@blamejs/blamejs-shop 0.4.85 → 0.4.87

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.15.15",
-  "createdAt": "2026-06-22T00:16:09.227Z",
+  "frameworkVersion": "0.15.16",
+  "createdAt": "2026-06-22T12:04:10.257Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -2346,6 +2346,10 @@
           "type": "function",
           "arity": 3
         },
+        "openAppendNoFollowSync": {
+          "type": "function",
+          "arity": 2
+        },
         "openNoFollowSync": {
           "type": "function",
           "arity": 2
@@ -16060,6 +16064,10 @@
           "type": "function",
           "arity": 0
         },
+        "supportsTransactions": {
+          "type": "function",
+          "arity": 1
+        },
         "transaction": {
           "type": "function",
           "arity": 2
@@ -49213,7 +49221,7 @@
         },
         "ipPrefix": {
           "type": "function",
-          "arity": 1
+          "arity": 2
         },
         "makeResourceAuditEmitter": {
           "type": "function",

package/lib/vendor/blamejs/lib/atomic-file.js

@@ -1336,6 +1336,39 @@ function openNoFollowSync(filepath, mode) {
   return nodeFs.openSync(filepath, flags, mode === undefined ? 0o600 : mode);
 }
 
+/**
+ * @primitive b.atomicFile.openAppendNoFollowSync
+ * @signature b.atomicFile.openAppendNoFollowSync(filepath, mode?)
+ * @since      0.15.16
+ * @status     stable
+ * @related    b.atomicFile.openNoFollowSync, b.atomicFile.writeSync
+ *
+ * Open a path for append with `O_NOFOLLOW` so a symlink at the final path
+ * component is refused (`ELOOP`) instead of followed — the append-sink
+ * counterpart to `openNoFollowSync` (read) and `_openExclTemp` (exclusive
+ * create). For long-lived append targets a one-shot atomic write can't
+ * model: an active log file kept open across many appends and reopened on
+ * rotation. The flags are `O_WRONLY | O_APPEND | O_CREAT | O_NOFOLLOW` —
+ * the file is created (mode-applied) if absent and appended to if it is a
+ * regular file, but a symlink at the path fails the open closed rather than
+ * redirecting writes to an attacker-chosen target (CWE-59). A bare
+ * `openSync(path, "a")` instead follows such a symlink, so a caller's
+ * pre-check-then-unlink defense still races a symlink re-planted before the
+ * sink's own open — this primitive makes the symlink refusal atomic with the
+ * open. `O_NOFOLLOW` is POSIX-only; on platforms without it the flag is 0
+ * (a plain append open) — Windows symlink semantics differ and are out of
+ * scope. Throws the raw `openSync` error (caller maps `ELOOP` / `ENOENT`).
+ *
+ * @example
+ *   var fd = b.atomicFile.openAppendNoFollowSync(activeLogPath, 0o600);
+ *   fs.writeSync(fd, line);   // appends; a symlink at activeLogPath → ELOOP
+ */
+function openAppendNoFollowSync(filepath, mode) {
+  var flags = nodeFs.constants.O_WRONLY | nodeFs.constants.O_APPEND |
+    nodeFs.constants.O_CREAT | (nodeFs.constants.O_NOFOLLOW || 0);
+  return nodeFs.openSync(filepath, flags, mode === undefined ? 0o600 : mode);
+}
+
 module.exports = {
   write:             write,
   writeSync:         writeSync,
@@ -1345,6 +1378,7 @@ module.exports = {
   readSync:          readSync,
   fdSafeReadSync:    fdSafeReadSync,
   openNoFollowSync:  openNoFollowSync,
+  openAppendNoFollowSync: openAppendNoFollowSync,
   writeJson:         writeJson,
   readJson:          readJson,
   copy:              copy,

