    if (connectDeadline) { try { clearTimeout(connectDeadline); } catch (_e) { /* best-effort */ } connectDeadline = null; }
+    callback(err, sock);
+  }
+  // ABSOLUTE wall-clock deadline on the proxy connect + CONNECT handshake. A
+  // proxy that accepts the socket but never sends the CRLFCRLF terminator —
+  // or trickles partial bytes just inside every idle window — must not hang
+  // the tunnel forever. socket.setTimeout is an IDLE timer that such a trickle
+  // resets indefinitely, so a fixed setTimeout (cleared in done()) enforces a
+  // real total-time bound regardless of how the bytes arrive.
+  var connectTimeoutMs = _connectTimeoutMs();
+  connectDeadline = setTimeout(function () {
+    done(new ProxyError("proxy/connect-timeout",
+      "proxy CONNECT to " + targetHost + ":" + targetPort + " timed out after " +
+      connectTimeoutMs + "ms"));
+    try { proxySocket.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+  }, connectTimeoutMs);
+  if (connectDeadline && typeof connectDeadline.unref === "function") connectDeadline.unref();
   proxySocket.on("error", function (e) { done(e); });
   proxySocket.on(proxyUrl.protocol === "https:" ? "secureConnect" : "connect", function () {
     if (proxyUrl.protocol === "https:") {
@@ -191,7 +229,18 @@ function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
     function onData(chunk) {
       buf = Buffer.concat([buf, chunk]);
       var idx = buf.indexOf("\r\n\r\n");
-      if (idx === -1) return;
+      if (idx === -1) {
+        // No header terminator yet — bound the accumulator so a proxy
+        // that trickles non-CRLFCRLF bytes forever can't OOM the process.
+        if (safeBuffer.byteLengthOf(buf) > TUNNEL_HEADER_MAX_BYTES) {
+          proxySocket.removeListener("data", onData);
+          done(new ProxyError("proxy/connect-headers-too-large",
+            "proxy CONNECT reply exceeded " + TUNNEL_HEADER_MAX_BYTES +
+            " bytes before CRLFCRLF"));
+          try { proxySocket.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+        }
+        return;
+      }
       proxySocket.removeListener("data", onData);
       var head = buf.slice(0, idx).toString("ascii");
       var status = head.split("\r\n")[0] || "";
@@ -271,8 +320,11 @@ function snapshot() {
 function _resetForTest() {
   STATE.http = null; STATE.https = null; STATE.noProxy = []; STATE.auth = null;
   STATE.agentCache.clear();
+  _testConnectTimeoutMs = null;
 }
 
+function _setConnectTimeoutForTest(ms) { _testConnectTimeoutMs = ms; }
+
 module.exports = {
   set:           set,
   fromEnv:       fromEnv,
@@ -281,4 +333,5 @@ module.exports = {
   snapshot:      snapshot,
   ProxyError:    ProxyError,
   _resetForTest: _resetForTest,
+  _setConnectTimeoutForTest: _setConnectTimeoutForTest,
 };

package/lib/vendor/blamejs/lib/object-store/azure-blob-bucket-ops.js

@@ -233,6 +233,7 @@ function create(config) {
       url:              url,
       headers:          headers,
       body:             body,
+      timeoutMs:        timeoutMs,
       idleTimeoutMs:    timeoutMs,
       allowedProtocols: allowedProtocols,
       errorClass:       ObjectStoreError,

package/lib/vendor/blamejs/lib/object-store/gcs-bucket-ops.js

@@ -182,6 +182,7 @@ function create(config) {
       url:              url,
       headers:          headers,
       body:             body,
+      timeoutMs:        timeoutMs,
       idleTimeoutMs:    timeoutMs,
       allowedProtocols: allowedProtocols,
       errorClass:       ObjectStoreError,

package/lib/vendor/blamejs/lib/object-store/http-request.js

@@ -36,6 +36,10 @@ function request(method, url, headers, body, opts) {
     url:              url,
     headers:          headers,
     body:             body,
+    // Both caps from the operator's configured timeout: timeoutMs bounds the
+    // whole request (no slow-trickle hold-open), idleTimeoutMs the zero-progress
+    // window. Undefined leaves httpClient's defaults unchanged.
+    timeoutMs:        opts.timeoutMs,
     idleTimeoutMs:    opts.timeoutMs,
     errorClass:       opts.errorClass || ObjectStoreError,
     allowedProtocols: opts.allowedProtocols,

