@blamejs/blamejs-shop 0.4.87 → 0.4.89

package/lib/vendor/blamejs/examples/wiki/Dockerfile

@@ -22,7 +22,22 @@
 # The :latest runtime image runs as `nonroot` (different user, lower
 # privilege); --chown=nonroot:nonroot on the COPY --from=deps rewrites
 # ownership at copy time into the runtime image.
-FROM cgr.dev/chainguard/node:latest-dev AS deps
+# Base images are NOT digest-pinned in source: Chainguard rebuilds :latest
+# continuously to ship CVE fixes, so a committed digest goes stale within hours
+# and the Trivy CRITICAL/HIGH release gate then rejects the build (e.g. a fixed
+# npm/undici DoS the rolling tag already carries). For a deployed, Trivy-gated
+# image, rolling + always-patched beats reproducible-but-frozen. (Scorecard
+# PinnedDependencies flags this by design — accepted.)
+#
+# To make the Trivy-scanned image identical to the multi-arch image that gets
+# published (release-container.yml builds those separately), the workflow
+# resolves the rolling tag to a digest ONCE at build time and passes it via
+# these build-args, so scan == publish without a stale committed pin. A local
+# `docker build` with no build-args falls back to the rolling tag.
+ARG BASE_DEPS=cgr.dev/chainguard/node:latest-dev
+ARG BASE_RUNTIME=cgr.dev/chainguard/node:latest
+
+FROM ${BASE_DEPS} AS deps
 WORKDIR /home/node
 COPY --chown=node:node package.json index.js NOTICE LICENSE README.md ./
 COPY --chown=node:node bin ./bin
@@ -41,7 +56,9 @@ RUN rm -rf node_modules data data-e2e public/dist \
  && node -e "var b = require('@blamejs/core'); var path = require('node:path'); (async function () { var bundler = b.bundler.create({ entries: { wiki: path.join(process.cwd(), 'src', 'wiki.js'), editor: path.join(process.cwd(), 'src', 'editor.js') }, outdir: path.join(process.cwd(), 'public', 'dist'), manifest: 'manifest.json', hashLen: 16 }); await bundler.build(); console.log('[Dockerfile] bundle pre-built into public/dist'); })().catch(function (e) { console.error('bundle build failed:', e.stack || e); process.exit(1); });" \
  && mkdir -p /home/node/data-skeleton
 
-FROM cgr.dev/chainguard/node:latest AS runtime
+# See the deps stage above: rolling base, resolved to a digest at build time by
+# release-container.yml (build-arg) so the scanned and published images match.
+FROM ${BASE_RUNTIME} AS runtime
 # Explicit USER directive — Chainguard's :latest image already runs as
 # `nonroot` (UID 65532) by default, but Trivy's static Dockerfile
 # checker (DS-0002) flags any image without an explicit USER line

