@blamejs/blamejs-shop 0.4.86 → 0.4.88

package/lib/vendor/blamejs/lib/middleware/dpop.js

@@ -144,33 +144,19 @@ function _nonceManager(rotateSec) {
   };
 }
 
-function _reconstructHtu(req, mopts) {
-  // The proof's htu is the request URI WITHOUT query/fragment. Behind
-  // a reverse proxy the operator may need to override via opts.htu /
-  // opts.getHtu. X-Forwarded-* headers are ATTACKER-CONTROLLED when
-  // the origin is reachable directly; an attacker who can hit the
-  // origin while spoofing X-Forwarded-Proto: https can trick this
-  // function into building an `https` htu that the DPoP proof was
-  // signed for — when the origin is actually serving HTTP. RFC 9449
-  // §4.3 says htu MUST be the absolute URL the request was sent to.
-  //
-  // Default: ignore X-Forwarded-* and derive proto/host from the
-  // socket. Operators with a confirmed-trusted front proxy opt in
-  // via opts.trustForwardedHeaders: true.
-  mopts = mopts || {};
-  var trustForwarded = mopts.trustForwardedHeaders === true;
-  var proto;
-  if (trustForwarded && req.headers["x-forwarded-proto"]) {
-    proto = String(req.headers["x-forwarded-proto"]).split(",")[0].trim();
-  } else {
-    proto = req.socket && req.socket.encrypted ? "https" : "http";
-  }
-  var host;
-  if (trustForwarded && req.headers["x-forwarded-host"]) {
-    host = String(req.headers["x-forwarded-host"]).split(",")[0].trim();
-  } else {
-    host = req.headers.host;
-  }
+function _reconstructHtu(req, protoResolver, hostResolver) {
+  // The proof's htu is the request URI WITHOUT query/fragment. Behind a
+  // reverse proxy the operator may override via opts.getHtu. RFC 9449 §4.3
+  // says htu MUST be the absolute URL the request was sent to — and it is
+  // cryptographically bound in the proof, so a forged scheme/authority lets a
+  // proof signed for one origin validate against another. proto + host are
+  // resolved through the peer-gated requestHelpers resolvers built in create():
+  // X-Forwarded-Proto / -Host are honored only from a declared trusted-proxy
+  // peer; otherwise the real TLS socket scheme + the request's own Host are
+  // used and forged forwarded headers are ignored.
+  if (!req || !req.headers) return null;
+  var proto = protoResolver.resolve(req);
+  var host = hostResolver.resolve(req);
   if (!host) return null;
   var path = req.url || "/";
   var qIdx = path.indexOf("?");
@@ -205,6 +191,9 @@ function _reconstructHtu(req, mopts) {
  *     getAccessToken: function(req): string|null,
  *     getNonce:       async function(req): string|null,
  *     getHtu:         function(req): string,
+ *     trustedProxies: string|string[],             // CIDRs of your reverse proxies — peer-gates X-Forwarded-Proto + X-Forwarded-Host for htu reconstruction
+ *     protocolResolver: function(req): "http"|"https",  // own the scheme decision
+ *     hostResolver:   function(req): string|null,  // own the authority decision
  *     nonceStore:     object,
  *     nonceWindowSec: number,
  *     nonceRotateSec: number,
@@ -228,9 +217,11 @@ function create(opts) {
     "replayStore", "algorithms", "iatWindowSec",
     "getAccessToken", "getNonce", "getHtu", "audit",
     "nonceStore", "nonceWindowSec", "nonceRotateSec", "requireNonce",
-    // v0.9.4 — opt-in trust gate for X-Forwarded-Proto/Host when
-    // reconstructing htu. Default off; operators
-    // with a confirmed-trusted front proxy set this to `true`.
+    // htu reconstruction trust. trustedProxies (CIDRs) peer-gates
+    // X-Forwarded-Proto + X-Forwarded-Host; protocolResolver/hostResolver let
+    // the operator own each. trustForwardedHeaders (legacy boolean) is refused
+    // on its own — see the peer-gating block below.
+    "trustedProxies", "protocolResolver", "hostResolver",
     "trustForwardedHeaders", "onDeny", "problemDetails",
   ], "middleware.dpop");
 
@@ -282,6 +273,38 @@ function create(opts) {
   validateOpts.optionalFunction(opts.getHtu,
     "middleware.dpop: getHtu", AuthError, "auth-dpop/bad-opt");
 
