@blamejs/core 0.16.3 → 0.16.5

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.5 (2026-07-03) — **Correctness fixes across the ReDoS guard, Base32 codec, HTTP multipart builder, SAML encrypted-assertion decryption, and the OAuth device grant — several restore advertised functionality that was silently non-working, plus a multipart header-injection fix.** This patch fixes a batch of correctness and security defects, several of which restore advertised behaviour that never actually worked. The ReDoS guard (b.guardRegex) no longer false-rejects LINEAR patterns that use a quantified non-capturing group (`(?:…)?`, `(?:…)*`) or an optional quantified group (`(X+)?`, `(?:X+)?`) — those repeat the group at most once and are not catastrophic; the detector now correctly requires the OUTER quantifier to be unbounded, so operator regex screening and b.selfUpdate asset patterns that use an optional SemVer suffix work again while genuine `(a+)+` shapes are still refused. The Base32 decoder now rejects NON-CANONICAL input (a final symbol whose unused low bits are non-zero — previously two distinct strings decoded to the same bytes, a malleability problem for the TOTP secrets and identifiers Base32 backs) and impossible symbol counts (1/3/6 mod 8 that silently produced a truncated buffer). The HTTP multipart/form-data builder now refuses CR/LF/NUL in a field name, filename, or content-type, closing a part-header-injection / form-part-forgery path. Two SAML EncryptedAssertion decryption paths that were completely dead — ML-KEM-1024 key transport and XChaCha20-Poly1305 content — are fixed (they referenced crypto entry points that were never exported, so the framework's advertised PQC-first / AEAD SAML encryption always failed and misreported the cause as a wrong-key or tag-mismatch error). The OAuth device grant now works against spec-compliant identity providers (its poll aborted on the first `authorization_pending`, which RFC 8628 delivers as an HTTP 400 the client was rejecting before reading), and a static (non-discovery) OAuth client can now use introspection, dynamic registration, and device authorization by configuring those endpoints. Smaller fixes round it out: the HTTP client's default error carries statusCode/permanent; the CLI dev server's repeatable flags accumulate; DANE and MTA-STS failures are scoped correctly per RFC; and typed errors replace raw TypeErrors on a couple of malformed-input paths. **Fixed:** *HTTP client default error carries statusCode and permanent* — request() fell back to the base FrameworkError when no explicit opts.errorClass was passed, so error.statusCode and error.permanent were undefined on the default path despite the documented default of HttpClientError. The default is now HttpClientError, so those fields are populated for every consumer. · *Static OAuth clients can configure introspection / registration / device-authorization endpoints* — create() never read opts.introspectionEndpoint / registrationEndpoint / deviceAuthorizationEndpoint into its static-endpoint set, so introspectToken / registerClient / deviceAuthorization resolved those endpoints only via OIDC discovery — a static (non-discovery) client could not use them, even though introspectToken's own error told operators to set the endpoint on create(). Those three endpoints are now honored from static config. · *CLI dev server repeatable flags accumulate* — `blamejs dev --arg / --watch / --ignore` are documented repeatable, but the argument parser overwrote each on repeat, so only the last occurrence survived — only the last --watch directory was monitored, only the last --ignore applied, and the child received only the last --arg. Repeated occurrences of these flags now accumulate as documented. · *DANE per-recipient failure isolation and MTA-STS testing-mode handling* — A DANE-enforce TLSA-lookup failure threw out of the entire deliver() batch instead of failing just the one recipient; it now fails that recipient and lets the rest proceed. And an MTA-STS policy published in `testing` mode was hard-bounced under the default enforce posture, violating RFC 8461 §5.2 (testing mode is report-only); a testing-mode policy no longer blocks delivery. · *external-db validates defaultBackend and enforces the pool min floor* — init() did not validate that opts.defaultBackend named a registered backend, so a typo surfaced as an opaque TypeError at the first query instead of a typed config-time error; it is now validated at init. The pool `min` (documented as a floor on idle clients) was never enforced; the reaper now respects it. · *mail-bounce returns a typed error for a null SES SNS message* — An SES SNS notification whose Message field is JSON literal `null` dereferenced null and threw a raw TypeError (also risking an internal-message leak); it now throws the typed MailBounceError like the other malformed-input paths. **Security:** *b.guardRegex no longer false-rejects linear quantified-group patterns (#432, #429)* — The nested-quantifier ReDoS detector treated the `?