@blamejs/core 0.15.67 → 0.16.0

package/lib/network-dns-resolver.js

@@ -232,6 +232,7 @@ function create(opts) {
   }
 
   var cache = new Map();                  // key → { response, parsed, ttl, expiresAt, staleUntil }
+  var inflight = new Map();               // key → Promise (single-flight: coalesce concurrent misses)
 
   // CWE-400/770. LRU eviction on insert when the cache is at
   // capacity. v8 Map preserves insertion order; oldest key is the
@@ -291,11 +292,53 @@ function create(opts) {
       return _result(hit.parsed, hit.ttl, true, false, hit.validated);
     }
 
-    // Cache miss / expired — fetch from upstream, bounded by the
-    // per-query wall-clock deadline. withTimeout rejects the await so a
-    // non-responsive / stalling endpoint can't hold the request pending
-    // forever; the default _wireLookup also tears the socket down on its
-    // own req.setTimeout so the underlying fd is released.
+    // Cache miss / expired. Single-flight: coalesce concurrent misses for the
+    // same key so N simultaneous callers trigger ONE upstream lookup instead
+    // of a thundering herd (cache stampede). The winner fills the cache; the
+    // others await it and re-derive their own verdict from the shared entry
+    // (applying their own validate gate — a non-validating fill mustn't hand a
+    // validating caller an AD=0 pass).
+    if (inflight.has(key)) {
+      try { await inflight.get(key).promise; } catch (_e) { /* winner failed — re-check cache, else fetch ourselves below */ }
+      var shared = cache.get(key);
+      if (shared && shared.expiresAt > Date.now()) {
+        if (validate && !shared.validated) {
+          throw new ResolverError("resolver/validate-failed",
+            "query: validate: true but cached response was AD=0 for " + name + "/" + qtype);
+        }
+        _touch(key, shared);
+        return _result(shared.parsed, shared.ttl, true, false, shared.validated);
+      }
+      // No fresh shared entry (winner errored / served stale) — fetch ourselves.
+    }
+
+    // Wrap the fill promise in a plain entry object so the finally-guard below
+    // compares object identity, not promise identity: if this fill errors and a
+    // follower re-registers its own fresh entry for the same key before this
+    // finally runs, the winner deletes only its OWN slot, never the follower's.
+    var entry = { promise: _fetchFill(name, qtype, key, hit, now) };
+    inflight.set(key, entry);
+    var filled;
+    try { filled = await entry.promise; }
+    finally { if (inflight.get(key) === entry) inflight.delete(key); }
+    if (filled.stale) return filled.result;
+    if (validate && !filled.validated) {
+      throw new ResolverError("resolver/validate-failed",
+        "query: validate: true but upstream returned AD=0 for " + name + "/" + qtype);
+    }
+    return _result(filled.parsed, filled.ttl, false, false, filled.validated);
+  }
+
+  // The single upstream fetch + parse + cache fill, shared by all coalesced
+  // callers. Returns { stale:false, parsed, ttl, validated } on a fresh fill,
+  // { stale:true, result } when serving stale on an upstream/parse failure, or
+  // throws on an unrecoverable error. Does NOT apply the per-caller validate
+  // gate — that stays with the caller so callers with different validate flags
+  // share one lookup.
+  async function _fetchFill(name, qtype, key, hit, now) {
+    // withTimeout rejects the await so a non-responsive / stalling endpoint
+    // can't hold the request pending forever; the default _wireLookup also
+    // tears the socket down on its own req.setTimeout so the fd is released.
     var wireResponse;
     try {
       wireResponse = await safeAsync.withTimeout(
@@ -307,7 +350,7 @@ function create(opts) {
       // Upstream failure — serve stale if we have it within window.
       if (hit && serveStale > 0 && hit.staleUntil > now) {
         _safeEmit("served_stale", { name: name, qtype: qtype, reason: "upstream-failure" });
-        return _result(hit.parsed, hit.ttl, true, true, hit.validated);
+        return { stale: true, result: _result(hit.parsed, hit.ttl, true, true, hit.validated) };
       }
       throw new ResolverError("resolver/upstream-failed",
         "query: upstream lookup failed for " + name + "/" + qtype + ": " + (e && e.message || String(e)));
@@ -320,7 +363,7 @@ function create(opts) {
       // Malformed upstream response — serve stale if within window.
       if (hit && serveStale > 0 && hit.staleUntil > now) {
         _safeEmit("served_stale", { name: name, qtype: qtype, reason: "parse-failed" });
-        return _result(hit.parsed, hit.ttl, true, true, hit.validated);
+        return { stale: true, result: _result(hit.parsed, hit.ttl, true, true, hit.validated) };
       }
       throw e;
     }
@@ -332,18 +375,10 @@ function create(opts) {
     }
 