package/lib/vendor/blamejs/lib/outbox.js

@@ -214,6 +214,35 @@ function create(opts) {
         throw new OutboxError("outbox/bad-externaldb",
           "outbox.create: externalDb must be the b.externalDb namespace (with transaction/query)");
       }
+      // The outbox dual-write guarantee (enqueue runs in the SAME
+      // transaction as the operator's business write) is VOID on a
+      // stateless / autocommit-per-statement backend: BEGIN / the
+      // business write / the enqueue INSERT / COMMIT each land on a
+      // different session, so a crash or rollback can drop the business
+      // row while keeping the event (or vice versa). Refuse at create()
+      // when the backend declares it cannot provide interactive
+      // transactions, rather than constructing an outbox whose core
+      // guarantee silently does not hold. supportsTransactions may be a
+      // boolean (custom externalDb object) or a function (the
+      // b.externalDb namespace probe); only an explicit false refuses —
+      // an absent flag preserves the historical stateful assumption.
+      var cap = v.supportsTransactions;
+      var atomic = true;
+      if (typeof cap === "function") {
+        try { atomic = !!cap(); } catch (_e) { atomic = true; }
+      } else if (cap === false) {
+        atomic = false;
+      }
+      if (!atomic) {
+        throw new OutboxError("outbox/non-atomic-backend",
+          "outbox.create: externalDb backend cannot provide interactive " +
+          "transactions (supportsTransactions: false — a stateless / " +
+          "autocommit-per-statement adapter). The outbox dual-write guarantee " +
+          "requires the business write and the enqueue INSERT to commit " +
+          "atomically in one transaction; on this backend they would not. " +
+          "Supply interactive beginTx / commit / rollback hooks, or a batch " +
+          "adapter, on the externalDb backend first.");
+      }
     },
     table: function (v) {
       validateOpts.requireNonEmptyString(v,

package/lib/vendor/blamejs/lib/queue-sqs.js

@@ -153,6 +153,7 @@ function create(opts) {
       url:              endpointUrl,
       headers:          signed.headers,
       body:             bodyBuf,
+      timeoutMs:        timeoutMs,
       idleTimeoutMs:    timeoutMs,
       allowedProtocols: allowedProtocols,
       errorClass:       QueueError,

