@blamejs/core 0.15.15 → 0.15.17

package/lib/network-proxy.js

@@ -7,6 +7,7 @@ var nodeTls = require("node:tls");
 
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
+var safeBuffer = require("./safe-buffer");
 var safeUrl = require("./safe-url");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -19,6 +20,23 @@ var IPV4_PREFIX_MAX_BITS = C.BYTES.bytes(32);   // RFC 791 §3.1 IPv4 address bi
 var DEFAULT_HTTPS_PORT   = 443;                 // RFC 9110 §4.2.2
 var DEFAULT_HTTP_PORT    = C.BYTES.bytes(80);   // RFC 9110 §4.2.1
 
+// Bound the CONNECT-reply framing buffer (mirrors ws-client's handshake
+// cap). A proxy that streams bytes without ever sending the CRLFCRLF
+// header terminator would otherwise grow `buf` without limit and OOM the
+// process; CONNECT replies are tiny, 64 KiB is generous headroom.
+var TUNNEL_HEADER_MAX_BYTES = C.BYTES.kib(64);
+// Wall-clock bound on the proxy connect + CONNECT handshake. Without it a
+// proxy that accepts the socket but never replies (or trickles forever)
+// hangs the tunnel indefinitely.
+var TUNNEL_CONNECT_TIMEOUT_MS = C.TIME.seconds(30);
+// Test-only override of the connect deadline so a unit test can prove the
+// absolute-timeout behavior without a 30s wall-clock wait. null = use the
+// real default. Cleared by _resetForTest.
+var _testConnectTimeoutMs = null;
+function _connectTimeoutMs() {
+  return typeof _testConnectTimeoutMs === "number" ? _testConnectTimeoutMs : TUNNEL_CONNECT_TIMEOUT_MS;
+}
+
 var observability = lazyRequire(function () { return require("./observability"); });
 // Lazy so pqc-agent's TLS/audit graph isn't pulled into every process that
 // imports network-proxy but never proxies an https upstream. Used only to audit
@@ -169,7 +187,27 @@ function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
       })
     : net.connect({ host: proxyUrl.hostname, port: proxyPort });
   var settled = false;
-  function done(err, sock) { if (settled) return; settled = true; callback(err, sock); }
+  var connectDeadline = null;
+  function done(err, sock) {
+    if (settled) return;
+    settled = true;
+    if (connectDeadline) { try { clearTimeout(connectDeadline); } catch (_e) { /* best-effort */ } connectDeadline = null; }
+    callback(err, sock);
+  }
+  // ABSOLUTE wall-clock deadline on the proxy connect + CONNECT handshake. A
+  // proxy that accepts the socket but never sends the CRLFCRLF terminator —
+  // or trickles partial bytes just inside every idle window — must not hang
+  // the tunnel forever. socket.setTimeout is an IDLE timer that such a trickle
+  // resets indefinitely, so a fixed setTimeout (cleared in done()) enforces a
+  // real total-time bound regardless of how the bytes arrive.
+  var connectTimeoutMs = _connectTimeoutMs();
+  connectDeadline = setTimeout(function () {
+    done(new ProxyError("proxy/connect-timeout",
+      "proxy CONNECT to " + targetHost + ":" + targetPort + " timed out after " +
+      connectTimeoutMs + "ms"));
+    try { proxySocket.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+  }, connectTimeoutMs);
+  if (connectDeadline && typeof connectDeadline.unref === "function") connectDeadline.unref();
   proxySocket.on("error", function (e) { done(e); });
   proxySocket.on(proxyUrl.protocol === "https:" ? "secureConnect" : "connect", function () {
     if (proxyUrl.protocol === "https:") {
@@ -191,7 +229,18 @@ function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
     function onData(chunk) {
       buf = Buffer.concat([buf, chunk]);
       var idx = buf.indexOf("\r\n\r\n");
-      if (idx === -1) return;
+      if (idx === -1) {
+        // No header terminator yet — bound the accumulator so a proxy
+        // that trickles non-CRLFCRLF bytes forever can't OOM the process.
+        if (safeBuffer.byteLengthOf(buf) > TUNNEL_HEADER_MAX_BYTES) {
+          proxySocket.removeListener("data", onData);
+          done(new ProxyError("proxy/connect-headers-too-large",
+            "proxy CONNECT reply exceeded " + TUNNEL_HEADER_MAX_BYTES +
+            " bytes before CRLFCRLF"));
+          try { proxySocket.destroy(); } catch (_e) { /* best-effort socket teardown */ }
+        }
+        return;
+      }
       proxySocket.removeListener("data", onData);
       var head = buf.slice(0, idx).toString("ascii");
       var status = head.split("\r\n")[0] || "";
@@ -271,8 +320,11 @@ function snapshot() {
 function _resetForTest() {
   STATE.http = null; STATE.https = null; STATE.noProxy = []; STATE.auth = null;
   STATE.agentCache.clear();
+  _testConnectTimeoutMs = null;
 }
 
