@blamejs/core 0.16.1 → 0.16.2

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.2 (2026-07-03) — **Security hardening across the mail, OAuth/SAML, ACME, keychain and router primitives — six fail-open / injection / bypass fixes and seven correctness fixes — alongside a large expansion of the automated test suite.** This patch closes a batch of security and correctness defects surfaced while substantially expanding the test suite across the framework's mail-authentication, federated-identity, ACME, keychain, backup, CLI and router primitives. The security fixes: SPF evaluation no longer throws (and thus can no longer be laundered into a temperror that a permissive inbound policy accepts) on a malformed `ip4:` CIDR mask; the Authentication-Results builder now refuses CR/LF/NUL in the `version` field, closing the last header-injection gap left by the earlier mail-header sweep; `res.redirect` now rejects a horizontal TAB (which user agents strip before URL parsing, turning `/\t/evil.example` into a protocol-relative redirect to an attacker origin); the OAuth refresh-token one-time-use replay gate now treats any truthy `seen()` result as seen (a Redis `1` / SQL `COUNT` no longer slips a stolen refresh token past a `=== true` compare) — with the same normalization applied to its sibling replay checks; SAML Single-Logout over HTTP-POST/SOAP now fails closed (throws) when a verification key is supplied without its algorithm, matching the redirect binding instead of silently skipping signature verification; and the OAuth authorization-URL / PAR builders now refuse operator `extraParams` that collide with framework-managed parameters (`redirect_uri`, `state`, `code_challenge`, …). The correctness fixes: concurrent keychain file-store writes are serialized under the existing file lock (no more lost bindings); TLS-RPT submission reads the real `statusCode` (successful reports are no longer misreported as failures); ACME account key-rollover stops double-encoding its inner JWS payload (rollover was always rejected by the CA); the response-schema validator now also validates JSON bodies sent via `res.end`; keychain `remove` validates a relative fallback path like `store`/`retrieve`; `bundleAdapterStorage` honors the ambient compliance posture like `create`; and a refused `dev --ignore` pattern now returns exit code 2 instead of rejecting the CLI promise. **Fixed:** *Concurrent keychain file-store writes no longer drop bindings* — `store` and the file-remove path performed an unlocked read-modify-write of the fallback file, so two concurrent stores could each read the pre-update document and the later write would clobber the earlier binding. Both read-modify-write sequences are now serialized under the file's existing lock. · *TLS-RPT submission reads the response `statusCode`* — `tlsRpt.submit` read `status` from the HTTP client response, but the client resolves `statusCode`, so a successful (2xx) report POST was reported as `{ ok: false, error: 'HTTP undefined' }`. It now reads `statusCode`, so delivered reports are distinguished from rejected ones. · *ACME account key-rollover no longer double-encodes its inner JWS payload* — `accountKeyRollover` passed an already-stringified payload to a signer that stringifies internally, so the inner keyChange JWS payload encoded a JSON string instead of the JSON object and every rollover was rejected by the CA (RFC 8555 §7.3.5). The payload is now passed once. · *Response-schema validator also validates `res.end` JSON bodies* — The response validator wrapped only `res.json`, so a handler shipping an invalid body via `res.end(JSON.stringify(...))` escaped validation despite the documented contract. JSON-shaped `res.end` bodies are now validated on the same path. · *keychain `remove` validates a relative fallback path like `store`/`retrieve`* — `remove` checked file existence before validating the fallback path, so a relative path silently no-op'd instead of throwing the config error that `store`/`retrieve` raise. It now validates first, consistent with the other file-fallback paths. · *`bundleAdapterStorage` honors the ambient compliance posture* — `bundleAdapterStorage` only refused an unencrypted strategy when an explicit posture was passed, unlike `create`, which reads the ambient `b.compliance` posture and refuses `encrypt:false` under HIPAA. `bundleAdapterStorage` now falls back to the ambient posture, closing the asymmetry. · *`dev --ignore` pattern refusal returns exit code 2* — A `dev --ignore` pattern that exceeded the length cap or was refused by the regex guard threw out of the CLI promise instead of writing to stderr and returning exit code 2 like every other CLI validation failure. It now returns the standard non-zero exit. **Security:** *SPF `ip4:` with a malformed CIDR mask fails closed instead of throwing (fail-open)* — `_ipv4InCidr` lacked the finite-mask guard its IPv6 sibling has, so an `ip4:` mechanism with a non-numeric prefix (e.g. `ip4:192.0.2.0/`) reached `BigInt(32 - NaN)` and threw an uncaught `RangeError` out of `b.mail.spf.verify` / `b.mail.inbound.verify`. Upstream mail handling catches that throw as a temperror, and an inbound policy configured to accept on temperror would then admit a sender that should have been evaluated. SPF now returns a `permerror` result for a malformed mask, honoring the primitive's documented never-throw-on-message-content contract. · *Authentication-Results builder refuses CR/LF/NUL in the `version` field (header injection)* — `b.mail.authResults.emit` validated the `authserv-id` against control characters but not the operator-supplied `version`, which is interpolated onto the `Authentication-Results:` header line — the last field left unguarded by the earlier mail-header CRLF sweep. A `version` containing CRLF could smuggle an arbitrary header. It is now refused with a typed error, like every other field on that line. · *`res.redirect` rejects horizontal TAB (open-redirect / same-origin bypass)* — The redirect target's control-character guard rejected CR/LF/NUL but not TAB (0x09). Node permits a TAB in a header value, but the WHATWG URL parser strips ASCII TAB/LF/CR from a URL before resolving it, so a `Location: /\t/evil.example` collapses to the protocol-relative `//evil.example` and navigates to the attacker origin — bypassing the same-origin/allowlist heuristic. TAB is now rejected alongside CR/LF/NUL. · *OAuth refresh-token replay gate treats any truthy `seen()` result as seen (fail-open)* — The legacy `seen(refreshToken)` replay gate compared the callback's return with `=== true`, but the documented contract is that it returns a truthy value when the token was presented before. A store returning a truthy non-`true` value — a Redis `EXISTS`/`SISMEMBER` `1`, a SQL `COUNT` — slipped a replayed (stolen) refresh token past the one-time-use gate. Any truthy result now counts as seen; the same normalization was applied to the sibling replay checks in the module. · *SAML Single-Logout over HTTP-POST/SOAP fails closed on a key without its algorithm* — The POST and SOAP SLO parsers gated signature verification with an OR condition and the verify helper early-returned when the algorithm was absent, so supplying a verification key without `idpVerifyAlg` silently accepted a forged, unsigned LogoutRequest — while the HTTP-Redirect binding failed closed. All four SLO parse paths now route through one config check that throws when a key is supplied without its algorithm. · *OAuth authorization-URL / PAR builders refuse `extraParams` that collide with managed parameters* — `authorizationUrl` and `pushAuthorizationRequest` merged operator `extraParams` with `URLSearchParams.set`, which replaces — so an `extraParams` entry for `redirect_uri`, `state`, or `code_challenge` overwrote the framework-generated value while the call still returned the framework's `state`/PKCE verifier, diverging the returned session seed from the emitted URL. Reserved parameter keys in `extraParams` are now refused with a typed error at both builders.
+
 - v0.16.1 (2026-07-03) — **Every source file now carries an SPDX license + copyright header; the wiki example emits its full HSTS when it runs behind a TLS-terminating reverse proxy; and a good-first-issue on-ramp lands for new contributors.** This patch stamps a per-file `SPDX-License-Identifier: Apache-2.0` and a copyright line onto every first-party source file, so the license of any single file is unambiguous when it is read, audited, or vendored in isolation. The project stays Apache-2.0 — this is a clarity change, not a license change, and vendored third-party files under lib/vendor/ keep their own upstream headers. The wiki example now passes its trusted-proxy CIDRs to the securityHeaders middleware: a deployment behind a TLS-terminating reverse proxy (Caddy or nginx) that forwards `X-Forwarded-Proto: https` now emits the framework's strong HSTS (two-year max-age, includeSubDomains, preload) instead of suppressing it on the plain-HTTP hop from the proxy — the wiki e2e asserts both the proxied-https and the direct-http cases. CONTRIBUTING gains a good-first-issue on-ramp so new contributors have a clear, small first step. **Added:** *Per-file SPDX license and copyright headers* — Every first-party source file now begins with `// SPDX-License-Identifier: Apache-2.0` and a copyright line, so the license and holder of any individual file are explicit when it is read or extracted on its own. No license change — the project remains Apache-2.0. Vendored files under `lib/vendor/` are untouched and retain their upstream license headers. **Changed:** *Good-first-issue on-ramp for new contributors* — CONTRIBUTING now points new contributors at issues labelled `good first issue` — small, self-contained tasks (a doc or wiki-example fix, a test for an uncovered branch) that are the easiest first step into the codebase. **Security:** *Wiki example emits its full HSTS behind a TLS-terminating reverse proxy* — The wiki example app now hands its trusted-proxy CIDRs to `securityHeaders`, so behind Caddy or nginx forwarding `X-Forwarded-Proto: https` it emits `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload` rather than dropping HSTS on the internal HTTP hop from the proxy. Operators modelling their own app on the example inherit the fix by declaring their proxy CIDRs via `WIKI_ADMIN_TRUSTED_PROXIES` (the production compose already defaults to the private ranges). The framework's `securityHeaders` primitive is unchanged; this closes a wiring gap in the example.
 