package/lib/vendor/blamejs/lib/auth/fido-mds3.js

@@ -214,6 +214,16 @@ function _validateChain(x5c, rootPems) {
   for (var v = 0; v < chain.length; v++) {
     var notBefore = Date.parse(chain[v].validFrom);
     var notAfter  = Date.parse(chain[v].validTo);
+    // Fail closed on an unparseable validity window: a cert whose
+    // notBefore/notAfter is present but does not parse (Date.parse ->
+    // NaN) must not slip past the window checks below — otherwise a
+    // forged / malformed validity date silently disables both the
+    // not-yet-valid and the expired guards.
+    if (!isFinite(notBefore) || !isFinite(notAfter)) {
+      throw new FidoMds3Error("fido-mds3/cert-bad-validity",
+        "x5c[" + v + "] has unparseable validity dates (validFrom=" +
+        chain[v].validFrom + ", validTo=" + chain[v].validTo + ")");
+    }
     if (isFinite(notBefore) && now < notBefore) {
       throw new FidoMds3Error("fido-mds3/cert-not-yet-valid",
         "x5c[" + v + "] is not yet valid (notBefore=" + chain[v].validFrom + ")");

package/lib/vendor/blamejs/lib/auth/password.js

@@ -434,6 +434,7 @@ function policy(opts) {
           method:        "GET",
           url:           url,
           headers:       { "User-Agent": "blamejs-password-policy/1" },
+          timeoutMs:     p.hibpTimeoutMs,
           idleTimeoutMs: p.hibpTimeoutMs,
           errorClass:    AuthError,
         });

package/lib/vendor/blamejs/lib/auth/saml.js

@@ -692,8 +692,13 @@ function create(opts) {
         if (!noaHok) continue;                                                                      // §3.1 (incorporates §3) — time-bound required
         var noaHokSec = Date.parse(noaHok) / 1000;                                                  // ms→s
         if (!isFinite(noaHokSec) || noaHokSec < nowSec - clockSkewSec) continue;                    // unparseable or expired
-        if (nbHok && isFinite(Date.parse(nbHok) / 1000) &&                                          // ms→s
-            Date.parse(nbHok) / 1000 > nowSec + clockSkewSec) continue;                             // ms→s
+        if (nbHok) {
+          // Fail CLOSED on a present-but-unparseable HoK NotBefore (same shape
+          // as the Bearer path + NotOnOrAfter above) — an unparseable bound
+          // can't establish the confirmation has begun, so skip this SCD.
+          var nbHokSec = Date.parse(nbHok) / 1000;                                                  // ms→s
+          if (!isFinite(nbHokSec) || nbHokSec > nowSec + clockSkewSec) continue;                    // unparseable or not-yet-valid
+        }
         var recipHok = _attr(scdHok, "Recipient");
         if (!recipHok || recipHok !== opts.assertionConsumerServiceUrl) continue;   // §3.1→§4.1.4.2 — Recipient is mandatory; absent fails the endpoint binding
         hokOk = true;
@@ -709,7 +714,10 @@ function create(opts) {
       var notBefore = _attr(scd, "NotBefore");
       if (notBefore) {
         var nb = Date.parse(notBefore) / 1000;                                                  // ms→s
-        if (isFinite(nb) && nb > nowSec + clockSkewSec) continue;
+        // Fail CLOSED on a present-but-unparseable NotBefore (mirrors the
+        // NotOnOrAfter line above + the Conditions block) — an unparseable
+        // bound can't establish the confirmation has begun, so skip this SCD.
+        if (!isFinite(nb) || nb > nowSec + clockSkewSec) continue;
       }
       // §4.1.4.2 — a Bearer SubjectConfirmationData delivered to an ACS MUST
       // carry a Recipient equal to this SP's ACS URL. Absent Recipient fails

package/lib/vendor/blamejs/lib/daemon.js

@@ -151,7 +151,10 @@ function _maybeReapStale(pidFile) {
 function _openLogFd(logFile) {
   if (typeof logFile !== "string" || logFile.length === 0) return null;
   atomicFile.ensureDir(nodePath.dirname(logFile));
-  var fd = nodeFs.openSync(logFile, "a", DEFAULT_LOG_FILE_MODE);
+  // O_NOFOLLOW append: refuse (ELOOP) a symlink planted at the daemon log
+  // path rather than redirecting the detached process's stdout/stderr to an
+  // attacker-chosen file (CWE-59).
+  var fd = atomicFile.openAppendNoFollowSync(logFile, DEFAULT_LOG_FILE_MODE);
   return fd;
 }
 