+function _setConnectTimeoutForTest(ms) { _testConnectTimeoutMs = ms; }
+
 module.exports = {
   set:           set,
   fromEnv:       fromEnv,
@@ -281,4 +333,5 @@ module.exports = {
   snapshot:      snapshot,
   ProxyError:    ProxyError,
   _resetForTest: _resetForTest,
+  _setConnectTimeoutForTest: _setConnectTimeoutForTest,
 };

package/lib/object-store/azure-blob-bucket-ops.js

@@ -233,6 +233,7 @@ function create(config) {
       url:              url,
       headers:          headers,
       body:             body,
+      timeoutMs:        timeoutMs,
       idleTimeoutMs:    timeoutMs,
       allowedProtocols: allowedProtocols,
       errorClass:       ObjectStoreError,

package/lib/object-store/gcs-bucket-ops.js

@@ -182,6 +182,7 @@ function create(config) {
       url:              url,
       headers:          headers,
       body:             body,
+      timeoutMs:        timeoutMs,
       idleTimeoutMs:    timeoutMs,
       allowedProtocols: allowedProtocols,
       errorClass:       ObjectStoreError,

package/lib/object-store/http-request.js

@@ -36,6 +36,10 @@ function request(method, url, headers, body, opts) {
     url:              url,
     headers:          headers,
     body:             body,
+    // Both caps from the operator's configured timeout: timeoutMs bounds the
+    // whole request (no slow-trickle hold-open), idleTimeoutMs the zero-progress
+    // window. Undefined leaves httpClient's defaults unchanged.
+    timeoutMs:        opts.timeoutMs,
     idleTimeoutMs:    opts.timeoutMs,
     errorClass:       opts.errorClass || ObjectStoreError,
     allowedProtocols: opts.allowedProtocols,

package/lib/outbox.js

@@ -214,6 +214,35 @@ function create(opts) {
         throw new OutboxError("outbox/bad-externaldb",
           "outbox.create: externalDb must be the b.externalDb namespace (with transaction/query)");
       }
+      // The outbox dual-write guarantee (enqueue runs in the SAME
+      // transaction as the operator's business write) is VOID on a
+      // stateless / autocommit-per-statement backend: BEGIN / the
+      // business write / the enqueue INSERT / COMMIT each land on a
+      // different session, so a crash or rollback can drop the business
+      // row while keeping the event (or vice versa). Refuse at create()
+      // when the backend declares it cannot provide interactive
+      // transactions, rather than constructing an outbox whose core
+      // guarantee silently does not hold. supportsTransactions may be a
+      // boolean (custom externalDb object) or a function (the
+      // b.externalDb namespace probe); only an explicit false refuses —
+      // an absent flag preserves the historical stateful assumption.
+      var cap = v.supportsTransactions;
+      var atomic = true;
+      if (typeof cap === "function") {
+        try { atomic = !!cap(); } catch (_e) { atomic = true; }
+      } else if (cap === false) {
+        atomic = false;
+      }
+      if (!atomic) {
+        throw new OutboxError("outbox/non-atomic-backend",
+          "outbox.create: externalDb backend cannot provide interactive " +
+          "transactions (supportsTransactions: false — a stateless / " +
+          "autocommit-per-statement adapter). The outbox dual-write guarantee " +
+          "requires the business write and the enqueue INSERT to commit " +
+          "atomically in one transaction; on this backend they would not. " +
+          "Supply interactive beginTx / commit / rollback hooks, or a batch " +
+          "adapter, on the externalDb backend first.");
+      }
     },
     table: function (v) {
       validateOpts.requireNonEmptyString(v,