 - v0.16.0 (2026-07-03) — **Raises the minimum Node.js engine to 24.18.0; the status-list verifier now binds the token type against a typ-confusion replay; and CI supply-chain pinning is consolidated behind committed dev/example lockfiles, `npm ci`, and a single aggregating pin tool that closes the OpenSSF Scorecard pinned-dependency gaps.** This minor raises the supported Node.js floor from 24.16.0 to 24.18.0 — operators must run Node 24.18.0 or newer (24.17.0 was a security release; 24.18.0 bundles SQLite 3.53.1 and a backup-path fix, and guarantees the native OpenSSL 3.5 SLH-DSA surface). b.auth.statusList.fromJwt now enforces RFC 8725 §3.11 by binding the JWS header typ to the "statuslist+jwt" that toJwt stamps, so a token minted for another purpose can't be replayed as a status list. The build's supply-chain pinning is reworked so OpenSSF Scorecard sees pinned installs everywhere it can: the dev-tool, example, and fuzz manifests now ship committed lockfiles and CI installs them with `npm ci` (Scorecard keys pinning on the `ci` verb, not on an `@version` specifier), the vendored fuzz toolchain and the oss-fuzz base image are pinned, and a new scripts/pin-all.js aggregates every pin — regenerating all lockfiles, pinning the GitHub Action SHAs, and syncing the Docker base-image digests in one `--fix`, with a `--check` gate wired into CI and the release flow so no pin can silently drift. The committed lockfiles are dev/example-only and excluded from the published tarball; the zero-npm-RUNTIME-deps rule is unchanged. **Added:** *scripts/pin-all.js — aggregated supply-chain pin tool* — One command re-pins every supply-chain segment: `--fix` regenerates the committed lockfiles (root / examples/wiki / fuzz), pins the GitHub Action SHAs, and syncs the Docker base-image digests; `--check` (wired into CI and the release flow) verifies the lockfile and digest segments — including each lockfile's package version — are in sync and fails closed on drift. Contributor tooling — it does not ship in the tarball. · *Project-governance and assurance documentation; OpenSSF Best Practices silver badge* — Adds a ROADMAP.md (documented direction plus an explicit out-of-scope list), a Developer Certificate of Origin policy in CONTRIBUTING.md (contributions carry a Signed-off-by; releases sign off through the release tooling), and an explicit security assurance case in SECURITY.md (a top security claim decomposed into evidence-backed sub-claims, with a residual-risk statement). The project earned the OpenSSF Best Practices silver badge, linked from the README. **Changed:** *Minimum Node.js engine raised to 24.18.0* — engines.node is now >=24.18.0 (was >=24.16.0). Operators must run Node 24.18.0 or newer. 24.17.0 was a security release and 24.18.0 bundles SQLite 3.53.1 plus a backup-keepalive fix; the floor also guarantees the native OpenSSL 3.5 SLH-DSA sign/verify surface. CI, the release container, and the docs are updated to the new floor. · *Supply-chain pinning consolidated behind committed lockfiles + `npm ci` + one aggregating pin tool* — The root dev-tool (esbuild, postject), examples/wiki, and fuzz (jazzer.js) manifests now ship committed package-lock.json files, and CI installs them with `npm ci` instead of `npm install pkg@version` — OpenSSF Scorecard's Pinned-Dependencies check treats only the `npm ci` verb as pinned, so this is what actually clears those alerts (an exact `@version` specifier does not). The vendored fuzz toolchain is pinned to an exact jazzer version and the oss-fuzz base image is digest-pinned (mirroring the Dependabot-tracked .clusterfuzzlite digest). A new scripts/pin-all.js aggregates every pinning segment — it regenerates all committed lockfiles, pins the GitHub Action SHAs (via check-actions-currency), and syncs the Docker base-image digests in one `--fix`; a `--check` mode runs in CI and scripts/release.js so a stale lockfile or drifted digest fails closed. The committed lockfiles are dev/example-only, excluded from the published tarball's files allowlist; the zero-npm-RUNTIME-deps rule is unchanged. **Security:** *Status-list verification binds the token type (RFC 8725 §3.11 typ-confusion)* — b.auth.statusList.fromJwt now passes expectedTyp "statuslist+jwt" to the JWT verifier, matching the typ that b.auth.statusList.toJwt stamps and every sibling verifier enforces. A token minted for another purpose — even one that happens to carry a status_list.lst claim — is now refused on the type binding before the claim is read, closing the typ-confusion class where such a token could be replayed as a status list.

