@blamejs/core 0.16.1 → 0.16.3

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.3 (2026-07-03) — **A batch of fail-open, injection-bypass and error-path fixes across the metrics, guard-sql, MCP, YAML-parser, content-credentials, tus-upload and buffer primitives — including a credential-leak fix on the /metrics exposition surface — alongside a further expansion of the automated test suite.** This patch closes a set of security and robustness defects concentrated in the error-handling and adversarial-input paths of the observability, SQL-guard, MCP, YAML-parsing, content-credentials and resumable-upload primitives, surfaced while continuing to expand the automated test suite. The most consequential: credential-shaped metric label values were redacted only in the internal cardinality key, not in the rendered exposition, so a raw bearer token / API key / JWT placed on a label leaked verbatim to every `/metrics` scrape reader — redaction now applies to the stored labels the exposition renders. The SQL guard's fragment mode (the `whereRaw` escape hatch) refused an embedded single-quoted literal but not a PostgreSQL dollar-quoted string (`$tag$…$tag$`) or a lone top-level `;`, so operator concatenation into a dollar-quoted context bypassed the floor that forces `?`-placeholder binding. MCP tool-input validation was fail-open when a JSON Schema omitted an explicit top-level `type:"object"` (a valid, common shape) — `required`/`properties`/`additionalProperties` were skipped and any input accepted; and its server-initiated sampling token cap was bypassable with a string `maxTokens`. The YAML parser's flow style (`{…}` / `[…]`) accepted duplicate keys and the merge key that block style rejects — letting a later value silently override an earlier one a preceding check had already read — and mis-parsed a root-level JSON object. content-credentials returned a only shallowly-frozen manifest (nested claim fields stayed mutable before signing), and its identity-assertion hash re-check used set membership rather than multiset matching, so duplicate referenced assertions could leave a bound assertion never re-confirmed. Robustness fixes round out the batch: metrics now reject `±Infinity`; the buffer collector preserves a caller error class's code/message (they were swapped for framework error classes, so a caller branching on the error code — e.g. a resumable-upload `413` vs `400` — never matched); resumable uploads return `413` (not a `400` that leaked the internal error code) on an oversized chunk, reject a prototype-key checksum algorithm with `400` (not `500`), and parse a deferred `Upload-Length` as strictly as creation; the MCP guard refuses `/register/` (trailing slash) like `/register`, answers a missing/invalid bearer with `401` and its `WWW-Authenticate` challenge instead of `400`, honors an explicit empty accepted-version list, and accepts a loopback `http` redirect URI for native/CLI clients while still refusing non-loopback `http`. **Fixed:** *Metrics reject non-finite values* — `gauge.set`, `histogram.observe` and `counter.inc` guarded their value with an `isNaN`-only check (counter only checked `< 0`), so `±Infinity` passed and produced `Infinity` / `-Infinity` in the exposition — invalid Prometheus 0.0.4 / OpenMetrics, which a scraper rejects. All three now require a finite number, matching their `must be a finite number` error text. · *Buffer stream collector preserves a caller error class's code and message* — `safeBuffer.collectStream` constructs its size-limit error with `(message, code)`, matching its own error class — but a framework error class (the convention elsewhere) takes `(code, message)`, the opposite order, so a caller that passed its own error class received an error with `code` and `message` swapped. A caller branching on the error code then never matched — for example the resumable-upload handler mapped an oversized chunk to `400` instead of `413`. The collector now sets both fields explicitly so they are correct whichever constructor order the passed class uses. · *Resumable upload: correct status codes and strict deferred-length parse* — An oversized `PATCH`/creation chunk now returns `413 Payload Too Large` instead of a `400` whose body leaked the internal error code; an `Upload-Checksum` naming a prototype key (e.g. `__proto__`) returns `400 unsupported` instead of a `500` from an unguarded lookup; and a deferred-length finalization now parses `Upload-Length` with the same strict check as creation, rejecting trailing junk (`"10abc"`) rather than silently truncating it. · *MCP guard: trailing-slash registration refusal, 401 bearer challenge, empty accepted-version list* — The static-registration refusal matched `/register` exactly or by suffix, so `/register/` — which most routers normalize to the same handler — slipped through; it is now refused too. A missing or invalid bearer now returns `401 Unauthorized` with its `WWW-Authenticate` challenge (RFC 6750 §3) instead of `400`, so clients keyed on `401` re-authenticate. And an explicit empty `accepted` protocol-version list now rejects every version instead of silently widening to the default set. · *MCP accepts a loopback `http` redirect URI* — `redirect_uri` validation parsed the URI with the default HTTPS-only protocol set, so a loopback `http://localhost/…` redirect (RFC 8252 native-app / CLI client, permitted by RFC 9700 §4.1.1) failed as `did not parse` before the local-host allowance could run. The parse now admits `http` so the loopback allowance applies; a non-loopback `http` redirect is still refused. · *YAML: trailing content after a flow collection and root-level JSON objects* — `root: [1, 2] junk` silently dropped the trailing content where the quoted-scalar path rejects it; trailing content after a flow collection is now refused (`yaml/trailing-content`). A root-level flow/JSON object (`{"a": 1, "b": 2}`) was mis-scanned as a block mapping with a garbage key and returned structurally-wrong data; the leading flow bracket is now recognized before the block-mapping scan so a root JSON object parses correctly. · *content-credentials: deep-frozen manifest and typed rejections for bad build/sign inputs* — `build` returned a shallowly-frozen manifest, leaving every nested claim field (`provider`/`system`/`content`) mutable before signing despite the documented pre-sign immutability guarantee; the manifest is now deep-frozen. A non-finite or out-of-Date-range `generatedAt` (`NaN` / `Infinity`) crashed with an untyped `RangeError`, and a non-Buffer `certChain` entry to `signCose` threw an untyped Node `TypeError`; both now reject with a typed `content-credentials/*` error at call time. **Security:** *Credential-shaped metric labels are redacted in the `/metrics` exposition, not just the cardinality key* — The metrics registry rewrote a credential-shaped label value to `[REDACTED-CREDENTIAL]`, but only inside the function that builds the internal Map cardinality key. The stored label object — the one the exposition renderer emits — kept the raw value, so a bearer token, API key or JWT placed on a label (e.g. an `authorization` label) was written verbatim to every `/metrics` scrape reader, contradicting the documented guarantee that the bytes never reach the scrape stream. Redaction now runs on the resolved labels themselves, so the key and the rendered output both carry the marker. · *SQL guard fragment mode refuses PostgreSQL dollar-quoted literals and any top-level semicolon* — In fragment mode (`whereRaw`), the embedded-string-literal floor that forces every value through a `?` placeholder detected a single-quoted literal but not a dollar-quoted one (`$tag$…$tag$` or `$$…$$`), so operator input concatenated into a dollar-quoted context passed the strict floor that the equivalent single-quoted value is refused by. The floor now recognizes dollar-quoted literals. Fragment mode also now refuses any top-level `;` — including a lone or trailing one — rather than relying on the stacked-statement scan, which only fired when a second statement followed the `;`. · *MCP tool-input validation enforces the schema without an explicit `type:"object"`* — `validateToolInput` gated the `required` / `properties` / `additionalProperties` checks on the schema declaring `type:"object"`. A schema that carries `properties`/`required` but omits `type` — a valid and common JSON Schema shape — was treated as untyped, so those constraints were skipped and any argument object was accepted, defeating the primitive's stated purpose (OWASP LLM07). Such a schema is now treated as an object schema and its constraints enforced. · *MCP sampling token cap rejects a non-numeric `maxTokens`* — `sampling.guard` applied the per-request token cap only when `maxTokens` was a number, so a hostile-tool-initiated sampling request carrying `maxTokens` as a string skipped the cap entirely — and a downstream SDK that coerces the string would then exceed the budget. A non-numeric `maxTokens` on this server-initiated surface is now refused with a typed error. · *content-credentials identity-assertion re-check uses multiset matching* — `verifyIdentityAssertion` re-confirmed the signed referenced-assertion hash binding with count-equality plus set membership, never consuming a matched entry. Supplying referenced assertions that hash to `[A, A]` against a signed binding of `[A, B]` passed — the counts matched and each supplied hash was present — even though the bound `hash(B)` was never re-confirmed against a real assertion (a transplant fail-open). The re-check now consumes each bound hash as it is matched, so duplicates can no longer stand in for a distinct bound assertion. · *YAML flow-style mappings refuse duplicate keys and the merge key like block style* — Block mappings rejected a duplicate key (`yaml/duplicate-key`) and the anchor-merge key `<<` (`yaml/merge-key-banned`), but flow mappings (`{ a: 1, a: 2 }`) enforced neither — silently keeping the last value on a repeat and accepting `<<` as an ordinary key. A value an earlier check has already read could thus be overridden through flow style. Flow mappings now apply both guards.
+
+- v0.16.2 (2026-07-03) — **Security hardening across the mail, OAuth/SAML, ACME, keychain and router primitives — six fail-open / injection / bypass fixes and seven correctness fixes — alongside a large expansion of the automated test suite.** This patch closes a batch of security and correctness defects surfaced while substantially expanding the test suite across the framework's mail-authentication, federated-identity, ACME, keychain, backup, CLI and router primitives. The security fixes: SPF evaluation no longer throws (and thus can no longer be laundered into a temperror that a permissive inbound policy accepts) on a malformed `ip4:` CIDR mask; the Authentication-Results builder now refuses CR/LF/NUL in the `version` field, closing the last header-injection gap left by the earlier mail-header sweep; `res.redirect` now rejects a horizontal TAB (which user agents strip before URL parsing, turning `/\t/evil.example` into a protocol-relative redirect to an attacker origin); the OAuth refresh-token one-time-use replay gate now treats any truthy `seen()` result as seen (a Redis `1` / SQL `COUNT` no longer slips a stolen refresh token past a `=== true` compare) — with the same normalization applied to its sibling replay checks; SAML Single-Logout over HTTP-POST/SOAP now fails closed (throws) when a verification key is supplied without its algorithm, matching the redirect binding instead of silently skipping signature verification; and the OAuth authorization-URL / PAR builders now refuse operator `extraParams` that collide with framework-managed parameters (`redirect_uri`, `state`, `code_challenge`, …). The correctness fixes: concurrent keychain file-store writes are serialized under the existing file lock (no more lost bindings); TLS-RPT submission reads the real `statusCode` (successful reports are no longer misreported as failures); ACME account key-rollover stops double-encoding its inner JWS payload (rollover was always rejected by the CA); the response-schema validator now also validates JSON bodies sent via `res.end`; keychain `remove` validates a relative fallback path like `store`/`retrieve`; `bundleAdapterStorage` honors the ambient compliance posture like `create`; and a refused `dev --ignore` pattern now returns exit code 2 instead of rejecting the CLI promise. **Fixed:** *Concurrent keychain file-store writes no longer drop bindings* — `store` and the file-remove path performed an unlocked read-modify-write of the fallback file, so two concurrent stores could each read the pre-update document and the later write would clobber the earlier binding. Both read-modify-write sequences are now serialized under the file's existing lock. · *TLS-RPT submission reads the response `statusCode`* — `tlsRpt.submit` read `status` from the HTTP client response, but the client resolves `statusCode`, so a successful (2xx) report POST was reported as `{ ok: false, error: 'HTTP undefined' }`. It now reads `statusCode`, so delivered reports are distinguished from rejected ones. · *ACME account key-rollover no longer double-encodes its inner JWS payload* — `accountKeyRollover` passed an already-stringified payload to a signer that stringifies internally, so the inner keyChange JWS payload encoded a JSON string instead of the JSON object and every rollover was rejected by the CA (RFC 8555 §7.3.5). The payload is now passed once. · *Response-schema validator also validates `res.end` JSON bodies* — The response validator wrapped only `res.json`, so a handler shipping an invalid body via `res.end(JSON.stringify(...))` escaped validation despite the documented contract. JSON-shaped `res.end` bodies are now validated on the same path. · *keychain `remove` validates a relative fallback path like `store`/`retrieve`* — `remove` checked file existence before validating the fallback path, so a relative path silently no-op'd instead of throwing the config error that `store`/`retrieve` raise. It now validates first, consistent with the other file-fallback paths. · *`bundleAdapterStorage` honors the ambient compliance posture* — `bundleAdapterStorage` only refused an unencrypted strategy when an explicit posture was passed, unlike `create`, which reads the ambient `b.compliance` posture and refuses `encrypt:false` under HIPAA. `bundleAdapterStorage` now falls back to the ambient posture, closing the asymmetry. · *`dev --ignore` pattern refusal returns exit code 2* — A `dev --ignore` pattern that exceeded the length cap or was refused by the regex guard threw out of the CLI promise instead of writing to stderr and returning exit code 2 like every other CLI validation failure. It now returns the standard non-zero exit. **Security:** *SPF `ip4:` with a malformed CIDR mask fails closed instead of throwing (fail-open)* — `_ipv4InCidr` lacked the finite-mask guard its IPv6 sibling has, so an `ip4:` mechanism with a non-numeric prefix (e.g. `ip4:192.0.2.0/`) reached `BigInt(32 - NaN)` and threw an uncaught `RangeError` out of `b.mail.spf.verify` / `b.mail.inbound.verify`. Upstream mail handling catches that throw as a temperror, and an inbound policy configured to accept on temperror would then admit a sender that should have been evaluated. SPF now returns a `permerror` result for a malformed mask, honoring the primitive's documented never-throw-on-message-content contract. · *Authentication-Results builder refuses CR/LF/NUL in the `version` field (header injection)* — `b.mail.authResults.emit` validated the `authserv-id` against control characters but not the operator-supplied `version`, which is interpolated onto the `Authentication-Results:` header line — the last field left unguarded by the earlier mail-header CRLF sweep. A `version` containing CRLF could smuggle an arbitrary header. It is now refused with a typed error, like every other field on that line. · *`res.redirect` rejects horizontal TAB (open-redirect / same-origin bypass)* — The redirect target's control-character guard rejected CR/LF/NUL but not TAB (0x09). Node permits a TAB in a header value, but the WHATWG URL parser strips ASCII TAB/LF/CR from a URL before resolving it, so a `Location: /\t/evil.example` collapses to the protocol-relative `//evil.example` and navigates to the attacker origin — bypassing the same-origin/allowlist heuristic. TAB is now rejected alongside CR/LF/NUL. · *OAuth refresh-token replay gate treats any truthy `seen()` result as seen (fail-open)* — The legacy `seen(refreshToken)` replay gate compared the callback's return with `=== true`, but the documented contract is that it returns a truthy value when the token was presented before. A store returning a truthy non-`true` value — a Redis `EXISTS`/`SISMEMBER` `1`, a SQL `COUNT` — slipped a replayed (stolen) refresh token past the one-time-use gate. Any truthy result now counts as seen; the same normalization was applied to the sibling replay checks in the module. · *SAML Single-Logout over HTTP-POST/SOAP fails closed on a key without its algorithm* — The POST and SOAP SLO parsers gated signature verification with an OR condition and the verify helper early-returned when the algorithm was absent, so supplying a verification key without `idpVerifyAlg` silently accepted a forged, unsigned LogoutRequest — while the HTTP-Redirect binding failed closed. All four SLO parse paths now route through one config check that throws when a key is supplied without its algorithm. · *OAuth authorization-URL / PAR builders refuse `extraParams` that collide with managed parameters* — `authorizationUrl` and `pushAuthorizationRequest` merged operator `extraParams` with `URLSearchParams.set`, which replaces — so an `extraParams` entry for `redirect_uri`, `state`, or `code_challenge` overwrote the framework-generated value while the call still returned the framework's `state`/PKCE verifier, diverging the returned session seed from the emitted URL. Reserved parameter keys in `extraParams` are now refused with a typed error at both builders.
+
 - v0.16.1 (2026-07-03) — **Every source file now carries an SPDX license + copyright header; the wiki example emits its full HSTS when it runs behind a TLS-terminating reverse proxy; and a good-first-issue on-ramp lands for new contributors.** This patch stamps a per-file `SPDX-License-Identifier: Apache-2.0` and a copyright line onto every first-party source file, so the license of any single file is unambiguous when it is read, audited, or vendored in isolation. The project stays Apache-2.0 — this is a clarity change, not a license change, and vendored third-party files under lib/vendor/ keep their own upstream headers. The wiki example now passes its trusted-proxy CIDRs to the securityHeaders middleware: a deployment behind a TLS-terminating reverse proxy (Caddy or nginx) that forwards `X-Forwarded-Proto: https` now emits the framework's strong HSTS (two-year max-age, includeSubDomains, preload) instead of suppressing it on the plain-HTTP hop from the proxy — the wiki e2e asserts both the proxied-https and the direct-http cases. CONTRIBUTING gains a good-first-issue on-ramp so new contributors have a clear, small first step. **Added:** *Per-file SPDX license and copyright headers* — Every first-party source file now begins with `// SPDX-License-Identifier: Apache-2.0` and a copyright line, so the license and holder of any individual file are explicit when it is read or extracted on its own. No license change — the project remains Apache-2.0. Vendored files under `lib/vendor/` are untouched and retain their upstream license headers. **Changed:** *Good-first-issue on-ramp for new contributors* — CONTRIBUTING now points new contributors at issues labelled `good first issue` — small, self-contained tasks (a doc or wiki-example fix, a test for an uncovered branch) that are the easiest first step into the codebase. **Security:** *Wiki example emits its full HSTS behind a TLS-terminating reverse proxy* — The wiki example app now hands its trusted-proxy CIDRs to `securityHeaders`, so behind Caddy or nginx forwarding `X-Forwarded-Proto: https` it emits `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload` rather than dropping HSTS on the internal HTTP hop from the proxy. Operators modelling their own app on the example inherit the fix by declaring their proxy CIDRs via `WIKI_ADMIN_TRUSTED_PROXIES` (the production compose already defaults to the private ranges). The framework's `securityHeaders` primitive is unchanged; this closes a wiring gap in the example.
 