package/lib/queue-local.js

@@ -230,14 +230,28 @@ function create(config) {
   // open each verb builder pre-bound to this table so the table reference
   // is resolved in exactly one place.
   var ref = _resolveTableRef(config);
-  function _select() { return sql.select(ref.name, ref.opts); }
-  function _insert() { return sql.insert(ref.name, ref.opts); }
-  function _update() { return sql.update(ref.name, ref.opts); }
-  function _delete() { return sql.delete(ref.name, ref.opts); }
-  // Quoted column expression for a setRaw RHS that references the column's
-  // own pre-update value (attempts/availableAt). dialect-sqlite quoting is
-  // the double-quote form clusterStorage's Postgres path keeps.
-  function _qc(col) { return safeSql.quoteIdentifier(col, "sqlite", { allowReserved: true }); }
+  // Resolve the ACTIVE backend dialect every verb builds for — sqlite in
+  // single-node, the operator-configured postgres/mysql in cluster mode — so
+  // b.sql emits dialect-correct identifier quoting (backticks on MySQL, not
+  // double-quotes that MySQL reads as string literals) and its own dialect
+  // guards fire. The default store IS clusterStorage (it knows the live
+  // dialect); a bring-your-own store declares config.dialect (or exposes its
+  // own dialect()), defaulting to sqlite. Resolved per call (lazy) like the
+  // sibling clusterStorage data-layer files, since cluster.init may run after
+  // queue.create.
+  function _dialect() {
+    if (store === clusterStorage) return clusterStorage.dialect();
+    if (typeof store.dialect === "function") return store.dialect();
+    return (typeof config.dialect === "string" && config.dialect) ? config.dialect : "sqlite";
+  }
+  function _opts() { return Object.assign({}, ref.opts, { dialect: _dialect() }); }
+  function _select() { return sql.select(ref.name, _opts()); }
+  function _insert() { return sql.insert(ref.name, _opts()); }
+  function _update() { return sql.update(ref.name, _opts()); }
+  function _delete() { return sql.delete(ref.name, _opts()); }
+  // Quoted column expression for a setRaw RHS that references the column's own
+  // pre-update value (attempts/availableAt), quoted for the ACTIVE dialect.
+  function _qc(col) { return safeSql.quoteIdentifier(col, _dialect(), { allowReserved: true }); }
 
   async function enqueue(queueName, payload, opts) {
     cluster.requireLeader();
@@ -324,22 +338,9 @@ function create(config) {
     };
   }
 