package/lib/vendor/blamejs/lib/atomic-file.js

@@ -895,6 +895,19 @@ function fdSafeReadSync(filepath, opts) {
   var errorFor = opts.errorFor || function (kind, detail) {
     return new AtomicFileError((detail && detail.message) || ("atomic-file: " + kind), "atomic-file/" + kind);
   };
+  // Every failure KIND routes through this one mapper-then-fallback gate: throw
+  // the caller's typed error when errorFor returns truthy, else the fallback —
+  // the raw OS error for enoent (preserving the rethrow-raw posture network-tls
+  // / vault / backup rely on), or a synthetic AtomicFileError for the kinds with
+  // no underlying OS error to rethrow. An errorFor that returns undefined for a
+  // kind must never make us throw the literal `undefined` (the openSync/enoent
+  // branch already guarded this; symlink / too-large / toctou / short-read /
+  // integrity now do too — #358).
+  function _raise(kind, detail, fallbackErr) {
+    var typed = errorFor(kind, detail);
+    throw typed || fallbackErr ||
+      new AtomicFileError((detail && detail.message) || ("atomic-file: " + kind), "atomic-file/" + kind);
+  }
   if (opts.maxBytes !== undefined) _validateMaxBytes(opts.maxBytes);
   var mode = opts.mode === undefined ? 0o600 : opts.mode;
   // refuseSymlink: lstat the path first and refuse a symlink source —
@@ -902,10 +915,21 @@ function fdSafeReadSync(filepath, opts) {
   // fd's inode is re-checked against this lstat's inode below.
   var lstat = null;
   if (opts.refuseSymlink) {
-    lstat = nodeFs.lstatSync(filepath);
-    if (lstat.isSymbolicLink()) throw errorFor("symlink", { path: filepath });
+    try {
+      lstat = nodeFs.lstatSync(filepath);
+    } catch (lstatErr) {
+      // A missing file makes lstat throw raw ENOENT BEFORE the openSync branch
+      // that consults errorFor("enoent"). Route it through the same mapping so
+      // the missing-file error class is identical with or without refuseSymlink
+      // (#358); any other lstat error rethrows raw.
+      if (lstatErr && lstatErr.code === "ENOENT") {
+        _raise("enoent", { path: filepath, cause: lstatErr }, lstatErr);
+      }
+      throw lstatErr;
+    }
+    if (lstat.isSymbolicLink()) _raise("symlink", { path: filepath });
     if (opts.maxBytes !== undefined && lstat.size > opts.maxBytes) {
-      throw errorFor("too-large", { size: lstat.size, max: opts.maxBytes });
+      _raise("too-large", { size: lstat.size, max: opts.maxBytes });
     }
   }
   // The third argument pins an owner-only mode (0o600 default). The flag
@@ -918,8 +942,7 @@ function fdSafeReadSync(filepath, opts) {
     fd = nodeFs.openSync(filepath, "r", mode);
   } catch (openErr) {
     if (openErr && openErr.code === "ENOENT") {
-      var typed = errorFor("enoent", { path: filepath, cause: openErr });
-      if (typed) throw typed;
+      _raise("enoent", { path: filepath, cause: openErr }, openErr);
     }
     throw openErr;
   }
@@ -933,10 +956,10 @@ function fdSafeReadSync(filepath, opts) {
     // plain (no-inodeCheck) reader reports an over-cap as too-large.
     if (lstat && opts.inodeCheck) {
       if (fstat.ino !== lstat.ino || (opts.maxBytes !== undefined && fstat.size > opts.maxBytes)) {
-        throw errorFor("toctou", { path: filepath });
+        _raise("toctou", { path: filepath });
       }
     } else if (opts.maxBytes !== undefined && fstat.size > opts.maxBytes) {
-      throw errorFor("too-large", { size: fstat.size, max: opts.maxBytes });
+      _raise("too-large", { size: fstat.size, max: opts.maxBytes });
     }
     buf = Buffer.alloc(fstat.size);
     var read = 0;
@@ -947,7 +970,7 @@ function fdSafeReadSync(filepath, opts) {
     }
     if (read !== fstat.size) {
       if (opts.allowShortRead) { buf = buf.slice(0, read); }
-      else { throw errorFor("short-read", { read: read, size: fstat.size }); }
+      else { _raise("short-read", { read: read, size: fstat.size }); }
     }
   } finally {
     try { nodeFs.closeSync(fd); } catch (_c) { /* close best-effort */ }
@@ -955,7 +978,7 @@ function fdSafeReadSync(filepath, opts) {
   if (opts.expectedHash) {
     var actual = sha3Hash(buf);
     if (actual !== opts.expectedHash) {
-      throw errorFor("integrity", { expected: opts.expectedHash, actual: actual });
+      _raise("integrity", { expected: opts.expectedHash, actual: actual });
     }
   }
   var content = opts.encoding ? buf.toString(opts.encoding) : buf;