 - v0.16.0 (2026-07-03) — **Raises the minimum Node.js engine to 24.18.0; the status-list verifier now binds the token type against a typ-confusion replay; and CI supply-chain pinning is consolidated behind committed dev/example lockfiles, `npm ci`, and a single aggregating pin tool that closes the OpenSSF Scorecard pinned-dependency gaps.** This minor raises the supported Node.js floor from 24.16.0 to 24.18.0 — operators must run Node 24.18.0 or newer (24.17.0 was a security release; 24.18.0 bundles SQLite 3.53.1 and a backup-path fix, and guarantees the native OpenSSL 3.5 SLH-DSA surface). b.auth.statusList.fromJwt now enforces RFC 8725 §3.11 by binding the JWS header typ to the "statuslist+jwt" that toJwt stamps, so a token minted for another purpose can't be replayed as a status list. The build's supply-chain pinning is reworked so OpenSSF Scorecard sees pinned installs everywhere it can: the dev-tool, example, and fuzz manifests now ship committed lockfiles and CI installs them with `npm ci` (Scorecard keys pinning on the `ci` verb, not on an `@version` specifier), the vendored fuzz toolchain and the oss-fuzz base image are pinned, and a new scripts/pin-all.js aggregates every pin — regenerating all lockfiles, pinning the GitHub Action SHAs, and syncing the Docker base-image digests in one `--fix`, with a `--check` gate wired into CI and the release flow so no pin can silently drift. The committed lockfiles are dev/example-only and excluded from the published tarball; the zero-npm-RUNTIME-deps rule is unchanged. **Added:** *scripts/pin-all.js — aggregated supply-chain pin tool* — One command re-pins every supply-chain segment: `--fix` regenerates the committed lockfiles (root / examples/wiki / fuzz), pins the GitHub Action SHAs, and syncs the Docker base-image digests; `--check` (wired into CI and the release flow) verifies the lockfile and digest segments — including each lockfile's package version — are in sync and fails closed on drift. Contributor tooling — it does not ship in the tarball. · *Project-governance and assurance documentation; OpenSSF Best Practices silver badge* — Adds a ROADMAP.md (documented direction plus an explicit out-of-scope list), a Developer Certificate of Origin policy in CONTRIBUTING.md (contributions carry a Signed-off-by; releases sign off through the release tooling), and an explicit security assurance case in SECURITY.md (a top security claim decomposed into evidence-backed sub-claims, with a residual-risk statement). The project earned the OpenSSF Best Practices silver badge, linked from the README. **Changed:** *Minimum Node.js engine raised to 24.18.0* — engines.node is now >=24.18.0 (was >=24.16.0). Operators must run Node 24.18.0 or newer. 24.17.0 was a security release and 24.18.0 bundles SQLite 3.53.1 plus a backup-keepalive fix; the floor also guarantees the native OpenSSL 3.5 SLH-DSA sign/verify surface. CI, the release container, and the docs are updated to the new floor. · *Supply-chain pinning consolidated behind committed lockfiles + `npm ci` + one aggregating pin tool* — The root dev-tool (esbuild, postject), examples/wiki, and fuzz (jazzer.js) manifests now ship committed package-lock.json files, and CI installs them with `npm ci` instead of `npm install pkg@version` — OpenSSF Scorecard's Pinned-Dependencies check treats only the `npm ci` verb as pinned, so this is what actually clears those alerts (an exact `@version` specifier does not). The vendored fuzz toolchain is pinned to an exact jazzer version and the oss-fuzz base image is digest-pinned (mirroring the Dependabot-tracked .clusterfuzzlite digest). A new scripts/pin-all.js aggregates every pinning segment — it regenerates all committed lockfiles, pins the GitHub Action SHAs (via check-actions-currency), and syncs the Docker base-image digests in one `--fix`; a `--check` mode runs in CI and scripts/release.js so a stale lockfile or drifted digest fails closed. The committed lockfiles are dev/example-only, excluded from the published tarball's files allowlist; the zero-npm-RUNTIME-deps rule is unchanged. **Security:** *Status-list verification binds the token type (RFC 8725 §3.11 typ-confusion)* — b.auth.statusList.fromJwt now passes expectedTyp "statuslist+jwt" to the JWT verifier, matching the typ that b.auth.statusList.toJwt stamps and every sibling verifier enforces. A token minted for another purpose — even one that happens to carry a status_list.lst claim — is now refused on the type binding before the claim is read, closing the typ-confusion class where such a token could be replayed as a status list.