-  async function lease(queueName, leaseMs, count) {
-    cluster.requireLeader();
-    var nowMs = Date.now();
-    var leaseExpiresAt = nowMs + leaseMs;
-    var maxRows = count != null ? count : 1;
-
-    // Single-statement atomic lease. The IN-subquery picks the head of
-    // the queue; the outer UPDATE locks those rows and only updates
-    // rows that still match status='pending' after the lock acquires
-    // (Postgres EvalPlanQual; SQLite is single-writer so the same row
-    // can't be picked twice). RETURNING hands back the leased columns
-    // so we don't need a separate SELECT after the UPDATE. maxRows is a
-    // framework-computed integer emitted inline via b.sql's .limit() (a
-    // bound LIMIT param has no portable form across the subquery path);
-    // attempts = attempts + 1 is a setRaw over the column's own value.
-    var leaseInner = _select()
+  // Build the head-of-queue candidate SELECT (shared by both lease paths).
+  function _leaseCandidates(queueName, nowMs, maxRows) {
+    return _select()
       .columns(["_id"])
       .where("queueName", queueName)
       .where("status", "pending")
@@ -348,20 +349,87 @@ function create(config) {
       .orderBy("availableAt", "asc")
       .orderBy("enqueuedAt", "asc")
       .limit(maxRows);
-    var leaseBuilt = _update()
-      .set("status", "inflight")
-      .set("leasedAt", nowMs)
-      .set("leaseExpiresAt", leaseExpiresAt)
-      .setRaw("attempts", _qc("attempts") + " + 1", [])
-      .whereIn("_id", leaseInner)
-      .returning(LEASE_RETURN_COLS)
-      .toSql();
-    var result = await store.execute(leaseBuilt.sql, leaseBuilt.params);
-    var leased = [];
-    for (var i = 0; i < result.rows.length; i++) {
-      leased.push(_shapeLeasedRow(result.rows[i]));
+  }
+
+  async function lease(queueName, leaseMs, count) {
+    cluster.requireLeader();
+    var nowMs = Date.now();
+    var leaseExpiresAt = nowMs + leaseMs;
+    var maxRows = count != null ? count : 1;
+    var dialect = _dialect();
+    var i;
+
+    // SQLite (single-writer): one self-contained statement is atomic. The
+    // IN-subquery picks the head of the queue, the outer UPDATE flips it, and
+    // RETURNING hands the leased rows back. This shape is valid ONLY on
+    // sqlite — Postgres freezes the materialized subquery qual (so a
+    // concurrent leaser double-claims the same row) and MySQL refuses both
+    // RETURNING and updating a table named in its own subquery (error 1093).
+    if (dialect === "sqlite") {
+      var leaseBuilt = _update()
+        .set("status", "inflight")
+        .set("leasedAt", nowMs)
+        .set("leaseExpiresAt", leaseExpiresAt)
+        .setRaw("attempts", _qc("attempts") + " + 1", [])
+        .whereIn("_id", _leaseCandidates(queueName, nowMs, maxRows))
+        .returning(LEASE_RETURN_COLS)
+        .toSql();
+      var result = await store.execute(leaseBuilt.sql, leaseBuilt.params);
+      var leased = [];
+      for (i = 0; i < result.rows.length; i++) leased.push(_shapeLeasedRow(result.rows[i]));
+      return leased;
+    }
+
+    // Postgres / MySQL: claim inside a transaction. SELECT ... FOR UPDATE SKIP
+    // LOCKED row-locks the head-of-queue ids so concurrent leasers see
+    // disjoint sets (no double-lease); the guarded UPDATE ... WHERE
+    // status='pending' AND _id IN (locked ids) uses a LITERAL id list (not a
+    // self-referencing subquery — avoids MySQL 1093), with the status guard as
+    // belt-and-suspenders. Postgres reads the leased rows back via RETURNING;
+    // MySQL (no RETURNING) re-selects them by the locked ids. Mirrors
+    // outbox._claimBatch — the framework's canonical competing-consumer claim.
+    if (typeof store.transaction !== "function") {
+      throw _err("CLUSTER_TX_UNSUPPORTED",
+        "queue lease on a '" + dialect + "' backend requires an interactive transaction, but the " +
+        "configured store exposes no transaction(); use the default cluster store or supply a " +
+        "transaction-capable store", true);
     }
-    return leased;
+    return await store.transaction(async function (tx) {
+      var selBuilt = _leaseCandidates(queueName, nowMs, maxRows)
+        .forUpdate({ skipLocked: true })
+        .toSql();
+      var selRes = await tx.execute(selBuilt.sql, selBuilt.params);
+      var ids = ((selRes && selRes.rows) || []).map(function (r) { return r._id; });
+      if (ids.length === 0) return [];
+
+      var upd = _update()
+        .set("status", "inflight")
+        .set("leasedAt", nowMs)
+        .set("leaseExpiresAt", leaseExpiresAt)
+        .setRaw("attempts", _qc("attempts") + " + 1", [])
+        .where("status", "pending")
+        .whereInArray("_id", ids);
+
+      var rows;
+      if (dialect === "postgres") {
+        var updBuilt = upd.returning(LEASE_RETURN_COLS).toSql();
+        var updRes = await tx.execute(updBuilt.sql, updBuilt.params);
+        rows = (updRes && updRes.rows) || [];
+      } else {
+        var u = upd.toSql();
+        await tx.execute(u.sql, u.params);
+        var rbBuilt = _select()
+          .columns(LEASE_RETURN_COLS)
+          .where("status", "inflight")
+          .whereInArray("_id", ids)
+          .toSql();
+        var rbRes = await tx.execute(rbBuilt.sql, rbBuilt.params);
+        rows = (rbRes && rbRes.rows) || [];
+      }
+      var out = [];
+      for (i = 0; i < rows.length; i++) out.push(_shapeLeasedRow(rows[i]));
+      return out;
+    });
   }
 
