@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/lib/middleware/dpop.js

@@ -311,16 +311,21 @@ function create(opts) {
 
   var middleware = async function dpopMiddleware(req, res, next) {
     var proofHeader = req.headers && req.headers.dpop;
+    // RFC 9449 §4.1 — only ONE DPoP header value per request. Check the
+    // array shape (repeated `DPoP:` header lines a custom server/proxy did
+    // not collapse) BEFORE the non-string guard: an array is not a string,
+    // so the guard below would otherwise shadow this branch and mislabel a
+    // duplicated proof as a missing one, letting the multiple-proof
+    // rejection never run.
+    if (Array.isArray(proofHeader)) {
+      return _writeUnauthorized(req, res, "invalid_dpop_proof",
+        "multiple DPoP headers are not allowed", null, onDeny, problemMode);
+    }
     if (typeof proofHeader !== "string" || proofHeader.length === 0) {
       return _writeUnauthorized(req, res,
         nonceMgr ? "use_dpop_nonce" : "invalid_dpop_proof",
         "DPoP header required", _freshNonce(), onDeny, problemMode);
     }
-    // RFC 9449 §4.1 — only ONE DPoP header value per request.
-    if (Array.isArray(proofHeader)) {
-      return _writeUnauthorized(req, res, "invalid_dpop_proof",
-        "multiple DPoP headers are not allowed", null, onDeny, problemMode);
-    }
     // RFC 9449 §4.1 single-value invariant. node:http
     // collapses repeated headers into a comma-joined string when the
     // client ships `DPoP: proof1, DPoP: proof2`; the Array.isArray

package/lib/vendor/blamejs/lib/middleware/index.js

@@ -120,7 +120,11 @@ module.exports = {
   tracePropagate:        tracePropagate.create,
   tusUpload:        tusUpload.create,
   webAppManifest:   webAppManifest.create,
-  clearSiteData:    clearSiteData.create,
+  clearSiteData:    Object.assign(clearSiteData.create, {
+    headerValue:   clearSiteData.headerValue,
+    KNOWN_TYPES:   clearSiteData.KNOWN_TYPES,
+    DEFAULT_TYPES: clearSiteData.DEFAULT_TYPES,
+  }),
   nel:              nel.create,
   speculationRules: speculationRules.create,
   protectedResourceMetadata: protectedResourceMetadata.create,
@@ -186,3 +190,4 @@ module.exports = {
 };
 
 module.exports.tusUpload.memoryStore = tusUpload.memoryStore;
+module.exports.tusUpload.close       = tusUpload.close;

package/lib/vendor/blamejs/lib/middleware/nel.js

@@ -151,7 +151,7 @@ function create(opts) {
   // honor secure-origin report endpoints. Refusing at config-time so
   // an operator typo (`http://`) surfaces at boot, not as silent
   // never-fires-in-production.
-  if (opts.collectorUrl.slice(0, 8) !== "https://") {                                       // string-prefix length, not bytes
+  if (opts.collectorUrl.slice(0, 8).toLowerCase() !== "https://") {                         // RFC 3986 scheme is case-insensitive; string-prefix length, not bytes
     throw new TypeError(
       "middleware.nel: opts.collectorUrl must be https:// (browsers " +
       "ignore non-secure NEL collectors); got " + opts.collectorUrl);

package/lib/vendor/blamejs/lib/middleware/openapi-serve.js

@@ -100,7 +100,7 @@ var audit         = lazyRequire(function () { return require("../audit"); });
  * @example
  *   var b = require("@blamejs/core");
  *   var app = b.router.create();
- *   var doc = b.openapi.create({ title: "api", version: "1.0.0" });
+ *   var doc = b.openapi.create({ info: { title: "api", version: "1.0.0" } });
  *   app.use(b.middleware.openapiServe({
  *     document:     doc,
  *     pretty:       true,