package/lib/vendor/blamejs/lib/request-helpers.js

@@ -476,7 +476,7 @@ function _maskIpv6(ip, prefix) {
 
 /**
  * @primitive b.requestHelpers.ipPrefix
- * @signature b.requestHelpers.ipPrefix(ip)
+ * @signature b.requestHelpers.ipPrefix(ip, opts?)
  * @since     0.15.15
  * @related   b.requestHelpers.clientIp, b.requestHelpers.trustedClientIp
  *
@@ -493,22 +493,41 @@ function _maskIpv6(ip, prefix) {
  * public IP within a subnet don't log a user out). Exposed so an operator who
  * drops to a function-form fingerprint field — for a custom mask width, or to
  * combine the prefix with other signals — reuses this exact algorithm instead
- * of re-deriving the /24 + /64 masking (and silently diverging).
+ * of re-deriving the /24 + /64 masking (and silently diverging). Pass
+ * <code>opts.v4Bits</code> / <code>opts.v6Bits</code> to override the mask
+ * widths (e.g. a device fingerprint that buckets at <code>/48</code> so a
+ * client roaming within its allocation but across a <code>/64</code> doesn't
+ * drift); an out-of-range or absent value falls back to the /24 + /64 default.
+ *
+ * @opts
+ *   v4Bits: number,   // IPv4 mask width in bits (default 24; valid 0..32)
+ *   v6Bits: number,   // IPv6 mask width in bits (default 64; valid 0..128)
  *
  * @example
  *   b.requestHelpers.ipPrefix("203.0.113.47");   // → "203.0.113.0/24"
  *   b.requestHelpers.ipPrefix("2001:db8::1");     // → "2001:db8:0:0/64"
  */
-function ipPrefix(ip) {
+function _resolvePrefixBits(bits, def, max) {
+  if (typeof bits !== "number" || !isFinite(bits) || bits < 0 || bits > max) return def;
+  return bits;
+}
+function ipPrefix(ip, opts) {
   if (typeof ip !== "string" || ip.length === 0) return "";
+  opts = opts || {};
+  // Configurable mask widths (default /24 + /64); an absent or out-of-range
+  // value falls back to the default. This preserves a caller's documented
+  // prefix width (e.g. a device fingerprint bucketing at /48) instead of
+  // silently forcing /64 — while still canonicalizing the address.
+  var v4 = _resolvePrefixBits(opts.v4Bits, IPV4_DEFAULT_PREFIX, 32);                            // IPv4 max prefix length in bits
+  var v6 = _resolvePrefixBits(opts.v6Bits, IPV6_DEFAULT_PREFIX, 128);                           // IPv6 max prefix length in bits
   // IPv4-mapped IPv6 (::ffff:1.2.3.4) — strip the wrapper so the v4 mask
   // applies. Same bucket regardless of how the proxy reported it.
   var lower = ip.toLowerCase();
   if (lower.indexOf(V4_MAPPED_V6_PREFIX) === 0 && lower.indexOf(".") !== -1) {
-    return _maskIpv4(lower.substring(V4_MAPPED_V6_PREFIX.length), IPV4_DEFAULT_PREFIX) || "";
+    return _maskIpv4(lower.substring(V4_MAPPED_V6_PREFIX.length), v4) || "";
   }
-  if (ip.indexOf(":") !== -1) return _maskIpv6(ip, IPV6_DEFAULT_PREFIX) || "";
-  if (ip.indexOf(".") !== -1) return _maskIpv4(ip, IPV4_DEFAULT_PREFIX) || "";
+  if (ip.indexOf(":") !== -1) return _maskIpv6(ip, v6) || "";
+  if (ip.indexOf(".") !== -1) return _maskIpv4(ip, v4) || "";
   return "";
 }
 

package/lib/vendor/blamejs/lib/session-device-binding.js

@@ -52,6 +52,14 @@
  * primitive falls back to b.session.touch metadata when the operator
  * passes session=b.session AND opts in via storeInSession=true.
  *
+ * No store at all: create() with neither bindingStore nor storeInSession
+ * still returns an instance — its stateless fingerprint(req) works (it
+ * touches no store), while bind/verify/unbind throw a clear "no store
+ * configured" error. Operators who only need the soft, store-free digest
+ * (sealed inside a self-validating cookie / JWT that compares it itself)
+ * can also skip create() entirely and call the static
+ * b.sessionDeviceBinding.fingerprint(req, opts).
+ *
  * Audit emissions:
  *
  *   session.device.bound      every successful bind()
@@ -61,7 +69,9 @@
  *
  * Validation policy:
  *   - create() opts → throw at config time
- *   - bind / verify  → throw on bad token / req shape (operator typo)
+ *   - bind / verify / unbind → throw on bad token / req shape (operator
+ *                      typo), and throw "no store configured" when called
+ *                      on a store-free instance
  *   - storage errors  → fail-CLOSED on verify (drift indistinguishable
  *                       from a wiped store, refuse rather than allow)
  *                       fail-OPEN on bind (don't lose a fresh session
@@ -135,28 +145,22 @@ function _normalizeAcceptEncoding(value) {
     .join(",");
 }
 