   // extendLease — push the lease expiry forward for a long-running job.
@@ -633,19 +701,28 @@ function create(config) {
     return result.rowCount || 0;
   }
 
-  // patchFlowDeps — the second pass of enqueueFlow. Writes the resolved
-  // dependsOn jobIds and parks availableAt at MAX_SAFE_INTEGER for a flow
-  // child that has dependencies. Lives on the backend (not in queue.js)
-  // so it targets THIS backend's configured store + table — a
-  // bring-your-own table receives the flow graph the same way the
-  // first-pass enqueue did, instead of the dispatcher writing to the
-  // default jobs table behind the backend's back. depIds is serialized
-  // to JSON for the dependsOn column.
+  // patchFlowDeps — the second pass of enqueueFlow. Rewrites the child's
+  // dependsOn from the dependency NAMES the first pass wrote to the resolved
+  // sibling jobIds (now that every sibling's jobId is known). Lives on the
+  // backend (not in queue.js) so it targets THIS backend's configured store +
+  // table — a bring-your-own table receives the flow graph the same way the
+  // first-pass enqueue did, instead of the dispatcher writing to the default
+  // jobs table behind the backend's back. depIds is serialized to JSON.
+  //
+  // It must NOT touch availableAt: the first pass already parked the child at
+  // FLOW_BLOCKED_AVAILABLE_AT (it enqueues deps-bearing children WITH their
+  // dependsOn), and a dependency that completes in the window between the two
+  // passes drives complete() → _maybeReleaseFlowChildren, which bumps the
+  // child's availableAt to now. Re-parking here would clobber that release,
+  // and since the dependency is already done it never completes again — the
+  // child would sit pending-but-unleaseable forever. Parking is owned by the
+  // first-pass enqueue; releasing is owned by completion. This pass only
+  // resolves names → ids (harmless to rewrite even on an already-released
+  // child: a leased child's own dependsOn is never re-read).
   async function patchFlowDeps(jobId, depIds) {
     cluster.requireLeader();
     var built = _update()
       .set("dependsOn", JSON.stringify(depIds))
-      .set("availableAt", FLOW_BLOCKED_AVAILABLE_AT)
       .where("_id", jobId)
       .toSql();
     var result = await store.execute(built.sql, built.params);

package/lib/queue-sqs.js

@@ -153,6 +153,7 @@ function create(opts) {
       url:              endpointUrl,
       headers:          signed.headers,
       body:             bodyBuf,
+      timeoutMs:        timeoutMs,
       idleTimeoutMs:    timeoutMs,
       allowedProtocols: allowedProtocols,
       errorClass:       QueueError,