package/lib/vendor/blamejs/lib/middleware/api-encrypt.js

@@ -223,12 +223,39 @@ function _validSid(sid) {
          SID_RE.test(sid);
 }
 
-function _writeRejection(res, code, body) {
+// _writeRejection — emit a protocol-level rejection body.
+//
+// On an ESTABLISHED per-session encrypted channel the rejection MUST
+// travel inside the session envelope, exactly like a successful
+// response: a client on a keyed channel that sends a stale / replayed /
+// malformed request would otherwise learn, in cleartext, which check
+// failed over an otherwise-encrypted channel. The middleware stamps
+// `req.apiEncryptRejectEncode` the moment a session is resolved with a
+// valid session key; when present, the body is wrapped through the same
+// response-encryption path successful responses use. Absent it (a
+// pre-session handshake error, where no session context exists yet, or
+// per-request mode) the body falls back to plaintext.
+function _writeRejection(req, res, code, body, opts) {
   if (res.headersSent || res.writableEnded) return;
-  if (typeof res.writeHead === "function") {
-    res.writeHead(code, { "Content-Type": "application/json" });
-    res.end(JSON.stringify(body));
+  if (typeof res.writeHead !== "function") return;
+  var out = body;
+  // opts.plaintext forces a cleartext body even on an established channel.
+  // Used for the generic "encrypted-payload-rejected" refusals that DO NOT
+  // delete the session (the monotonic-counter replay and the atomic-claim
+  // loss): riding those on the session envelope would emit a response _ctr
+  // the client tracks as consumed, but those paths return before the
+  // server persists responsesEmitted — so the next genuine response reuses
+  // that _ctr and the client refuses it as a replay, bricking the session.
+  // The body is already generic (no session-lifecycle reason leaks the way
+  // session-expired / rotation-required would), so plaintext here costs no
+  // meaningful confidentiality.
+  var encode = (!opts || !opts.plaintext) && req && req.apiEncryptRejectEncode;
+  if (typeof encode === "function") {
+    try { out = encode(body); }
+    catch (_e) { out = body; }  // encryption failed → fall back to plaintext rather than hang
   }
+  res.writeHead(code, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(out));
 }
 
 // ---- Server-side middleware ----
@@ -458,6 +485,26 @@ function create(opts) {
     return encrypted;
   }
 
+  // _installRejectEncoder — stamp req with a function that wraps a
+  // protocol-level rejection body in the SAME session envelope a
+  // successful response uses, so an error emitted on an established
+  // per-session encrypted channel does not leak (in cleartext) which
+  // check the request tripped. Called the moment a session is resolved
+  // with a valid session key, BEFORE the expiry / rotation / replay
+  // gates that fire on a keyed channel. The rejection rides a fresh
+  // response counter (sid bound, strictly above the session's last
+  // emitted response) so the client's monotonic _ctr check still holds.
+  // The session-deleting rejections (expired / rotation) and the
+  // post-claim tag-mismatch ride this encoder; the two generic surviving
+  // rejections (monotonic-counter replay, atomic-claim loss) opt out via
+  // _writeRejection({ plaintext: true }) because they return before the
+  // consumed counter is persisted — see _writeRejection.
+  function _installRejectEncoder(req, sessionKey, sid, responseCtr) {
+    req.apiEncryptRejectEncode = function (body) {
+      return _encodeEnvelope(body, sessionKey, { sid: sid, responseCtr: responseCtr });
+    };
+  }
+
   // _wrapResJson — install res.json that encrypts the response with the
   // session key. In per-request mode the response is `{ _ct }`; in
   // per-session mode it carries `{ _ct, _sid, _ctr }` so the client can
@@ -507,18 +554,18 @@ function create(opts) {
     var body = req.body;
     if (!body || typeof body !== "object") {
       _emitFailure(req, "shape");
-      return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+      return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
     }
 
     var now = Date.now();
     var ct = body._ct, ts = body._ts;
     if (typeof ct !== "string" || typeof ts !== "number") {
       _emitFailure(req, "shape");
-      return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+      return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
     }
     if (Math.abs(now - ts) > replayWindowMs) {
       _emitFailure(req, "stale");
-      return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
+      return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
     }
 