     // AD bit (RFC 4035 §3.2.3) — set by upstream after chain validation.
-    // Bit 5 of byte 3 of header; parsed.flags is the full 16-bit flags
-    // field at offset 2..3. AD is bit 5 within byte 3 = bit 5 of the
-    // low byte of the 16-bit flags value.
     var ad = (parsed.flags & 0x0020) !== 0;                                                              // RFC 4035 §3.2.3 AD-bit mask within DNS header flags
-    if (validate && !ad) {
-      throw new ResolverError("resolver/validate-failed",
-        "query: validate: true but upstream returned AD=0 for " + name + "/" + qtype);
-    }
 
-    // Compute effective TTL — min across answer RRs (RFC 2181 §5.2:
-    // RRset TTL is the minimum of the included RR TTLs), then clamped
-    // to [minTtlMs, maxTtlMs] to bound any single RR's TTL from
+    // Compute effective TTL — min across answer RRs (RFC 2181 §5.2), then
+    // clamped to [minTtlMs, maxTtlMs] to bound any single RR's TTL from
     // pinning a poisoned entry past operator policy.
     var rrTtl = _minTtl(parsed.answer);
     var ttlMs = Math.max(minTtlMs, Math.min(maxTtlMs, rrTtl * C.TIME.seconds(1)));
@@ -358,7 +393,7 @@ function create(opts) {
       validated:  ad,
     });
     _safeEmit("cached", { name: name, qtype: qtype, ttlMs: ttlMs, adBit: ad });
-    return _result(parsed, ttlMs, false, false, ad);
+    return { stale: false, parsed: parsed, ttl: ttlMs, validated: ad };
   }
 
   function _result(parsed, ttlMs, fromCache, stale, validated) {

package/lib/observability-otlp-exporter.js

@@ -161,7 +161,7 @@ function _spanToOtlp(span) {
     droppedAttributesCount: span.droppedAttributesCount || 0,
     events: (span.events || []).map(function (e) {
       return {
-        name:         e.name,
+        name:         _redactWireString("otel.event.name", e.name),
         timeUnixNano: e.timeUnixNano,
         attributes:   _attrToOtlp(e.attributes),
         droppedAttributesCount: 0,
@@ -357,7 +357,7 @@ function _spanToProto(span) {
   var eventsRepeated = pb.repeatedMessage(11, span.events || [], function (e) {
     return Buffer.concat([
       pb.fixed64(1, e.timeUnixNano || 0),
-      pb.string(2, e.name || ""),
+      pb.string(2, _redactWireString("otel.event.name", e.name || "")),
       pb.repeatedMessage(3, _attrsToProto(e.attributes), _keyValueToProto),
       pb.uint32(4, 0),
     ]);

package/lib/safe-buffer.js

@@ -798,6 +798,68 @@ function stripCrlf(s, replacement) {
   return s.replace(CRLF_RE_GLOBAL, replacement === undefined ? "" : replacement);
 }
 