package/lib/queue.js

@@ -938,14 +938,16 @@ function enqueueFlow(spec) {
     { queueName: spec.queueName, flowId: flowId, childCount: spec.children.length },
     async function () {
       var jobs = [];
-      // Two-pass insert: first pass enqueues all children with their
-      // names attached so the second pass can write dependsOn jobIds
-      // resolved by name. Children with deps land at MAX_SAFE_INTEGER
-      // availableAt automatically (see queue-local enqueue logic).
+      // Two-pass insert: first pass enqueues all children (so the second pass
+      // can resolve dependsOn names → sibling jobIds); a deps-bearing child is
+      // PARKED at enqueue time by passing its dependsOn through, so it is never
+      // leaseable in the window between the two passes (a concurrent consumer
+      // could otherwise lease it before its deps run). The second pass only
+      // rewrites the parked child's dependsOn from names to the resolved jobIds.
       var nameToJobId = {};
       for (var p = 0; p < spec.children.length; p++) {
         var ch = spec.children[p];
-        // Hold off setting dependsOn until we know all sibling jobIds.
+        var hasDeps = Array.isArray(ch.dependsOn) && ch.dependsOn.length > 0;
         var enqOpts = {
           backend:       flowBackend.name,
           flowId:        flowId,
@@ -954,10 +956,12 @@ function enqueueFlow(spec) {
           classification: ch.classification || null,
           traceId:       ch.traceId || null,
           maxAttempts:   ch.maxAttempts,
-          // dependsOn intentionally omitted on first pass — will be patched
-          // in via the backend's patchFlowDeps after all jobIds are known.
-          // Root children (no deps) are immediately leaseable; deps-bearing
-          // children get parked at MAX_SAFE_INTEGER via the second pass.
+          // Park a deps-bearing child immediately (queue-local parks when
+          // opts.dependsOn is present); the second pass replaces these dep
+          // NAMES with the resolved sibling jobIds, keeping it parked until
+          // completion bumps availableAt. Root children (no deps) stay
+          // immediately leaseable.
+          dependsOn:     hasDeps ? ch.dependsOn : undefined,
         };
         var result = await enqueue(spec.queueName, ch.payload, enqOpts);
         nameToJobId[ch.name] = result.jobId;

package/lib/request-helpers.js

@@ -476,7 +476,7 @@ function _maskIpv6(ip, prefix) {
 
 /**
  * @primitive b.requestHelpers.ipPrefix
- * @signature b.requestHelpers.ipPrefix(ip)
+ * @signature b.requestHelpers.ipPrefix(ip, opts?)
  * @since     0.15.15
  * @related   b.requestHelpers.clientIp, b.requestHelpers.trustedClientIp
  *
@@ -493,22 +493,41 @@ function _maskIpv6(ip, prefix) {
  * public IP within a subnet don't log a user out). Exposed so an operator who
  * drops to a function-form fingerprint field — for a custom mask width, or to
  * combine the prefix with other signals — reuses this exact algorithm instead
- * of re-deriving the /24 + /64 masking (and silently diverging).
+ * of re-deriving the /24 + /64 masking (and silently diverging). Pass
+ * <code>opts.v4Bits</code> / <code>opts.v6Bits</code> to override the mask
+ * widths (e.g. a device fingerprint that buckets at <code>/48</code> so a
+ * client roaming within its allocation but across a <code>/64</code> doesn't
+ * drift); an out-of-range or absent value falls back to the /24 + /64 default.
+ *
+ * @opts
+ *   v4Bits: number,   // IPv4 mask width in bits (default 24; valid 0..32)
+ *   v6Bits: number,   // IPv6 mask width in bits (default 64; valid 0..128)
  *
  * @example
  *   b.requestHelpers.ipPrefix("203.0.113.47");   // → "203.0.113.0/24"
  *   b.requestHelpers.ipPrefix("2001:db8::1");     // → "2001:db8:0:0/64"
  */
-function ipPrefix(ip) {
+function _resolvePrefixBits(bits, def, max) {
+  if (typeof bits !== "number" || !isFinite(bits) || bits < 0 || bits > max) return def;
+  return bits;
+}
+function ipPrefix(ip, opts) {
   if (typeof ip !== "string" || ip.length === 0) return "";
+  opts = opts || {};
+  // Configurable mask widths (default /24 + /64); an absent or out-of-range
+  // value falls back to the default. This preserves a caller's documented
+  // prefix width (e.g. a device fingerprint bucketing at /48) instead of
+  // silently forcing /64 — while still canonicalizing the address.
+  var v4 = _resolvePrefixBits(opts.v4Bits, IPV4_DEFAULT_PREFIX, 32);                            // IPv4 max prefix length in bits
+  var v6 = _resolvePrefixBits(opts.v6Bits, IPV6_DEFAULT_PREFIX, 128);                           // IPv6 max prefix length in bits
   // IPv4-mapped IPv6 (::ffff:1.2.3.4) — strip the wrapper so the v4 mask
   // applies. Same bucket regardless of how the proxy reported it.
   var lower = ip.toLowerCase();
   if (lower.indexOf(V4_MAPPED_V6_PREFIX) === 0 && lower.indexOf(".") !== -1) {
-    return _maskIpv4(lower.substring(V4_MAPPED_V6_PREFIX.length), IPV4_DEFAULT_PREFIX) || "";
+    return _maskIpv4(lower.substring(V4_MAPPED_V6_PREFIX.length), v4) || "";
   }
-  if (ip.indexOf(":") !== -1) return _maskIpv6(ip, IPV6_DEFAULT_PREFIX) || "";
-  if (ip.indexOf(".") !== -1) return _maskIpv4(ip, IPV4_DEFAULT_PREFIX) || "";
+  if (ip.indexOf(":") !== -1) return _maskIpv6(ip, v6) || "";
+  if (ip.indexOf(".") !== -1) return _maskIpv4(ip, v4) || "";
   return "";
 }
 