package/lib/acme.js

@@ -1177,7 +1177,11 @@ function create(opts) {
       url: state.directory.keyChange,
     };
     var innerPayload = { account: state.accountUrl, oldKey: publicJwk };
-    var innerJws = _signJws(newPrivateKey, innerProtected, _stringify(innerPayload));
+    // _signJws base64url-encodes _stringify(payload) itself (like every
+    // other signer, e.g. _signedPost) — pass the raw object, never a
+    // pre-stringified string, or the inner JWS payload double-encodes to
+    // a JSON *string* and every RFC 8555 §7.3.5 server rejects it.
+    var innerJws = _signJws(newPrivateKey, innerProtected, innerPayload);
     var rsp = await _signedPost(state.directory.keyChange, innerJws);
     if (rsp.statusCode !== 200) {
       _emitAudit(audit, "acme.account.key_rotated", "failure",

package/lib/auth/oauth.js

@@ -961,7 +961,11 @@ async function verifyClientAttestation(attestationJwt, popJwt, vopts) {
       throw new OAuthError("auth-oauth/attestation-pop-seen-callback-failed",
         "client-attestation-pop: seenJti() callback threw: " + ((e && e.message) || String(e)));
     }
-    if (unseen === false) {
+    // Fail closed on ANY non-truthy result. The contract is "returns truthy
+    // when UNSEEN"; an operator store fronting Redis EXISTS / SISMEMBER or a
+    // SQL COUNT returns 0 (falsy, not `false`) on a replay, so an
+    // `=== false` comparison would miss it and accept the replayed PoP.
+    if (!unseen) {
       throw new OAuthError("auth-oauth/attestation-pop-replay",
         "client-attestation-pop: jti already seen (replay refused, draft §12.1)");
     }
@@ -982,6 +986,47 @@ function _constantTimeStrEq(a, b) {
   return cryptoTimingSafeEqual(a, b);
 }
 
+// Framework-managed authorization-request parameters. Operator-supplied
+// extraParams may not carry any of these — the builder generates them and
+// RETURNS the security-critical ones (state, PKCE verifier/challenge) to the
+// caller, so an extraParams override would silently diverge the returned
+// values from what the URL/PAR body actually carries (a broken CSRF / PKCE
+// binding). Covers redirect target, client identity, requested response,
+// scope, state, nonce, PKCE challenge, response mode, RAR details, and the
+// JAR request container.
+var RESERVED_AUTHZ_PARAMS = {
+  "response_type":         1,
+  "client_id":             1,
+  "redirect_uri":          1,
+  "scope":                 1,
+  "state":                 1,
+  "nonce":                 1,
+  "code_challenge":        1,
+  "code_challenge_method": 1,
+  "response_mode":         1,
+  "authorization_details": 1,
+  "request":               1,
+  "request_uri":           1,
+};
+
+// Refuse operator-supplied extraParams keys that collide with a framework-
+// managed parameter. extraParams is operator-controlled, so a collision is a
+// config-time bug (a library merge / copy-paste) — refuse it loudly rather
+// than let it shadow a value the framework generated and returned. Fail
+// closed; shared by authorizationUrl, pushAuthorizationRequest, and
+// endSessionUrl so every URL/PAR builder guards the same way.
+function _assertNoReservedExtraParams(extraParams, reserved, errCode, ctx) {
+  if (!extraParams || typeof extraParams !== "object") return;
+  var ek = Object.keys(extraParams);
+  for (var i = 0; i < ek.length; i++) {
+    if (Object.prototype.hasOwnProperty.call(reserved, ek[i])) {
+      throw new OAuthError(errCode,
+        ctx + ": extraParams key '" + ek[i] + "' collides with a " +
+        "framework-managed parameter — pass it through the named option instead");
+    }
+  }
+}
+
 // ---- core ----
 