` in a `(?:` group prefix as an inner quantifier and treated a bounded outer `?` / `{0,1}` as a dangerous outer quantifier, so it wrongly refused LINEAR patterns like `^(?:/page/\d+)?$`, `^foo(?:bar)*$`, `^(a+)?$`, and `(?:[-+][0-9A-Za-z.-]+)?`. The catastrophic class requires the OUTER quantifier to be unbounded (`*`/`+`/`{n,}`). The detector now relies solely on the paren-aware structural scanner, which requires an unbounded outer quantifier and does not miscount a group prefix — so genuine `(a+)+` / `((a)+)+` shapes stay refused while these linear ones are accepted. Consumers screening operator-supplied regexes (route rules, and b.selfUpdate asset patterns using an optional SemVer prerelease/build group) are no longer forced to rewrite valid input. · *Base32 decoder rejects non-canonical encodings and impossible lengths* — b.base32.decode discarded the final symbol's unused low bits without checking they were zero (RFC 4648 §3.5), so two distinct strings — e.g. `MY======` and `MZ======` — decoded to the same bytes (decoder malleability), and it silently accepted impossible symbol counts (1/3/6 mod 8) that can't represent whole bytes, returning a truncated buffer. Both are now refused (`base32/non-canonical`, `base32/bad-length`), giving a one-to-one mapping between a byte sequence and its Base32 string — important where the string is a key / secret / dedup handle (TOTP, identifiers). Valid input, including unpadded and loose-mode input, is unaffected. · *HTTP multipart/form-data builder refuses CR/LF/NUL in part-header values* — The multipart body builder interpolated the field name, file field, filename, and content-type onto `Content-Disposition:` / `Content-Type:` part-header lines without a control-character check, so an attacker controlling one of those values could smuggle a CRLF and inject additional part headers or forge form parts. CR, LF, and NUL in any of those values are now refused, matching the header-safety the mail-header sweep already applies to RFC 822 lines. · *SAML EncryptedAssertion ML-KEM-1024 and XChaCha20-Poly1305 decryption now work* — verifyResponse's post-quantum key-transport branch and its XChaCha20-Poly1305 content branch called crypto entry points that the crypto module never exported, so every ML-KEM-1024-wrapped or XChaCha20-Poly1305-encrypted SAML assertion failed with an internal TypeError that was re-reported as a key-unwrap or tag-mismatch error — the advertised PQC-first / AEAD SAML encryption was dead. Both paths now route through the exported envelope-open and packed-AEAD primitives, verified with a full encrypt→decrypt round trip. Fails closed (no auth bypass) either way. · *OAuth device grant polls correctly against spec-compliant providers* — pollDeviceCode issued its token request in the default buffering mode, so the HTTP client rejected the HTTP 400 that RFC 8628 §3.5 / RFC 6749 §5.2 use to carry `authorization_pending` / `slow_down` before the poll loop could read the OAuth error body — the grant aborted on the first poll (which is almost always `authorization_pending`, since the user hasn't approved yet). The request now resolves 4xx OAuth error responses so the pending / slow-down / terminal handling runs and the device grant completes.
+
+- v0.16.4 (2026-07-03) — **A CalDAV/CardDAV path-traversal fix, an SMTP BDAT body-corruption fix, and a database-stream off-by-one — plus five smaller robustness fixes — surfaced by a large expansion of command-handler and error-branch test coverage across the mail servers, DNS, TLS and database primitives.** This patch fixes a batch of defects concentrated in the error and adversarial-input paths of the mail-server, DNS, TLS and database primitives, found while substantially expanding the automated test suite over their command handlers and failure branches. The most serious is a CalDAV/CardDAV path-traversal: the request-path guard rejected a literal `..` or `%2e%2e` before decoding, but each path segment was then percent-decoded and handed to the storage backend — so a MIXED encoding such as `.%2e` (neither form the guard checks) slipped through and decoded to `..`, reaching the operator's storage backend with a traversal segment. Path segments are now validated AFTER decoding. On the SMTP submission path, the message body was dot-stuffed (SMTP DATA transparency) inside the message builder and that same body was reused for RFC 3030 BDAT/CHUNKING chunks — which are length-framed and are NOT un-stuffed by the receiver — so any body line beginning with `.