+  // htu reconstruction (RFC 9449 §4.3) builds the absolute request URL —
+  // proto + host — that the proof's cryptographically-bound `htu` claim is
+  // verified against. Behind a proxy both come from forgeable X-Forwarded-*
+  // headers, so resolve them through the peer-gated requestHelpers primitives
+  // (the same fail-closed model csrf-protect / security-headers / cors use):
+  // X-Forwarded-Proto / -Host are honored ONLY when the immediate peer is a
+  // declared trusted proxy. The legacy trustForwardedHeaders:true trusted the
+  // headers from ANY caller — a direct attacker could forge XFP:https / a
+  // victim XFH to make a proof signed for one origin validate against another
+  // (htu confusion). It is refused on its own; migrate to trustedProxies.
+  var _proto = requestHelpers.trustedProtocol({
+    trustedProxies:   opts.trustedProxies,
+    protocolResolver: opts.protocolResolver,
+  });
+  var _host = requestHelpers.trustedHost({
+    trustedProxies: opts.trustedProxies,
+    hostResolver:   opts.hostResolver,
+  });
+  // Only refuse the spoofable legacy flag when the htu is actually
+  // reconstructed from the request. When the operator supplies getHtu they own
+  // the entire URI, _reconstructHtu (and the forwarded headers) is never
+  // consulted, so a leftover trustForwardedHeaders is moot — don't fail
+  // construction on it (the error text even offers getHtu as a migration path).
+  if (typeof opts.getHtu !== "function" && opts.trustForwardedHeaders === true && !_proto.peerGated) {
+    throw new AuthError("auth-dpop/bad-opt",
+      "middleware.dpop: trustForwardedHeaders is spoofable for the htu reconstruction " +
+      "(a direct caller can forge X-Forwarded-Proto / X-Forwarded-Host) and is no longer " +
+      "honored on its own. Declare your reverse proxies via trustedProxies: [\"10.0.0.0/8\", …] " +
+      "(peer-gates X-Forwarded-Proto + X-Forwarded-Host), or own the decision via " +
+      "protocolResolver(req) / hostResolver(req) / getHtu(req).");
+  }
+
   function _freshNonce() { return nonceMgr ? nonceMgr.issue() : null; }
 
   var middleware = async function dpopMiddleware(req, res, next) {
@@ -309,7 +332,7 @@ function create(opts) {
         "multiple DPoP proofs in one header value are not allowed", null, onDeny, problemMode);
     }
 
-    var htu = (typeof opts.getHtu === "function" ? opts.getHtu(req) : _reconstructHtu(req, opts));
+    var htu = (typeof opts.getHtu === "function" ? opts.getHtu(req) : _reconstructHtu(req, _proto, _host));
     if (!htu) {
       return _writeUnauthorized(req, res, "invalid_dpop_proof", "could not reconstruct htu", null, onDeny, problemMode);
     }

package/lib/vendor/blamejs/lib/middleware/span-http-server.js

@@ -68,6 +68,11 @@ function _splitUrl(url) {
 }
 
 function _scheme(req) {
+  // Display-only: the OTel url.scheme span attribute reflects the scheme the
+  // client used (forwarded), NOT a Secure/HSTS/origin trust decision. Routing
+  // through trustedProtocol would drop the forwarded scheme from spans behind a
+  // proxy (less accurate telemetry) for no security gain.
+  // allow:raw-xfp — telemetry label, not a trust sink (see above).
   var x = req.headers && (req.headers["x-forwarded-proto"] || "");
   if (typeof x === "string" && x.length > 0) {
     var first = x.split(",")[0].trim().toLowerCase();
@@ -77,6 +82,8 @@ function _scheme(req) {
 }
 
 function _serverAddress(req) {
+  // allow:raw-xfp — display-only: server.address span attribute (telemetry),
+  // not an authority trust decision. Same rationale as _scheme above.
   var hostHeader = req.headers && (req.headers["x-forwarded-host"] || req.headers.host);
   if (typeof hostHeader === "string" && hostHeader.length > 0) {
     return hostHeader.split(",")[0].trim();