+// Mask the client IP to its fingerprint bucket. Routes through the shared
+// canonical masker (requestHelpers.ipPrefix) so a `::`-shorthand address and
+// its fully-expanded equivalent (2001:db8::1 vs 2001:db8:0:0:0:0:0:1), or a
+// leading-zero-folded group, collapse to ONE bucket — the hand-rolled textual
+// ':'-group slice this replaced hashed them differently and logged a roaming
+// user out on a false drift. `bits === 0` is the documented "skip the IP check
+// entirely" escape hatch (mobile clients that switch networks), so it returns
+// "" before any masking. `bits` is the family-resolved configured width (cfg
+// .v4Bits for a v4 client, cfg.v6Bits for v6 — default /24 + /48); pass it as
+// BOTH v4Bits and v6Bits so the canonical masker applies the configured width
+// to whichever family it detects, instead of ipPrefix's bare /24 + /64 default
+// (which would drop the configured width AND silently tighten v6 from /48 to /64).
 function _ipPrefix(ip, bits) {
   if (typeof ip !== "string" || ip.length === 0) return "";
   if (bits === 0) return "";
-  // IPv6
-  if (ip.indexOf(":") !== -1) {
-    var v6Bits = bits;
-    var groups = ip.split(":");
-    // Naive expansion — keep the first ceil(v6Bits/16) groups intact
-    // and zero the rest. Sufficient for fingerprint stability; not a
-    // canonical IPv6 representation.
-    var keepGroups = Math.ceil(v6Bits / 16); // IPv6 group width in bits
-    var kept = groups.slice(0, keepGroups).join(":");
-    return "v6:" + kept + "/" + v6Bits;
-  }
-  // IPv4
-  var parts = ip.split(".");
-  if (parts.length !== 4) return "v4:" + ip + "/" + bits;
-  var v4Bits = bits;
-  var keepOctets = Math.floor(v4Bits / 8); // IPv4 octet width in bits
-  var maskedOctets = parts.slice(0, keepOctets);
-  while (maskedOctets.length < 4) maskedOctets.push("0");
-  return "v4:" + maskedOctets.join(".") + "/" + v4Bits;
+  return requestHelpers.ipPrefix(ip, { v4Bits: bits, v6Bits: bits });
 }
 
 // Resolve operator-supplied fingerprintExtras(req) to a stable string. A
@@ -195,6 +199,7 @@ function _computeDeviceFingerprint(req, cfg) {
   var ae = _normalizeAcceptEncoding(headers["accept-encoding"]);
   var ip = "";
   try { ip = requestHelpers.clientIp(req); } catch (_e) { ip = ""; }
+  if (typeof ip !== "string") ip = "";
   var family = ip.indexOf(":") !== -1 ? "v6" : "v4";
   var ipPart = _ipPrefix(ip, family === "v6" ? cfg.v6Bits : cfg.v4Bits);
   var keyPart = "";
@@ -291,10 +296,15 @@ function create(opts) {
   }
 
   var storeInSession = !!opts.storeInSession;
-  if (!storeInSession && !opts.bindingStore) {
-    throw new SessionDeviceBindingError("session-device-binding/bad-opt",
-      "either bindingStore (b.cache-shaped) or storeInSession=true must be set");
-  }
+  // A no-store instance is still useful: the stateless fingerprint() reads no
+  // store and is the soft device-binding building block for self-validating
+  // tokens (a sealed cookie / JWT carrying the fingerprint inside). Rather than
+  // refuse to construct (issue #330 — fingerprint() unreachable without a
+  // store), build the instance and let the persisted bind()/verify() lifecycle
+  // throw a clear "no store configured" when actually called. Operators wanting
+  // ONLY the stateless digest can also use the static
+  // b.sessionDeviceBinding.fingerprint(req, opts) with no create() at all.
+  var hasStore = !!(storeInSession || opts.bindingStore);
   if (opts.bindingStore) _requireBindingStore(opts.bindingStore);
   if (storeInSession && (!opts.session || typeof opts.session.touch !== "function")) {
     throw new SessionDeviceBindingError("session-device-binding/bad-opt",
@@ -351,8 +361,18 @@ function create(opts) {
     return { ok: true, fingerprint: r.fingerprint, components: r.components };
   }
 
+  function _requireStore(stage) {
+    if (!hasStore) {
+      throw new SessionDeviceBindingError("session-device-binding/no-store",
+        stage + ": no store configured — pass bindingStore (b.cache-shaped) or "
+        + "storeInSession=true to create(), or use the stateless "
+        + "b.sessionDeviceBinding.fingerprint(req, opts) for soft binding");
+    }
+  }
+
   async function bind(token, req) {
     _requireToken(token);
+    _requireStore("bind");
     var fp = _computeFingerprint(req);
     if (!fp.ok) {
       _emitObs("session.device.refused", { reason: fp.reason });
@@ -408,6 +428,7 @@ function create(opts) {
 
   async function verify(token, req) {
     _requireToken(token);
+    _requireStore("verify");
     var fpResult = _computeFingerprint(req);
     if (!fpResult.ok) {
       _emitObs("session.device.refused", { reason: fpResult.reason });
@@ -444,6 +465,7 @@ function create(opts) {
 