package/lib/vendor/blamejs/lib/external-db.js

@@ -706,6 +706,8 @@ class Pool {
  *   //   close(client):        async → void                             (optional; default no-op)
  *   //   ping(client):         async → void                             (optional; default `SELECT 1`)
  *   //   beginTx / commit / rollback(client):  async → void             (optional; default `BEGIN`/`COMMIT`/`ROLLBACK`)
+ *   //   batch(client, statements):  async → void                        (optional; atomic multi-statement path for batch-only adapters, e.g. D1 db.batch)
+ *   //   supportsTransactions:  boolean                                  (interactive-tx capability; set false on a stateless/autocommit-per-statement adapter so transaction()/outbox REFUSE rather than silently run non-atomic — default assumes stateful)
  *   //   dialect:              "postgres" | "mysql" | "sqlite" | "mongodb" | "other"  (default "postgres")
  *   //   requireTls:           boolean                                  (opt-in TLS posture gate; default off — see below)
  *   //   tls / ssl / sslmode:  transport-TLS declaration consulted by requireTls (tls:true | ssl:<obj> | sslmode:"require"|"verify-ca"|"verify-full")
@@ -796,6 +798,60 @@ function init(opts) {
         applicationName.length + ")", true);
       }
     }
+    // ---- Interactive-transaction capability ----
+    //
+    // transaction(fn) and the b.outbox dual-write guarantee both require
+    // an INTERACTIVE transaction: BEGIN, the body statements, and COMMIT
+    // must all run on the SAME session so the body sees isolation and a
+    // throw rolls everything back. A stateless / autocommit-per-statement
+    // adapter (connect() returns a sentinel, each query() is an
+    // independent round-trip — e.g. an HTTP bridge to Cloudflare D1) makes
+    // BEGIN / body / COMMIT land on different sessions: no isolation, no
+    // rollback, yet every call resolves, so the consumer wrongly believes
+    // the block was atomic. Detect that posture up front and REFUSE
+    // loudly rather than silently degrade to no-op BEGIN/COMMIT.
+    //
+    // An INTERACTIVE transaction (transaction(fn) runs arbitrary async
+    // operator logic between tx.query calls) requires a stateful session;
+    // it cannot be transparently replayed as a static batch, so a backend
+    // can provide interactive transactions only when:
+    //   - it supplies interactive-tx hooks (beginTx / commit / rollback)
+    //     bound to a stateful client, OR
+    //   - it explicitly declares supportsTransactions: true (operator
+    //     asserts the default BEGIN/COMMIT runs on a stateful client).
+    // It CANNOT when it explicitly declares supportsTransactions: false
+    // (the stateless / autocommit-per-statement declaration). When the
+    // flag is omitted and no hooks are present the backend is assumed
+    // stateful — the historical default — so existing stateful pg / sqlite
+    // / mysql backends are unaffected.
+    //
+    // A batch(client, statements) hook is a SEPARATE atomic-multi-statement
+    // path for batch-only adapters (e.g. D1's db.batch([...])); it does NOT
+    // make interactive transaction(fn) safe (the interleaved operator logic
+    // can't be captured as a static statement list), so its presence is
+    // recorded but does not flip supportsTransactions.
+    if (cfg.supportsTransactions !== undefined && cfg.supportsTransactions !== null) {
+      validateOpts.optionalBoolean(cfg.supportsTransactions,
+        "backend '" + name + "': supportsTransactions", ExternalDbError, "INVALID_CONFIG");
+    }
+    if (cfg.batch !== undefined && cfg.batch !== null && typeof cfg.batch !== "function") {
+      throw _err("INVALID_CONFIG",
+        "backend '" + name + "': batch must be a function (client, statements) when supplied", true);
+    }
+    var hasInteractiveHooks =
+      typeof cfg.beginTx === "function" &&
+      typeof cfg.commit === "function" &&
+      typeof cfg.rollback === "function";
+    var hasBatch = typeof cfg.batch === "function";
+    var supportsTransactions;
+    if (cfg.supportsTransactions === false) {
+      supportsTransactions = false;
+    } else {
+      // true flag, interactive hooks, or (historical default) flag omitted
+      // with no hooks → assume a stateful interactive session.
+      supportsTransactions = true;
+    }
+
     var rawConnect = cfg.connect;
     var rawQuery   = cfg.query;
     var connectFn = rawConnect;
@@ -834,6 +890,9 @@ function init(opts) {
       beginTx:         cfg.beginTx  || function (client) { return cfg.query(client, "BEGIN", []); },
       commit:          cfg.commit   || function (client) { return cfg.query(client, "COMMIT", []); },
       rollback:        cfg.rollback || function (client) { return cfg.query(client, "ROLLBACK", []); },
+      supportsTransactions: supportsTransactions,
+      hasInteractiveHooks:  hasInteractiveHooks,
+      batch:                hasBatch ? cfg.batch : null,
       classifications: Array.isArray(cfg.classifications) && cfg.classifications.length > 0
                          ? cfg.classifications.slice()
                          : ["*"],
@@ -1015,6 +1074,62 @@ function _servesClassification(b, cls) {
   return b.classifications.indexOf("*") !== -1 || b.classifications.indexOf(cls) !== -1;
 }
 