` was delivered with a spurious doubled dot to every peer advertising CHUNKING (Gmail/Outlook/Exchange/Postfix all do); dot-stuffing now applies only on the DATA path. The database row-streamer had an off-by-one: a result set of exactly `streamLimit` rows errored with `db/stream-limit-exceeded` instead of completing, because the cap was checked before the iterator could report done — so a valid, complete export surfaced as a stream error. Five smaller fixes round it out: CalDAV/CardDAV now return 400 (not 500) for a malformed/empty client request body; `dns.resolve` rejects a non-string record type with a typed error instead of an untyped TypeError; the DNS negative cache is honored when an explicit negative TTL is set even if the positive TTL is 0; and the Resend mail transport handles a literal JSON `null` response body without taking a mislabeled error path. **Fixed:** *SMTP BDAT/CHUNKING no longer corrupts body lines beginning with a dot* — The RFC 822 message builder applied SMTP DATA-transparency dot-stuffing (a leading `.` on a line is doubled) to the body, and the submission transport reused that same body for RFC 3030 BDAT chunks. BDAT framing is purely length-based and receivers do NOT un-stuff it, so a body line starting with `.` was delivered with an extra leading dot to any peer advertising CHUNKING (which Gmail, Outlook, Exchange and Postfix all do — CHUNKING is default-on). Dot-stuffing is now applied only when framing via DATA; the message the builder produces (and that DKIM signs) is the un-stuffed body the receiver verifies, and the BDAT path sends it verbatim. · *db.stream no longer errors on a result set of exactly streamLimit rows* — The stream's per-read cap was checked at the top of the read callback, before the row iterator could report completion, so after emitting exactly `streamLimit` rows the next read destroyed the stream with `db/stream-limit-exceeded` even though the count never exceeded the cap — turning a valid, complete export into an error event. The cap is now enforced after pulling the next row and checking for end-of-results, so exactly-`streamLimit` rows complete cleanly and only a row BEYOND the cap trips the guard. · *CalDAV/CardDAV return 400 for a malformed or empty client request body* — A malformed PROPFIND/REPORT XML body (or an empty REPORT body) threw from the body parser into the generic dispatch catch, which unconditionally returned 500 — inconsistent with MKCALENDAR/MKCOL, which already return 400 for the same input. Client-fault body-parse errors now return 400 (Bad Request); a genuine server-side backend throw still returns 500. · *dns.resolve rejects a non-string record type with a typed error* — `dns.resolve(host, type)` called `.toUpperCase()` on whatever `type` was passed, so a non-string (e.g. a number) threw a raw `TypeError` with no code and no `.permanent` flag — unlike an unknown STRING type, which throws a typed `dns/unsupported-type`. A caller keying on the documented `err.permanent` retry contract would have read undefined (falsy) and treated an unfixable input as retryable. A non-string type is now rejected with the typed error. · *DNS negative cache honors an explicit negative TTL when the positive TTL is 0* — The negative-response cache early-returned whenever the positive `cacheTtlMs` was 0, so `setCacheTtlMs(0, 60000)` (positive caching off, negative caching 60s) silently never populated the negative cache — the accepted negative TTL was not applied. The negative cache now uses the explicit negative TTL even when the positive TTL is 0. · *Resend transport handles a literal JSON null response body* — The Resend mail transport parsed the response body then dereferenced `data.id`; a literal JSON `null` body parses to `null`, so the dereference threw a raw TypeError that was reported as an interpret failure rather than the intended bad-response verdict. A null/absent parsed body is now treated as a bad response directly. **Security:** *CalDAV/CardDAV path-traversal via mixed percent-encoding is refused* — `_parsePath` rejected a literal `..`, `%2e%2e`, `%00` or NUL in the RAW request path, but then percent-decoded each segment and passed the decoded value (principalId / collection / component id) straight to the storage backend (getComponent / putComponent / listComponents / …). A mixed encoding such as `.%2e` or `%2e.` contains neither a literal `..` nor `%2e%2e`, so it passed the pre-decode guard and decoded to `..`, reaching the backend with a traversal segment. Each segment is now validated AFTER decoding — any decoded `.` / `..` / NUL / embedded path separator is refused — matching the decode-once-then-validate discipline the router already applies.