package/lib/vendor/blamejs/lib/network-tls.js

@@ -1187,8 +1187,18 @@ function evaluateOcspResponse(ocspDer, opts) {
   var clockSkewMs = typeof opts.clockSkewMs === "number" && opts.clockSkewMs >= 0           // allow:numeric-opt-Infinity — operator-supplied skew, default 5 min if absent or invalid
     ? opts.clockSkewMs : C.TIME.minutes(5);
   var now = typeof opts.now === "number" ? opts.now : Date.now();
-  var thisUpdateMs = match.thisUpdate ? Date.parse(match.thisUpdate) : NaN;
-  var nextUpdateMs = match.nextUpdate ? Date.parse(match.nextUpdate) : NaN;
+  // thisUpdate / nextUpdate are already unix-ms NUMBERS (parseOcspResponse →
+  // _parseTime returns Date.UTC(...)). Do NOT Date.parse() them: Date.parse
+  // coerces its argument to a string, and a bare-integer string is not a
+  // recognized date format, so Date.parse(<number>) is NaN — which made the
+  // !isFinite guard below reject every response (fresh or stale) with a
+  // misleading "missing thisUpdate", leaving the real staleness window checks
+  // (future thisUpdate, past nextUpdate) as unreachable dead code. Read the
+  // numbers directly; the typeof guard keeps a legitimate epoch-0 thisUpdate
+  // (Date.UTC(1970,0,1)===0, which is falsy) and maps a null nextUpdate to NaN
+  // so the optional-field branch still no-ops.
+  var thisUpdateMs = typeof match.thisUpdate === "number" ? match.thisUpdate : NaN;
+  var nextUpdateMs = typeof match.nextUpdate === "number" ? match.nextUpdate : NaN;
   if (!isFinite(thisUpdateMs)) {
     return { ok: false, status: parsed.status, signatureValid: true,
              certStatus: match.certStatus,

package/lib/vendor/blamejs/lib/queue-local.js

@@ -230,14 +230,28 @@ function create(config) {
   // open each verb builder pre-bound to this table so the table reference
   // is resolved in exactly one place.
   var ref = _resolveTableRef(config);
-  function _select() { return sql.select(ref.name, ref.opts); }
-  function _insert() { return sql.insert(ref.name, ref.opts); }
-  function _update() { return sql.update(ref.name, ref.opts); }
-  function _delete() { return sql.delete(ref.name, ref.opts); }
-  // Quoted column expression for a setRaw RHS that references the column's
-  // own pre-update value (attempts/availableAt). dialect-sqlite quoting is
-  // the double-quote form clusterStorage's Postgres path keeps.
-  function _qc(col) { return safeSql.quoteIdentifier(col, "sqlite", { allowReserved: true }); }
+  // Resolve the ACTIVE backend dialect every verb builds for — sqlite in
+  // single-node, the operator-configured postgres/mysql in cluster mode — so
+  // b.sql emits dialect-correct identifier quoting (backticks on MySQL, not
+  // double-quotes that MySQL reads as string literals) and its own dialect
+  // guards fire. The default store IS clusterStorage (it knows the live
+  // dialect); a bring-your-own store declares config.dialect (or exposes its
+  // own dialect()), defaulting to sqlite. Resolved per call (lazy) like the
+  // sibling clusterStorage data-layer files, since cluster.init may run after
+  // queue.create.
+  function _dialect() {
+    if (store === clusterStorage) return clusterStorage.dialect();
+    if (typeof store.dialect === "function") return store.dialect();
+    return (typeof config.dialect === "string" && config.dialect) ? config.dialect : "sqlite";
+  }
+  function _opts() { return Object.assign({}, ref.opts, { dialect: _dialect() }); }
+  function _select() { return sql.select(ref.name, _opts()); }
+  function _insert() { return sql.insert(ref.name, _opts()); }
+  function _update() { return sql.update(ref.name, _opts()); }
+  function _delete() { return sql.delete(ref.name, _opts()); }
+  // Quoted column expression for a setRaw RHS that references the column's own
+  // pre-update value (attempts/availableAt), quoted for the ACTIVE dialect.
+  function _qc(col) { return safeSql.quoteIdentifier(col, _dialect(), { allowReserved: true }); }
 
   async function enqueue(queueName, payload, opts) {
     cluster.requireLeader();
@@ -324,22 +338,9 @@ function create(config) {
     };
   }
 