+/**
+ * @primitive b.safeBuffer.foldHeaderText
+ * @signature b.safeBuffer.foldHeaderText(value, replacement?)
+ * @since     0.15.68
+ * @status    stable
+ * @related   b.safeBuffer.assertHeaderSafe, b.safeBuffer.stripCrlf
+ *
+ * Neutralize free-text bound for a CRLF-delimited protocol line: replace
+ * every CR and LF with <code>replacement</code> (default a single space) so
+ * the text folds onto one line, AND remove every NUL byte. Use this for a
+ * value that may LEGITIMATELY wrap — a multi-line SMTP 5xx reply folded into
+ * one diagnostic line — where <code>assertHeaderSafe</code> (reject) would
+ * be too strict. Unlike bare <code>stripCrlf</code>, this also strips NUL,
+ * which is never valid in an RFC 5322 header value and which downstream
+ * SMTP / mail parsers treat specially. Non-string input passes through
+ * unchanged.
+ *
+ * @example
+ *   b.safeBuffer.foldHeaderText("550 mailbox full\r\nX-Injected: evil");
+ *   // → "550 mailbox full X-Injected: evil"
+ */
+function foldHeaderText(value, replacement) {
+  if (typeof value !== "string") return value;
+  var rep = replacement === undefined ? " " : replacement;
+  return value.replace(CRLF_RE_GLOBAL, rep).split("\u0000").join("");
+}
+
+/**
+ * @primitive b.safeBuffer.assertHeaderSafe
+ * @signature b.safeBuffer.assertHeaderSafe(value, label, ErrorClass, code)
+ * @since     0.15.68
+ * @status    stable
+ * @related   b.safeBuffer.hasCrlf, b.safeBuffer.stripCrlf
+ *
+ * Throw when a string bound for a CRLF-delimited protocol line — an SMTP /
+ * RFC 5322 header value, an HTTP header — contains CR, LF, or a NUL byte,
+ * the canonical header-injection / smuggling vector. Route every
+ * <code>Name: value\r\n</code> builder's STRUCTURED fields (addresses,
+ * domains, identifiers, MTA names) through this; they can never
+ * legitimately carry those bytes. For free-text that may legitimately wrap
+ * (a multi-line SMTP reply folded into one diagnostic line), fold it with
+ * <code>stripCrlf</code> instead of rejecting. Throws
+ * <code>new ErrorClass(code, ...)</code> so each caller reports in its own
+ * error domain (the <code>validateOpts</code> convention). A non-string
+ * value passes through untouched — callers type-check separately.
+ *
+ * @example
+ *   b.safeBuffer.assertHeaderSafe("rcpt@example.com", "to", MailError, "mail/bad-header");
+ *   // → "rcpt@example.com"
+ *
+ *   b.safeBuffer.assertHeaderSafe("rcpt\r\nBcc: evil@x", "to", MailError, "mail/bad-header");
+ *   // → throws MailError("mail/bad-header")
+ */
+function assertHeaderSafe(value, label, ErrorClass, code) {
+  if (typeof value === "string" &&
+      (CRLF_RE.test(value) || value.indexOf("\u0000") !== -1)) {
+    throw new ErrorClass(code,
+      label + ": must not contain CR, LF, or NUL (header injection)");
+  }
+  return value;
+}
+
 module.exports = {
   normalizeText:         normalizeText,
   toBuffer:              toBuffer,
@@ -809,6 +871,8 @@ module.exports = {
   isHex:                 isHex,
   hasCrlf:               hasCrlf,
   stripCrlf:             stripCrlf,
+  foldHeaderText:        foldHeaderText,
+  assertHeaderSafe:      assertHeaderSafe,
   stripTrailingHspace:   stripTrailingHspace,
   indexAfterOpenTag:     indexAfterOpenTag,
   HEX_RE:                HEX_RE,

package/lib/safe-icap.js

@@ -77,6 +77,7 @@
 
 var C                  = require("./constants");
 var { defineClass }    = require("./framework-error");
+var pick               = require("./pick");
 var gateContract       = require("./gate-contract");
 
 var SafeIcapError = defineClass("SafeIcapError", { alwaysPermanent: true });
@@ -395,6 +396,10 @@ function _parseHeaderLine(line, maxValueBytes) {
 }
 
 function _addHeader(headers, name, value) {
+  // A header named __proto__ / constructor / prototype would pollute or
+  // shadow the plain-object header map; drop it (ICAP headers are echoed
+  // from an untrusted upstream response).
+  if (pick.isPoisonedKey(name)) return;
   if (headers[name] === undefined) {
     headers[name] = value;
   } else if (Array.isArray(headers[name])) {