package/lib/acme.js

@@ -1177,7 +1177,11 @@ function create(opts) {
       url: state.directory.keyChange,
     };
     var innerPayload = { account: state.accountUrl, oldKey: publicJwk };
-    var innerJws = _signJws(newPrivateKey, innerProtected, _stringify(innerPayload));
+    // _signJws base64url-encodes _stringify(payload) itself (like every
+    // other signer, e.g. _signedPost) — pass the raw object, never a
+    // pre-stringified string, or the inner JWS payload double-encodes to
+    // a JSON *string* and every RFC 8555 §7.3.5 server rejects it.
+    var innerJws = _signJws(newPrivateKey, innerProtected, innerPayload);
     var rsp = await _signedPost(state.directory.keyChange, innerJws);
     if (rsp.statusCode !== 200) {
       _emitAudit(audit, "acme.account.key_rotated", "failure",

package/lib/auth/oauth.js

@@ -961,7 +961,11 @@ async function verifyClientAttestation(attestationJwt, popJwt, vopts) {
       throw new OAuthError("auth-oauth/attestation-pop-seen-callback-failed",
         "client-attestation-pop: seenJti() callback threw: " + ((e && e.message) || String(e)));
     }
-    if (unseen === false) {
+    // Fail closed on ANY non-truthy result. The contract is "returns truthy
+    // when UNSEEN"; an operator store fronting Redis EXISTS / SISMEMBER or a
+    // SQL COUNT returns 0 (falsy, not `false`) on a replay, so an
+    // `=== false` comparison would miss it and accept the replayed PoP.
+    if (!unseen) {
       throw new OAuthError("auth-oauth/attestation-pop-replay",
         "client-attestation-pop: jti already seen (replay refused, draft §12.1)");
     }
@@ -982,6 +986,47 @@ function _constantTimeStrEq(a, b) {
   return cryptoTimingSafeEqual(a, b);
 }
 
+// Framework-managed authorization-request parameters. Operator-supplied
+// extraParams may not carry any of these — the builder generates them and
+// RETURNS the security-critical ones (state, PKCE verifier/challenge) to the
+// caller, so an extraParams override would silently diverge the returned
+// values from what the URL/PAR body actually carries (a broken CSRF / PKCE
+// binding). Covers redirect target, client identity, requested response,
+// scope, state, nonce, PKCE challenge, response mode, RAR details, and the
+// JAR request container.
+var RESERVED_AUTHZ_PARAMS = {
+  "response_type":         1,
+  "client_id":             1,
+  "redirect_uri":          1,
+  "scope":                 1,
+  "state":                 1,
+  "nonce":                 1,
+  "code_challenge":        1,
+  "code_challenge_method": 1,
+  "response_mode":         1,
+  "authorization_details": 1,
+  "request":               1,
+  "request_uri":           1,
+};
+
+// Refuse operator-supplied extraParams keys that collide with a framework-
+// managed parameter. extraParams is operator-controlled, so a collision is a
+// config-time bug (a library merge / copy-paste) — refuse it loudly rather
+// than let it shadow a value the framework generated and returned. Fail
+// closed; shared by authorizationUrl, pushAuthorizationRequest, and
+// endSessionUrl so every URL/PAR builder guards the same way.
+function _assertNoReservedExtraParams(extraParams, reserved, errCode, ctx) {
+  if (!extraParams || typeof extraParams !== "object") return;
+  var ek = Object.keys(extraParams);
+  for (var i = 0; i < ek.length; i++) {
+    if (Object.prototype.hasOwnProperty.call(reserved, ek[i])) {
+      throw new OAuthError(errCode,
+        ctx + ": extraParams key '" + ek[i] + "' collides with a " +
+        "framework-managed parameter — pass it through the named option instead");
+    }
+  }
+}
+
 // ---- core ----
 