-  async function lease(queueName, leaseMs, count) {
-    cluster.requireLeader();
-    var nowMs = Date.now();
-    var leaseExpiresAt = nowMs + leaseMs;
-    var maxRows = count != null ? count : 1;
-
-    // Single-statement atomic lease. The IN-subquery picks the head of
-    // the queue; the outer UPDATE locks those rows and only updates
-    // rows that still match status='pending' after the lock acquires
-    // (Postgres EvalPlanQual; SQLite is single-writer so the same row
-    // can't be picked twice). RETURNING hands back the leased columns
-    // so we don't need a separate SELECT after the UPDATE. maxRows is a
-    // framework-computed integer emitted inline via b.sql's .limit() (a
-    // bound LIMIT param has no portable form across the subquery path);
-    // attempts = attempts + 1 is a setRaw over the column's own value.
-    var leaseInner = _select()
+  // Build the head-of-queue candidate SELECT (shared by both lease paths).
+  function _leaseCandidates(queueName, nowMs, maxRows) {
+    return _select()
       .columns(["_id"])
       .where("queueName", queueName)
       .where("status", "pending")
@@ -348,20 +349,87 @@ function create(config) {
       .orderBy("availableAt", "asc")
       .orderBy("enqueuedAt", "asc")
       .limit(maxRows);
-    var leaseBuilt = _update()
-      .set("status", "inflight")
-      .set("leasedAt", nowMs)
-      .set("leaseExpiresAt", leaseExpiresAt)
-      .setRaw("attempts", _qc("attempts") + " + 1", [])
-      .whereIn("_id", leaseInner)
-      .returning(LEASE_RETURN_COLS)
-      .toSql();
-    var result = await store.execute(leaseBuilt.sql, leaseBuilt.params);
-    var leased = [];
-    for (var i = 0; i < result.rows.length; i++) {
-      leased.push(_shapeLeasedRow(result.rows[i]));
+  }
+
+  async function lease(queueName, leaseMs, count) {
+    cluster.requireLeader();
+    var nowMs = Date.now();
+    var leaseExpiresAt = nowMs + leaseMs;
+    var maxRows = count != null ? count : 1;
+    var dialect = _dialect();
+    var i;
+
+    // SQLite (single-writer): one self-contained statement is atomic. The
+    // IN-subquery picks the head of the queue, the outer UPDATE flips it, and
+    // RETURNING hands the leased rows back. This shape is valid ONLY on
+    // sqlite — Postgres freezes the materialized subquery qual (so a
+    // concurrent leaser double-claims the same row) and MySQL refuses both
+    // RETURNING and updating a table named in its own subquery (error 1093).
+    if (dialect === "sqlite") {
+      var leaseBuilt = _update()
+        .set("status", "inflight")
+        .set("leasedAt", nowMs)
+        .set("leaseExpiresAt", leaseExpiresAt)
+        .setRaw("attempts", _qc("attempts") + " + 1", [])
+        .whereIn("_id", _leaseCandidates(queueName, nowMs, maxRows))
+        .returning(LEASE_RETURN_COLS)
+        .toSql();
+      var result = await store.execute(leaseBuilt.sql, leaseBuilt.params);
+      var leased = [];
+      for (i = 0; i < result.rows.length; i++) leased.push(_shapeLeasedRow(result.rows[i]));
+      return leased;
+    }
+
+    // Postgres / MySQL: claim inside a transaction. SELECT ... FOR UPDATE SKIP
+    // LOCKED row-locks the head-of-queue ids so concurrent leasers see
+    // disjoint sets (no double-lease); the guarded UPDATE ... WHERE
+    // status='pending' AND _id IN (locked ids) uses a LITERAL id list (not a
+    // self-referencing subquery — avoids MySQL 1093), with the status guard as
+    // belt-and-suspenders. Postgres reads the leased rows back via RETURNING;
+    // MySQL (no RETURNING) re-selects them by the locked ids. Mirrors
+    // outbox._claimBatch — the framework's canonical competing-consumer claim.
+    if (typeof store.transaction !== "function") {
+      throw _err("CLUSTER_TX_UNSUPPORTED",
+        "queue lease on a '" + dialect + "' backend requires an interactive transaction, but the " +
+        "configured store exposes no transaction(); use the default cluster store or supply a " +
+        "transaction-capable store", true);
     }
-    return leased;
+    return await store.transaction(async function (tx) {
+      var selBuilt = _leaseCandidates(queueName, nowMs, maxRows)
+        .forUpdate({ skipLocked: true })
+        .toSql();
+      var selRes = await tx.execute(selBuilt.sql, selBuilt.params);
+      var ids = ((selRes && selRes.rows) || []).map(function (r) { return r._id; });
+      if (ids.length === 0) return [];
+
+      var upd = _update()
+        .set("status", "inflight")
+        .set("leasedAt", nowMs)
+        .set("leaseExpiresAt", leaseExpiresAt)
+        .setRaw("attempts", _qc("attempts") + " + 1", [])
+        .where("status", "pending")
+        .whereInArray("_id", ids);
+
+      var rows;
+      if (dialect === "postgres") {
+        var updBuilt = upd.returning(LEASE_RETURN_COLS).toSql();
+        var updRes = await tx.execute(updBuilt.sql, updBuilt.params);
+        rows = (updRes && updRes.rows) || [];
+      } else {
+        var u = upd.toSql();
+        await tx.execute(u.sql, u.params);
+        var rbBuilt = _select()
+          .columns(LEASE_RETURN_COLS)
+          .where("status", "inflight")
+          .whereInArray("_id", ids)
+          .toSql();
+        var rbRes = await tx.execute(rbBuilt.sql, rbBuilt.params);
+        rows = (rbRes && rbRes.rows) || [];
+      }
+      var out = [];
+      for (i = 0; i < rows.length; i++) out.push(_shapeLeasedRow(rows[i]));
+      return out;
+    });
   }
 