package/lib/self-update-standalone-verifier.js

@@ -116,6 +116,49 @@ function _detectAlg(pubkeyPem) {
                   "(need ecdsa-p384, ed25519, or ml-dsa-87)");
 }
 
+// _looksLikeDerEcdsa — true iff `sig` is a structurally-well-formed ASN.1
+// DER ECDSA signature: SEQUENCE { INTEGER r, INTEGER s }. We dispatch the
+// dsaEncoding by STRUCTURE, never by length: a P-384 DER signature whose r
+// and s both encode short can total exactly 96 bytes — the same length as a
+// raw IEEE-P1363 P-384 signature (48-byte r || 48-byte s) — so a length-only
+// test mis-decodes the valid DER signature as raw and spuriously rejects an
+// otherwise-valid update. This is a shape check only; cryptographic validity
+// is still decided by the single verifier.verify() call below.
+//
+// DER layout: 0x30 <seqLen> 0x02 <rLen> <r...> 0x02 <sLen> <s...>, where each
+// declared length must exactly frame the bytes that follow (definite-form,
+// short or long encoding) and the SEQUENCE body must consume the whole sig.
+function _readDerLen(buf, off) {
+  if (off >= buf.length) return null;
+  var first = buf[off];
+  if (first < 0x80) return { len: first, next: off + 1 };   // short form
+  var numBytes = first & 0x7f;
+  if (numBytes === 0 || numBytes > 4) return null;           // indefinite / oversized: reject
+  if (off + 1 + numBytes > buf.length) return null;
+  var len = 0;
+  for (var i = 0; i < numBytes; i++) len = (len * 256) + buf[off + 1 + i];
+  return { len: len, next: off + 1 + numBytes };
+}
+function _readDerInteger(buf, off) {
+  if (off >= buf.length || buf[off] !== 0x02) return null;   // INTEGER tag
+  var l = _readDerLen(buf, off + 1);
+  if (l === null || l.len === 0) return null;
+  var end = l.next + l.len;
+  if (end > buf.length) return null;
+  return { next: end };
+}
+function _looksLikeDerEcdsa(sig) {
+  if (sig.length < 8 || sig[0] !== 0x30) return false;       // SEQUENCE tag
+  var seq = _readDerLen(sig, 1);
+  if (seq === null) return false;
+  if (seq.next + seq.len !== sig.length) return false;       // body must frame to end
+  var r = _readDerInteger(sig, seq.next);
+  if (r === null) return false;
+  var s = _readDerInteger(sig, r.next);
+  if (s === null) return false;
+  return s.next === sig.length;                              // exactly two INTEGERs, no trailing bytes
+}
+
 /**
  * @primitive b.selfUpdate.standaloneVerifier.verify
  * @signature b.selfUpdate.standaloneVerifier.verify(assetPath, signaturePath, pubkeyPem)
@@ -285,13 +328,32 @@ function verify(assetPath, signaturePath, pubkeyPem) {
 