 function create(opts) {
@@ -1261,7 +1306,14 @@ function create(opts) {
       params.set("authorization_details", JSON.stringify(requestedAuthzDetails));
     }
     // Operator-supplied additional params (audience, resource, etc.).
+    // Refuse keys that collide with a framework-managed parameter so an
+    // operator typo / library-merge can't shadow the redirect_uri / state /
+    // code_challenge the builder generated and returned — which would
+    // silently diverge the returned {state, verifier} from the URL and
+    // break the CSRF / PKCE binding.
     if (uopts.extraParams && typeof uopts.extraParams === "object") {
+      _assertNoReservedExtraParams(uopts.extraParams, RESERVED_AUTHZ_PARAMS,
+        "auth-oauth/reserved-extra-param", "authorizationUrl");
       var ek = Object.keys(uopts.extraParams);
       for (var i = 0; i < ek.length; i++) params.set(ek[i], String(uopts.extraParams[ek[i]]));
     }
@@ -1373,23 +1425,30 @@ function create(opts) {
         throw new OAuthError("auth-oauth/seen-callback-failed",
           "refreshAccessToken: checkAndInsert() callback threw: " + ((e && e.message) || String(e)));
       }
-      // Spec contract: inserted===true → first sighting (OK);
-      // inserted===false → replay. v0.9.3 had this inverted, which
-      // broke every first refresh attempt for operators reusing an
-      // existing b.nonceStore-style backend.
-      alreadySeen = inserted === false;
+      // Spec contract: a TRUTHY result → first sighting (the value was
+      // inserted, OK); a FALSY result → replay. v0.9.3 had this inverted,
+      // which broke every first refresh attempt for operators reusing an
+      // existing b.nonceStore-style backend. Test truthiness, not an
+      // `=== false` literal: a store fronting Redis SETNX / SQL INSERT
+      // returns 0 (falsy, not `false`) when the row already existed, so
+      // an exact-literal compare would miss the replay and fail OPEN.
+      alreadySeen = !inserted;
     } else if (typeof ropts.seen === "function") {
       // Legacy non-atomic path. Documented as a check-then-act race;
       // operators sharing a single-writer store (Redis SETNX, DB
       // INSERT ON CONFLICT) MUST migrate to checkAndInsert. Stays
       // here for backwards-compat with existing operator code.
+      // Legacy contract: truthy → the token was presented before (replay).
+      // The value is used by truthiness at the gate below, so a store
+      // returning 1 from Redis EXISTS / a SQL COUNT is honored as "seen"
+      // instead of being missed by an `=== true` literal compare.
       try { alreadySeen = await ropts.seen(refreshToken); }
       catch (e) {
         throw new OAuthError("auth-oauth/seen-callback-failed",
           "refreshAccessToken: seen() callback threw: " + ((e && e.message) || String(e)));
       }
     }
-    if (alreadySeen === true) {
+    if (alreadySeen) {
       throw new OAuthError("auth-oauth/refresh-token-replay",
         "refreshAccessToken: refresh token has been presented before — refused " +
         "(OAuth 2.1 §6.1 / RFC 9700 §4.13 one-time-use defense). The operator MUST " +
@@ -2012,15 +2071,10 @@ function create(opts) {
         "ui_locales":                 1,
         "client_id":                  1,
       };
+      _assertNoReservedExtraParams(uopts.extraParams, RESERVED_END_SESSION_PARAMS,
+        "auth-oauth/end-session-reserved-extra-param", "endSessionUrl");
       var ek = Object.keys(uopts.extraParams);
-      for (var i = 0; i < ek.length; i++) {
-        if (RESERVED_END_SESSION_PARAMS[ek[i]]) {
-          throw new OAuthError("auth-oauth/end-session-reserved-extra-param",
-            "endSessionUrl: extraParams key '" + ek[i] + "' collides with a first-class " +
-            "RP-Init Logout parameter — pass it through the named field instead");
-        }
-        params.set(ek[i], String(uopts.extraParams[ek[i]]));
-      }
+      for (var i = 0; i < ek.length; i++) params.set(ek[i], String(uopts.extraParams[ek[i]]));
     }
     var qs = params.toString();
     if (qs.length === 0) return endpoint;
@@ -2108,6 +2162,11 @@ function create(opts) {
         : JSON.stringify(requestedAuthzDetails);   // form param — JSON string
     }
     if (uopts.extraParams && typeof uopts.extraParams === "object") {
+      // Same reserved-key guard as authorizationUrl — a PAR request pushes
+      // the identical security-critical parameter set, so extraParams may
+      // not shadow redirect_uri / state / code_challenge here either.
+      _assertNoReservedExtraParams(uopts.extraParams, RESERVED_AUTHZ_PARAMS,
+        "auth-oauth/reserved-extra-param", "pushAuthorizationRequest");
       var ek = Object.keys(uopts.extraParams);
       for (var i = 0; i < ek.length; i++) authzParams[ek[i]] = String(uopts.extraParams[ek[i]]);
     }
@@ -2354,7 +2413,10 @@ function create(opts) {
           "verifyBackchannelLogoutToken: atomicReplayStore.checkAndInsert threw: " +
           ((e && e.message) || String(e)));
       }
-      if (inserted === false) {
+      // Fail closed on ANY non-truthy result. A store fronting SETNX / an
+      // ON-CONFLICT INSERT returns 0 (falsy, not `false`) on a duplicate,
+      // so an `=== false` compare would miss the replay.
+      if (!inserted) {
         throw new OAuthError("auth-oauth/logout-token-replay",
           "verifyBackchannelLogoutToken: jti '" + claims.jti +
           "' already seen — replay refused (atomic)");
@@ -2370,7 +2432,10 @@ function create(opts) {
         throw new OAuthError("auth-oauth/seen-callback-failed",
           "verifyBackchannelLogoutToken: seen() callback threw: " + ((e && e.message) || String(e)));
       }
-      if (first === false) {
+      // Fail closed on ANY non-truthy result — `seen()` returns truthy the
+      // first time it sees the (jti, iss) pair; a store returning 0 for a
+      // duplicate must still refuse, which an `=== false` compare would miss.
+      if (!first) {
         throw new OAuthError("auth-oauth/logout-token-replay",
           "verifyBackchannelLogoutToken: jti already seen — replay refused");
       }

package/lib/auth/saml.js

@@ -1052,7 +1052,7 @@ function create(opts) {
         "parseLogoutRequest: inflate failed: " + ((e && e.message) || String(e)));
     }
     // Verify the redirect-binding signature when an IdP key is supplied.
-    if (vopts.idpVerifyKey) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutRequest")) {
       if (typeof vopts.queryString !== "string") {
         throw new AuthError("auth-saml/no-query-string",
           "parseLogoutRequest: idpVerifyKey requires queryString (raw URL query)");
@@ -1240,7 +1240,7 @@ function create(opts) {
       throw new AuthError("auth-saml/bad-saml-response",
         "parseLogoutResponse: inflate failed: " + ((e && e.message) || String(e)));
     }
-    if (vopts.idpVerifyKey) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutResponse")) {
       if (typeof vopts.queryString !== "string") {
         throw new AuthError("auth-saml/no-query-string",
           "parseLogoutResponse: idpVerifyKey requires queryString");
@@ -1412,7 +1412,7 @@ function create(opts) {
         "parseLogoutRequestPost: samlRequestB64 must be a non-empty string");
     }
     var xml = Buffer.from(samlRequestB64, "base64").toString("utf8");
-    if (vopts.idpVerifyKey || vopts.idpVerifyAlg) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutRequestPost")) {
       _verifyEmbeddedXmlDsig(xml, vopts.idpVerifyKey, vopts.idpVerifyAlg, "LogoutRequest");
     }
     var c14n = xmlC14n();
@@ -1534,7 +1534,7 @@ function create(opts) {
         "parseLogoutResponseSoap: soap:Body is empty");
     }
     var innerXml = Buffer.from(c14n.canonicalize(inner)).toString("utf8");
-    if (vopts.idpVerifyKey || vopts.idpVerifyAlg) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutResponseSoap")) {
       _verifyEmbeddedXmlDsig(innerXml, vopts.idpVerifyKey, vopts.idpVerifyAlg, "LogoutResponse");
     }
     var innerLocal = inner.name.split(":").pop();
@@ -1866,8 +1866,31 @@ function _embedXmlDsig(bodyXml, refId, signingKey, signingAlg) {
   return bodyXml.substring(0, splitAt) + sigEl + bodyXml.substring(splitAt);
 }
 
+// SLO verification-config gate. Presence of EITHER idpVerifyKey or
+// idpVerifyAlg signals the operator intends to verify the inbound
+// message; a half-supplied pair is a configuration error, never a
+// license to skip the signature check. Returns true when both are
+// present (verify), false when neither is (verification not requested),
+// and throws — fail closed — when exactly one is present, so a
+// fat-fingered verifier can never silently accept a forged, unsigned
+// LogoutRequest / LogoutResponse. Every SLO parse path (HTTP-Redirect,
+// HTTP-POST, SOAP) routes its verify decision through this one gate so
+// the redirect and back-channel bindings agree on fail-closed behavior.
+function _verifyConfig(idpVerifyKey, idpVerifyAlg, ctx) {
+  if (!idpVerifyKey && !idpVerifyAlg) return false;
+  if (!idpVerifyKey) {
+    throw new AuthError("auth-saml/no-verify-key",
+      ctx + ": idpVerifyAlg supplied without idpVerifyKey — verification cannot proceed");
+  }
+  if (!idpVerifyAlg) {
+    throw new AuthError("auth-saml/no-verify-alg",
+      ctx + ": idpVerifyKey supplied without idpVerifyAlg (alg is required when key is supplied)");
+  }
+  return true;
+}
+
 function _verifyEmbeddedXmlDsig(xml, idpVerifyKey, idpVerifyAlg, expectedRootLocal) {
-  if (!idpVerifyKey || !idpVerifyAlg) return;
+  if (!_verifyConfig(idpVerifyKey, idpVerifyAlg, "_verifyEmbeddedXmlDsig")) return;
   var sigAlgUrn = _sigAlgUrn(idpVerifyAlg);
   if (!sigAlgUrn) {
     throw new AuthError("auth-saml/bad-verify-alg",

package/lib/backup/index.js

@@ -1178,7 +1178,19 @@ function bundleAdapterStorage(opts) {
       "the adapter — the wrap layer composes only with tar / tar.gz bundles. Per-file " +
       "encryption for directory format is a future patch alongside the _crypto-base.js refactor.");
   }
+  // Mirror create()'s ambient-posture read (see the create() encryption
+  // gate above): an explicit opts.posture wins, but when it is unset the
+  // globally-pinned compliance posture (b.compliance.set(...)) still drives
+  // the encryption-required gate. Without this fallback a deployment that
+  // pins HIPAA / PCI-DSS once and constructs the store with the documented
+  // default ({ adapter }, cryptoStrategy defaulting to "none") slips a
+  // plaintext bundle store past a gate create() enforces on encrypt:false —
+  // an asymmetric fail-open under the same regulated posture.
   var posture = opts.posture;
+  if (posture === undefined || posture === null) {
+    try { posture = compliance().current(); }
+    catch (_e) { posture = null; }                                                  // compliance optional at construction time
+  }
   if (posture && BACKUP_ENCRYPTION_REQUIRED_POSTURES.indexOf(posture) !== -1) {
     if (cryptoStrategy === "none") {
       throw new BackupError("backup/posture-requires-encryption",

package/lib/cli.js

@@ -348,6 +348,44 @@ function _coerceList(val) {
   return Array.isArray(val) ? val.slice() : [val];
 }
 