   // extendLease — push the lease expiry forward for a long-running job.
@@ -633,19 +701,28 @@ function create(config) {
     return result.rowCount || 0;
   }
 
-  // patchFlowDeps — the second pass of enqueueFlow. Writes the resolved
-  // dependsOn jobIds and parks availableAt at MAX_SAFE_INTEGER for a flow
-  // child that has dependencies. Lives on the backend (not in queue.js)
-  // so it targets THIS backend's configured store + table — a
-  // bring-your-own table receives the flow graph the same way the
-  // first-pass enqueue did, instead of the dispatcher writing to the
-  // default jobs table behind the backend's back. depIds is serialized
-  // to JSON for the dependsOn column.
+  // patchFlowDeps — the second pass of enqueueFlow. Rewrites the child's
+  // dependsOn from the dependency NAMES the first pass wrote to the resolved
+  // sibling jobIds (now that every sibling's jobId is known). Lives on the
+  // backend (not in queue.js) so it targets THIS backend's configured store +
+  // table — a bring-your-own table receives the flow graph the same way the
+  // first-pass enqueue did, instead of the dispatcher writing to the default
+  // jobs table behind the backend's back. depIds is serialized to JSON.
+  //
+  // It must NOT touch availableAt: the first pass already parked the child at
+  // FLOW_BLOCKED_AVAILABLE_AT (it enqueues deps-bearing children WITH their
+  // dependsOn), and a dependency that completes in the window between the two
+  // passes drives complete() → _maybeReleaseFlowChildren, which bumps the
+  // child's availableAt to now. Re-parking here would clobber that release,
+  // and since the dependency is already done it never completes again — the
+  // child would sit pending-but-unleaseable forever. Parking is owned by the
+  // first-pass enqueue; releasing is owned by completion. This pass only
+  // resolves names → ids (harmless to rewrite even on an already-released
+  // child: a leased child's own dependsOn is never re-read).
   async function patchFlowDeps(jobId, depIds) {
     cluster.requireLeader();
     var built = _update()
       .set("dependsOn", JSON.stringify(depIds))
-      .set("availableAt", FLOW_BLOCKED_AVAILABLE_AT)
       .where("_id", jobId)
       .toSql();
     var result = await store.execute(built.sql, built.params);

package/lib/vendor/blamejs/lib/queue.js

@@ -938,14 +938,16 @@ function enqueueFlow(spec) {
     { queueName: spec.queueName, flowId: flowId, childCount: spec.children.length },
     async function () {
       var jobs = [];
-      // Two-pass insert: first pass enqueues all children with their
-      // names attached so the second pass can write dependsOn jobIds
-      // resolved by name. Children with deps land at MAX_SAFE_INTEGER
-      // availableAt automatically (see queue-local enqueue logic).
+      // Two-pass insert: first pass enqueues all children (so the second pass
+      // can resolve dependsOn names → sibling jobIds); a deps-bearing child is
+      // PARKED at enqueue time by passing its dependsOn through, so it is never
+      // leaseable in the window between the two passes (a concurrent consumer
+      // could otherwise lease it before its deps run). The second pass only
+      // rewrites the parked child's dependsOn from names to the resolved jobIds.
       var nameToJobId = {};
       for (var p = 0; p < spec.children.length; p++) {
         var ch = spec.children[p];
-        // Hold off setting dependsOn until we know all sibling jobIds.
+        var hasDeps = Array.isArray(ch.dependsOn) && ch.dependsOn.length > 0;
         var enqOpts = {
           backend:       flowBackend.name,
           flowId:        flowId,
@@ -954,10 +956,12 @@ function enqueueFlow(spec) {
           classification: ch.classification || null,
           traceId:       ch.traceId || null,
           maxAttempts:   ch.maxAttempts,
-          // dependsOn intentionally omitted on first pass — will be patched
-          // in via the backend's patchFlowDeps after all jobIds are known.
-          // Root children (no deps) are immediately leaseable; deps-bearing
-          // children get parked at MAX_SAFE_INTEGER via the second pass.
+          // Park a deps-bearing child immediately (queue-local parks when
+          // opts.dependsOn is present); the second pass replaces these dep
+          // NAMES with the resolved sibling jobIds, keeping it parked until
+          // completion bumps availableAt. Root children (no deps) stay
+          // immediately leaseable.
+          dependsOn:     hasDeps ? ch.dependsOn : undefined,
         };
         var result = await enqueue(spec.queueName, ch.payload, enqOpts);
         nameToJobId[ch.name] = result.jobId;