   async function unbind(token) {
     _requireToken(token);
+    _requireStore("unbind");
     if (bindingStore) {
       try { await bindingStore.del(token); } catch (_e) { /* drop-silent */ }
     }

package/lib/vendor/blamejs/lib/session.js

@@ -182,6 +182,49 @@ function _validFromConflictRefs(dialect, table) {
   };
 }
 
+// CREATE TABLE IF NOT EXISTS for the valid-from boundary, matching the
+// framework schema in db.js (single-node) / framework-schema.js (cluster mode):
+// subjectHash PRIMARY KEY, validFromEpoch + updatedAt NOT NULL. The pluggable
+// store is always a dedicated node:sqlite file (b.session.stores.localDbThin —
+// see session-stores.js), so the dialect is the literal "sqlite". Used to
+// provision the table on demand in a store-backed-only deployment (a
+// b.session.useStore consumer that never ran b.db.init(), so the framework db
+// — the default home of this table — is not initialized).
+function _validFromSchemaSql() {
+  return sql.createTable(_validFromSqlTable(), [
+    { name: "subjectHash",    type: "text", primaryKey: true },
+    { name: "validFromEpoch", type: "int",  notNull: true },
+    { name: "updatedAt",      type: "int",  notNull: true },
+  ], { dialect: "sqlite" }).sql;
+}
+
+// Run a valid-from boundary operation (bump write / validFrom read / check
+// read) against the correct backend. The boundary lives in the FRAMEWORK db
+// (clusterStorage) — it is a stateless-token revocation primitive shared across
+// every issuer, not per-session data — so that is always the first choice and a
+// present db is never silently bypassed. ONLY when the framework db is not
+// initialized (single-node, b.db.init() never awaited) AND an operator store is
+// configured (b.session.useStore) does the boundary fall back to that store, so
+// a store-backed-only deployment's logout-everywhere still raises (and honors)
+// the stateless boundary instead of 500ing on db/not-initialized (#340). With
+// neither a framework db nor a store, db/not-initialized is a real
+// misconfiguration and propagates unchanged (fail closed — the boundary is
+// never silently dropped). The store provisions the table on demand because a
+// session-data store (localDbThin) does not ship the valid-from DDL.
+async function _runValidFrom(runner) {
+  try {
+    return await runner(clusterStorage);
+  } catch (e) {
+    if (e && e.code === "db/not-initialized" && _store) {
+      // Framework db absent, operator store present: route through the store,
+      // provisioning the boundary table first (idempotent CREATE IF NOT EXISTS).
+      await _store.execute(_validFromSchemaSql(), []);
+      return await runner(_store);
+    }
+    throw e;
+  }
+}
+
 // Column order used for INSERT — kept as a constant so the placeholders
 // list and the values list stay in sync. Must match the session table's
 // schema in db.js (single-node) and framework-schema.js (cluster mode).
@@ -786,21 +829,23 @@ async function destroyAllForUser(userId) {
   var result = await _currentStore().execute(built.sql, built.params);
   // Also raise the stateless valid-from boundary so a "logout everywhere"
   // revokes the operator's stateless tokens (sealed cookies / JWTs checked via
-  // b.session.check) too, not only the store-backed rows just deleted. This
-  // bump writes to the FRAMEWORK db (clusterStorage); a pluggable-store consumer
-  // (b.session.useStore) who never ran b.db.init() would otherwise surface the
-  // opaque "db/not-initialized" here, after the store delete already succeeded.
-  // Rethrow it as a session-specific, actionable error.
+  // b.session.check) too, not only the store-backed rows just deleted. bump()
+  // writes to the framework db when one is initialized, otherwise to the
+  // configured store (b.session.useStore) — so a store-backed-only consumer who
+  // never ran b.db.init() still raises the boundary here instead of 500ing on
+  // db/not-initialized (#340). The only state in which bump still surfaces
+  // db/not-initialized is the default store (no useStore) with an uninitialized
+  // framework db — but the store DELETE above (also via clusterStorage) would
+  // have already thrown, so this rewrap is defensive belt-and-suspenders.
   try {
     await bump(userId);
   } catch (e) {
     if (e && e.code === "db/not-initialized") {
       throw _err("MISCONFIGURED",
