@blamejs/core 0.15.15 → 0.15.17

package/lib/session-device-binding.js

@@ -52,6 +52,14 @@
  * primitive falls back to b.session.touch metadata when the operator
  * passes session=b.session AND opts in via storeInSession=true.
  *
+ * No store at all: create() with neither bindingStore nor storeInSession
+ * still returns an instance — its stateless fingerprint(req) works (it
+ * touches no store), while bind/verify/unbind throw a clear "no store
+ * configured" error. Operators who only need the soft, store-free digest
+ * (sealed inside a self-validating cookie / JWT that compares it itself)
+ * can also skip create() entirely and call the static
+ * b.sessionDeviceBinding.fingerprint(req, opts).
+ *
  * Audit emissions:
  *
  *   session.device.bound      every successful bind()
@@ -61,7 +69,9 @@
  *
  * Validation policy:
  *   - create() opts → throw at config time
- *   - bind / verify  → throw on bad token / req shape (operator typo)
+ *   - bind / verify / unbind → throw on bad token / req shape (operator
+ *                      typo), and throw "no store configured" when called
+ *                      on a store-free instance
  *   - storage errors  → fail-CLOSED on verify (drift indistinguishable
  *                       from a wiped store, refuse rather than allow)
  *                       fail-OPEN on bind (don't lose a fresh session
@@ -135,28 +145,22 @@ function _normalizeAcceptEncoding(value) {
     .join(",");
 }
 
+// Mask the client IP to its fingerprint bucket. Routes through the shared
+// canonical masker (requestHelpers.ipPrefix) so a `::`-shorthand address and
+// its fully-expanded equivalent (2001:db8::1 vs 2001:db8:0:0:0:0:0:1), or a
+// leading-zero-folded group, collapse to ONE bucket — the hand-rolled textual
+// ':'-group slice this replaced hashed them differently and logged a roaming
+// user out on a false drift. `bits === 0` is the documented "skip the IP check
+// entirely" escape hatch (mobile clients that switch networks), so it returns
+// "" before any masking. `bits` is the family-resolved configured width (cfg
+// .v4Bits for a v4 client, cfg.v6Bits for v6 — default /24 + /48); pass it as
+// BOTH v4Bits and v6Bits so the canonical masker applies the configured width
+// to whichever family it detects, instead of ipPrefix's bare /24 + /64 default
+// (which would drop the configured width AND silently tighten v6 from /48 to /64).
 function _ipPrefix(ip, bits) {
   if (typeof ip !== "string" || ip.length === 0) return "";
   if (bits === 0) return "";
-  // IPv6
-  if (ip.indexOf(":") !== -1) {
-    var v6Bits = bits;
-    var groups = ip.split(":");
-    // Naive expansion — keep the first ceil(v6Bits/16) groups intact
-    // and zero the rest. Sufficient for fingerprint stability; not a
-    // canonical IPv6 representation.
-    var keepGroups = Math.ceil(v6Bits / 16); // IPv6 group width in bits
-    var kept = groups.slice(0, keepGroups).join(":");
-    return "v6:" + kept + "/" + v6Bits;
-  }
-  // IPv4
-  var parts = ip.split(".");
-  if (parts.length !== 4) return "v4:" + ip + "/" + bits;
-  var v4Bits = bits;
-  var keepOctets = Math.floor(v4Bits / 8); // IPv4 octet width in bits
-  var maskedOctets = parts.slice(0, keepOctets);
-  while (maskedOctets.length < 4) maskedOctets.push("0");
-  return "v4:" + maskedOctets.join(".") + "/" + v4Bits;
+  return requestHelpers.ipPrefix(ip, { v4Bits: bits, v6Bits: bits });
 }
 
 // Resolve operator-supplied fingerprintExtras(req) to a stable string. A
@@ -195,6 +199,7 @@ function _computeDeviceFingerprint(req, cfg) {
   var ae = _normalizeAcceptEncoding(headers["accept-encoding"]);
   var ip = "";
   try { ip = requestHelpers.clientIp(req); } catch (_e) { ip = ""; }
+  if (typeof ip !== "string") ip = "";
   var family = ip.indexOf(":") !== -1 ? "v6" : "v4";
   var ipPart = _ipPrefix(ip, family === "v6" ? cfg.v6Bits : cfg.v4Bits);
   var keyPart = "";
@@ -291,10 +296,15 @@ function create(opts) {
   }
 