 function create(opts) {
@@ -1261,7 +1306,14 @@ function create(opts) {
       params.set("authorization_details", JSON.stringify(requestedAuthzDetails));
     }
     // Operator-supplied additional params (audience, resource, etc.).
+    // Refuse keys that collide with a framework-managed parameter so an
+    // operator typo / library-merge can't shadow the redirect_uri / state /
+    // code_challenge the builder generated and returned — which would
+    // silently diverge the returned {state, verifier} from the URL and
+    // break the CSRF / PKCE binding.
     if (uopts.extraParams && typeof uopts.extraParams === "object") {
+      _assertNoReservedExtraParams(uopts.extraParams, RESERVED_AUTHZ_PARAMS,
+        "auth-oauth/reserved-extra-param", "authorizationUrl");
       var ek = Object.keys(uopts.extraParams);
       for (var i = 0; i < ek.length; i++) params.set(ek[i], String(uopts.extraParams[ek[i]]));
     }
@@ -1373,23 +1425,30 @@ function create(opts) {
         throw new OAuthError("auth-oauth/seen-callback-failed",
           "refreshAccessToken: checkAndInsert() callback threw: " + ((e && e.message) || String(e)));
       }
-      // Spec contract: inserted===true → first sighting (OK);
-      // inserted===false → replay. v0.9.3 had this inverted, which
-      // broke every first refresh attempt for operators reusing an
-      // existing b.nonceStore-style backend.
-      alreadySeen = inserted === false;
+      // Spec contract: a TRUTHY result → first sighting (the value was
+      // inserted, OK); a FALSY result → replay. v0.9.3 had this inverted,
+      // which broke every first refresh attempt for operators reusing an
+      // existing b.nonceStore-style backend. Test truthiness, not an
+      // `=== false` literal: a store fronting Redis SETNX / SQL INSERT
+      // returns 0 (falsy, not `false`) when the row already existed, so
+      // an exact-literal compare would miss the replay and fail OPEN.
+      alreadySeen = !inserted;
     } else if (typeof ropts.seen === "function") {
       // Legacy non-atomic path. Documented as a check-then-act race;
       // operators sharing a single-writer store (Redis SETNX, DB
       // INSERT ON CONFLICT) MUST migrate to checkAndInsert. Stays
       // here for backwards-compat with existing operator code.
+      // Legacy contract: truthy → the token was presented before (replay).
+      // The value is used by truthiness at the gate below, so a store
+      // returning 1 from Redis EXISTS / a SQL COUNT is honored as "seen"
+      // instead of being missed by an `=== true` literal compare.
       try { alreadySeen = await ropts.seen(refreshToken); }
       catch (e) {
         throw new OAuthError("auth-oauth/seen-callback-failed",
           "refreshAccessToken: seen() callback threw: " + ((e && e.message) || String(e)));
       }
     }
-    if (alreadySeen === true) {
+    if (alreadySeen) {
       throw new OAuthError("auth-oauth/refresh-token-replay",
         "refreshAccessToken: refresh token has been presented before — refused " +
         "(OAuth 2.1 §6.1 / RFC 9700 §4.13 one-time-use defense). The operator MUST " +
@@ -2012,15 +2071,10 @@ function create(opts) {
         "ui_locales":                 1,
         "client_id":                  1,
       };
+      _assertNoReservedExtraParams(uopts.extraParams, RESERVED_END_SESSION_PARAMS,
+        "auth-oauth/end-session-reserved-extra-param", "endSessionUrl");
       var ek = Object.keys(uopts.extraParams);
-      for (var i = 0; i < ek.length; i++) {
-        if (RESERVED_END_SESSION_PARAMS[ek[i]]) {
-          throw new OAuthError("auth-oauth/end-session-reserved-extra-param",
-            "endSessionUrl: extraParams key '" + ek[i] + "' collides with a first-class " +
-            "RP-Init Logout parameter — pass it through the named field instead");
-        }
-        params.set(ek[i], String(uopts.extraParams[ek[i]]));
-      }
+      for (var i = 0; i < ek.length; i++) params.set(ek[i], String(uopts.extraParams[ek[i]]));
     }
     var qs = params.toString();
     if (qs.length === 0) return endpoint;
@@ -2108,6 +2162,11 @@ function create(opts) {
         : JSON.stringify(requestedAuthzDetails);   // form param — JSON string
     }
     if (uopts.extraParams && typeof uopts.extraParams === "object") {
+      // Same reserved-key guard as authorizationUrl — a PAR request pushes
+      // the identical security-critical parameter set, so extraParams may
+      // not shadow redirect_uri / state / code_challenge here either.
+      _assertNoReservedExtraParams(uopts.extraParams, RESERVED_AUTHZ_PARAMS,
+        "auth-oauth/reserved-extra-param", "pushAuthorizationRequest");
       var ek = Object.keys(uopts.extraParams);
       for (var i = 0; i < ek.length; i++) authzParams[ek[i]] = String(uopts.extraParams[ek[i]]);
     }
@@ -2354,7 +2413,10 @@ function create(opts) {
           "verifyBackchannelLogoutToken: atomicReplayStore.checkAndInsert threw: " +
           ((e && e.message) || String(e)));
       }
-      if (inserted === false) {
+      // Fail closed on ANY non-truthy result. A store fronting SETNX / an
+      // ON-CONFLICT INSERT returns 0 (falsy, not `false`) on a duplicate,
+      // so an `=== false` compare would miss the replay.
+      if (!inserted) {
         throw new OAuthError("auth-oauth/logout-token-replay",
           "verifyBackchannelLogoutToken: jti '" + claims.jti +
           "' already seen — replay refused (atomic)");
@@ -2370,7 +2432,10 @@ function create(opts) {
         throw new OAuthError("auth-oauth/seen-callback-failed",
           "verifyBackchannelLogoutToken: seen() callback threw: " + ((e && e.message) || String(e)));
       }
-      if (first === false) {
+      // Fail closed on ANY non-truthy result — `seen()` returns truthy the
+      // first time it sees the (jti, iss) pair; a store returning 0 for a
+      // duplicate must still refuse, which an `=== false` compare would miss.
+      if (!first) {
         throw new OAuthError("auth-oauth/logout-token-replay",
           "verifyBackchannelLogoutToken: jti already seen — replay refused");
       }