   var ok = false;
   if (alg === "ecdsa-p384") {
-    // P-384 IEEE-P1363 sigs are exactly 96 bytes (48-byte r || 48-byte s).
-    // P-384 DER sigs are variable (~100-104 bytes — ASN.1 SEQUENCE
-    // wrapping two INTEGERs). Detect by length so we only call
-    // verifier.verify ONCE — calling it a second time after a failed
-    // verify returns stale state and silently passes tampered assets.
-    // 96 = P-384 IEEE-P1363 signature length; protocol constant, not a byte-size.
-    var dsaEncoding = signature.length === 96 ? "ieee-p1363" : "der";   // IEEE-P1363 P-384 signature length
+    // Pick the ECDSA signature encoding by STRUCTURE, not by length. A P-384
+    // DER signature whose r and s both encode short can total exactly 96
+    // bytes — the same length as a raw IEEE-P1363 P-384 signature (48-byte r
+    // || 48-byte s) — so a length-only test mis-decodes the valid DER
+    // signature as raw and spuriously rejects an otherwise-valid update.
+    //
+    // A well-formed ASN.1 DER ECDSA signature is a SEQUENCE { INTEGER r,
+    // INTEGER s }; raw IEEE-P1363 is exactly 2*coordLen bytes (coordLen =
+    // 48 for the P-384 field). If it parses as DER, treat as DER; else if it
+    // is exactly 2*coordLen, treat as raw; else fail closed. We call
+    // verifier.verify() ONCE — a second call after a failed verify returns
+    // stale state and can silently pass tampered assets.
+    var coordLen = 48;   // P-384 field element width in bytes; protocol constant, not a byte-size cap
+    var dsaEncoding;
+    if (_looksLikeDerEcdsa(signature)) {
+      dsaEncoding = "der";
+    } else if (signature.length === coordLen * 2) {
+      dsaEncoding = "ieee-p1363";
+    } else {
+      // assetFd was already closed by the read loop's `finally`; this is a
+      // pure fail-closed refusal, same as the `if (!ok)` path below.
+      throw new Error("standalone-verifier.verify: ecdsa-p384 signature is neither a " +
+                      "well-formed DER SEQUENCE nor a raw " + (coordLen * 2) +
+                      "-byte IEEE-P1363 pair (length " + signature.length +
+                      ") — refusing to guess the encoding");
+    }
     ok = verifier.verify({ key: key, dsaEncoding: dsaEncoding }, signature);
   } else if (alg === "ed25519") {
     // fullBuf may be shorter than allocated (sparse files / size-races);

package/lib/self-update.js

@@ -297,6 +297,13 @@ function _matchAsset(name, pattern, fallback) {
  * with conservative fallbacks. Throws SelfUpdateError on a non-2xx
  * upstream, malformed JSON, or unexpected shape.
  *
+ * Each matched asset / signature is reported as
+ * `{ name, url, size, digest }`. `digest` carries the release API's
+ * published `assets[].digest` (e.g. `"sha256:<hex>"`) verbatim when the
+ * upstream supplies it, or `null` when absent — a consumer can use it
+ * for a defense-in-depth in-flight integrity check of the downloaded
+ * bytes alongside the detached-signature verify.
+ *
  * @opts
  *   releasesUrl:      string,    // required — feed URL
  *   currentVersion:   string,    // required — e.g. "0.8.43" or "v0.8.43"
@@ -446,11 +453,13 @@ async function poll(opts) {
     var a = assets[i] || {};
     if (typeof a.name !== "string" || typeof a.browser_download_url !== "string") continue;
     if (signatureMatch === null && _matchAsset(a.name, opts.signaturePattern, /\.sig$|\.asc$|\.sig\.bin$/i)) {
-      signatureMatch = { name: a.name, url: a.browser_download_url, size: a.size || null };
+      signatureMatch = { name: a.name, url: a.browser_download_url, size: a.size || null,
+                         digest: typeof a.digest === "string" ? a.digest : null };
       continue;
     }
     if (assetMatch === null && _matchAsset(a.name, opts.assetPattern, /\.(tar\.gz|tgz|zip|node|exe|bin)$/i)) {
-      assetMatch = { name: a.name, url: a.browser_download_url, size: a.size || null };
+      assetMatch = { name: a.name, url: a.browser_download_url, size: a.size || null,
+                     digest: typeof a.digest === "string" ? a.digest : null };
     }
   }