   var storeInSession = !!opts.storeInSession;
-  if (!storeInSession && !opts.bindingStore) {
-    throw new SessionDeviceBindingError("session-device-binding/bad-opt",
-      "either bindingStore (b.cache-shaped) or storeInSession=true must be set");
-  }
+  // A no-store instance is still useful: the stateless fingerprint() reads no
+  // store and is the soft device-binding building block for self-validating
+  // tokens (a sealed cookie / JWT carrying the fingerprint inside). Rather than
+  // refuse to construct (issue #330 — fingerprint() unreachable without a
+  // store), build the instance and let the persisted bind()/verify() lifecycle
+  // throw a clear "no store configured" when actually called. Operators wanting
+  // ONLY the stateless digest can also use the static
+  // b.sessionDeviceBinding.fingerprint(req, opts) with no create() at all.
+  var hasStore = !!(storeInSession || opts.bindingStore);
   if (opts.bindingStore) _requireBindingStore(opts.bindingStore);
   if (storeInSession && (!opts.session || typeof opts.session.touch !== "function")) {
     throw new SessionDeviceBindingError("session-device-binding/bad-opt",
@@ -351,8 +361,18 @@ function create(opts) {
     return { ok: true, fingerprint: r.fingerprint, components: r.components };
   }
 
+  function _requireStore(stage) {
+    if (!hasStore) {
+      throw new SessionDeviceBindingError("session-device-binding/no-store",
+        stage + ": no store configured — pass bindingStore (b.cache-shaped) or "
+        + "storeInSession=true to create(), or use the stateless "
+        + "b.sessionDeviceBinding.fingerprint(req, opts) for soft binding");
+    }
+  }
+
   async function bind(token, req) {
     _requireToken(token);
+    _requireStore("bind");
     var fp = _computeFingerprint(req);
     if (!fp.ok) {
       _emitObs("session.device.refused", { reason: fp.reason });
@@ -408,6 +428,7 @@ function create(opts) {
 
   async function verify(token, req) {
     _requireToken(token);
+    _requireStore("verify");
     var fpResult = _computeFingerprint(req);
     if (!fpResult.ok) {
       _emitObs("session.device.refused", { reason: fpResult.reason });
@@ -444,6 +465,7 @@ function create(opts) {
 
   async function unbind(token) {
     _requireToken(token);
+    _requireStore("unbind");
     if (bindingStore) {
       try { await bindingStore.del(token); } catch (_e) { /* drop-silent */ }
     }