+// Compile one operator-supplied `dev --ignore` pattern to a RegExp,
+// refusing (with a CliError the caller converts to exit 2) any pattern
+// that is over-length, a ReDoS catastrophic-backtracking shape, or one
+// RegExp() itself can't compile. Every refusal shape raises the same
+// CliError type so a single caller-side catch takes the standard
+// exit-2 + stderr path.
+function _compileIgnorePattern(s) {
+  var str = String(s);
+  if (str.length > MAX_IGNORE_PATTERN_LENGTH) {
+    throw new CliError("cli/bad-ignore-pattern",
+      "blamejs dev: --ignore pattern exceeds max length " +
+      MAX_IGNORE_PATTERN_LENGTH + " (got " + str.length + ")");
+  }
+  // ReDoS / catastrophic-backtracking defense — refuses nested-quant
+  // (CVE-2024-21538 class), consecutive-* (CVE-2026-26996), nested
+  // extglob (CVE-2026-33671), and lookaround-quant shapes before the
+  // pattern reaches RegExp(). Operator typo / hostile-input identical
+  // shape from here on — both want the same refusal.
+  try {
+    guardRegex.sanitize(str, { profile: "strict" });
+  } catch (e) {
+    throw new CliError("cli/bad-ignore-pattern",
+      "blamejs dev: --ignore pattern refused by guardRegex: " +
+      ((e && e.message) || String(e)));
+  }
+  // A pattern that clears the ReDoS screen can still be un-compilable
+  // (unbalanced group, dangling quantifier). RegExp() throws a
+  // SyntaxError here — route it through the same refusal, not up to a
+  // main() rejection.
+  try {
+    return RegExp(str);
+  } catch (e) {
+    throw new CliError("cli/bad-ignore-pattern",
+      "blamejs dev: --ignore pattern is not a valid regular expression: " +
+      ((e && e.message) || String(e)));
+  }
+}
+
 async function _runDev(args, ctx) {
   if (args.flags.help || args.flags.h) {
     _writeLine(ctx.stdout, DEV_USAGE);
@@ -361,27 +399,24 @@ async function _runDev(args, ctx) {
   }
   var argList   = _coerceList(args.flags.arg).map(String);
   var watchList = _coerceList(args.flags.watch).map(String);
-  var ignoreList = _coerceList(args.flags.ignore).map(function (s) {
-    var str = String(s);
-    if (str.length > MAX_IGNORE_PATTERN_LENGTH) {
-      throw new CliError("cli/bad-ignore-pattern",
-        "blamejs dev: --ignore pattern exceeds max length " +
-        MAX_IGNORE_PATTERN_LENGTH + " (got " + str.length + ")");
-    }
-    // ReDoS / catastrophic-backtracking defense — refuses nested-quant
-    // (CVE-2024-21538 class), consecutive-* (CVE-2026-26996), nested
-    // extglob (CVE-2026-33671), and lookaround-quant shapes before the
-    // pattern reaches RegExp(). Operator typo / hostile-input identical
-    // shape from here on — both want the same refusal.
-    try {
-      guardRegex.sanitize(str, { profile: "strict" });
-    } catch (e) {
-      throw new CliError("cli/bad-ignore-pattern",
-        "blamejs dev: --ignore pattern refused by guardRegex: " +
-        ((e && e.message) || String(e)));
+  // --ignore validation is operator-input validation, not an internal
+  // fault: a refused pattern must take the same exit-2 + stderr path
+  // every other dev flag uses, never reject main()'s awaited promise
+  // (the bin shim would surface a rejection as a stack trace + exit 1).
+  // The per-pattern helper raises a CliError for the three refusal
+  // shapes — over-length, guardRegex-refused, and an un-compilable
+  // RegExp — and the catch below converts any of them to the standard
+  // refusal path; a non-CliError (a genuine internal fault) re-throws.
+  var ignoreList;
+  try {
+    ignoreList = _coerceList(args.flags.ignore).map(_compileIgnorePattern);
+  } catch (e) {
+    if (e && e.isCliError) {
+      _writeLine(ctx.stderr, e.message || String(e));
+      return 2;
     }
-    return RegExp(str);
-  });
+    throw e;
+  }
   var graceMs = args.flags["grace-ms"] !== undefined ? Number(args.flags["grace-ms"]) : undefined;
   if (graceMs !== undefined && (!Number.isFinite(graceMs) || graceMs < 0)) {
     _writeLine(ctx.stderr, "blamejs dev: --grace-ms must be a non-negative number");

package/lib/content-credentials.js

@@ -137,6 +137,15 @@ function _validateBuildOpts(opts) {
  */
 function build(opts) {
   _validateBuildOpts(opts);
+  // A `typeof === "number"` gate alone lets NaN / Infinity / out-of-Date-range
+  // values through, which then crash `new Date(x).toISOString()` with an untyped
+  // RangeError. Config-time inputs reject with a typed error instead.
+  if (opts.generatedAt !== undefined &&
+      (typeof opts.generatedAt !== "number" || !isFinite(opts.generatedAt) ||
+       Math.abs(opts.generatedAt) > 8.64e15)) {
+    throw ContentCredentialsError.factory("content-credentials/bad-generated-at",
+      "contentCredentials.build: generatedAt must be a finite epoch-millis number within the valid Date range");
+  }
   var generatedAt = typeof opts.generatedAt === "number" ? opts.generatedAt : Date.now();
   var manifest = {
     "@context":   "https://c2pa.org/specifications/specifications/2.1/",
@@ -161,7 +170,24 @@ function build(opts) {
     // Optional operator-supplied display assertion (SB-942 §22757(b))
     visibleDisclosure: opts.visibleDisclosure || null,
   };
-  return Object.freeze(manifest);
+  // Deep-freeze — every claim field lives in a nested object (provider/system/
+  // content), so a top-level Object.freeze alone left content.id etc. mutable,
+  // contradicting the documented pre-sign immutability guarantee.
+  return _deepFreeze(manifest);
+}
+
+// Recursively freeze an object graph so no nested claim can be mutated before
+// signing. Cyclic input isn't produced here (manifest is a plain literal tree).
+function _deepFreeze(obj) {
+  if (obj && typeof obj === "object" && !Object.isFrozen(obj)) {
+    var keys = Object.keys(obj);
+    for (var i = 0; i < keys.length; i += 1) {
+      var v = obj[keys[i]];
+      if (v && typeof v === "object") _deepFreeze(v);
+    }
+    Object.freeze(obj);
+  }
+  return obj;
 }
 
 /**
@@ -672,6 +698,15 @@ function signCose(manifest, opts) {
   // 35) when a token was attached.
   var unprotEntries = [];
   if (Array.isArray(opts.certChain) && opts.certChain.length > 0) {
+    // Validate each entry is raw DER bytes — a non-Buffer element would reach
+    // Buffer.concat / _cborBytes and throw an untyped Node ERR_INVALID_ARG_TYPE
+    // instead of an operator-actionable typed rejection.
+    opts.certChain.forEach(function (der, idx) {
+      if (!Buffer.isBuffer(der) && !(der instanceof Uint8Array)) {
+        throw ContentCredentialsError.factory("content-credentials/bad-cert-chain",
+          "contentCredentials.signCose: certChain[" + idx + "] must be a Buffer/Uint8Array of DER bytes");
+      }
+    });
     var chainArray;
     if (opts.certChain.length === 1) {
       // Single-cert form: header value is the DER bytes directly.
@@ -1252,14 +1287,20 @@ function verifyIdentityAssertion(assertion, publicKeyPem, opts) {
   if (supplied.length !== bound.length) {
     return _fail("referenced-assertions-count-mismatch");
   }
+  // Multiset match — consume each bound hash as it is matched so duplicate
+  // supplied hashes ([A, A]) can't satisfy a binding of distinct hashes
+  // ([A, B]) while leaving hash(B) never re-confirmed (a transplant fail-open).
+  var boundRemaining = bound.slice();
   for (var i = 0; i < supplied.length; i += 1) {
-    if (bound.indexOf(supplied[i]) === -1) {
+    var mIdx = boundRemaining.indexOf(supplied[i]);
+    if (mIdx === -1) {
       if (auditOn) {
         audit.safeEmit({ action: "contentcredentials.identity_verified", outcome: "denied",
           metadata: { binding: sp.binding, reason: "assertion-hash-mismatch" } });
       }
       return _fail("assertion-hash-mismatch");
     }
+    boundRemaining.splice(mIdx, 1);
   }
 