package/lib/vendor/blamejs/lib/middleware/rate-limit.js

@@ -570,7 +570,18 @@ function create(opts) {
   var middleware = function rateLimit(req, res, next) {
     if (_shouldSkip(req)) return next();
     var k = keyFn(req);
-    if (scope === "per-route") k = (req.method || "GET") + ":" + (req.pathname || req.url || "/") + "|" + k;
+    // Per-route scope keys on the route PATH only — never the query string. The
+    // query is not part of route identity; keying on it lets an attacker rotate
+    // a throwaway param (?nonce=N) to mint a fresh per-route bucket per request
+    // and evade the limit. req.pathname (set query-free by b.router) is
+    // preferred; when it is absent (a raw Node req handed to the middleware
+    // directly) fall back to req.url with the query stripped — the same strip
+    // every sibling guard (request-log / require-auth / network-allowlist)
+    // already applies.
+    if (scope === "per-route") {
+      var routePath = req.pathname || (req.url || "/").split("?")[0] || "/";
+      k = (req.method || "GET") + ":" + routePath + "|" + k;
+    }
 
     function _handle(verdict) {
       if (emitHeaders && typeof res.setHeader === "function") {

package/lib/vendor/blamejs/lib/middleware/require-bound-key.js

@@ -289,7 +289,7 @@ function create(opts) {
             keyId: record.id || null,
           });
         }
-      } else if (!bCrypto().isCertRevoked(req.peerCert.raw, pinned)) {
+      } else if (!(req.peerCert && req.peerCert.raw) || !bCrypto().isCertRevoked(req.peerCert.raw, pinned)) {
         // isCertRevoked returns true on MATCH against the deny-list
         // shape; we use it here as a fingerprint-set membership test
         // because it does the same constant-time hex/colon comparison

package/lib/vendor/blamejs/lib/middleware/scim-server.js

@@ -262,7 +262,7 @@ async function _dispatch(req, res, basePath, bearer, opts, maxPageSize, bulkCfg)
   if (req.method === "POST" && !resourceId) {
     _assertSchema(body, resourceType === "Users" ? SCIM_CORE_SCHEMA_USER : SCIM_CORE_SCHEMA_GROUP);
     var created = await impl.create(body, ctx);
-    _writeJson(res, H.CREATED, created);
+    _writeJson(res, 201, created);   // 201 Created (HTTP_STATUS has no CREATED key)
     return;
   }
 

package/lib/vendor/blamejs/lib/middleware/tus-upload.js

@@ -511,8 +511,12 @@ function create(opts) {
     if (expHdr) headers["Upload-Expires"] = expHdr;
 
     // creation-with-upload: append the body in the same request when
-    // Content-Type is application/offset+octet-stream.
-    var contentType = req.headers["content-type"];
+    // Content-Type is application/offset+octet-stream. RFC 7231 §3.1.1.1 —
+    // the media type is case-insensitive and may carry parameters, so compare
+    // the lowercased type/subtype (a compliant `Application/Offset+Octet-Stream`
+    // must still take the append path).
+    var rawContentType = req.headers["content-type"];
+    var contentType = rawContentType ? String(rawContentType).split(";")[0].trim().toLowerCase() : "";
     if (hasCreationWithBody && contentType === "application/offset+octet-stream") {
       var chunk;
       try { chunk = await _readChunk(req, maxChunkSize); }