+
 - v0.16.3 (2026-07-03) — **A batch of fail-open, injection-bypass and error-path fixes across the metrics, guard-sql, MCP, YAML-parser, content-credentials, tus-upload and buffer primitives — including a credential-leak fix on the /metrics exposition surface — alongside a further expansion of the automated test suite.** This patch closes a set of security and robustness defects concentrated in the error-handling and adversarial-input paths of the observability, SQL-guard, MCP, YAML-parsing, content-credentials and resumable-upload primitives, surfaced while continuing to expand the automated test suite. The most consequential: credential-shaped metric label values were redacted only in the internal cardinality key, not in the rendered exposition, so a raw bearer token / API key / JWT placed on a label leaked verbatim to every `/metrics` scrape reader — redaction now applies to the stored labels the exposition renders. The SQL guard's fragment mode (the `whereRaw` escape hatch) refused an embedded single-quoted literal but not a PostgreSQL dollar-quoted string (`$tag$…$tag$`) or a lone top-level `;`, so operator concatenation into a dollar-quoted context bypassed the floor that forces `?`-placeholder binding. MCP tool-input validation was fail-open when a JSON Schema omitted an explicit top-level `type:"object"` (a valid, common shape) — `required`/`properties`/`additionalProperties` were skipped and any input accepted; and its server-initiated sampling token cap was bypassable with a string `maxTokens`. The YAML parser's flow style (`{…}` / `[…]`) accepted duplicate keys and the merge key that block style rejects — letting a later value silently override an earlier one a preceding check had already read — and mis-parsed a root-level JSON object. content-credentials returned a only shallowly-frozen manifest (nested claim fields stayed mutable before signing), and its identity-assertion hash re-check used set membership rather than multiset matching, so duplicate referenced assertions could leave a bound assertion never re-confirmed. Robustness fixes round out the batch: metrics now reject `±Infinity`; the buffer collector preserves a caller error class's code/message (they were swapped for framework error classes, so a caller branching on the error code — e.g. a resumable-upload `413` vs `400` — never matched); resumable uploads return `413` (not a `400` that leaked the internal error code) on an oversized chunk, reject a prototype-key checksum algorithm with `400` (not `500`), and parse a deferred `Upload-Length` as strictly as creation; the MCP guard refuses `/register/` (trailing slash) like `/register`, answers a missing/invalid bearer with `401` and its `WWW-Authenticate` challenge instead of `400`, honors an explicit empty accepted-version list, and accepts a loopback `http` redirect URI for native/CLI clients while still refusing non-loopback `http`. **Fixed:** *Metrics reject non-finite values* — `gauge.set`, `histogram.observe` and `counter.inc` guarded their value with an `isNaN`-only check (counter only checked `< 0`), so `±Infinity` passed and produced `Infinity` / `-Infinity` in the exposition — invalid Prometheus 0.0.4 / OpenMetrics, which a scraper rejects. All three now require a finite number, matching their `must be a finite number` error text. · *Buffer stream collector preserves a caller error class's code and message* — `safeBuffer.collectStream` constructs its size-limit error with `(message, code)`, matching its own error class — but a framework error class (the convention elsewhere) takes `(code, message)`, the opposite order, so a caller that passed its own error class received an error with `code` and `message` swapped. A caller branching on the error code then never matched — for example the resumable-upload handler mapped an oversized chunk to `400` instead of `413`. The collector now sets both fields explicitly so they are correct whichever constructor order the passed class uses. · *Resumable upload: correct status codes and strict deferred-length parse* — An oversized `PATCH`/creation chunk now returns `413 Payload Too Large` instead of a `400` whose body leaked the internal error code; an `Upload-Checksum` naming a prototype key (e.g. `__proto__`) returns `400 unsupported` instead of a `500` from an unguarded lookup; and a deferred-length finalization now parses `Upload-Length` with the same strict check as creation, rejecting trailing junk (`"10abc"`) rather than silently truncating it. · *MCP guard: trailing-slash registration refusal, 401 bearer challenge, empty accepted-version list* — The static-registration refusal matched `/register` exactly or by suffix, so `/register/` — which most routers normalize to the same handler — slipped through; it is now refused too. A missing or invalid bearer now returns `401 Unauthorized` with its `WWW-Authenticate` challenge (RFC 6750 §3) instead of `400`, so clients keyed on `401` re-authenticate. And an explicit empty `accepted` protocol-version list now rejects every version