   // (3) trust resolution. verified:true ONLY for x509 with a supplied

package/lib/guard-sql.js

@@ -1045,6 +1045,18 @@ function _inspectFragment(rawText, normalized, opts, issues) {
                "with a ? placeholder, or pass allowLiterals:true for a static literal",
     });
   }
+  // A value-expression fragment contains no statement separator at all — any
+  // top-level ';' violates the fragment contract, including a LONE or TRAILING
+  // one ("x = 1;") that the stacked-statement scan misses (it only fires on a
+  // second statement after the ';'). Literals/comments are masked in
+  // `normalized`, so a ';' here is genuinely top-level.
+  if (normalized.indexOf(";") !== -1) {
+    issues.push({
+      code: "sql.refuse", severity: "critical", kind: "semicolon-in-fragment",
+      ruleId: "sql.semicolon-in-fragment",
+      snippet: "top-level ';' in a value-expression fragment — a fragment must be a single expression",
+    });
+  }
 }
 
 // operator-sql mode — exactly one statement (stacked scan already
@@ -1122,6 +1134,23 @@ function _hasEmbeddedStringLiteral(sql) {
       continue;
     }
     if (ch === SQUOTE) return true;
+    // Postgres dollar-quoted string literal opener ($tag$ or $$, tag = identifier
+    // chars or empty) — an embedded dollar-quote is a string literal just like
+    // '...', and the fragment floor must refuse it the same way (the single-quote
+    // check alone let `x = $tag$secret$tag$` bypass the strict embedded-literal gate).
+    if (ch === "$") {
+      // The tag between the opening and closing '$' is identifier chars only
+      // (no '$', which terminates it) — char compares, not a regex literal, to
+      // keep the pattern out of the shared-regex-duplication detector.
+      var j = i + 1;
+      while (j < len) {
+        var tch = sql.charAt(j);
+        if (!((tch >= "a" && tch <= "z") || (tch >= "A" && tch <= "Z") ||
+              (tch >= "0" && tch <= "9") || tch === "_")) break;
+        j += 1;
+      }
+      if (j < len && sql.charAt(j) === "$") return true;
+    }
     i += 1;
   }
   return false;

package/lib/keychain.js

@@ -649,9 +649,20 @@ async function store(opts) {
   }
 
   _validateFallbackFile(opts.fallbackFile, "keychain.store");
-  var doc = await _readFile(opts.fallbackFile, opts.passphrase);
-  doc.entries[_bindingKey(opts.service, opts.account)] = String(opts.password);
-  await _writeFile(opts.fallbackFile, doc, opts.passphrase);
+  // The lock sentinel lives beside fallbackFile, so its parent directory must
+  // exist before the FIRST writer can lock — otherwise the lock (added to
+  // serialize the RMW below) fails where the pre-lock atomicFile.write used to
+  // create the directory lazily on first store.
+  atomicFile.ensureDir(nodePath.dirname(opts.fallbackFile), 0o700);
+  // Serialize the read-modify-write so concurrent stores to the same
+  // fallbackFile can't each read the pre-update document and clobber one
+  // another's binding on write. atomicFile.lock is a cross-process file
+  // mutex; _removeFromFile serializes its RMW through the same lock.
+  await atomicFile.lock(opts.fallbackFile, async function () {
+    var doc = await _readFile(opts.fallbackFile, opts.passphrase);
+    doc.entries[_bindingKey(opts.service, opts.account)] = String(opts.password);
+    await _writeFile(opts.fallbackFile, doc, opts.passphrase);
+  });
   _emit("keychain.stored", "success", {
     service: opts.service, account: opts.account, backend: "file",
   }, auditOn);
@@ -818,13 +829,18 @@ async function remove(opts) {
     }
   }
 
+  // Validate a supplied fallbackFile (reject a relative path) BEFORE the
+  // exists check, so a relative path throws keychain/relative-fallback-file
+  // consistently with store/retrieve instead of silently no-op'ing.
+  if (opts.fallbackFile) {
+    _validateFallbackFile(opts.fallbackFile, "keychain.remove");
+  }
   if (!opts.fallbackFile || !atomicFile.exists(opts.fallbackFile)) {
     _emit("keychain.removed", "no-op", {
       service: opts.service, account: opts.account, backend: "file",
     }, auditOn);
     return false;
   }
-  _validateFallbackFile(opts.fallbackFile, "keychain.remove");
   var existed = await _removeFromFile(opts.fallbackFile, opts.service, opts.account, opts.passphrase);
   _emit("keychain.removed", existed ? "success" : "no-op", {
     service: opts.service, account: opts.account, backend: "file",
@@ -833,12 +849,16 @@ async function remove(opts) {
 }
 
 async function _removeFromFile(fallbackFile, service, account, passphrase) {
-  var doc = await _readFile(fallbackFile, passphrase);
-  var bindingKey = _bindingKey(service, account);
-  if (!Object.prototype.hasOwnProperty.call(doc.entries, bindingKey)) return false;
-  delete doc.entries[bindingKey];
-  await _writeFile(fallbackFile, doc, passphrase);
-  return true;
+  // Same serialized read-modify-write as store: hold the file mutex across
+  // read -> delete -> write so a concurrent store/remove can't lose the edit.
+  return await atomicFile.lock(fallbackFile, async function () {
+    var doc = await _readFile(fallbackFile, passphrase);
+    var bindingKey = _bindingKey(service, account);
+    if (!Object.prototype.hasOwnProperty.call(doc.entries, bindingKey)) return false;
+    delete doc.entries[bindingKey];
+    await _writeFile(fallbackFile, doc, passphrase);
+    return true;
+  });
 }
 
 // ---- Test seam -------------------------------------------------------------

package/lib/mail-auth.js

@@ -294,7 +294,7 @@ function _ipv4InCidr(ip, cidr) {
   var slash = cidr.indexOf("/");
   var net = slash === -1 ? cidr : cidr.slice(0, slash);
   var mask = slash === -1 ? 32 : parseInt(cidr.slice(slash + 1), 10);             // IPv4 max prefix
-  if (mask < 0 || mask > 32) return false;                                       // IPv4 max prefix
+  if (!isFinite(mask) || mask < 0 || mask > 32) return false;                     // IPv4 max prefix
   var ipInt = _ipv4ToInt(ip);
   var netInt = _ipv4ToInt(net);
   if (ipInt === null || netInt === null) return false;
@@ -2123,6 +2123,10 @@ function authResultsEmit(opts) {
 
   var version = (opts.version === undefined || opts.version === null)
     ? "1" : String(opts.version);
+  if (/[\r\n\0]/.test(version)) {
+    throw new MailAuthError("mail-auth/ar-bad-version",
+      "authResults.emit: version contains forbidden control characters");
+  }
   var head = opts.authservId + (version === "1" ? "" : " " + version);
 
   if (opts.results.length === 0) {

package/lib/mcp.js

@@ -149,6 +149,7 @@ function refuse(res, code, message, id) {
   // HTTP status mapping for the JSON-RPC error code we reply with.
   res.statusCode = code === JSONRPC_PARSE_ERROR || code === JSONRPC_INVALID_REQUEST ? 400 :  // HTTP status code (RFC 9110)
                    code === JSONRPC_METHOD_NOT_FOUND ? 404 :                                  // HTTP status code (RFC 9110)
+                   code === JSONRPC_AUTH_REQUIRED ? 401 :                                     // RFC 6750 §3 — bearer challenge is 401
                    code === JSONRPC_INTERNAL_ERROR ? 500 : 400;                              // HTTP status code (RFC 9110)
   res.end(body);
 }
@@ -190,7 +191,11 @@ function _checkRedirectUri(uri, allowlist, errorClass) {
       "mcp: redirect_uri not in allowlist (OAuth 2.1 / RFC 9700 sec 4.1.1)");
   }
   var parsed;
-  try { parsed = safeUrl.parse(uri); }
+  // Allow http: through the PARSE (default is https-only) so a loopback
+  // http://localhost redirect (RFC 8252 native-app / CLI MCP client) reaches
+  // the isHttps||isLocal gate below instead of failing here as "did not parse".
+  // Non-loopback http is still refused by that gate (RFC 9700 §4.1.1).
+  try { parsed = safeUrl.parse(uri, { allowedProtocols: ["https:", "http:"] }); }
   catch (_e) {
     throw errorClass.factory("mcp/bad-redirect-uri",
       "mcp: redirect_uri did not parse");
@@ -321,7 +326,11 @@ function serverGuard(opts) {
         req.mcpClaims = claims || null;
 