     // Per-request OR per-session bootstrap path: shape includes _ek + _nonce.
@@ -540,25 +587,25 @@ function create(opts) {
       try { freshNonce = await store.checkAndInsert(nonceHash, expireAt); }
       catch (_e) {
         _emitFailure(req, "nonce-store-error");
-        return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "nonce-store-unavailable" });
+        return _writeRejection(req, res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "nonce-store-unavailable" });
       }
       if (!freshNonce) {
         _emitFailure(req, "replay");
-        return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
+        return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
       }
       sessionKey = _decryptEkToSessionKey(ek);
       if (!sessionKey) {
         _emitFailure(req, "tag");
-        return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
+        return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
       }
       if (keying === "per-session") {
         if (!_validSid(sid)) {
           _emitFailure(req, "shape");
-          return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+          return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
         }
         if (!numericBounds.isNonNegativeFiniteInt(ctr)) {
           _emitFailure(req, "shape");
-          return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+          return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
         }
         // Bootstrap a new session row keyed by sid. responsesEmitted is
         // set to 1 (this bootstrap emits one response) BEFORE the store
@@ -579,7 +626,7 @@ function create(opts) {
         try { await sessionStore.set(sid, session, { ttlMs: sessionTtlMs }); }
         catch (_e) {
           _emitFailure(req, "session-store-error");
-          return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "session-store-unavailable" });
+          return _writeRejection(req, res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "session-store-unavailable" });
         }
         _emitObs("apiEncrypt.session.created", 1, { mode: "per-session" });
         _emitSessionAudit("apiEncrypt.session.created", {
@@ -588,28 +635,56 @@ function create(opts) {
           requestId: req.requestId || null,
         });
         sessionCtx = { sid: sid, responseCtr: 1 };
+        // Session now established — a post-bootstrap rejection (e.g. the
+        // final decrypt below) rides the session envelope under the same
+        // counter the success response would have used.
+        _installRejectEncoder(req, sessionKey, sid, 1);
       }
     } else if (keying === "per-session" &&
                typeof sid === "string" && typeof ctr === "number") {
       // ---- Per-session subsequent-request path ----
       if (!_validSid(sid)) {
         _emitFailure(req, "shape");
-        return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+        return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
       }
       if (!numericBounds.isNonNegativeFiniteInt(ctr)) {
         _emitFailure(req, "shape");
-        return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+        return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
       }
       try { session = await sessionStore.get(sid); }
       catch (_e) {
         _emitFailure(req, "session-store-error");
-        return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "session-store-unavailable" });
+        return _writeRejection(req, res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "session-store-unavailable" });
       }
       if (!session) {
         _emitObs("apiEncrypt.session.unknown", 1, {});
         _emitFailure(req, "session-unknown");
-        return _writeRejection(res, HTTP_STATUS.UNAUTHORIZED, { error: "session-unknown" });
+        return _writeRejection(req, res, HTTP_STATUS.UNAUTHORIZED, { error: "session-unknown" });
+      }
+      // Recover + coerce the session key BEFORE the expiry / rotation /
+      // replay gates so a rejection on this established channel can ride
+      // the session envelope (the channel is keyed the moment the sid
+      // resolves to a stored session, even if THIS request is then
+      // refused). An operator store may have JSON-serialised the buffer.
+      sessionKey = session.sessionKey;
+      if (Buffer.isBuffer(sessionKey) === false) {
+        if (typeof sessionKey === "string") {
+          sessionKey = Buffer.from(sessionKey, "base64");
+        } else if (sessionKey && sessionKey.type === "Buffer" && Array.isArray(sessionKey.data)) {
+          sessionKey = Buffer.from(sessionKey.data);
+        } else if (sessionKey instanceof Uint8Array) {
+          sessionKey = Buffer.from(sessionKey);
+        }