package/lib/vendor/blamejs/lib/mtls-ca.js

@@ -607,7 +607,21 @@ function create(opts) {
         "framework's bundled CA engine, which supports it");
     }
     var ca = await initCA();
-    var revocations = revocationStore.list();
+    var allRevocations = revocationStore.list();
+    // A standard X.509 CRL (RFC 5280 §5.1) is keyed by certificate serial
+    // number. revoke({ fingerprint }) — a first-class revocation mode, and the
+    // value the require-mtls gate pins on — stores no serial (serialNumber is
+    // null). Such an entry cannot be represented in a CRL, so project it out
+    // here rather than handing a null serial to the CRL encoder: the encoder
+    // throws on it, which would break CRL generation for the ENTIRE registry,
+    // dropping the serial-keyed certs that CAN be published from every fresh
+    // CRL (a fail-open for those certs' published revocation). Fingerprint-only
+    // revocations stay enforced through isRevoked()/the mTLS gate, which is
+    // fingerprint-aware; the count that could not be represented is surfaced.
+    var revocations = allRevocations.filter(function (r) {
+      return r && r.serialNumber != null;
+    });
+    var fingerprintOnlyOmitted = allRevocations.length - revocations.length;
     var nowMs = Date.now();
     var thisUpdate = opts3.thisUpdate || new Date(nowMs);
     var nextUpdate = opts3.nextUpdate ||
@@ -627,7 +641,9 @@ function create(opts) {
       atomicFile.writeSync(paths.crl, crlPem, { mode: 0o644 });
     }
     return { crlPem: crlPem, thisUpdate: thisUpdate, nextUpdate: nextUpdate,
-             entryCount: revocations.length, path: paths.crl };
+             entryCount: revocations.length,
+             fingerprintOnlyOmitted: fingerprintOnlyOmitted,
+             path: paths.crl };
   }
 
   return {

package/lib/vendor/blamejs/lib/network-dns-resolver.js

@@ -323,7 +323,17 @@ function create(opts) {
     var filled;
     try { filled = await entry.promise; }
     finally { if (inflight.get(key) === entry) inflight.delete(key); }
-    if (filled.stale) return filled.result;
+    if (filled.stale) {
+      // The validate: true AD-bit gate holds on the serve-stale path too —
+      // otherwise an upstream outage silently downgrades a DNSSEC-strict
+      // lookup to unauthenticated stale data (the verdict is per-response,
+      // RFC 4035 §3.2.3, so a stale entry cached AD=0 must still be refused).
+      if (validate && !filled.result.validated) {
+        throw new ResolverError("resolver/validate-failed",
+          "query: validate: true but served-stale response was AD=0 for " + name + "/" + qtype);
+      }
+      return filled.result;
+    }
     if (validate && !filled.validated) {
       throw new ResolverError("resolver/validate-failed",
         "query: validate: true but upstream returned AD=0 for " + name + "/" + qtype);

package/lib/vendor/blamejs/lib/network-dns.js

@@ -158,8 +158,12 @@ function _cachePutPositive(host, family, value) {
 }
 
 function _cachePutNegative(host, family, error) {
-  if (STATE.cacheTtlMs <= 0) return;
-  var ttl = STATE.cacheNegativeTtlMs > 0 ? STATE.cacheNegativeTtlMs : Math.min(STATE.cacheTtlMs, C.TIME.seconds(30));
+  // Effective negative TTL: an explicit cacheNegativeTtlMs applies even when the
+  // positive TTL is 0 (setCacheTtlMs(0, 60000) = positives off, negatives 60s);
+  // only fall back to the positive TTL when no explicit negative TTL is set.
+  var ttl = STATE.cacheNegativeTtlMs > 0 ? STATE.cacheNegativeTtlMs
+    : (STATE.cacheTtlMs > 0 ? Math.min(STATE.cacheTtlMs, C.TIME.seconds(30)) : 0);
+  if (ttl <= 0) return;
   NEGATIVE_CACHE.set(host + "/" + family, {
     error:     error,
     expiresAt: _now() + ttl,
@@ -237,6 +241,14 @@ function setCacheTtlMs(ms, negativeMs) {
         "dns.setCacheTtlMs negativeMs: expected non-negative finite number, got " + JSON.stringify(negativeMs));
     }
     STATE.cacheNegativeTtlMs = negativeMs;
+  } else {
+    // No explicit negative TTL this call — clear any stale explicit value so it
+    // can't outlive the setCacheTtlMs call that set it. Otherwise
+    // setCacheTtlMs(0) after an earlier setCacheTtlMs(ms, negMs) would leave
+    // negative caching alive (sticky transient failures) even though caching was
+    // just disabled; with this cleared, negative TTL derives from the positive
+    // TTL, so ms=0 disables both positive and negative caching.
+    STATE.cacheNegativeTtlMs = 0;
   }
   if (ms === 0) _clearCache();
 }
@@ -1696,6 +1708,13 @@ async function resolveAaaa(host, opts) { return _resolveProtocol(host, 6, opts);
 // `type` defaults to "A"; "AAAA" routes through resolve6; SVCB / HTTPS
 // types route through the new querySvcb / queryHttps primitives.
 async function resolve(host, type, opts) {
+  // A non-string `type` would throw a raw TypeError from .toUpperCase() (code
+  // undefined, no .permanent) — reject it as a typed DnsError like every other
+  // bad-type path, so a caller keying on err.permanent gets the right verdict.
+  if (type !== undefined && type !== null && typeof type !== "string") {
+    throw new DnsError("dns/unsupported-type",
+      "dns.resolve: type must be a string (got " + typeof type + ")");
+  }
   type = (type || "A").toUpperCase();
   if (type === "A")     return _resolveProtocol(host, 4, opts);
   if (type === "AAAA")  return _resolveProtocol(host, 6, opts);