         var path = String(req.url || "").split("?")[0];
-        if (path === "/register" || path.endsWith("/register")) {
+        // Strip trailing slashes for the match — most routers normalize
+        // `/register/` to the same handler, so the guard must too (an exact/
+        // suffix match on the raw path let `/register/` slip past the refusal).
+        var normPath = path.replace(/\/+$/, "");
+        if (normPath === "/register" || normPath.endsWith("/register")) {
           if (!allowDynamicRegister) {
             _emitDenied(req, "mcp.register.refused-static", "dynamic registration disabled", { path: path });
             return refuse(res, JSONRPC_METHOD_NOT_FOUND, "dynamic client registration is not permitted");
@@ -663,7 +672,22 @@ function _validateValueAgainstSchema(value, schema, path) {
     if (typeof schema.minimum === "number" && value < schema.minimum) return path + ": " + value + " < minimum " + schema.minimum;
     if (typeof schema.maximum === "number" && value > schema.maximum) return path + ": " + value + " > maximum " + schema.maximum;
   }
-  if (t === "object" && value && typeof value === "object" && !Array.isArray(value)) {
+  // A schema with `properties`/`required`/`additionalProperties` but no explicit
+  // `type: "object"` is valid + common JSON Schema — treat it as an object schema
+  // so those constraints are ENFORCED, not silently skipped (fail-open on the
+  // whole validation gate, OWASP LLM07).
+  var describesObject = t === "object" || (t === undefined &&
+    (schema.properties !== undefined || schema.required !== undefined ||
+     schema.additionalProperties !== undefined));
+  if (describesObject) {
+    // An inferred object schema (no explicit `type`) skips the top type-match,
+    // so a scalar / null / array would otherwise pass by simply skipping the
+    // checks below — the exact fail-open this branch exists to close. Reject a
+    // non-object value explicitly.
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      return path + ": expected object, got " +
+        (Array.isArray(value) ? "array" : (value === null ? "null" : typeof value));
+    }
     if (Array.isArray(schema.required)) {
       for (var ri = 0; ri < schema.required.length; ri++) {
         if (!Object.prototype.hasOwnProperty.call(value, schema.required[ri])) {
@@ -766,7 +790,9 @@ var MCP_PROTOCOL_VERSIONS_ACCEPTED = ["2024-11-05", "2025-03-26", "2025-06-18",
  */
 function _assertProtocolVersion(req, opts) {
   opts = opts || {};
-  var accepted = Array.isArray(opts.accepted) && opts.accepted.length > 0
+  // An explicit empty `accepted: []` means "accept no version" (reject all), not
+  // "fall back to the default set" — only an absent/non-array value defaults.
+  var accepted = Array.isArray(opts.accepted)
     ? opts.accepted : MCP_PROTOCOL_VERSIONS_ACCEPTED;
   var hdr = req && req.headers && req.headers["mcp-protocol-version"];
   if (typeof hdr !== "string" || hdr.length === 0) {
@@ -854,6 +880,13 @@ function _samplingGuard(opts) {
       throw new McpError("mcp/sampling-too-many-messages",
         "sampling.guard: " + messages.length + " messages > maxMessagesPerRequest=" + maxMsg);
     }
+    // Reject a non-number maxTokens on this untrusted, server-initiated surface
+    // — a string "999999" would otherwise skip the numeric cap entirely and a
+    // downstream SDK that coerces it would blow past the budget (type-confusion).
+    if (samplingRequest.maxTokens !== undefined && typeof samplingRequest.maxTokens !== "number") {
+      throw new McpError("mcp/sampling-bad-max-tokens",
+        "sampling.guard: maxTokens must be a number");
+    }
     if (typeof samplingRequest.maxTokens === "number" && samplingRequest.maxTokens > maxTokens) {
       throw new McpError("mcp/sampling-too-many-tokens",
         "sampling.guard: requested maxTokens " + samplingRequest.maxTokens +

package/lib/metrics.js

@@ -282,7 +282,15 @@ function _resolveLabels(defaultLabels, declaredNames, callLabels) {
         "label '" + declaredNames[n] + "' is required (declared in labelNames)");
     }
   }
-  return out;
+  // Redact credential-shaped values on the resolved labels themselves — the
+  // stored entry.labels are rendered verbatim into the exposition stream, so
+  // redacting only inside _labelsKey (the Map cardinality key) left raw bearer
+  // tokens / API keys / JWTs reaching /metrics. _labelsKey re-runs the same
+  // coercion, so this stays idempotent.
+  var redacted = {};
+  var ok = Object.keys(out);
+  for (var r = 0; r < ok.length; r++) redacted[ok[r]] = _validateLabelValue(out[ok[r]]);
+  return redacted;
 }
 
 // ---- registry factory ----
@@ -384,6 +392,10 @@ function create(opts) {
       values:     values,
       inc: function (callLabels, n) {
         var arg = _normalizeLabelArg(callLabels, n, 1);
+        if (typeof arg.value !== "number" || !isFinite(arg.value)) {
+          throw new MetricsError("metrics/counter-bad-value",
+            "counter.inc value must be a finite number");
+        }
         if (arg.value < 0) {
           throw new MetricsError("metrics/counter-decrement",
             "counter.inc value must be >= 0 (got " + arg.value + ") — counters never decrease");
@@ -454,7 +466,7 @@ function create(opts) {
       values:     values,
       set: function (callLabels, v) {
         var arg = _normalizeLabelArg(callLabels, v, NaN);
-        if (typeof arg.value !== "number" || isNaN(arg.value)) {
+        if (typeof arg.value !== "number" || !isFinite(arg.value)) {
           throw new MetricsError("metrics/gauge-bad-value",
             "gauge.set value must be a finite number");
         }
@@ -520,7 +532,7 @@ function create(opts) {
       values:     values,
       observe: function (callLabels, v, exemplar) {
         var arg = _normalizeLabelArg(callLabels, v, NaN);
-        if (typeof arg.value !== "number" || isNaN(arg.value)) {
+        if (typeof arg.value !== "number" || !isFinite(arg.value)) {
           throw new MetricsError("metrics/histogram-bad-value",
             "histogram.observe value must be a finite number");
         }

package/lib/middleware/tus-upload.js

@@ -157,8 +157,12 @@ function _parseChecksumHeader(headerValue, allowedSet) {
   var algo = kvp.key;
   var digestB64 = kvp.value.trim();
   if (algo.length === 0 || digestB64.length === 0) return { error: "malformed" };
-  if (!allowedSet[algo]) return { error: "algo-unsupported" };
+  // hasOwnProperty-guarded lookups — a bare `allowedSet[algo]` resolves
+  // Object.prototype for algo="__proto__"/"constructor" (truthy), bypassing the
+  // unsupported-algo guard and handing createHash a non-string → HTTP 500.
+  if (!Object.prototype.hasOwnProperty.call(allowedSet, algo)) return { error: "algo-unsupported" };
   if (!/^[A-Za-z0-9+/=]+$/.test(digestB64)) return { error: "malformed" };
+  if (!Object.prototype.hasOwnProperty.call(KNOWN_CHECKSUM_ALGORITHMS, algo)) return { error: "algo-unsupported" };
   var nodeAlgo = KNOWN_CHECKSUM_ALGORITHMS[algo];
   if (!nodeAlgo) return { error: "algo-unsupported" };
   return { algo: algo, nodeAlgo: nodeAlgo, digestB64: digestB64 };
@@ -570,7 +574,10 @@ function create(opts) {
     if (rec.length === null && req.headers["upload-length"] !== undefined) {
       // Upload-Defer-Length finalization (§4.3) — declare length on first PATCH
       var declared = parseInt(req.headers["upload-length"], 10);
-      if (!isFinite(declared) || declared < 0) {
+      // Same strict parse the POST creation path uses — reject trailing junk
+      // ("10abc" → 10, "0x10" → 0) rather than parseInt-ing leniently.
+      if (!isFinite(declared) || declared < 0 ||
+          String(declared) !== String(req.headers["upload-length"]).trim()) {
         return _writeError(res, STATUS_BAD_REQUEST, "Upload-Length must be a non-negative integer");
       }
       if (maxSize !== undefined && declared > maxSize) {

package/lib/network-smtp-policy.js

@@ -675,7 +675,10 @@ async function tlsRptSubmit(report, opts) {
           body:    gzipped,
           timeoutMs: timeoutMs,
         });
-        entry.status = rv && rv.status;
+        // The framework httpClient resolves { statusCode, headers, body }
+        // (same shape mtaSts.fetch reads above) — not { status }. Reading
+        // the wrong field marked every real 2xx submission as a failure.
+        entry.status = rv && rv.statusCode;
         entry.ok = entry.status >= 200 && entry.status < 300;                  // HTTP 2xx range
         if (!entry.ok) entry.error = "HTTP " + entry.status;
       } else if (/^mailto:/i.test(uri)) {

package/lib/parsers/safe-yaml.js

@@ -262,6 +262,14 @@ function parse(input, opts) {
       return _parseBlockSequence(k, indent, depth);
     }
 