package/lib/auth/saml.js

@@ -1052,7 +1052,7 @@ function create(opts) {
         "parseLogoutRequest: inflate failed: " + ((e && e.message) || String(e)));
     }
     // Verify the redirect-binding signature when an IdP key is supplied.
-    if (vopts.idpVerifyKey) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutRequest")) {
       if (typeof vopts.queryString !== "string") {
         throw new AuthError("auth-saml/no-query-string",
           "parseLogoutRequest: idpVerifyKey requires queryString (raw URL query)");
@@ -1240,7 +1240,7 @@ function create(opts) {
       throw new AuthError("auth-saml/bad-saml-response",
         "parseLogoutResponse: inflate failed: " + ((e && e.message) || String(e)));
     }
-    if (vopts.idpVerifyKey) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutResponse")) {
       if (typeof vopts.queryString !== "string") {
         throw new AuthError("auth-saml/no-query-string",
           "parseLogoutResponse: idpVerifyKey requires queryString");
@@ -1412,7 +1412,7 @@ function create(opts) {
         "parseLogoutRequestPost: samlRequestB64 must be a non-empty string");
     }
     var xml = Buffer.from(samlRequestB64, "base64").toString("utf8");
-    if (vopts.idpVerifyKey || vopts.idpVerifyAlg) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutRequestPost")) {
       _verifyEmbeddedXmlDsig(xml, vopts.idpVerifyKey, vopts.idpVerifyAlg, "LogoutRequest");
     }
     var c14n = xmlC14n();
@@ -1534,7 +1534,7 @@ function create(opts) {
         "parseLogoutResponseSoap: soap:Body is empty");
     }
     var innerXml = Buffer.from(c14n.canonicalize(inner)).toString("utf8");
-    if (vopts.idpVerifyKey || vopts.idpVerifyAlg) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutResponseSoap")) {
       _verifyEmbeddedXmlDsig(innerXml, vopts.idpVerifyKey, vopts.idpVerifyAlg, "LogoutResponse");
     }
     var innerLocal = inner.name.split(":").pop();
@@ -1866,8 +1866,31 @@ function _embedXmlDsig(bodyXml, refId, signingKey, signingAlg) {
   return bodyXml.substring(0, splitAt) + sigEl + bodyXml.substring(splitAt);
 }
 
+// SLO verification-config gate. Presence of EITHER idpVerifyKey or
+// idpVerifyAlg signals the operator intends to verify the inbound
+// message; a half-supplied pair is a configuration error, never a
+// license to skip the signature check. Returns true when both are
+// present (verify), false when neither is (verification not requested),
+// and throws — fail closed — when exactly one is present, so a
+// fat-fingered verifier can never silently accept a forged, unsigned
+// LogoutRequest / LogoutResponse. Every SLO parse path (HTTP-Redirect,
+// HTTP-POST, SOAP) routes its verify decision through this one gate so
+// the redirect and back-channel bindings agree on fail-closed behavior.
+function _verifyConfig(idpVerifyKey, idpVerifyAlg, ctx) {
+  if (!idpVerifyKey && !idpVerifyAlg) return false;
+  if (!idpVerifyKey) {
+    throw new AuthError("auth-saml/no-verify-key",
+      ctx + ": idpVerifyAlg supplied without idpVerifyKey — verification cannot proceed");
+  }
+  if (!idpVerifyAlg) {
+    throw new AuthError("auth-saml/no-verify-alg",
+      ctx + ": idpVerifyKey supplied without idpVerifyAlg (alg is required when key is supplied)");
+  }
+  return true;
+}
+
 function _verifyEmbeddedXmlDsig(xml, idpVerifyKey, idpVerifyAlg, expectedRootLocal) {
-  if (!idpVerifyKey || !idpVerifyAlg) return;
+  if (!_verifyConfig(idpVerifyKey, idpVerifyAlg, "_verifyEmbeddedXmlDsig")) return;
   var sigAlgUrn = _sigAlgUrn(idpVerifyAlg);
   if (!sigAlgUrn) {
     throw new AuthError("auth-saml/bad-verify-alg",

package/lib/backup/index.js

@@ -1178,7 +1178,19 @@ function bundleAdapterStorage(opts) {
       "the adapter — the wrap layer composes only with tar / tar.gz bundles. Per-file " +
       "encryption for directory format is a future patch alongside the _crypto-base.js refactor.");
   }
+  // Mirror create()'s ambient-posture read (see the create() encryption
+  // gate above): an explicit opts.posture wins, but when it is unset the
+  // globally-pinned compliance posture (b.compliance.set(...)) still drives
+  // the encryption-required gate. Without this fallback a deployment that
+  // pins HIPAA / PCI-DSS once and constructs the store with the documented
+  // default ({ adapter }, cryptoStrategy defaulting to "none") slips a
+  // plaintext bundle store past a gate create() enforces on encrypt:false —
+  // an asymmetric fail-open under the same regulated posture.
   var posture = opts.posture;
+  if (posture === undefined || posture === null) {
+    try { posture = compliance().current(); }
+    catch (_e) { posture = null; }                                                  // compliance optional at construction time
+  }
   if (posture && BACKUP_ENCRYPTION_REQUIRED_POSTURES.indexOf(posture) !== -1) {
     if (cryptoStrategy === "none") {
       throw new BackupError("backup/posture-requires-encryption",

package/lib/cli.js

@@ -348,6 +348,44 @@ function _coerceList(val) {
   return Array.isArray(val) ? val.slice() : [val];
 }
 