package/lib/vendor/blamejs/lib/network-tls.js

@@ -13,6 +13,7 @@ var atomicFile = require("./atomic-file");
 var bCrypto = require("./crypto");
 var C = require("./constants");
 var safeBuffer = require("./safe-buffer");
+var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
@@ -3071,6 +3072,49 @@ function _matchDnsNamePattern(pattern, host) {
   return true;
 }
 
+// Node renders a SAN value that contains separators/control chars as a
+// JSON-quoted string (the CVE-2021-44531/44532 remediation), e.g. a single
+// dNSName whose value is `x, DNS:y.com` appears as `DNS:"x, DNS:y.com"`. A
+// naive split(",") would break that one entry into several and smuggle a
+// clean `DNS:y.com` token the certificate never asserted — a hostname
+// verification bypass. Split on commas OUTSIDE quotes and JSON-decode quoted
+// spans, mirroring Node's own splitEscapedAltNames, so each entry is exactly
+// one GeneralName.
+var _SAN_QUOTED_RE = /^"(?:[^"\\]|\\.)*"/;
+function _splitEscapedAltNames(altNames) {
+  var result = [];
+  var current = "";
+  var offset = 0;
+  while (offset !== altNames.length) {
+    var nextSep = altNames.indexOf(",", offset);
+    var nextQuote = altNames.indexOf('"', offset);
+    if (nextQuote !== -1 && (nextSep === -1 || nextQuote < nextSep)) {
+      current += altNames.substring(offset, nextQuote);
+      var match = _SAN_QUOTED_RE.exec(altNames.substring(nextQuote));
+      if (!match) {
+        // Malformed quoting — refuse to parse rather than guess.
+        throw new TlsTrustError("tls/altname-format",
+          "malformed quoted subjectAltName entry");
+      }
+      // match[0] is a JSON string literal (the `_SAN_QUOTED_RE` shape); route
+      // through the framework JSON primitive rather than raw JSON.parse.
+      current += safeJson.parse(match[0]);
+      offset = nextQuote + match[0].length;
+    } else if (nextSep !== -1) {
+      current += altNames.substring(offset, nextSep);
+      result.push(current);
+      current = "";
+      offset = nextSep + 1;
+      if (altNames.charAt(offset) === " ") offset += 1;   // skip the ", " gap
+    } else {
+      current += altNames.substring(offset);
+      offset = altNames.length;
+    }
+  }
+  result.push(current);
+  return result;
+}
+
 function _parseSanString(rawSubjectAltName) {
   // Node exposes the SAN as a comma-separated string of typed entries:
   //   "DNS:foo.example.com, DNS:*.example.com, IP Address:198.51.100.1,
@@ -3081,13 +3125,27 @@ function _parseSanString(rawSubjectAltName) {
   if (typeof rawSubjectAltName !== "string" || rawSubjectAltName.length === 0) {
     return { dns: dns, ips: ips };
   }
-  var entries = rawSubjectAltName.split(",");
+  var entries;
+  try {
+    entries = _splitEscapedAltNames(rawSubjectAltName);
+  } catch (_e) {
+    // Malformed SAN quoting → assert no identifiers (fail closed).
+    return { dns: dns, ips: ips };
+  }
   for (var i = 0; i < entries.length; i += 1) {
-    var raw = entries[i].trim();
-    var colon = raw.indexOf(":");
+    var entry = entries[i];
+    var colon = entry.indexOf(":");
     if (colon === -1) continue;
-    var kind = raw.slice(0, colon).trim();
-    var val  = raw.slice(colon + 1).trim();
+    // The GeneralName TYPE prefix is emitted by _splitEscapedAltNames exactly
+    // (no surrounding whitespace), and the value MUST be preserved EXACTLY —
+    // NOT trimmed. Trimming would strip leading/trailing control whitespace a
+    // decoded quoted value can carry: a dNSName that is a newline followed by
+    // "victim.com" decodes to "\nvictim.com", and a trim would reduce it to a
+    // bare "victim.com" that matches a name the certificate never asserts — a
+    // bypass. Node compares the decoded value verbatim, so an identifier with
+    // such characters simply fails the exact match and is rejected.
+    var kind = entry.slice(0, colon);
+    var val  = entry.slice(colon + 1);
     if (kind === "DNS") {
       dns.push(val);
     } else if (kind === "IP Address" || kind === "IP") {
@@ -3101,9 +3159,13 @@ function _parseSanString(rawSubjectAltName) {
 