+// Refuse an interactive-transaction request against a backend that cannot
+// honor it (declared supportsTransactions:false, no beginTx/commit/rollback
+// hooks, no batch path). Such a backend would run BEGIN / body / COMMIT as
+// independent autocommit round-trips on different sessions — no isolation,
+// no rollback — and resolve, leaving the consumer believing the block was
+// atomic. Fail closed at the gate (CWE-662-shaped: improper synchronization
+// → lost atomicity) so the operator wires interactive-tx hooks or a batch
+// adapter rather than shipping a silently non-atomic dual-write.
+function _assertInteractiveTransactions(b, where) {
+  if (!b) return;
+  if (b.supportsTransactions === false) {
+    throw _err("NON_ATOMIC_BACKEND",
+      "externalDb." + where + " requires an interactive transaction, but backend '" +
+      b.name + "' declares supportsTransactions: false (a stateless / " +
+      "autocommit-per-statement adapter). BEGIN / the body statements / COMMIT " +
+      "would each run on a different session — no isolation, no rollback — so the " +
+      "block would NOT be atomic. Supply interactive beginTx / commit / rollback " +
+      "hooks, or a batch(client, statements) adapter, on this backend before using " +
+      "externalDb." + where + " (and b.outbox, which is built on it).",
+      true);
+  }
+}
+
+/**
+ * @primitive b.externalDb.supportsTransactions
+ * @signature b.externalDb.supportsTransactions(opts?)
+ * @since     0.15.16
+ * @related   b.externalDb.transaction, b.externalDb.init
+ *
+ * Report whether the picked (or default) backend can provide an
+ * interactive transaction. Returns `false` only when the backend declares
+ * `supportsTransactions: false` at `init()` — a stateless /
+ * autocommit-per-statement adapter on which `transaction()` would run
+ * `BEGIN` / the body / `COMMIT` on different sessions (no isolation, no
+ * rollback). Consumers built on the dual-write guarantee (`b.outbox`) call
+ * this at construction so a non-atomic backend is refused up front rather
+ * than at the first transaction.
+ *
+ * Same backend-selection `opts` as `b.externalDb.query` (`backend` /
+ * `classification`).
+ *
+ * @opts
+ *   backend?:        string,   // explicit backend name
+ *   classification?: string,   // route by data class
+ *
+ * @example
+ *   if (!b.externalDb.supportsTransactions()) {
+ *     throw new Error("this backend cannot run atomic transactions");
+ *   }
+ */
+function supportsTransactions(opts) {
+  _requireInit();
+  var b = _pickBackend(opts);
+  return !!(b && b.supportsTransactions !== false);
+}
+
 // ---- Public API ----
 
 /**
@@ -1158,6 +1273,13 @@ async function query(sql, params, opts) {
  * `BEGIN`, so RLS state set by `sessionGucs` (`SET LOCAL`) applies for
  * the duration of the transaction and resets at COMMIT/ROLLBACK.
  *
+ * Refuses (`NON_ATOMIC_BACKEND`) when the picked backend declares
+ * `supportsTransactions: false` — a stateless / autocommit-per-statement
+ * adapter on which BEGIN / the body / COMMIT would run on different
+ * sessions (no isolation, no rollback). Supply interactive
+ * `beginTx`/`commit`/`rollback` hooks or a `batch` adapter on the backend
+ * instead of shipping a silently non-atomic block.
+ *
  * @opts
  *   backend?:                    string,                       // explicit backend name
  *   classification?:             string,                       // route by data class
@@ -1185,6 +1307,14 @@ async function transaction(fn, opts) {
   if (typeof fn !== "function") throw _err("INVALID_FN", "transaction requires a function", true);
   opts = opts || {};
   var b = _pickBackend(opts);
+  // Fail closed on a backend that cannot provide interactive transactions
+  // (stateless / autocommit-per-statement adapter declared
+  // supportsTransactions:false with no beginTx/commit/rollback hooks and
+  // no batch path). Running the default BEGIN / body / COMMIT against such
+  // a backend lands each statement on a different session — no isolation,
+  // no rollback — yet resolves, so the consumer wrongly believes the block
+  // was atomic. Refuse instead of silently degrading.
+  _assertInteractiveTransactions(b, "transaction");
   var role = dbRoleContext.getRole();
 