+// Compile one operator-supplied `dev --ignore` pattern to a RegExp,
+// refusing (with a CliError the caller converts to exit 2) any pattern
+// that is over-length, a ReDoS catastrophic-backtracking shape, or one
+// RegExp() itself can't compile. Every refusal shape raises the same
+// CliError type so a single caller-side catch takes the standard
+// exit-2 + stderr path.
+function _compileIgnorePattern(s) {
+  var str = String(s);
+  if (str.length > MAX_IGNORE_PATTERN_LENGTH) {
+    throw new CliError("cli/bad-ignore-pattern",
+      "blamejs dev: --ignore pattern exceeds max length " +
+      MAX_IGNORE_PATTERN_LENGTH + " (got " + str.length + ")");
+  }
+  // ReDoS / catastrophic-backtracking defense — refuses nested-quant
+  // (CVE-2024-21538 class), consecutive-* (CVE-2026-26996), nested
+  // extglob (CVE-2026-33671), and lookaround-quant shapes before the
+  // pattern reaches RegExp(). Operator typo / hostile-input identical
+  // shape from here on — both want the same refusal.
+  try {
+    guardRegex.sanitize(str, { profile: "strict" });
+  } catch (e) {
+    throw new CliError("cli/bad-ignore-pattern",
+      "blamejs dev: --ignore pattern refused by guardRegex: " +
+      ((e && e.message) || String(e)));
+  }
+  // A pattern that clears the ReDoS screen can still be un-compilable
+  // (unbalanced group, dangling quantifier). RegExp() throws a
+  // SyntaxError here — route it through the same refusal, not up to a
+  // main() rejection.
+  try {
+    return RegExp(str);
+  } catch (e) {
+    throw new CliError("cli/bad-ignore-pattern",
+      "blamejs dev: --ignore pattern is not a valid regular expression: " +
+      ((e && e.message) || String(e)));
+  }
+}
+
 async function _runDev(args, ctx) {
   if (args.flags.help || args.flags.h) {
     _writeLine(ctx.stdout, DEV_USAGE);
@@ -361,27 +399,24 @@ async function _runDev(args, ctx) {
   }
   var argList   = _coerceList(args.flags.arg).map(String);
   var watchList = _coerceList(args.flags.watch).map(String);
-  var ignoreList = _coerceList(args.flags.ignore).map(function (s) {
-    var str = String(s);
-    if (str.length > MAX_IGNORE_PATTERN_LENGTH) {
-      throw new CliError("cli/bad-ignore-pattern",
-        "blamejs dev: --ignore pattern exceeds max length " +
-        MAX_IGNORE_PATTERN_LENGTH + " (got " + str.length + ")");
-    }
-    // ReDoS / catastrophic-backtracking defense — refuses nested-quant
-    // (CVE-2024-21538 class), consecutive-* (CVE-2026-26996), nested
-    // extglob (CVE-2026-33671), and lookaround-quant shapes before the
-    // pattern reaches RegExp(). Operator typo / hostile-input identical
-    // shape from here on — both want the same refusal.
-    try {
-      guardRegex.sanitize(str, { profile: "strict" });
-    } catch (e) {
-      throw new CliError("cli/bad-ignore-pattern",
-        "blamejs dev: --ignore pattern refused by guardRegex: " +
-        ((e && e.message) || String(e)));
+  // --ignore validation is operator-input validation, not an internal
+  // fault: a refused pattern must take the same exit-2 + stderr path
+  // every other dev flag uses, never reject main()'s awaited promise
+  // (the bin shim would surface a rejection as a stack trace + exit 1).
+  // The per-pattern helper raises a CliError for the three refusal
+  // shapes — over-length, guardRegex-refused, and an un-compilable
+  // RegExp — and the catch below converts any of them to the standard
+  // refusal path; a non-CliError (a genuine internal fault) re-throws.
+  var ignoreList;
+  try {
+    ignoreList = _coerceList(args.flags.ignore).map(_compileIgnorePattern);
+  } catch (e) {
+    if (e && e.isCliError) {
+      _writeLine(ctx.stderr, e.message || String(e));
+      return 2;
     }
-    return RegExp(str);
-  });
+    throw e;
+  }
   var graceMs = args.flags["grace-ms"] !== undefined ? Number(args.flags["grace-ms"]) : undefined;
   if (graceMs !== undefined && (!Number.isFinite(graceMs) || graceMs < 0)) {
     _writeLine(ctx.stderr, "blamejs dev: --grace-ms must be a non-negative number");

package/lib/keychain.js

@@ -649,9 +649,20 @@ async function store(opts) {
   }
 
   _validateFallbackFile(opts.fallbackFile, "keychain.store");
-  var doc = await _readFile(opts.fallbackFile, opts.passphrase);
-  doc.entries[_bindingKey(opts.service, opts.account)] = String(opts.password);
-  await _writeFile(opts.fallbackFile, doc, opts.passphrase);
+  // The lock sentinel lives beside fallbackFile, so its parent directory must
+  // exist before the FIRST writer can lock — otherwise the lock (added to
+  // serialize the RMW below) fails where the pre-lock atomicFile.write used to
+  // create the directory lazily on first store.
+  atomicFile.ensureDir(nodePath.dirname(opts.fallbackFile), 0o700);
+  // Serialize the read-modify-write so concurrent stores to the same
+  // fallbackFile can't each read the pre-update document and clobber one
+  // another's binding on write. atomicFile.lock is a cross-process file
+  // mutex; _removeFromFile serializes its RMW through the same lock.
+  await atomicFile.lock(opts.fallbackFile, async function () {
+    var doc = await _readFile(opts.fallbackFile, opts.passphrase);
+    doc.entries[_bindingKey(opts.service, opts.account)] = String(opts.password);
+    await _writeFile(opts.fallbackFile, doc, opts.passphrase);
+  });
   _emit("keychain.stored", "success", {
     service: opts.service, account: opts.account, backend: "file",
   }, auditOn);
@@ -818,13 +829,18 @@ async function remove(opts) {
     }
   }
 