 function _normalizeIpForCompare(ip) {
   // Lower-case + strip embedded brackets so "[::1]" / "::1" / "::0001"
-  // all compare equal.
+  // all compare equal. Do NOT trim surrounding whitespace: a valid IP never
+  // carries any, and trimming would let a smuggled SAN value like
+  // "1.2.3.4\n" (a decoded quoted entry) normalize to a clean IP and match a
+  // host the certificate never asserts — net.isIP rejects such a value, so
+  // preserving it verbatim fails closed.
   if (typeof ip !== "string") return null;
-  var s = ip.trim();
+  var s = ip;
   if (s.length >= 2 && s.charAt(0) === "[" && s.charAt(s.length - 1) === "]") {
     s = s.slice(1, -1);
   }

package/lib/vendor/blamejs/lib/nonce-store.js

@@ -291,7 +291,15 @@ async function enforceReplay(store, jti, expireAtMs, opts) {
     throw new opts.errorClass(opts.storeFailedCode,
       "replayStore.checkAndInsert threw: " + ((e && e.message) || String(e)));
   }
-  if (inserted === false) {
+  // Fail CLOSED on ANY non-truthy result, not just a literal `false`. The
+  // recommended backends (Redis SETNX, SQL INSERT ... ON CONFLICT) signal a
+  // duplicate with a non-`false` falsy value — `SET ... NX` returns null, the
+  // SETNX command / an INSERT returns 0 — so an `=== false` compare would miss
+  // the replay and admit the token (fail open). Only a truthy result is a
+  // positive "first-seen" confirmation; anything else is treated as a replay.
+  // Mirrors the truthiness guard every inline consumer already uses
+  // (b.auth.oauth `!inserted`, api-encrypt `!freshNonce`, webhook `!fresh`).
+  if (!inserted) {
     throw new opts.errorClass(opts.replayCode,
       opts.tokenLabel + " jti='" + jti + "' has been seen before — replay refused");
   }

package/lib/vendor/blamejs/lib/object-store/gcs.js

@@ -362,6 +362,13 @@ function create(config) {
 
     url.searchParams.set("X-Goog-Signature", signature);
 
+    // Final query mutation done — align the wire space encoding to the signed
+    // canonical query (GCS V4 signs "%20" but url.toString() would serialize a
+    // space as "+", so a spaced response-header override / prefix would be
+    // rejected as a signature mismatch). Must precede url.toString(); do not
+    // touch url.searchParams afterward (it re-serializes spaces back to "+").
+    sigv4.alignWireQueryToSigV4(url);
+
     var clientHeaders = {};
     if (opts.contentType) clientHeaders["Content-Type"] = opts.contentType;
 

package/lib/vendor/blamejs/lib/object-store/sigv4.js

@@ -120,6 +120,29 @@ function canonicalQueryString(searchParams) {
   }).join("&");
 }
 