   // sessionGucs — per-transaction `SET LOCAL "name" = value` plumbing.
@@ -2608,6 +2738,7 @@ module.exports = {
   init:           init,
   query:          query,
   transaction:    transaction,
+  supportsTransactions: supportsTransactions,
   healthCheck:    healthCheck,
   listBackends:   listBackends,
   shutdown:       shutdown,

package/lib/vendor/blamejs/lib/graphql-federation.js

@@ -27,6 +27,7 @@ var numericBounds = require("./numeric-bounds");
 var safeJson = require("./safe-json");
 var safeBuffer = require("./safe-buffer");
 var requestHelpers = require("./request-helpers");
+var validateOpts = require("./validate-opts");
 var audit = require("./audit");
 var { GraphqlFederationError } = require("./framework-error");
 
@@ -121,7 +122,7 @@ function _readBody(req, errorClass) {
  * @opts
  *   publicSchemaOk:   boolean,                                       // default false — explicit override to publish the SDL
  *   routerToken:      string,                                        // required unless publicSchemaOk; 32+ chars
- *   nonceStore:       { has(nonce): bool, remember(nonce, ttlMs) },  // optional — replay protection
+ *   nonceStore:       { checkAndInsert(nonce, expireAt): bool },     // optional atomic replay protection (b.nonceStore-shaped)
  *   nonceHeader:      string,                                        // default "x-apollographql-router-nonce" — request header carrying the replay nonce
  *   nonceTtlMs:       number,                                        // default 5 minutes
  *   errorClass:       Function,                                      // default GraphqlFederationError
@@ -143,8 +144,15 @@ function guardSdl(opts) {
     throw errorClass.factory("graphql-federation/bad-opts",
       "graphqlFederation.guardSdl: routerToken (32+ char) required unless publicSchemaOk=true");
   }
-  var nonceStore = opts.nonceStore && typeof opts.nonceStore.has === "function" &&
-                   typeof opts.nonceStore.remember === "function" ? opts.nonceStore : null;
+  // Replay store speaks the framework's ATOMIC checkAndInsert(nonce, expireAt)
+  // contract — the same one b.webhook.verify and b.nonceStore.create use — so
+  // the framework's own replay store drops in and concurrent redeliveries of a
+  // captured token can't both pass a non-atomic has()-then-remember() race
+  // (CWE-367). A store lacking checkAndInsert is refused at config time.
+  validateOpts.optionalObjectWithMethod(opts.nonceStore, "checkAndInsert",
+    "graphqlFederation.guardSdl: nonceStore", errorClass, "graphql-federation/bad-nonce-store",
+    "must implement checkAndInsert(nonce, expireAt) — b.nonceStore.create is the reference store");
+  var nonceStore = opts.nonceStore || null;
   numericBounds.requirePositiveFiniteIntIfPresent(opts.nonceTtlMs, "graphqlFederation.guardSdl: opts.nonceTtlMs", errorClass, "BAD_TTL");
   var nonceTtlMs = opts.nonceTtlMs || C.TIME.minutes(5);
   var auditOn = opts.audit !== false;
@@ -215,21 +223,23 @@ function guardSdl(opts) {
             _emitDenied(req, "missing nonce", {});
             return _refuse(res, 401, "graphql federation: nonce required");
           }
-          return Promise.resolve(nonceStore.has(nonce)).then(function (seen) {
-            if (seen) {
+          // Atomic check-and-insert: a redelivered nonce returns false (already
+          // present) and is refused; a fresh nonce is inserted with an absolute
+          // expiry in one operation, so two concurrent deliveries of the same
+          // captured token can't both observe "unseen" and pass.
+          return Promise.resolve(nonceStore.checkAndInsert(nonce, Date.now() + nonceTtlMs)).then(function (fresh) {
+            if (!fresh) {
               _emitDenied(req, "nonce replay", { nonce: nonce.slice(0, NONCE_PREVIEW_LEN) + "..." });
               return _refuse(res, 401, "graphql federation: nonce replay");
             }
-            return Promise.resolve(nonceStore.remember(nonce, nonceTtlMs)).then(function () {
-              if (auditOn) {
-                audit.safeEmit({
-                  action:   "graphqlfederation.sdl_allowed",
-                  outcome:  "success",
-                  metadata: {},
-                });
-              }
-              if (typeof next === "function") next();
-            });
+            if (auditOn) {
+              audit.safeEmit({
+                action:   "graphqlfederation.sdl_allowed",
+                outcome:  "success",
+                metadata: {},
+              });
+            }
+            if (typeof next === "function") next();
           });
         }
         if (auditOn) {