package/lib/session.js

@@ -510,6 +510,30 @@ async function create(opts) {
  *   var roles  = (info.data && info.data.roles) || [];
  *   // → { userId: "user-42", data: { roles: ["admin"] }, createdAt: ..., expiresAt: ..., lastActivity: ..., fingerprintDrift: false, fingerprintAnomalyScore: null }
  */
+// Evaluate the idle + absolute timeout floors against a session row.
+// Returns { action, metadata } describing the breach, or null if the session
+// is within both floors. Centralized so EVERY session-read path (verify,
+// touch, ...) enforces the floors identically — a refresh must never
+// resurrect a session that verify() would expire.
+function _timeoutFloorBreach(row, nowMs, opts) {
+  opts = opts || {};
+  var idleMs = opts.idleTimeoutMs !== undefined ? opts.idleTimeoutMs : DEFAULT_IDLE_TIMEOUT_MS;
+  var absMs = opts.absoluteTimeoutMs !== undefined ? opts.absoluteTimeoutMs : DEFAULT_ABSOLUTE_TIMEOUT_MS;
+  if (idleMs > 0) {
+    var lastActivity = Number(row.lastActivity);
+    if ((nowMs - lastActivity) > idleMs) {
+      return { action: "auth.session.expired_idle", metadata: { idleMs: nowMs - lastActivity, threshold: idleMs } };
+    }
+  }
+  if (absMs > 0) {
+    var createdAt = Number(row.createdAt);
+    if ((nowMs - createdAt) > absMs) {
+      return { action: "auth.session.expired_absolute", metadata: { ageMs: nowMs - createdAt, threshold: absMs } };
+    }
+  }
+  return null;
+}
+
 async function verify(token, verifyOpts) {
   if (typeof token !== "string" || token.length === 0) return null;
   verifyOpts = verifyOpts || {};
@@ -541,39 +565,15 @@ async function verify(token, verifyOpts) {
   // SP 800-63B-4). These shorten the effective lifetime even when the
   // operator picked a long ttlMs. Defaults: idle 30m, absolute 12h.
   // Operator opt-out by passing 0 (disables that timeout).
-  var idleMs = verifyOpts.idleTimeoutMs !== undefined
-    ? verifyOpts.idleTimeoutMs : DEFAULT_IDLE_TIMEOUT_MS;
-  var absMs = verifyOpts.absoluteTimeoutMs !== undefined
-    ? verifyOpts.absoluteTimeoutMs : DEFAULT_ABSOLUTE_TIMEOUT_MS;
-  if (idleMs > 0) {
-    var lastActivity = Number(row.lastActivity);
-    if ((nowMs - lastActivity) > idleMs) {
-      try {
-        audit.safeEmit({
-          action: "auth.session.expired_idle", outcome: "success",
-          metadata: { idleMs: nowMs - lastActivity, threshold: idleMs },
-        });
-      } catch (_ignored) { /* audit best-effort */ }
-      if (cluster.isLeader()) {
-        try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
-      }
-      return null;
-    }
-  }
-  if (absMs > 0) {
-    var createdAt = Number(row.createdAt);
-    if ((nowMs - createdAt) > absMs) {
-      try {
-        audit.safeEmit({
-          action: "auth.session.expired_absolute", outcome: "success",
-          metadata: { ageMs: nowMs - createdAt, threshold: absMs },
-        });
-      } catch (_ignored) { /* audit best-effort */ }
-      if (cluster.isLeader()) {
-        try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
-      }
-      return null;
+  var floorBreach = _timeoutFloorBreach(row, nowMs, verifyOpts);
+  if (floorBreach) {
+    try {
+      audit.safeEmit({ action: floorBreach.action, outcome: "success", metadata: floorBreach.metadata });
+    } catch (_ignored) { /* audit best-effort */ }
+    if (cluster.isLeader()) {
+      try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
     }
+    return null;
   }
   // Unseal sealed columns (userId, data) using the cryptoField pipeline
   // so we return cleartext to the caller — same shape as the previous
@@ -909,6 +909,21 @@ async function touch(token, opts) {
   if (sid === null) return false;
   var sidHash = _hashSid(sid);
   var nowMs = Date.now();
+  // A session past its idle / absolute timeout floor must not be resurrected
+  // by a refresh — enforce the floors (as verify does) before extending.
+  // Without this, touch() would reset lastActivity on a session verify()
+  // would have expired, defeating the floor.
+  var floorSel = sql.select(_sessionSqlTable(), _sessionSqlOpts())
+    .columns(["createdAt", "lastActivity"])
+    .where("sidHash", sidHash)
+    .where("expiresAt", ">=", nowMs)
+    .toSql();
+  var floorRow = await _currentStore().executeOne(floorSel.sql, floorSel.params);
+  if (!floorRow) return false;
+  if (_timeoutFloorBreach(floorRow, nowMs, opts)) {
+    try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
+    return false;
+  }
   // Two SQL paths so the SET list stays static (no dynamic column
   // assembly) and matches the call shape clusterStorage expects.
   // extendBy resets expiresAt relative to NOW, not relative to the

package/lib/vc.js

@@ -69,6 +69,32 @@ var JOSE_ALGS = {
   "EdDSA": { nodeHash: null },
 };
 