instead of silently widening to the default set. · *MCP accepts a loopback `http` redirect URI* — `redirect_uri` validation parsed the URI with the default HTTPS-only protocol set, so a loopback `http://localhost/…` redirect (RFC 8252 native-app / CLI client, permitted by RFC 9700 §4.1.1) failed as `did not parse` before the local-host allowance could run. The parse now admits `http` so the loopback allowance applies; a non-loopback `http` redirect is still refused. · *YAML: trailing content after a flow collection and root-level JSON objects* — `root: [1, 2] junk` silently dropped the trailing content where the quoted-scalar path rejects it; trailing content after a flow collection is now refused (`yaml/trailing-content`). A root-level flow/JSON object (`{"a": 1, "b": 2}`) was mis-scanned as a block mapping with a garbage key and returned structurally-wrong data; the leading flow bracket is now recognized before the block-mapping scan so a root JSON object parses correctly. · *content-credentials: deep-frozen manifest and typed rejections for bad build/sign inputs* — `build` returned a shallowly-frozen manifest, leaving every nested claim field (`provider`/`system`/`content`) mutable before signing despite the documented pre-sign immutability guarantee; the manifest is now deep-frozen. A non-finite or out-of-Date-range `generatedAt` (`NaN` / `Infinity`) crashed with an untyped `RangeError`, and a non-Buffer `certChain` entry to `signCose` threw an untyped Node `TypeError`; both now reject with a typed `content-credentials/*` error at call time. **Security:** *Credential-shaped metric labels are redacted in the `/metrics` exposition, not just the cardinality key* — The metrics registry rewrote a credential-shaped label value to `[REDACTED-CREDENTIAL]`, but only inside the function that builds the internal Map cardinality key. The stored label object — the one the exposition renderer emits — kept the raw value, so a bearer token, API key or JWT placed on a label (e.g. an `authorization` label) was written verbatim to every `/metrics` scrape reader, contradicting the documented guarantee that the bytes never reach the scrape stream. Redaction now runs on the resolved labels themselves, so the key and the rendered output both carry the marker. · *SQL guard fragment mode refuses PostgreSQL dollar-quoted literals and any top-level semicolon* — In fragment mode (`whereRaw`), the embedded-string-literal floor that forces every value through a `?` placeholder detected a single-quoted literal but not a dollar-quoted one (`$tag$…$tag$` or `$$…$$`), so operator input concatenated into a dollar-quoted context passed the strict floor that the equivalent single-quoted value is refused by. The floor now recognizes dollar-quoted literals. Fragment mode also now refuses any top-level `;` — including a lone or trailing one — rather than relying on the stacked-statement scan, which only fired when a second statement followed the `;`. · *MCP tool-input validation enforces the schema without an explicit `type:"object"`* — `validateToolInput` gated the `required` / `properties` / `additionalProperties` checks on the schema declaring `type:"object"`. A schema that carries `properties`/`required` but omits `type` — a valid and common JSON Schema shape — was treated as untyped, so those constraints were skipped and any argument object was accepted, defeating the primitive's stated purpose (OWASP LLM07). Such a schema is now treated as an object schema and its constraints enforced. · *MCP sampling token cap rejects a non-numeric `maxTokens`* — `sampling.guard` applied the per-request token cap only when `maxTokens` was a number, so a hostile-tool-initiated sampling request carrying `maxTokens` as a string skipped the cap entirely — and a downstream SDK that coerces the string would then exceed the budget. A non-numeric `maxTokens` on this server-initiated surface is now refused with a typed error. · *content-credentials identity-assertion re-check uses multiset matching* — `verifyIdentityAssertion` re-confirmed the signed referenced-assertion hash binding with count-equality plus set membership, never consuming a matched entry. Supplying referenced assertions that hash to `[A, A]` against a signed binding of `[A, B]` passed — the counts matched and each supplied hash was present — even though the bound `hash(B)` was never re-confirmed against a real assertion (a transplant fail-open). The re-check now consumes each bound hash as it is matched, so duplicates can no longer stand in for a distinct bound assertion. · *YAML flow-style mappings refuse duplicate keys and the merge key like block style* — Block mappings rejected a duplicate key (`yaml/duplicate-key`) and the anchor-merge key `<<` (`yaml/merge-key-banned`), but flow mappings (`{ a: 1, a: 2 }`) enforced neither — silently keeping the last value on a repeat and accepting `<<` as an ordinary key. A value an earlier check has already read could thus be overridden through flow style. Flow mappings now apply both guards.