+      }
+      if (!Buffer.isBuffer(sessionKey) || sessionKey.length !== SESSION_KEY_BYTES) {
+        sessionKey = null;
+        _emitFailure(req, "session-store-error");
+        return _writeRejection(req, res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "session-store-unavailable" });
       }
+      // From here the channel is established: error bodies encrypt. The
+      // rejection counter sits one above the session's last emitted
+      // response so the client's strictly-increasing _ctr check holds.
+      _installRejectEncoder(req, sessionKey, sid, session.responsesEmitted + 1);
       if (now > session.expiresAt) {
         try { await sessionStore.delete(sid); } catch (_e) { /* best-effort */ }
         _emitObs("apiEncrypt.session.expired", 1, {});
@@ -620,7 +695,7 @@ function create(opts) {
           requestId: req.requestId || null,
         });
         _emitFailure(req, "session-expired");
-        return _writeRejection(res, HTTP_STATUS.UNAUTHORIZED, { error: "session-expired" });
+        return _writeRejection(req, res, HTTP_STATUS.UNAUTHORIZED, { error: "session-expired" });
       }
       if (session.responsesEmitted >= sessionMaxResponses) {
         try { await sessionStore.delete(sid); } catch (_e) { /* best-effort */ }
@@ -632,7 +707,7 @@ function create(opts) {
           requestId: req.requestId || null,
         });
         _emitFailure(req, "session-rotation-required");
-        return _writeRejection(res, HTTP_STATUS.UNAUTHORIZED, { error: "session-rotation-required" });
+        return _writeRejection(req, res, HTTP_STATUS.UNAUTHORIZED, { error: "session-rotation-required" });
       }
       // Replay defense: counter MUST strictly increase.
       if (ctr <= session.lastReqCtr) {
@@ -644,7 +719,10 @@ function create(opts) {
           requestId: req.requestId || null,
         });
         _emitFailure(req, "counter-replay");
-        return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
+        // Plaintext: this path does not persist a consumed response counter
+        // (see _writeRejection). Keeping it cleartext avoids desyncing the
+        // session's response-counter sequence.
+        return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" }, { plaintext: true });
       }
       // Atomic replay gate (CWE-367). The monotonic counter check above is
       // an ordering fast-path only: on a clustered session store, get(sid)
@@ -674,7 +752,7 @@ function create(opts) {
       try { ctrFresh = await store.checkAndInsert(ctrKey, session.expiresAt); }
       catch (_e) {
         _emitFailure(req, "nonce-store-error");
-        return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "nonce-store-unavailable" });
+        return _writeRejection(req, res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "nonce-store-unavailable" });
       }
       if (!ctrFresh) {
         _emitObs("apiEncrypt.session.replay_rejected", 1, { lane: "atomic" });
@@ -685,23 +763,10 @@ function create(opts) {
           requestId: req.requestId || null,
         });
         _emitFailure(req, "counter-replay");
-        return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
-      }
-      sessionKey = session.sessionKey;
-      if (Buffer.isBuffer(sessionKey) === false) {
-        // Operator-supplied store may have JSON-serialised the buffer.
-        // Accept hex / base64 / Uint8Array and coerce.
-        if (typeof sessionKey === "string") {
-          sessionKey = Buffer.from(sessionKey, "base64");
-        } else if (sessionKey && sessionKey.type === "Buffer" && Array.isArray(sessionKey.data)) {
-          sessionKey = Buffer.from(sessionKey.data);
-        } else if (sessionKey instanceof Uint8Array) {
-          sessionKey = Buffer.from(sessionKey);
-        }
-      }
-      if (!Buffer.isBuffer(sessionKey) || sessionKey.length !== SESSION_KEY_BYTES) {
-        _emitFailure(req, "session-store-error");
-        return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "session-store-unavailable" });
+        // Plaintext for the same reason as the monotonic-replay path above:
+        // the atomic-claim loser returns before responsesEmitted is persisted,
+        // so encrypting it would consume a response _ctr the server never records.
+        return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" }, { plaintext: true });
       }
       session.lastReqCtr = ctr;
       session.lastUsedAt = now;
@@ -711,7 +776,7 @@ function create(opts) {
       sessionCtx = { sid: sid, responseCtr: session.responsesEmitted };
     } else {
       _emitFailure(req, "shape");
-      return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
+      return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-required" });
     }
 