package/lib/vendor/blamejs/lib/request-helpers.js

@@ -636,6 +636,94 @@ function requestProtocol(req, opts) {
   return "http";
 }
 
+/**
+ * @primitive b.requestHelpers.trustedHost
+ * @signature b.requestHelpers.trustedHost(opts?)
+ * @since     0.15.18
+ * @related   b.requestHelpers.requestHost, b.requestHelpers.trustedProtocol
+ *
+ * Peer-gated companion to trustedProtocol for the request authority (host).
+ * Reconstructing the absolute request URL — the DPoP `htu`, an origin/issuer
+ * string, a redirect base — depends on the host the client addressed; behind a
+ * proxy that comes from X-Forwarded-Host, which is forgeable unless the
+ * immediate peer is a trusted proxy. Returns `{ resolve(req)=>string|null,
+ * peerGated }`. With `trustedProxies` (CIDRs) X-Forwarded-Host is honored only
+ * from a trusted peer; with `hostResolver(req)` the operator owns it; with
+ * neither only the request's own Host header is used (forwarded host ignored).
+ *
+ * @opts
+ *   trustedProxies: string | string[],
+ *   hostResolver:   function(req): string|null,
+ *
+ * @example
+ *   var th = b.requestHelpers.trustedHost({ trustedProxies: ["10.0.0.0/8"] });
+ *   th.resolve(req);   // X-Forwarded-Host only when it came via a trusted peer
+ */
+function trustedHost(opts) {
+  opts = opts || {};
+  var resolver = opts.hostResolver;
+  if (resolver != null && typeof resolver !== "function") {
+    throw new TypeError("trustedHost: hostResolver must be a function(req) => string|null");
+  }
+  var predicate = _trustedProxyPredicate(_normTrustedProxies(opts), "trustedHost");
+  return {
+    peerGated: !!(resolver || predicate),
+    resolve: function (req) {
+      if (resolver) return resolver(req);
+      if (predicate) return requestHost(req, { trustProxy: predicate });
+      return requestHost(req, { trustProxy: false });
+    },
+  };
+}
+
+/**
+ * @primitive b.requestHelpers.requestHost
+ * @signature b.requestHelpers.requestHost(req, opts?)
+ * @since     0.15.18
+ * @related   b.requestHelpers.requestProtocol, b.requestHelpers.trustedHost
+ *
+ * Resolve the inbound authority (host[:port]). Default returns the request's
+ * own `Host` header. Behind a trusted reverse proxy that rewrites the host,
+ * pass `trustProxy` as a PREDICATE `function(addr)=>boolean` (build it via
+ * `b.requestHelpers.trustedHost`): `X-Forwarded-Host` is then honored only when
+ * the immediate peer is a trusted proxy, so a direct caller can't forge it. The
+ * legacy `trustProxy: true` reads the leftmost forwarded hop without checking
+ * the peer — forgeable. Returns the host string, or `null` when absent.
+ *
+ * @opts
+ *   trustProxy: boolean | function   // false (default) | predicate (peer-gated) | legacy true
+ *
+ * @example
+ *   b.requestHelpers.requestHost({ headers: { host: "app.example.com" } });
+ *   // → "app.example.com"
+ */
+function requestHost(req, opts) {
+  if (!req || !req.headers) return null;
+  var trust = opts && opts.trustProxy;
+  if (trust) {
+    var fwd = req.headers["x-forwarded-host"];
+    if (typeof fwd === "string" && fwd.length > 0) {
+      var hops = parseListHeader(fwd);
+      if (hops.length > 0) {
+        if (typeof trust === "function") {
+          // Peer-gated: honor X-Forwarded-Host only when the immediate TCP peer
+          // is a trusted proxy. A direct caller's forged header is ignored —
+          // fall through to the request's own Host header.
+          var peer =
+            (req.socket && typeof req.socket.remoteAddress === "string" && req.socket.remoteAddress) ? req.socket.remoteAddress
+            : (req.connection && typeof req.connection.remoteAddress === "string" && req.connection.remoteAddress) ? req.connection.remoteAddress
+            : null;
+          if (peer && trust(peer)) return hops[0];
+          // peer not a trusted proxy → ignore forgeable header, fall through
+        } else {
+          return hops[0];   // legacy true — spoofable, see docstring
+        }
+      }
+    }
+  }
+  return typeof req.headers.host === "string" ? req.headers.host : null;
+}
+
 // RFC 9110 §5.6.2 token grammar — letters, digits, and the
 // punctuation set `!#$%&'*+-.^_`|~`. Used by header-list parsers
 // that consume protocol tokens (Connection, Sec-WebSocket-Protocol,
@@ -1221,6 +1309,8 @@ module.exports = {
   ipPrefix:                  ipPrefix,
   requestProtocol:           requestProtocol,
   trustedProtocol:           trustedProtocol,
+  requestHost:               requestHost,
+  trustedHost:               trustedHost,
   appendVary:                appendVary,
   // CVE-2026-21710 wrap — safe alternative to req.headersDistinct
   safeHeadersDistinct:       safeHeadersDistinct,