+  // Validate a supplied fallbackFile (reject a relative path) BEFORE the
+  // exists check, so a relative path throws keychain/relative-fallback-file
+  // consistently with store/retrieve instead of silently no-op'ing.
+  if (opts.fallbackFile) {
+    _validateFallbackFile(opts.fallbackFile, "keychain.remove");
+  }
   if (!opts.fallbackFile || !atomicFile.exists(opts.fallbackFile)) {
     _emit("keychain.removed", "no-op", {
       service: opts.service, account: opts.account, backend: "file",
     }, auditOn);
     return false;
   }
-  _validateFallbackFile(opts.fallbackFile, "keychain.remove");
   var existed = await _removeFromFile(opts.fallbackFile, opts.service, opts.account, opts.passphrase);
   _emit("keychain.removed", existed ? "success" : "no-op", {
     service: opts.service, account: opts.account, backend: "file",
@@ -833,12 +849,16 @@ async function remove(opts) {
 }
 
 async function _removeFromFile(fallbackFile, service, account, passphrase) {
-  var doc = await _readFile(fallbackFile, passphrase);
-  var bindingKey = _bindingKey(service, account);
-  if (!Object.prototype.hasOwnProperty.call(doc.entries, bindingKey)) return false;
-  delete doc.entries[bindingKey];
-  await _writeFile(fallbackFile, doc, passphrase);
-  return true;
+  // Same serialized read-modify-write as store: hold the file mutex across
+  // read -> delete -> write so a concurrent store/remove can't lose the edit.
+  return await atomicFile.lock(fallbackFile, async function () {
+    var doc = await _readFile(fallbackFile, passphrase);
+    var bindingKey = _bindingKey(service, account);
+    if (!Object.prototype.hasOwnProperty.call(doc.entries, bindingKey)) return false;
+    delete doc.entries[bindingKey];
+    await _writeFile(fallbackFile, doc, passphrase);
+    return true;
+  });
 }
 
 // ---- Test seam -------------------------------------------------------------

package/lib/mail-auth.js

@@ -294,7 +294,7 @@ function _ipv4InCidr(ip, cidr) {
   var slash = cidr.indexOf("/");
   var net = slash === -1 ? cidr : cidr.slice(0, slash);
   var mask = slash === -1 ? 32 : parseInt(cidr.slice(slash + 1), 10);             // IPv4 max prefix
-  if (mask < 0 || mask > 32) return false;                                       // IPv4 max prefix
+  if (!isFinite(mask) || mask < 0 || mask > 32) return false;                     // IPv4 max prefix
   var ipInt = _ipv4ToInt(ip);
   var netInt = _ipv4ToInt(net);
   if (ipInt === null || netInt === null) return false;
@@ -2123,6 +2123,10 @@ function authResultsEmit(opts) {
 
   var version = (opts.version === undefined || opts.version === null)
     ? "1" : String(opts.version);
+  if (/[\r\n\0]/.test(version)) {
+    throw new MailAuthError("mail-auth/ar-bad-version",
+      "authResults.emit: version contains forbidden control characters");
+  }
   var head = opts.authservId + (version === "1" ? "" : " " + version);
 
   if (opts.results.length === 0) {

package/lib/network-smtp-policy.js

@@ -675,7 +675,10 @@ async function tlsRptSubmit(report, opts) {
           body:    gzipped,
           timeoutMs: timeoutMs,
         });
-        entry.status = rv && rv.status;
+        // The framework httpClient resolves { statusCode, headers, body }
+        // (same shape mtaSts.fetch reads above) — not { status }. Reading
+        // the wrong field marked every real 2xx submission as a failure.
+        entry.status = rv && rv.statusCode;
         entry.ok = entry.status >= 200 && entry.status < 300;                  // HTTP 2xx range
         if (!entry.ok) entry.error = "HTTP " + entry.status;
       } else if (/^mailto:/i.test(uri)) {

package/lib/router.js

@@ -44,6 +44,7 @@ var requestHelpers = require("./request-helpers");
 var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
 var safeEnv = require("./parsers/safe-env");
+var safeJson = require("./safe-json");
 var safeUrl = require("./safe-url");
 var validateOpts = require("./validate-opts");
 var websocket = require("./websocket");
@@ -163,9 +164,25 @@ function _makeSchemaValidator(spec) {
   };
 }
 