         "session.destroyAllForUser raises the stateless valid-from boundary (so a " +
-        "logout-everywhere also revokes sealed-cookie / JWT sessions), which requires " +
-        "b.db.init() — call it at boot even when session data lives in a pluggable " +
-        "store (b.session.useStore). The store-backed rows were already deleted; rerun " +
-        "after b.db.init() to also raise the stateless boundary.", true);
+        "logout-everywhere also revokes sealed-cookie / JWT sessions). No storage is " +
+        "available: call b.db.init() at boot, OR configure a session store via " +
+        "b.session.useStore. The store-backed rows were already deleted.", true);
     }
     throw e;
   }
@@ -1340,21 +1385,27 @@ async function bump(subjectId, opts) {
     .returning(["validFromEpoch"])
     .toSql();
   // The valid-from boundary is a FRAMEWORK table (FRAMEWORK_SCHEMA / cluster
-  // DDL), NOT session data — it must execute against clusterStorage (the
-  // framework db), never _currentStore(): a pluggable session-data store
-  // (b.session.useStore / localDbThin) does not provision this table, so
-  // routing the bump through it throws "no such table".
-  var row;
-  if (built.readbackSql) {
-    // MySQL: ON DUPLICATE KEY UPDATE has no RETURNING — run the upsert, then
-    // the readback SELECT b.sql emits (keyed on subjectHash).
-    await clusterStorage.execute(built.sql, built.params);
-    var readback = await clusterStorage.execute(built.readbackSql.sql, built.readbackSql.params);
-    row = readback.rows && readback.rows[0];
-  } else {
-    var result = await clusterStorage.execute(built.sql, built.params);
-    row = result.rows && result.rows[0];
-  }
+  // DDL), NOT session data — it executes against clusterStorage (the framework
+  // db) whenever one is initialized, never _currentStore(). When the framework
+  // db is NOT initialized but an operator store IS configured (a store-backed-
+  // only b.session.useStore deployment that never ran b.db.init()), the boundary
+  // falls back to that store — provisioned on demand — so logout-everywhere
+  // still raises the stateless boundary instead of throwing db/not-initialized
+  // (#340). _runValidFrom resolves the target; never silently drops the boundary
+  // when a db is present, and propagates db/not-initialized when neither exists.
+  var row = await _runValidFrom(async function (target) {
+    if (built.readbackSql) {
+      // MySQL: ON DUPLICATE KEY UPDATE has no RETURNING — run the upsert, then
+      // the readback SELECT b.sql emits (keyed on subjectHash). MySQL only ever
+      // runs against the framework cluster db; the localDbThin fallback store is
+      // sqlite (RETURNING), so this branch never routes through it.
+      await target.execute(built.sql, built.params);
+      var readback = await target.execute(built.readbackSql.sql, built.readbackSql.params);
+      return readback.rows && readback.rows[0];
+    }
+    var result = await target.execute(built.sql, built.params);
+    return result.rows && result.rows[0];
+  });
   var effective = row ? Number(row.validFromEpoch) : epochMs;
 
   // Best-effort audit — matches the file's emit convention (safeEmit is
@@ -1393,10 +1444,16 @@ async function validFrom(subjectId) {
     .columns(["validFromEpoch"])
     .where("subjectHash", _hashSubjectId(subjectId))
     .toSql();
-  // Framework valid-from table — read from clusterStorage (the framework db),
-  // not _currentStore(), so a pluggable session-data store cannot divert it (it
-  // does not provision this table). See bump() for the full rationale.
-  var row = await clusterStorage.executeOne(built.sql, built.params);
+  // Framework valid-from table — read from clusterStorage (the framework db)
+  // when one is initialized, falling back to the configured store only when it
+  // is not (the same store bump() wrote the boundary to in a store-backed-only
+  // deployment). _runValidFrom keeps the read on the SAME backend the write
+  // chose, so a boundary raised via destroyAllForUser/bump is the one read back
+  // here. See bump() for the full rationale (#340).
+  var row = await _runValidFrom(async function (target) {
+    var result = await target.execute(built.sql, built.params);
+    return result.rows && result.rows.length > 0 ? result.rows[0] : null;
+  });
   return row ? Number(row.validFromEpoch) : 0;
 }