package/lib/vendor/blamejs/lib/self-update-standalone-verifier.js

@@ -116,6 +116,49 @@ function _detectAlg(pubkeyPem) {
                   "(need ecdsa-p384, ed25519, or ml-dsa-87)");
 }
 
+// _looksLikeDerEcdsa — true iff `sig` is a structurally-well-formed ASN.1
+// DER ECDSA signature: SEQUENCE { INTEGER r, INTEGER s }. We dispatch the
+// dsaEncoding by STRUCTURE, never by length: a P-384 DER signature whose r
+// and s both encode short can total exactly 96 bytes — the same length as a
+// raw IEEE-P1363 P-384 signature (48-byte r || 48-byte s) — so a length-only
+// test mis-decodes the valid DER signature as raw and spuriously rejects an
+// otherwise-valid update. This is a shape check only; cryptographic validity
+// is still decided by the single verifier.verify() call below.
+//
+// DER layout: 0x30 <seqLen> 0x02 <rLen> <r...> 0x02 <sLen> <s...>, where each
+// declared length must exactly frame the bytes that follow (definite-form,
+// short or long encoding) and the SEQUENCE body must consume the whole sig.
+function _readDerLen(buf, off) {
+  if (off >= buf.length) return null;
+  var first = buf[off];
+  if (first < 0x80) return { len: first, next: off + 1 };   // short form
+  var numBytes = first & 0x7f;
+  if (numBytes === 0 || numBytes > 4) return null;           // indefinite / oversized: reject
+  if (off + 1 + numBytes > buf.length) return null;
+  var len = 0;
+  for (var i = 0; i < numBytes; i++) len = (len * 256) + buf[off + 1 + i];
+  return { len: len, next: off + 1 + numBytes };
+}
+function _readDerInteger(buf, off) {
+  if (off >= buf.length || buf[off] !== 0x02) return null;   // INTEGER tag
+  var l = _readDerLen(buf, off + 1);
+  if (l === null || l.len === 0) return null;
+  var end = l.next + l.len;
+  if (end > buf.length) return null;
+  return { next: end };
+}
+function _looksLikeDerEcdsa(sig) {
+  if (sig.length < 8 || sig[0] !== 0x30) return false;       // SEQUENCE tag
+  var seq = _readDerLen(sig, 1);
+  if (seq === null) return false;
+  if (seq.next + seq.len !== sig.length) return false;       // body must frame to end
+  var r = _readDerInteger(sig, seq.next);
+  if (r === null) return false;
+  var s = _readDerInteger(sig, r.next);
+  if (s === null) return false;
+  return s.next === sig.length;                              // exactly two INTEGERs, no trailing bytes
+}
+
 /**
  * @primitive b.selfUpdate.standaloneVerifier.verify
  * @signature b.selfUpdate.standaloneVerifier.verify(assetPath, signaturePath, pubkeyPem)
@@ -285,13 +328,32 @@ function verify(assetPath, signaturePath, pubkeyPem) {
 