+// Reconcile the wire query with the signed canonical query. The WHATWG URL
+// serializes its query via application/x-www-form-urlencoded, which encodes a
+// space as "+"; SigV4 signs canonicalQueryString, which encodes a space as
+// "%20" (AWS: "encode the space character as %20 and not +"). Left
+// unreconciled, a signed query parameter carrying a literal space (a
+// response-content-disposition filename, a list prefix) is transmitted
+// (url.search / url.toString) as "+" while the signature commits to "%20", so
+// the server re-canonicalizes to different bytes and rejects the request with
+// SignatureDoesNotMatch. A bare "+" in url.search is ALWAYS an encoded space —
+// URLSearchParams serializes a literal "+" as "%2B" and parses "+" back to a
+// space, so canonicalQueryString already signed that position as "%20";
+// rewriting "+" to "%20" makes the transmitted query byte-identical to the
+// signed canonical query. Bare subresource tokens (?uploads / ?lifecycle) carry
+// no "+", so they pass through untouched. Mutates url.search in place (the
+// string setter preserves "%20"); callers MUST NOT touch url.searchParams
+// afterward — that re-serializes spaces back to "+".
+function _alignWireQueryToSigV4(url) {
+  var search = url.search;
+  if (search.indexOf("+") !== -1) {
+    url.search = search.replace(/\+/g, "%20");   // allow:regex-no-length-cap — single-char global replace, input bounded by maxUrlLength
+  }
+}
+
 function canonicalHeaders(headers) {
   var pairs = [];
   for (var k in headers) {
@@ -233,6 +256,10 @@ function signRequest(opts) {
     ", Signature=" + signature;
   headers["Authorization"] = auth;
 
+  // The URL just signed is the one the caller transmits — make its wire query
+  // byte-identical to the canonical query the signature commits to.
+  _alignWireQueryToSigV4(url);
+
   return { headers: headers, signature: signature, canonicalRequest: canon, stringToSign: sts };
 }
 
@@ -810,6 +837,9 @@ function create(config) {
     var signature = nodeCrypto.createHmac("sha256", signingKey).update(sts).digest("hex");
 
     url.searchParams.set("X-Amz-Signature", signature);
+    // Final query mutation done — align the wire space encoding to the signed
+    // "%20" form before serializing the URL the client will use.
+    _alignWireQueryToSigV4(url);
 
     var clientHeaders = {};
     if (opts.contentType) clientHeaders["Content-Type"] = opts.contentType;
@@ -994,6 +1024,7 @@ module.exports = {
   deriveSigningKey:     deriveSigningKey,
   canonicalQueryString: canonicalQueryString,
   canonicalHeaders:     canonicalHeaders,
+  alignWireQueryToSigV4: _alignWireQueryToSigV4,
   awsUriEncode:         awsUriEncode,
   sha256Hex:            sha256Hex,
   formatAmzDate:        _formatAmzDate,

package/lib/vendor/blamejs/lib/observability-otlp-exporter.js

@@ -377,7 +377,7 @@ function _spanToProto(span) {
     pb.uint32(10, span.droppedAttributesCount || 0),
     eventsRepeated,
     pb.uint32(12, span.droppedEventsCount || 0),
-    pb.uint32(15, 0),                                                           // links repeated count placeholder; encoder emits 0 length-delim when no links
+    pb.uint32(14, 0),                                                           // dropped_links_count (proto field 14); no links propagated yet
     Buffer.concat([
       pb._tag(15, 2),                                                           // WIRE_LDELIM tag for status
       pb._writeVarint(statusBody.length),

package/lib/vendor/blamejs/lib/outbox.js

@@ -99,7 +99,7 @@ var KEY_MAX_LEN             = C.BYTES.bytes(255);
 function _validateTableName(name) {
   // SQL identifier — quoteIdentifier rejects anything with embedded
   // quotes, schema-qualified names valid via dot-separated parts.
-  return safeSql.quoteIdentifier(name);
+  return safeSql.quoteIdentifier(name, undefined, { allowReserved: true }); // parity with b.db.from()
 }
 