     // Decrypt _ct → cleartext payload bytes → JSON object. The request
@@ -726,7 +791,7 @@ function create(opts) {
       clearObj = safeJson.parse(ptBuf.toString("utf8"), { maxBytes: maxDecryptedBytes });
     } catch (_e) {
       _emitFailure(req, "tag");
-      return _writeRejection(res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
+      return _writeRejection(req, res, HTTP_STATUS.BAD_REQUEST, { error: "encrypted-payload-rejected" });
     }
 
     // Replace req.body with cleartext, stash session key for any

package/lib/vendor/blamejs/lib/middleware/dpop.js

@@ -144,33 +144,19 @@ function _nonceManager(rotateSec) {
   };
 }
 
-function _reconstructHtu(req, mopts) {
-  // The proof's htu is the request URI WITHOUT query/fragment. Behind
-  // a reverse proxy the operator may need to override via opts.htu /
-  // opts.getHtu. X-Forwarded-* headers are ATTACKER-CONTROLLED when
-  // the origin is reachable directly; an attacker who can hit the
-  // origin while spoofing X-Forwarded-Proto: https can trick this
-  // function into building an `https` htu that the DPoP proof was
-  // signed for — when the origin is actually serving HTTP. RFC 9449
-  // §4.3 says htu MUST be the absolute URL the request was sent to.
-  //
-  // Default: ignore X-Forwarded-* and derive proto/host from the
-  // socket. Operators with a confirmed-trusted front proxy opt in
-  // via opts.trustForwardedHeaders: true.
-  mopts = mopts || {};
-  var trustForwarded = mopts.trustForwardedHeaders === true;
-  var proto;
-  if (trustForwarded && req.headers["x-forwarded-proto"]) {
-    proto = String(req.headers["x-forwarded-proto"]).split(",")[0].trim();
-  } else {
-    proto = req.socket && req.socket.encrypted ? "https" : "http";
-  }
-  var host;
-  if (trustForwarded && req.headers["x-forwarded-host"]) {
-    host = String(req.headers["x-forwarded-host"]).split(",")[0].trim();
-  } else {
-    host = req.headers.host;
-  }
+function _reconstructHtu(req, protoResolver, hostResolver) {
+  // The proof's htu is the request URI WITHOUT query/fragment. Behind a
+  // reverse proxy the operator may override via opts.getHtu. RFC 9449 §4.3
+  // says htu MUST be the absolute URL the request was sent to — and it is
+  // cryptographically bound in the proof, so a forged scheme/authority lets a
+  // proof signed for one origin validate against another. proto + host are
+  // resolved through the peer-gated requestHelpers resolvers built in create():
+  // X-Forwarded-Proto / -Host are honored only from a declared trusted-proxy
+  // peer; otherwise the real TLS socket scheme + the request's own Host are
+  // used and forged forwarded headers are ignored.
+  if (!req || !req.headers) return null;
+  var proto = protoResolver.resolve(req);
+  var host = hostResolver.resolve(req);
   if (!host) return null;
   var path = req.url || "/";
   var qIdx = path.indexOf("?");
@@ -205,6 +191,9 @@ function _reconstructHtu(req, mopts) {
  *     getAccessToken: function(req): string|null,
  *     getNonce:       async function(req): string|null,
  *     getHtu:         function(req): string,
+ *     trustedProxies: string|string[],             // CIDRs of your reverse proxies — peer-gates X-Forwarded-Proto + X-Forwarded-Host for htu reconstruction
+ *     protocolResolver: function(req): "http"|"https",  // own the scheme decision
+ *     hostResolver:   function(req): string|null,  // own the authority decision
  *     nonceStore:     object,
  *     nonceWindowSec: number,
  *     nonceRotateSec: number,
@@ -228,9 +217,11 @@ function create(opts) {
     "replayStore", "algorithms", "iatWindowSec",
     "getAccessToken", "getNonce", "getHtu", "audit",
     "nonceStore", "nonceWindowSec", "nonceRotateSec", "requireNonce",
-    // v0.9.4 — opt-in trust gate for X-Forwarded-Proto/Host when
-    // reconstructing htu. Default off; operators
-    // with a confirmed-trusted front proxy set this to `true`.
+    // htu reconstruction trust. trustedProxies (CIDRs) peer-gates
+    // X-Forwarded-Proto + X-Forwarded-Host; protocolResolver/hostResolver let
+    // the operator own each. trustForwardedHeaders (legacy boolean) is refused
+    // on its own — see the peer-gating block below.
+    "trustedProxies", "protocolResolver", "hostResolver",
     "trustForwardedHeaders", "onDeny", "problemDetails",
   ], "middleware.dpop");
 
@@ -282,6 +273,38 @@ function create(opts) {
   validateOpts.optionalFunction(opts.getHtu,
     "middleware.dpop: getHtu", AuthError, "auth-dpop/bad-opt");
 
+  // htu reconstruction (RFC 9449 §4.3) builds the absolute request URL —
+  // proto + host — that the proof's cryptographically-bound `htu` claim is
+  // verified against. Behind a proxy both come from forgeable X-Forwarded-*
+  // headers, so resolve them through the peer-gated requestHelpers primitives
+  // (the same fail-closed model csrf-protect / security-headers / cors use):
+  // X-Forwarded-Proto / -Host are honored ONLY when the immediate peer is a
+  // declared trusted proxy. The legacy trustForwardedHeaders:true trusted the
+  // headers from ANY caller — a direct attacker could forge XFP:https / a
+  // victim XFH to make a proof signed for one origin validate against another
+  // (htu confusion). It is refused on its own; migrate to trustedProxies.
+  var _proto = requestHelpers.trustedProtocol({
+    trustedProxies:   opts.trustedProxies,
+    protocolResolver: opts.protocolResolver,
+  });
+  var _host = requestHelpers.trustedHost({
+    trustedProxies: opts.trustedProxies,
+    hostResolver:   opts.hostResolver,
+  });
+  // Only refuse the spoofable legacy flag when the htu is actually
+  // reconstructed from the request. When the operator supplies getHtu they own
+  // the entire URI, _reconstructHtu (and the forwarded headers) is never
+  // consulted, so a leftover trustForwardedHeaders is moot — don't fail
+  // construction on it (the error text even offers getHtu as a migration path).
+  if (typeof opts.getHtu !== "function" && opts.trustForwardedHeaders === true && !_proto.peerGated) {
+    throw new AuthError("auth-dpop/bad-opt",
+      "middleware.dpop: trustForwardedHeaders is spoofable for the htu reconstruction " +
+      "(a direct caller can forge X-Forwarded-Proto / X-Forwarded-Host) and is no longer " +
+      "honored on its own. Declare your reverse proxies via trustedProxies: [\"10.0.0.0/8\", …] " +
+      "(peer-gates X-Forwarded-Proto + X-Forwarded-Host), or own the decision via " +
+      "protocolResolver(req) / hostResolver(req) / getHtu(req).");
+  }
+
   function _freshNonce() { return nonceMgr ? nonceMgr.issue() : null; }
 