+// RFC 7518 §3.4 binds each ECDSA alg to a specific curve. The verifier must
+// reject a signature whose header alg does not match the resolved key's type
+// / curve — otherwise the attacker picks the alg (hash + encoding) from the
+// header independent of the key an ECDSA curve/type confusion (CWE-347).
+var _ES_ALG_CURVE = { "ES256": "prime256v1", "ES384": "secp384r1", "ES512": "secp521r1" };
+
+function _assertJoseAlgKey(algName, key) {
+  var kt = key && key.asymmetricKeyType;
+  if (algName === "EdDSA") {
+    if (kt !== "ed25519" && kt !== "ed448") {
+      throw new VcError("vc/alg-key-mismatch",
+        "vc.verify: alg EdDSA requires an Ed25519/Ed448 key, got " + (kt || "?"));
+    }
+    return;
+  }
+  var wantCurve = _ES_ALG_CURVE[algName];
+  if (wantCurve) {
+    var gotCurve = key && key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve;
+    if (kt !== "ec" || gotCurve !== wantCurve) {
+      throw new VcError("vc/alg-key-mismatch",
+        "vc.verify: alg " + algName + " requires an EC " + wantCurve + " key, got " +
+        (kt || "?") + "/" + (gotCurve || "?"));
+    }
+  }
+}
+
 function _b64urlJson(obj) {
   return Buffer.from(JSON.stringify(obj), "utf8").toString("base64url");
 }
@@ -234,6 +260,9 @@ function _verifyJose(token, opts, expectedTyp) {
   }
   var params = JOSE_ALGS[header.alg];
   var pub = opts.publicKey ? _toKey(opts.publicKey, "public") : _toKey(opts.keyResolver(header), "public");
+  // Bind the header-declared alg to the resolved key's type/curve before
+  // verifying — reject an alg the attacker chose that doesn't match the key.
+  _assertJoseAlgKey(header.alg, pub);
   var signingInput = parts[0] + "." + parts[1];
   var sig = Buffer.from(parts[2], "base64url");
   var ok = params.nodeHash === null

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:5d539dfc9ef47121d4c09bd7256d76448a1f5ac47ee09ac44c78ff6a062af9ab"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:ebf254d5eb56aef8705a1c4af9603f47987b4870a9bb5e657e06907b701e2731"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9190309daadca4c2e2cc2b76beaa6b96e463429cc3c390bd9f0ceaf7b588c68"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:49411d893f5e9b0e2fcaa564b4ec7921f73a9a06229b5e53d49c1453ea1a365c"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -154,12 +154,12 @@
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
       "bundledAt": "2026-06-24T00:00:00Z",
       "hashes": {
-        "server": "sha256:42c4f3544726fa2feb4f304c889c5e391feb5d28080c9b6356ff82e267a93706",
-        "data_js": "sha256:c840d9ae5c6bf4a07967340a5c649df2c6a66a287db41e408461c46cc32348e6"
+        "server": "sha256:5afbeea28737514a69a0bdca7cd3818979e67c443444de4d19f2f8713cf5372e",
+        "data_js": "sha256:6ed61937db12f148494db7c336498740bf4458cd9f49ec73d887eda83529f207"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -190,7 +190,7 @@
       "hashes": {
         "server": "sha256:9bbc191afaaa2b1e5757f00480457c08134cdc2c55d541df18d9155bba9cbf77"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     }
   }
 }

package/lib/vendor/public-suffix-list.dat

@@ -5,8 +5,8 @@
 // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
 // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
 
-// VERSION: 2026-06-24_06-18-09_UTC
-// COMMIT: 18ecca5d54471f21918798da451dd8d03a18f3c7
+// VERSION: 2026-07-02_09-58-14_UTC
+// COMMIT: d67b6cb8e70e9c76b0803809b66e7ffdd09484bd
 
 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
 
@@ -14614,7 +14614,6 @@ polyspace.com
 // May First - People Link : https://mayfirst.org/
 // Submitted by Jamie McClelland <info@mayfirst.org>
 mayfirst.info
-mayfirst.org
 
 // McHost : https://mchost.ru
 // Submitted by Evgeniy Subbotin <e.subbotin@mchost.ru>
@@ -16411,7 +16410,6 @@ zabc.net
 
 // ===END PRIVATE DOMAINS===
 
-
 // ===BEGIN blamejs canary===
 // Honeytoken — vendor-data integrity defense (lib/vendor-data.js).
 _blamejs_canary_v0_9_8_.local