   var ok = false;
   if (alg === "ecdsa-p384") {
-    // P-384 IEEE-P1363 sigs are exactly 96 bytes (48-byte r || 48-byte s).
-    // P-384 DER sigs are variable (~100-104 bytes — ASN.1 SEQUENCE
-    // wrapping two INTEGERs). Detect by length so we only call
-    // verifier.verify ONCE — calling it a second time after a failed
-    // verify returns stale state and silently passes tampered assets.
-    // 96 = P-384 IEEE-P1363 signature length; protocol constant, not a byte-size.
-    var dsaEncoding = signature.length === 96 ? "ieee-p1363" : "der";   // IEEE-P1363 P-384 signature length
+    // Pick the ECDSA signature encoding by STRUCTURE, not by length. A P-384
+    // DER signature whose r and s both encode short can total exactly 96
+    // bytes — the same length as a raw IEEE-P1363 P-384 signature (48-byte r
+    // || 48-byte s) — so a length-only test mis-decodes the valid DER
+    // signature as raw and spuriously rejects an otherwise-valid update.
+    //
+    // A well-formed ASN.1 DER ECDSA signature is a SEQUENCE { INTEGER r,
+    // INTEGER s }; raw IEEE-P1363 is exactly 2*coordLen bytes (coordLen =
+    // 48 for the P-384 field). If it parses as DER, treat as DER; else if it
+    // is exactly 2*coordLen, treat as raw; else fail closed. We call
+    // verifier.verify() ONCE — a second call after a failed verify returns
+    // stale state and can silently pass tampered assets.
+    var coordLen = 48;   // P-384 field element width in bytes; protocol constant, not a byte-size cap
+    var dsaEncoding;
+    if (_looksLikeDerEcdsa(signature)) {
+      dsaEncoding = "der";
+    } else if (signature.length === coordLen * 2) {
+      dsaEncoding = "ieee-p1363";
+    } else {
+      // assetFd was already closed by the read loop's `finally`; this is a
+      // pure fail-closed refusal, same as the `if (!ok)` path below.
+      throw new Error("standalone-verifier.verify: ecdsa-p384 signature is neither a " +
+                      "well-formed DER SEQUENCE nor a raw " + (coordLen * 2) +
+                      "-byte IEEE-P1363 pair (length " + signature.length +
+                      ") — refusing to guess the encoding");
+    }
     ok = verifier.verify({ key: key, dsaEncoding: dsaEncoding }, signature);
   } else if (alg === "ed25519") {
     // fullBuf may be shorter than allocated (sparse files / size-races);

package/lib/vendor/blamejs/lib/self-update.js

@@ -297,6 +297,13 @@ function _matchAsset(name, pattern, fallback) {
  * with conservative fallbacks. Throws SelfUpdateError on a non-2xx
  * upstream, malformed JSON, or unexpected shape.
  *
+ * Each matched asset / signature is reported as
+ * `{ name, url, size, digest }`. `digest` carries the release API's
+ * published `assets[].digest` (e.g. `"sha256:<hex>"`) verbatim when the
+ * upstream supplies it, or `null` when absent — a consumer can use it
+ * for a defense-in-depth in-flight integrity check of the downloaded
+ * bytes alongside the detached-signature verify.
+ *
  * @opts
  *   releasesUrl:      string,    // required — feed URL
  *   currentVersion:   string,    // required — e.g. "0.8.43" or "v0.8.43"
@@ -446,11 +453,13 @@ async function poll(opts) {
     var a = assets[i] || {};
     if (typeof a.name !== "string" || typeof a.browser_download_url !== "string") continue;
     if (signatureMatch === null && _matchAsset(a.name, opts.signaturePattern, /\.sig$|\.asc$|\.sig\.bin$/i)) {
-      signatureMatch = { name: a.name, url: a.browser_download_url, size: a.size || null };
+      signatureMatch = { name: a.name, url: a.browser_download_url, size: a.size || null,
+                         digest: typeof a.digest === "string" ? a.digest : null };
       continue;
     }
     if (assetMatch === null && _matchAsset(a.name, opts.assetPattern, /\.(tar\.gz|tgz|zip|node|exe|bin)$/i)) {
-      assetMatch = { name: a.name, url: a.browser_download_url, size: a.size || null };
+      assetMatch = { name: a.name, url: a.browser_download_url, size: a.size || null,
+                     digest: typeof a.digest === "string" ? a.digest : null };
     }
   }