package/lib/vendor/blamejs/lib/log-stream-cloudwatch.js

@@ -161,6 +161,7 @@ function _post(cfg, body, headers) {
     url:              _resolveEndpoint(cfg),
     headers:          headers,
     body:             body,
+    timeoutMs:        cfg.timeoutMs,
     idleTimeoutMs:    cfg.timeoutMs,
     maxResponseBytes: MAX_RESPONSE_BYTES,
     errorClass:       LogStreamError,

package/lib/vendor/blamejs/lib/log-stream-local.js

@@ -57,7 +57,20 @@ function create(config) {
   var bytesWritten = 0;
 
   function _open() {
-    fd = nodeFs.openSync(activePath, "a", cfg.fileMode);
+    // O_NOFOLLOW append open: a symlink planted at the active log path is
+    // refused (ELOOP) instead of followed, so log writes can't be redirected
+    // to an attacker-chosen file (CWE-59). This makes the symlink refusal
+    // atomic with the open — a caller's pre-check-then-unlink can't close the
+    // race on its own because the sink's own open is what follows the link.
+    try {
+      fd = atomicFile.openAppendNoFollowSync(activePath, cfg.fileMode);
+    } catch (e) {
+      if (e && e.code === "ELOOP") {
+        throw _err("SYMLINK_REFUSED",
+          "refusing to open log at a symlink: " + activePath, true);
+      }
+      throw e;
+    }
     openedAt = Date.now();
     try {
       var stat = nodeFs.fstatSync(fd);

package/lib/vendor/blamejs/lib/log-stream-otlp.js

@@ -188,6 +188,7 @@ function _post(url, body, headers, timeoutMs, allowedProtocols, allowInternal) {
     url:              url,
     headers:          headers,
     body:             body,
+    timeoutMs:        timeoutMs,
     idleTimeoutMs:    timeoutMs,
     maxResponseBytes: MAX_RESPONSE_BYTES,
     errorClass:       LogStreamError,

package/lib/vendor/blamejs/lib/log-stream-webhook.js

@@ -67,6 +67,7 @@ function _post(url, body, headers, timeoutMs, allowedProtocols, allowInternal) {
     url:              url,
     headers:          headers,
     body:             body,
+    timeoutMs:        timeoutMs,
     idleTimeoutMs:    timeoutMs,
     maxResponseBytes: MAX_RESPONSE_BYTES,
     errorClass:       LogStreamError,

package/lib/vendor/blamejs/lib/mail-auth.js

@@ -1102,6 +1102,11 @@ async function _fetchDmarcRecord(domain, dnsLookup) {
 // throw on malformed v= / unrecognized np= or psd= values rather than
 // silently dropping — operators with a typo'd record otherwise see the
 // fallback policy applied without warning.
+// RFC 7489 §6.3 — p= (and DMARCbis sp=/np=) take exactly one of
+// none|quarantine|reject. p= is REQUIRED; a record without a valid p=
+// carries no usable policy (treat as if no record were published rather
+// than defaulting any unrecognized value to "deliver").
+var DMARC_VALID_P = { none: 1, quarantine: 1, reject: 1 };
 var DMARCBIS_VALID_NP = { none: 1, quarantine: 1, reject: 1 };
 var DMARCBIS_VALID_PSD = { y: 1, n: 1, u: 1 };
 