 // Map the operator backend's dialect tag to the b.sql dialect vocabulary.

package/lib/vendor/blamejs/lib/parsers/safe-ini.js

@@ -132,7 +132,15 @@ function _coerceValue(raw) {
     return n;
   }
   if (/^-?\d+\.\d+([eE][+-]?\d+)?$/.test(raw) || /^-?\d+[eE][+-]?\d+$/.test(raw)) {
-    return Number(raw);
+    var f = Number(raw);
+    // Float overflow (e.g. 1e999) coerces to ±Infinity — the same
+    // never-silently-coerce refusal the integer/hex branches enforce with
+    // Number.isSafeInteger. An Infinity slipping into a downstream size cap
+    // or timeout is a live DoS, so an out-of-range float is rejected here.
+    if (!Number.isFinite(f)) {
+      throw _err("ini/value-out-of-range", "float exceeds representable range: " + raw);
+    }
+    return f;
   }
   return _unquote(raw);
 }

package/lib/vendor/blamejs/lib/parsers/safe-toml.js

@@ -201,7 +201,16 @@ function parse(input, opts) {
     while (!_eof()) {
       var c = _peek();
       if (c === quote) {
-        if (!basic) out = input.substring(start, pos);
+        // Append the pending verbatim run for BOTH kinds. A basic key
+        // accumulates decoded escapes into `out` and resets `start` past
+        // each; the trailing literal run (or the whole key when it has no
+        // escapes) must still be appended here. A literal key never
+        // touches `out` before this point, so the append yields its full
+        // verbatim content. Assigning only for the literal branch dropped
+        // every escape-free basic key to "" — collapsing distinct quoted
+        // keys together and letting a quoted `"__proto__"` slip past the
+        // poisoned-key guard by decoding to the empty string.
+        out += input.substring(start, pos);
         _advance();
         return out;
       }

package/lib/vendor/blamejs/lib/permissions.js

@@ -572,9 +572,12 @@ function create(opts) {
         // Window floor — when neither route nor role supplies an
         // explicit mfaWindowMs, default to 15 minutes. Without this
         // floor, a stolen long-lived cookie carrying an old `mfaAt`
-        // walks past every requireMfa: true gate. Operators who want
-        // an explicit no-window pass-through must say so via
-        // mfaWindowMs: Infinity (audited reason).
+        // walks past every requireMfa: true gate. There is deliberately
+        // NO no-window opt-out: the role- and route-level validators
+        // reject a non-finite mfaWindowMs, so freshness is always
+        // enforced. (The `!== Infinity` guard below is a defensive
+        // backstop for a hypothetically-injected value, not a supported
+        // config path.)
         if (enforceWindowMs === null) {
           enforceWindowMs = C.TIME.minutes(15);
         }