+    // Root-level flow collection ({...} / [...]) — recognize the flow bracket
+    // BEFORE the block-mapping key scan. Otherwise a root JSON/flow object like
+    // '{a: 1, b: 2}' matches the block-mapping key scan (the first ': ' makes
+    // '{a' look like a bare key) and silently returns structurally-wrong data.
+    if (content.charAt(0) === "{" || content.charAt(0) === "[") {
+      return { value: _parseInlineValue(content, firstLine.lineNumber, indent), nextLine: k + 1 };
+    }
+
     // Block mapping starts with a key (bare or quoted) followed by `:`.
     var keyRange = _scanKeyRange(content, firstLine.lineNumber, indent);
     if (keyRange) {
@@ -493,8 +501,19 @@ function parse(input, opts) {
     // Strip trailing whitespace/comment already done by caller (mostly).
     // Handle: flow [...] / {...}, quoted strings, plain scalars.
     var t = text;
-    if (t.charAt(0) === "[") return _parseFlowSequence(t, lineNumber, col, 0);
-    if (t.charAt(0) === "{") return _parseFlowMapping(t, lineNumber, col, 0);
+    if (t.charAt(0) === "[" || t.charAt(0) === "{") {
+      // Reject trailing junk after a flow collection (matching the quoted-scalar
+      // branch below) using _parseFlowValue's end position, then return the value
+      // via the direct parser so the shape is identical to the pre-existing path.
+      var fend = _parseFlowValue(t, 0, lineNumber, col, 0).nextPos;
+      var afterFlow = t.slice(fend).replace(/^\s+/, "");
+      if (afterFlow.length > 0 && afterFlow.charAt(0) !== "#") {
+        throw new SafeYamlError("unexpected content after flow collection",
+          "yaml/trailing-content", lineNumber, col);
+      }
+      return t.charAt(0) === "[" ? _parseFlowSequence(t, lineNumber, col, 0)
+                                 : _parseFlowMapping(t, lineNumber, col, 0);
+    }
     if (t.charAt(0) === '"') {
       var dq = _decodeDoubleQuoted(t, lineNumber, col);
       var afterDq = _trailingAfterQuoted(t, '"');
@@ -570,6 +589,18 @@ function parse(input, opts) {
         throw new SafeYamlError("forbidden key '" + key + "'",
           "yaml/poisoned-key", lineNumber, col + p);
       }
+      // Mirror the block-mapping guards so flow style can't bypass them:
+      // the merge key '<<' is banned, and a duplicate key is refused (block
+      // rejects both; flow previously accepted '<<' as a literal key and
+      // silently kept the LAST value on a repeat — a config-override risk).
+      if (key === "<<") {
+        throw new SafeYamlError("merge key '<<' not supported (anchor-using feature)",
+          "yaml/merge-key-banned", lineNumber, col + p);
+      }
+      if (Object.prototype.hasOwnProperty.call(result, key)) {
+        throw new SafeYamlError("duplicate mapping key '" + key + "'",
+          "yaml/duplicate-key", lineNumber, col + p);
+      }
       _bumpKeys(lineNumber);
       p = keyVal.nextPos;
       p = _flowSkipWsIndex(text, p);

package/lib/router.js

@@ -44,6 +44,7 @@ var requestHelpers = require("./request-helpers");
 var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
 var safeEnv = require("./parsers/safe-env");
+var safeJson = require("./safe-json");
 var safeUrl = require("./safe-url");
 var validateOpts = require("./validate-opts");
 var websocket = require("./websocket");
@@ -163,9 +164,25 @@ function _makeSchemaValidator(spec) {
   };
 }
 
+// True when a res.end body structurally looks like a JSON document — the
+// first non-whitespace byte is an object/array opener. Narrow on purpose:
+// a plain-text / HTML body on a response-schema route (leading "<", a bare
+// word, etc.) is skipped so the validator never throws on a non-JSON
+// response, and a JSON scalar (a bare number / quoted string) is not
+// mistaken for a schema-shaped document.
+function _bodyLooksLikeJson(text) {
+  for (var i = 0; i < text.length; i += 1) {
+    var ch = text.charCodeAt(i);
+    if (ch === 0x20 || ch === 0x09 || ch === 0x0A || ch === 0x0D) continue;   // skip leading whitespace
+    return ch === 0x7B || ch === 0x5B;                                        // "{" or "["
+  }
+  return false;
+}
+
 function _makeResponseValidator(spec) {
-  // Wraps res.json (and res.end when called with a JSON-shaped buffer)
-  // to validate the response body against spec.response. Mode:
+  // Validate the response body against spec.response no matter which exit
+  // the handler used — res.json OR a raw res.end(JSON.stringify(...)) that
+  // ships a JSON-shaped buffer. Mode:
   //   - BLAMEJS_VALIDATE_RESPONSES=throw (or per-route validateResponse: "throw")
   //     → throw a SafeSchemaError-shaped error; route handler's caller sees a 500.
   //   - BLAMEJS_VALIDATE_RESPONSES=warn (or per-route validateResponse: "warn")
@@ -177,21 +194,59 @@ function _makeResponseValidator(spec) {
   if (!mode) return function passthrough(_req, _res, next) { next(); };
 
   return function responseValidator(req, res, next) {
+    // One request-scoped check shared by both the res.json and res.end
+    // wrappers so a single failure shape covers every exit.
+    var validated = false;
+    function runCheck(value, headersAlreadySent) {
+      var rr = spec.response.safeParse(value);
+      if (rr.ok) return;
+      if (mode === "throw") {
+        // A raw res.end after writeHead cannot be un-sent — throwing there
+        // would abort mid-flush and can't reach a clean 500. Degrade to a
+        // logged error in that case; res.json (and a pre-writeHead res.end)
+        // still throw before any header is committed.
+        if (!headersAlreadySent) {
+          throw new Error("router response-validation failed for " +
+            (req.method + " " + req.routePattern) + ": " +
+            JSON.stringify(rr.errors));
+        }
+        log.error("response-validation failed after headers sent on " +
+                  req.method + " " + req.routePattern + ": " +
+                  JSON.stringify(rr.errors).slice(0, 500));
+        return;
+      }
+      // warn mode
+      log.warn("response-validation drift on " + req.method + " " + req.routePattern +
+               ": " + JSON.stringify(rr.errors).slice(0, 500));
+    }
+
     var origJson = typeof res.json === "function" ? res.json.bind(res) : null;
     if (origJson) {
       res.json = function (value) {
-        var rr = spec.response.safeParse(value);
-        if (!rr.ok) {
-          if (mode === "throw") {
-            throw new Error("router response-validation failed for " +
-              (req.method + " " + req.routePattern) + ": " +
-              JSON.stringify(rr.errors));
+        runCheck(value, false);   // res.json validates before it writes headers
+        validated = true;         // res.json delegates to res.end internally — don't re-check
+        return origJson(value);
+      };
+    }
+
+    var origEnd = typeof res.end === "function" ? res.end.bind(res) : null;
+    if (origEnd) {
+      res.end = function (chunk) {
+        if (!validated) {
+          var text = null;
+          if (typeof chunk === "string") text = chunk;
+          else if (Buffer.isBuffer(chunk)) text = chunk.toString("utf8");
+          if (text !== null && _bodyLooksLikeJson(text)) {
+            var parsed;
+            var parsedOk = true;
+            try { parsed = safeJson.parse(text); } catch (_e) { parsedOk = false; }
+            if (parsedOk) {
+              validated = true;
+              runCheck(parsed, res.headersSent === true);
+            }
           }
-          // warn mode
-          log.warn("response-validation drift on " + req.method + " " + req.routePattern +
-                   ": " + JSON.stringify(rr.errors).slice(0, 500));
         }
-        return origJson(value);
+        return origEnd.apply(res, arguments);
       };
     }
     next();
@@ -958,16 +1013,24 @@ class Router {
             "res.redirect: target must be a non-empty string"
           );
         }
-        // Reject embedded CR / LF / NUL early — header injection class.
-        // Node's writeHead would refuse these too, but the explicit
-        // refusal here gives operators a router-shaped error rather than
-        // a generic ERR_INVALID_CHAR.
+        // Reject every byte a header line or a URL-parsing user agent
+        // treats specially. CR / LF / NUL are the header-injection class
+        // (Node's writeHead would refuse them too — the explicit refusal
+        // gives operators a router-shaped error over ERR_INVALID_CHAR).
+        // TAB (0x09) is the open-redirect class: Node PERMITS a horizontal
+        // tab in a header value, but WHATWG URL removes ASCII TAB / LF / CR
+        // from a URL before parsing it, so "/<TAB>/evil.example" — which
+        // the same-origin heuristic below reads as a rooted path — collapses
+        // to the protocol-relative "//evil.example" in the browser and
+        // bounces to an attacker origin. Refuse the whole browser-stripped
+        // set here so the byte the heuristic inspects is the byte the user
+        // agent parses.
         for (var ci = 0; ci < url.length; ci += 1) {
           var cc = url.charCodeAt(ci);
-          if (cc === 0x00 || cc === 0x0A || cc === 0x0D) {
+          if (cc === 0x00 || cc === 0x09 || cc === 0x0A || cc === 0x0D) {
             throw new RouterError(
               "router/redirect-target-has-control-chars",
-              "res.redirect: target must not contain CR / LF / NUL bytes"
+              "res.redirect: target must not contain CR / LF / TAB / NUL bytes"
             );
           }
         }

package/lib/safe-buffer.js

@@ -69,7 +69,17 @@ class SafeBufferError extends FrameworkError {
 
 function _throw(errorClass, message, code) {
   var Cls = errorClass || SafeBufferError;
-  throw new Cls(message, code);
+  var err = new Cls(message, code);
+  // SafeBufferError takes (message, code) but a defineClass errorClass (the
+  // convention for every framework-error, e.g. a caller's TusError) takes
+  // (code, message) — the opposite order — so `new Cls(message, code)` would
+  // SWAP .code/.message for such a class (a caller branching on e.code then
+  // never matches). Set both fields explicitly so they are correct whichever
+  // constructor order the passed class uses; the class-derived flags are set
+  // from the class options, not the code value, so this is safe.
+  err.code = code;
+  err.message = message;
+  throw err;
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.1",
+  "version": "0.16.3",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c7d7addc-92d7-4060-8b48-b51d9726a093",
+  "serialNumber": "urn:uuid:3e7515ff-90ec-4d95-be2f-ec3082f1f6d8",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-03T05:24:29.849Z",
+    "timestamp": "2026-07-03T23:06:39.610Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.1",
+      "bom-ref": "@blamejs/core@0.16.3",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.1",
+      "version": "0.16.3",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.1",
+      "purl": "pkg:npm/%40blamejs/core@0.16.3",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.1",
+      "ref": "@blamejs/core@0.16.3",
       "dependsOn": []
     }
   ]