@@ -1115,8 +1120,22 @@ function _parseDmarcRecord(text) {
     var key = pairs[i][0];
     var val = pairs[i][1];
     if (key === "v")     policy.v = val;
-    else if (key === "p")     policy.p = val.toLowerCase();
-    else if (key === "sp")    policy.sp = val.toLowerCase();
+    else if (key === "p") {
+      var pVal = val.toLowerCase();
+      if (!Object.prototype.hasOwnProperty.call(DMARC_VALID_P, pVal)) {
+        throw new MailAuthError("mail-auth/dmarcbis-bad-tag",
+          "DMARC p= must be one of none|quarantine|reject, got " + JSON.stringify(val));
+      }
+      policy.p = pVal;
+    }
+    else if (key === "sp") {
+      var spVal = val.toLowerCase();
+      if (!Object.prototype.hasOwnProperty.call(DMARC_VALID_P, spVal)) {
+        throw new MailAuthError("mail-auth/dmarcbis-bad-tag",
+          "DMARC sp= must be one of none|quarantine|reject, got " + JSON.stringify(val));
+      }
+      policy.sp = spVal;
+    }
     else if (key === "pct")   policy.pct = parseInt(val, 10);
     else if (key === "adkim") policy.adkim = val.toLowerCase();
     else if (key === "aspf")  policy.aspf = val.toLowerCase();
@@ -1141,6 +1160,16 @@ function _parseDmarcRecord(text) {
     throw new MailAuthError("mail-auth/dmarc-bad-version",
       "DMARC record version must be DMARC1, got " + JSON.stringify(policy.v));
   }
+  // RFC 7489 §6.3 — p= is REQUIRED. A record syntactically valid in
+  // every other respect but missing p= publishes no usable policy; the
+  // receiver MUST treat it as if no record were found rather than
+  // synthesizing a permissive default. Fail closed here so the caller
+  // can route the missing-policy case (none/permerror) instead of
+  // delivering an unauthenticated message.
+  if (policy.p === null) {
+    throw new MailAuthError("mail-auth/dmarc-missing-policy",
+      "DMARC record has no required p= tag (RFC 7489 §6.3)");
+  }
   return policy;
 }
 
@@ -1236,7 +1265,18 @@ async function dmarcEvaluate(opts) {
       }
     }
   } catch (e) {
-    return { result: "temperror", explanation: e.message,
+    // RFC 7489 §6.6.3 — a syntactically invalid / policy-less record is a
+    // PERMANENT error (permerror); only transient DNS resolution failures
+    // are temperror. The DMARC parser raises typed MailAuthError codes for
+    // the permanent cases (bad version, unrecognized tag value, missing
+    // required p=); anything else (DNS lookup) is transient. Either way the
+    // disposition is fail-closed — neither path yields recommendedAction
+    // "deliver".
+    var permanent = e && typeof e.code === "string" &&
+      (e.code === "mail-auth/dmarc-bad-version" ||
+       e.code === "mail-auth/dmarcbis-bad-tag" ||
+       e.code === "mail-auth/dmarc-missing-policy");
+    return { result: permanent ? "permerror" : "temperror", explanation: e.message,
              policy: null, alignment: { spf: false, dkim: false },
              orgDomain: orgDomain };
   }
@@ -1312,13 +1352,23 @@ async function dmarcEvaluate(opts) {
     sampleRoll = bCrypto.randomInt(0, 100);                                                     // pct sample roll
   }
   var sampled = !pass && pct < 100 && sampleRoll >= pct;
-  var recommendedAction = pass ? "deliver" :
-                          sampled
-                            ? (policy.p === "reject" ? "quarantine" :
-                               policy.p === "quarantine" ? "none" : "deliver")
-                            : (policy.p === "reject"     ? "reject" :
-                               policy.p === "quarantine" ? "quarantine" :
-                               "deliver");
+  // Disposition is driven by the validated p= value. policy.p is one of
+  // none|quarantine|reject (the parser fails closed on anything else, so a
+  // missing/typo'd policy never reaches here). "none" is monitor-only →
+  // deliver; reject/quarantine map to their disposition (sampled = the
+  // next-less-strict step per §6.6.4). The explicit "none" arm — rather
+  // than a catch-all "else → deliver" — keeps an unexpected value from
+  // silently delivering a failing message.
+  var recommendedAction;
+  if (pass) {
+    recommendedAction = "deliver";
+  } else if (policy.p === "none") {
+    recommendedAction = "deliver";
+  } else if (sampled) {
+    recommendedAction = policy.p === "reject" ? "quarantine" : "none";       // p is reject|quarantine here
+  } else {
+    recommendedAction = policy.p === "reject" ? "reject" : "quarantine";     // p is reject|quarantine here
+  }
 