package/lib/vendor/blamejs/lib/pid-probe.js

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// pid-probe — the signal-0 liveness probe + fd-safe pidfile reader shared by
+// b.daemon (lib/daemon.js) and b.appShutdown.pidLock (lib/app-shutdown.js).
+// Both files carried a byte-for-byte copy of the liveness check and the capped,
+// symlink-refusing pidfile reader; a single owner keeps the liveness semantics
+// (process.kill(pid, 0) → alive; EPERM → alive-but-unowned; ESRCH → dead) and
+// the read hardening (1 KiB cap + O_NOFOLLOW refusal so a planted symlink or an
+// oversized file can neither redirect nor OOM the read) identical across every
+// caller — daemon.start / stop / status and pidLock.acquire / release.
+//
+// This is not request-reachable: the two callers are process-lifecycle
+// primitives, so a throw here would only ever surface at daemon start/stop.
+// Both entry points are defensive readers (return-default, never throw): a
+// missing / malformed / hostile pidfile yields null ("nothing live there")
+// rather than propagating an error into the shutdown path.
+
+var atomicFile = require("./atomic-file");
+var C = require("./constants");
+
+// isLivePid(pid) — signal-0 existence probe. process.kill(pid, 0) sends no
+// signal but performs the permission + existence check the kernel would do for
+// a real signal: it succeeds when the process is alive and signalable, throws
+// EPERM when the process is alive but owned by another user (still "live"), and
+// throws ESRCH when no such process exists (dead). A non-numeric / non-finite /
+// non-positive pid is never live.
+function isLivePid(pid) {
+  if (typeof pid !== "number" || !isFinite(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; }
+  catch (e) { return !!(e && e.code === "EPERM"); }
+}
+
+// readPidFile(pidFile) — fd-safe + capped + symlink-refusing read of a PID
+// sidecar. A PID file is never a legitimate symlink mount (unlike a k8s/certbot
+// secret mount), so refuseSymlink is safe here and stops a planted symlink from
+// redirecting the read; the 1 KiB cap stops an oversized planted file from
+// OOM-ing it. Returns the parsed positive PID, or null for any failure
+// (missing / symlink / too-large / non-numeric) — the uniform "nothing live
+// there" sentinel both callers already relied on.
+function readPidFile(pidFile) {
+  try {
+    var raw = atomicFile.fdSafeReadSync(pidFile, {
+      maxBytes: C.BYTES.kib(1), refuseSymlink: true, encoding: "utf8",
+    });
+    var pid = parseInt(String(raw).trim(), 10);
+    return isFinite(pid) && pid > 0 ? pid : null;
+  } catch (_e) { return null; }
+}
+
+module.exports = {
+  isLivePid:   isLivePid,
+  readPidFile: readPidFile,
+};

package/lib/vendor/blamejs/lib/pqc-agent.js

@@ -176,6 +176,13 @@ function _buildAgentOpts(opts) {
   } else {
     merged.ecdhCurve = C.TLS_GROUP_CURVE_STR;
   }
+  // Mirror the resolved ecdhCurve into `groups` from one string (same
+  // shape as network-tls.buildOptions). `applyToContext` only fills
+  // `groups` when it is undefined, so setting it here preserves the
+  // caller's narrowed/reordered selection instead of letting the
+  // context filler re-derive `groups` from STATE.tlsKeyShares — a
+  // different ordering that would ignore the caller's ecdhCurve.
+  merged.groups = merged.ecdhCurve;
   merged.minVersion = "TLSv1.3";
   if (networkTls && typeof networkTls.applyToContext === "function") {
     merged = networkTls.applyToContext({ base: merged });
@@ -203,7 +210,7 @@ function _buildAgentOpts(opts) {
  *   maxSockets?:          number,
  *   maxFreeSockets?:      number,
  *   scheduling?:          string,
- *   ecdhCurve?:           string,   // colon-separated group names; must subset C.TLS_GROUP_PREFERENCE
+ *   ecdhCurve?:           string,   // colon-separated group names; must subset C.TLS_GROUP_PREFERENCE. The TLS `groups` list tracks this value exactly (mirrored from one resolved string), so a narrowed/reordered ecdhCurve is the negotiated key-share order.
  *   allowOperatorGroups?: boolean,  // default false; opt in to operator-supplied groups outside the framework PQC preference
  *
  * @example

package/lib/vendor/blamejs/lib/pqc-software.js

@@ -103,7 +103,7 @@ function _accessor(name) {
  * posture returns a stub whose primitive calls throw `PqcError`.
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   if (b.pqcSoftware.isAvailable()) {
  *     var ss = b.pqcSoftware.DEFAULT_KEM.keygen();
  *     ss.publicKey.length;
@@ -128,7 +128,7 @@ function isAvailable() {
  * bundle is unavailable.
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   var names = b.pqcSoftware.listAlgorithms();
  *   names.indexOf("ml_kem_1024") >= 0;
  *   // → true (when the vendored bundle is present)
@@ -235,7 +235,7 @@ Object.defineProperty(pqc, "DEFAULT_HASH_SIG", {
  * shared secrets are byte-identical (32 bytes per FIPS 203 §1).
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   var result = b.pqcSoftware.runKnownAnswerTest();
  *   result.ok;
  *   // → true (or { ok: false, reason: "<diagnostic>" } when broken)