package/lib/session.js

@@ -182,6 +182,49 @@ function _validFromConflictRefs(dialect, table) {
   };
 }
 
+// CREATE TABLE IF NOT EXISTS for the valid-from boundary, matching the
+// framework schema in db.js (single-node) / framework-schema.js (cluster mode):
+// subjectHash PRIMARY KEY, validFromEpoch + updatedAt NOT NULL. The pluggable
+// store is always a dedicated node:sqlite file (b.session.stores.localDbThin —
+// see session-stores.js), so the dialect is the literal "sqlite". Used to
+// provision the table on demand in a store-backed-only deployment (a
+// b.session.useStore consumer that never ran b.db.init(), so the framework db
+// — the default home of this table — is not initialized).
+function _validFromSchemaSql() {
+  return sql.createTable(_validFromSqlTable(), [
+    { name: "subjectHash",    type: "text", primaryKey: true },
+    { name: "validFromEpoch", type: "int",  notNull: true },
+    { name: "updatedAt",      type: "int",  notNull: true },
+  ], { dialect: "sqlite" }).sql;
+}
+
+// Run a valid-from boundary operation (bump write / validFrom read / check
+// read) against the correct backend. The boundary lives in the FRAMEWORK db
+// (clusterStorage) — it is a stateless-token revocation primitive shared across
+// every issuer, not per-session data — so that is always the first choice and a
+// present db is never silently bypassed. ONLY when the framework db is not
+// initialized (single-node, b.db.init() never awaited) AND an operator store is
+// configured (b.session.useStore) does the boundary fall back to that store, so
+// a store-backed-only deployment's logout-everywhere still raises (and honors)
+// the stateless boundary instead of 500ing on db/not-initialized (#340). With
+// neither a framework db nor a store, db/not-initialized is a real
+// misconfiguration and propagates unchanged (fail closed — the boundary is
+// never silently dropped). The store provisions the table on demand because a
+// session-data store (localDbThin) does not ship the valid-from DDL.
+async function _runValidFrom(runner) {
+  try {
+    return await runner(clusterStorage);
+  } catch (e) {
+    if (e && e.code === "db/not-initialized" && _store) {
+      // Framework db absent, operator store present: route through the store,
+      // provisioning the boundary table first (idempotent CREATE IF NOT EXISTS).
+      await _store.execute(_validFromSchemaSql(), []);
+      return await runner(_store);
+    }
+    throw e;
+  }
+}
+
 // Column order used for INSERT — kept as a constant so the placeholders
 // list and the values list stay in sync. Must match the session table's
 // schema in db.js (single-node) and framework-schema.js (cluster mode).
@@ -786,21 +829,23 @@ async function destroyAllForUser(userId) {
   var result = await _currentStore().execute(built.sql, built.params);
   // Also raise the stateless valid-from boundary so a "logout everywhere"
   // revokes the operator's stateless tokens (sealed cookies / JWTs checked via
-  // b.session.check) too, not only the store-backed rows just deleted. This
-  // bump writes to the FRAMEWORK db (clusterStorage); a pluggable-store consumer
-  // (b.session.useStore) who never ran b.db.init() would otherwise surface the
-  // opaque "db/not-initialized" here, after the store delete already succeeded.
-  // Rethrow it as a session-specific, actionable error.
+  // b.session.check) too, not only the store-backed rows just deleted. bump()
+  // writes to the framework db when one is initialized, otherwise to the
+  // configured store (b.session.useStore) — so a store-backed-only consumer who
+  // never ran b.db.init() still raises the boundary here instead of 500ing on
+  // db/not-initialized (#340). The only state in which bump still surfaces
+  // db/not-initialized is the default store (no useStore) with an uninitialized
+  // framework db — but the store DELETE above (also via clusterStorage) would
+  // have already thrown, so this rewrap is defensive belt-and-suspenders.
   try {
     await bump(userId);
   } catch (e) {
     if (e && e.code === "db/not-initialized") {
       throw _err("MISCONFIGURED",
         "session.destroyAllForUser raises the stateless valid-from boundary (so a " +
-        "logout-everywhere also revokes sealed-cookie / JWT sessions), which requires " +
-        "b.db.init() — call it at boot even when session data lives in a pluggable " +
-        "store (b.session.useStore). The store-backed rows were already deleted; rerun " +
-        "after b.db.init() to also raise the stateless boundary.", true);
+        "logout-everywhere also revokes sealed-cookie / JWT sessions). No storage is " +
+        "available: call b.db.init() at boot, OR configure a session store via " +
+        "b.session.useStore. The store-backed rows were already deleted.", true);
     }
     throw e;
   }
@@ -1340,21 +1385,27 @@ async function bump(subjectId, opts) {
     .returning(["validFromEpoch"])
     .toSql();
   // The valid-from boundary is a FRAMEWORK table (FRAMEWORK_SCHEMA / cluster
-  // DDL), NOT session data — it must execute against clusterStorage (the
-  // framework db), never _currentStore(): a pluggable session-data store
-  // (b.session.useStore / localDbThin) does not provision this table, so
-  // routing the bump through it throws "no such table".
-  var row;
-  if (built.readbackSql) {
-    // MySQL: ON DUPLICATE KEY UPDATE has no RETURNING — run the upsert, then
-    // the readback SELECT b.sql emits (keyed on subjectHash).
-    await clusterStorage.execute(built.sql, built.params);
-    var readback = await clusterStorage.execute(built.readbackSql.sql, built.readbackSql.params);
-    row = readback.rows && readback.rows[0];
-  } else {
-    var result = await clusterStorage.execute(built.sql, built.params);
-    row = result.rows && result.rows[0];
-  }
+  // DDL), NOT session data — it executes against clusterStorage (the framework
+  // db) whenever one is initialized, never _currentStore(). When the framework
+  // db is NOT initialized but an operator store IS configured (a store-backed-
+  // only b.session.useStore deployment that never ran b.db.init()), the boundary
+  // falls back to that store — provisioned on demand — so logout-everywhere
+  // still raises the stateless boundary instead of throwing db/not-initialized
+  // (#340). _runValidFrom resolves the target; never silently drops the boundary
+  // when a db is present, and propagates db/not-initialized when neither exists.
+  var row = await _runValidFrom(async function (target) {
+    if (built.readbackSql) {
+      // MySQL: ON DUPLICATE KEY UPDATE has no RETURNING — run the upsert, then
+      // the readback SELECT b.sql emits (keyed on subjectHash). MySQL only ever
+      // runs against the framework cluster db; the localDbThin fallback store is
+      // sqlite (RETURNING), so this branch never routes through it.
+      await target.execute(built.sql, built.params);
+      var readback = await target.execute(built.readbackSql.sql, built.readbackSql.params);
+      return readback.rows && readback.rows[0];
+    }
+    var result = await target.execute(built.sql, built.params);
+    return result.rows && result.rows[0];
+  });
   var effective = row ? Number(row.validFromEpoch) : epochMs;
 