   var middleware = async function dpopMiddleware(req, res, next) {
@@ -309,7 +332,7 @@ function create(opts) {
         "multiple DPoP proofs in one header value are not allowed", null, onDeny, problemMode);
     }
 
-    var htu = (typeof opts.getHtu === "function" ? opts.getHtu(req) : _reconstructHtu(req, opts));
+    var htu = (typeof opts.getHtu === "function" ? opts.getHtu(req) : _reconstructHtu(req, _proto, _host));
     if (!htu) {
       return _writeUnauthorized(req, res, "invalid_dpop_proof", "could not reconstruct htu", null, onDeny, problemMode);
     }

package/lib/vendor/blamejs/lib/middleware/span-http-server.js

@@ -68,6 +68,11 @@ function _splitUrl(url) {
 }
 
 function _scheme(req) {
+  // Display-only: the OTel url.scheme span attribute reflects the scheme the
+  // client used (forwarded), NOT a Secure/HSTS/origin trust decision. Routing
+  // through trustedProtocol would drop the forwarded scheme from spans behind a
+  // proxy (less accurate telemetry) for no security gain.
+  // allow:raw-xfp — telemetry label, not a trust sink (see above).
   var x = req.headers && (req.headers["x-forwarded-proto"] || "");
   if (typeof x === "string" && x.length > 0) {
     var first = x.split(",")[0].trim().toLowerCase();
@@ -77,6 +82,8 @@ function _scheme(req) {
 }
 
 function _serverAddress(req) {
+  // allow:raw-xfp — display-only: server.address span attribute (telemetry),
+  // not an authority trust decision. Same rationale as _scheme above.
   var hostHeader = req.headers && (req.headers["x-forwarded-host"] || req.headers.host);
   if (typeof hostHeader === "string" && hostHeader.length > 0) {
     return hostHeader.split(",")[0].trim();

package/lib/vendor/blamejs/lib/network-tls.js

@@ -1187,8 +1187,18 @@ function evaluateOcspResponse(ocspDer, opts) {
   var clockSkewMs = typeof opts.clockSkewMs === "number" && opts.clockSkewMs >= 0           // allow:numeric-opt-Infinity — operator-supplied skew, default 5 min if absent or invalid
     ? opts.clockSkewMs : C.TIME.minutes(5);
   var now = typeof opts.now === "number" ? opts.now : Date.now();
-  var thisUpdateMs = match.thisUpdate ? Date.parse(match.thisUpdate) : NaN;
-  var nextUpdateMs = match.nextUpdate ? Date.parse(match.nextUpdate) : NaN;
+  // thisUpdate / nextUpdate are already unix-ms NUMBERS (parseOcspResponse →
+  // _parseTime returns Date.UTC(...)). Do NOT Date.parse() them: Date.parse
+  // coerces its argument to a string, and a bare-integer string is not a
+  // recognized date format, so Date.parse(<number>) is NaN — which made the
+  // !isFinite guard below reject every response (fresh or stale) with a
+  // misleading "missing thisUpdate", leaving the real staleness window checks
+  // (future thisUpdate, past nextUpdate) as unreachable dead code. Read the
+  // numbers directly; the typeof guard keeps a legitimate epoch-0 thisUpdate
+  // (Date.UTC(1970,0,1)===0, which is falsy) and maps a null nextUpdate to NaN
+  // so the optional-field branch still no-ops.
+  var thisUpdateMs = typeof match.thisUpdate === "number" ? match.thisUpdate : NaN;
+  var nextUpdateMs = typeof match.nextUpdate === "number" ? match.nextUpdate : NaN;
   if (!isFinite(thisUpdateMs)) {
     return { ok: false, status: parsed.status, signatureValid: true,
              certStatus: match.certStatus,