   return {
     result:     pass ? "pass" : "fail",
@@ -1544,10 +1594,15 @@ async function arcVerify(rfc822, opts) {
     var asX  = asTags.x  ? parseInt(asTags.x, 10)  : null;
     var skewSec = Math.floor(arcClockSkewMs / 1000);                                          // sec divisor
     var timeFault = null;
-    if (amsT && isFinite(amsT) && amsT - skewSec > nowSec) timeFault = "ams-t-future";
-    if (amsX && isFinite(amsX) && amsX + skewSec < nowSec) timeFault = "ams-x-expired";
-    if (asT  && isFinite(asT)  && asT  - skewSec > nowSec) timeFault = "as-t-future";
-    if (asX  && isFinite(asX)  && asX  + skewSec < nowSec) timeFault = "as-x-expired";
+    // RFC 8617 §5.2 — a PRESENT t=/x= that is unparseable (parseInt → NaN) must
+    // FAIL CLOSED (a time fault), not silently skip the future/expiry check: a
+    // bare `isFinite(amsT) &&` lets a malformed timestamp slip the MUST-reject
+    // gate. Gate on the RAW tag's presence (amsTags.t/x) so an unparseable value
+    // becomes a fault, while an absent tag is correctly ignored.
+    if (amsTags.t && (!isFinite(amsT) || amsT - skewSec > nowSec)) timeFault = isFinite(amsT) ? "ams-t-future" : "ams-t-unparseable";
+    if (amsTags.x && (!isFinite(amsX) || amsX + skewSec < nowSec)) timeFault = isFinite(amsX) ? "ams-x-expired" : "ams-x-unparseable";
+    if (asTags.t  && (!isFinite(asT)  || asT  - skewSec > nowSec)) timeFault = isFinite(asT)  ? "as-t-future"  : "as-t-unparseable";
+    if (asTags.x  && (!isFinite(asX)  || asX  + skewSec < nowSec)) timeFault = isFinite(asX)  ? "as-x-expired" : "as-x-unparseable";
 
     // AMS — RFC 8617 §5.1.1. Same shape as a DKIM-Signature; reuses
     // the DKIM verifier by injecting a temporary message that has

package/lib/vendor/blamejs/lib/mail-bimi.js

@@ -819,6 +819,12 @@ function _verifyCertChain(leaf, intermediates, anchors) {
   while (depth < MAX_DEPTH) {
     var notBefore = Date.parse(current.validFrom);
     var notAfter  = Date.parse(current.validTo);
+    // Fail closed on a present-but-unparseable validity window: a NaN date
+    // would otherwise skip both window checks below and let the cert pass
+    // validation unchecked.
+    if (!isFinite(notBefore) || !isFinite(notAfter)) {
+      return { ok: false, reason: "cert validity dates unparseable" };
+    }
     if (isFinite(notBefore) && now < notBefore) {
       return { ok: false, reason: "cert not-yet-valid (notBefore=" + current.validFrom + ")" };
     }

package/lib/vendor/blamejs/lib/mail-crypto-smime.js

@@ -829,6 +829,16 @@ function checkCert(opts) {
   var nowMs = Date.now();
   var notBeforeMs = Date.parse(cert.validFrom);
   var notAfterMs  = Date.parse(cert.validTo);
+  // Fail closed on a present-but-unparseable validity field — gating
+  // each comparison behind isFinite() alone let a NaN notBefore /
+  // notAfter skip both checks and pass validity. RFC 5280 §4.1.2.5
+  // makes both dates mandatory; a date a peer cannot parse must be
+  // refused at preflight, not accepted and left to fail interop later.
+  if (!isFinite(notBeforeMs) || !isFinite(notAfterMs)) {
+    throw new MailCryptoError("mail-crypto/smime/bad-validity",
+      "cert has unparseable validity dates (validFrom=" + cert.validFrom +
+      ", validTo=" + cert.validTo + ")");
+  }
   if (isFinite(notBeforeMs) && nowMs < notBeforeMs) {
     throw new MailCryptoError("mail-crypto/smime/expired-cert",
       "cert is not yet valid (notBefore=" + cert.validFrom + ", now=" +