   // Best-effort audit — matches the file's emit convention (safeEmit is
@@ -1393,10 +1444,16 @@ async function validFrom(subjectId) {
     .columns(["validFromEpoch"])
     .where("subjectHash", _hashSubjectId(subjectId))
     .toSql();
-  // Framework valid-from table — read from clusterStorage (the framework db),
-  // not _currentStore(), so a pluggable session-data store cannot divert it (it
-  // does not provision this table). See bump() for the full rationale.
-  var row = await clusterStorage.executeOne(built.sql, built.params);
+  // Framework valid-from table — read from clusterStorage (the framework db)
+  // when one is initialized, falling back to the configured store only when it
+  // is not (the same store bump() wrote the boundary to in a store-backed-only
+  // deployment). _runValidFrom keeps the read on the SAME backend the write
+  // chose, so a boundary raised via destroyAllForUser/bump is the one read back
+  // here. See bump() for the full rationale (#340).
+  var row = await _runValidFrom(async function (target) {
+    var result = await target.execute(built.sql, built.params);
+    return result.rows && result.rows.length > 0 ? result.rows[0] : null;
+  });
   return row ? Number(row.validFromEpoch) : 0;
 }
 

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:5d539dfc9ef47121d4c09bd7256d76448a1f5ac47ee09ac44c78ff6a062af9ab"
       },
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:ebf254d5eb56aef8705a1c4af9603f47987b4870a9bb5e657e06907b701e2731"
       },
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9190309daadca4c2e2cc2b76beaa6b96e463429cc3c390bd9f0ceaf7b588c68"
       },
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.1",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:f359a782ac57e3ff56ac71083d17f5c082f88ab49d645fc2bede398b47adebdb"
       },
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -152,14 +152,14 @@
         "data_js": "lib/vendor/public-suffix-list.data.js"
       },
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
-      "bundledAt": "2026-05-13T00:00:00Z",
+      "bundledAt": "2026-06-22T00:00:00Z",
       "hashes": {
-        "server": "sha256:927884952ea8857ba3608eefe617f3c8acd63ad94be7b0bfb7586632cfc59560",
-        "data_js": "sha256:c2f67f5e7f7306eb5ec26548ea275673c652cfdd830b909fd63ed2b39e4838f6"
+        "server": "sha256:0adddeb62057d8d40799dffb29fe14f65dd009259afe02eb2f0b4602b791aae6",
+        "data_js": "sha256:82af512cacf0fd2c60925e63f877b69477b1b2f7bb5af698fd862af61369902e"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -190,7 +190,7 @@
       "hashes": {
         "server": "sha256:9bbc191afaaa2b1e5757f00480457c08134cdc2c55d541df18d9155bba9cbf77"
       },
-      "refreshedAt": "2026-06-20T04:17:15.833Z"
+      "refreshedAt": "2026-06-22T16:29:46.590Z"
     }
   }
 }

package/lib/vendor/public-suffix-list.dat

@@ -5,8 +5,8 @@
 // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
 // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
 
-// VERSION: 2026-06-13_21-47-18_UTC
-// COMMIT: 9186eeeda85cef35b1551d00731464939c765cab
+// VERSION: 2026-06-22_11-46-12_UTC
+// COMMIT: 27a7b5d881b91def306422e6cc243f05c49f3a58
 
 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
 
@@ -14721,6 +14721,10 @@ mittwaldserver.info
 typo3server.info
 project.space
 
+// MKM : https://mkm.fan/
+// Submitted by Kashi Ahmer <admin@mkm.fan>
+mkm.fan
+
 // Mocha : https://getmocha.com
 // Submitted by Ben Reinhart <security@getmocha.com>
 mocha.app