+// True when a res.end body structurally looks like a JSON document — the
+// first non-whitespace byte is an object/array opener. Narrow on purpose:
+// a plain-text / HTML body on a response-schema route (leading "<", a bare
+// word, etc.) is skipped so the validator never throws on a non-JSON
+// response, and a JSON scalar (a bare number / quoted string) is not
+// mistaken for a schema-shaped document.
+function _bodyLooksLikeJson(text) {
+  for (var i = 0; i < text.length; i += 1) {
+    var ch = text.charCodeAt(i);
+    if (ch === 0x20 || ch === 0x09 || ch === 0x0A || ch === 0x0D) continue;   // skip leading whitespace
+    return ch === 0x7B || ch === 0x5B;                                        // "{" or "["
+  }
+  return false;
+}
+
 function _makeResponseValidator(spec) {
-  // Wraps res.json (and res.end when called with a JSON-shaped buffer)
-  // to validate the response body against spec.response. Mode:
+  // Validate the response body against spec.response no matter which exit
+  // the handler used — res.json OR a raw res.end(JSON.stringify(...)) that
+  // ships a JSON-shaped buffer. Mode:
   //   - BLAMEJS_VALIDATE_RESPONSES=throw (or per-route validateResponse: "throw")
   //     → throw a SafeSchemaError-shaped error; route handler's caller sees a 500.
   //   - BLAMEJS_VALIDATE_RESPONSES=warn (or per-route validateResponse: "warn")
@@ -177,21 +194,59 @@ function _makeResponseValidator(spec) {
   if (!mode) return function passthrough(_req, _res, next) { next(); };
 
   return function responseValidator(req, res, next) {
+    // One request-scoped check shared by both the res.json and res.end
+    // wrappers so a single failure shape covers every exit.
+    var validated = false;
+    function runCheck(value, headersAlreadySent) {
+      var rr = spec.response.safeParse(value);
+      if (rr.ok) return;
+      if (mode === "throw") {
+        // A raw res.end after writeHead cannot be un-sent — throwing there
+        // would abort mid-flush and can't reach a clean 500. Degrade to a
+        // logged error in that case; res.json (and a pre-writeHead res.end)
+        // still throw before any header is committed.
+        if (!headersAlreadySent) {
+          throw new Error("router response-validation failed for " +
+            (req.method + " " + req.routePattern) + ": " +
+            JSON.stringify(rr.errors));
+        }
+        log.error("response-validation failed after headers sent on " +
+                  req.method + " " + req.routePattern + ": " +
+                  JSON.stringify(rr.errors).slice(0, 500));
+        return;
+      }
+      // warn mode
+      log.warn("response-validation drift on " + req.method + " " + req.routePattern +
+               ": " + JSON.stringify(rr.errors).slice(0, 500));
+    }
+
     var origJson = typeof res.json === "function" ? res.json.bind(res) : null;
     if (origJson) {
       res.json = function (value) {
-        var rr = spec.response.safeParse(value);
-        if (!rr.ok) {
-          if (mode === "throw") {
-            throw new Error("router response-validation failed for " +
-              (req.method + " " + req.routePattern) + ": " +
-              JSON.stringify(rr.errors));
+        runCheck(value, false);   // res.json validates before it writes headers
+        validated = true;         // res.json delegates to res.end internally — don't re-check
+        return origJson(value);
+      };
+    }
+
+    var origEnd = typeof res.end === "function" ? res.end.bind(res) : null;
+    if (origEnd) {
+      res.end = function (chunk) {
+        if (!validated) {
+          var text = null;
+          if (typeof chunk === "string") text = chunk;
+          else if (Buffer.isBuffer(chunk)) text = chunk.toString("utf8");
+          if (text !== null && _bodyLooksLikeJson(text)) {
+            var parsed;
+            var parsedOk = true;
+            try { parsed = safeJson.parse(text); } catch (_e) { parsedOk = false; }
+            if (parsedOk) {
+              validated = true;
+              runCheck(parsed, res.headersSent === true);
+            }
           }
-          // warn mode
-          log.warn("response-validation drift on " + req.method + " " + req.routePattern +
-                   ": " + JSON.stringify(rr.errors).slice(0, 500));
         }
-        return origJson(value);
+        return origEnd.apply(res, arguments);
       };
     }
     next();
@@ -958,16 +1013,24 @@ class Router {
             "res.redirect: target must be a non-empty string"
           );
         }
-        // Reject embedded CR / LF / NUL early — header injection class.
-        // Node's writeHead would refuse these too, but the explicit
-        // refusal here gives operators a router-shaped error rather than
-        // a generic ERR_INVALID_CHAR.
+        // Reject every byte a header line or a URL-parsing user agent
+        // treats specially. CR / LF / NUL are the header-injection class
+        // (Node's writeHead would refuse them too — the explicit refusal
+        // gives operators a router-shaped error over ERR_INVALID_CHAR).
+        // TAB (0x09) is the open-redirect class: Node PERMITS a horizontal
+        // tab in a header value, but WHATWG URL removes ASCII TAB / LF / CR
+        // from a URL before parsing it, so "/<TAB>/evil.example" — which
+        // the same-origin heuristic below reads as a rooted path — collapses
+        // to the protocol-relative "//evil.example" in the browser and
+        // bounces to an attacker origin. Refuse the whole browser-stripped
+        // set here so the byte the heuristic inspects is the byte the user
+        // agent parses.
         for (var ci = 0; ci < url.length; ci += 1) {
           var cc = url.charCodeAt(ci);
-          if (cc === 0x00 || cc === 0x0A || cc === 0x0D) {
+          if (cc === 0x00 || cc === 0x09 || cc === 0x0A || cc === 0x0D) {
             throw new RouterError(
               "router/redirect-target-has-control-chars",
-              "res.redirect: target must not contain CR / LF / NUL bytes"
+              "res.redirect: target must not contain CR / LF / TAB / NUL bytes"
             );
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.1",
+  "version": "0.16.2",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c7d7addc-92d7-4060-8b48-b51d9726a093",
+  "serialNumber": "urn:uuid:c8057ebc-9951-4f40-91e4-0a8fb92d95b7",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-03T05:24:29.849Z",
+    "timestamp": "2026-07-03T13:52:26.518Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.1",
+      "bom-ref": "@blamejs/core@0.16.2",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.1",
+      "version": "0.16.2",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.1",
+      "purl": "pkg:npm/%40blamejs/core@0.16.2",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.1",
+      "ref": "@blamejs/core@0.16.2",
       "dependsOn": []
     }
   ]