 
 - v0.16.2 (2026-07-03) — **Security hardening across the mail, OAuth/SAML, ACME, keychain and router primitives — six fail-open / injection / bypass fixes and seven correctness fixes — alongside a large expansion of the automated test suite.** This patch closes a batch of security and correctness defects surfaced while substantially expanding the test suite across the framework's mail-authentication, federated-identity, ACME, keychain, backup, CLI and router primitives. The security fixes: SPF evaluation no longer throws (and thus can no longer be laundered into a temperror that a permissive inbound policy accepts) on a malformed `ip4:` CIDR mask; the Authentication-Results builder now refuses CR/LF/NUL in the `version` field, closing the last header-injection gap left by the earlier mail-header sweep; `res.redirect` now rejects a horizontal TAB (which user agents strip before URL parsing, turning `/\t/evil.example` into a protocol-relative redirect to an attacker origin); the OAuth refresh-token one-time-use replay gate now treats any truthy `seen()` result as seen (a Redis `1` / SQL `COUNT` no longer slips a stolen refresh token past a `=== true` compare) — with the same normalization applied to its sibling replay checks; SAML Single-Logout over HTTP-POST/SOAP now fails closed (throws) when a verification key is supplied without its algorithm, matching the redirect binding instead of silently skipping signature verification; and the OAuth authorization-URL / PAR builders now refuse operator `extraParams` that collide with framework-managed parameters (`redirect_uri`, `state`, `code_challenge`, …). The correctness fixes: concurrent keychain file-store writes are serialized under the existing file lock (no more lost bindings); TLS-RPT submission reads the real `statusCode` (successful reports are no longer misreported as failures); ACME account key-rollover stops double-encoding its inner JWS payload (rollover was always rejected by the CA); the response-schema validator now also validates JSON bodies sent via `res.end`; keychain `remove` validates a relative fallback path like `store`/`retrieve`; `bundleAdapterStorage` honors the ambient compliance posture like `create`; and a refused `dev --ignore` pattern now returns exit code 2 instead of rejecting the CLI promise. **Fixed:** *Concurrent keychain file-store writes no longer drop bindings* — `store` and the file-remove path performed an unlocked read-modify-write of the fallback file, so two concurrent stores could each read the pre-update document and the later write would clobber the earlier binding. Both read-modify-write sequences are now serialized under the file's existing lock. · *TLS-RPT submission reads the response `statusCode`* — `tlsRpt.submit` read `status` from the HTTP client response, but the client resolves `statusCode`, so a successful (2xx) report POST was reported as `{ ok: false, error: 'HTTP undefined' }`. It now reads `statusCode`, so delivered reports are distinguished from rejected ones. · *ACME account key-rollover no longer double-encodes its inner JWS payload* — `accountKeyRollover` passed an already-stringified payload to a signer that stringifies internally, so the inner keyChange JWS payload encoded a JSON string instead of the JSON object and every rollover was rejected by the CA (RFC 8555 §7.3.5). The payload is now passed once. · *Response-schema validator also validates `res.end` JSON bodies* — The response validator wrapped only `res.json`, so a handler shipping an invalid body via `res.end(JSON.stringify(...))` escaped validation despite the documented contract. JSON-shaped `res.end` bodies are now validated on the same path. · *keychain `remove` validates a relative fallback path like `store`/`retrieve`* — `remove` checked file existence before validating the fallback path, so a relative path silently no-op'd instead of throwing the config error that `store`/`retrieve` raise. It now validates first, consistent with the other file-fallback paths. · *`bundleAdapterStorage` honors the ambient compliance posture* — `bundleAdapterStorage` only refused an unencrypted strategy when an explicit posture was passed, unlike `create`, which reads the ambient `b.compliance` posture and refuses `encrypt:false` under HIPAA. `bundleAdapterStorage` now falls back to the ambient posture, closing the asymmetry. · *`dev --ignore` pattern refusal returns exit code 2* — A `dev --ignore` pattern that exceeded the length cap or was refused by the regex guard threw out of the CLI promise instead of writing to stderr and returning exit code 2 like every other CLI validation failure. It now returns the standard non-zero exit. **Security:** *SPF `ip4:` with a malformed CIDR mask fails closed instead of throwing (fail-open)* — `_ipv4InCidr` lacked the finite-mask guard its IPv6 sibling has, so an `ip4:` mechanism with a non-numeric prefix (e.g. `ip4:192.0.2.0/`) reached `BigInt(32 - NaN)` and threw an uncaught `RangeError` out of `b.mail.spf.verify` / `b.mail.inbound.verify`. Upstream mail handling catches that throw as a temperror, and an inbound policy configured to accept on temperror would then admit a sender that should have been evaluated. SPF now returns a `permerror` result for a malformed mask, honoring the primitive's documented never-throw-on-message-content contract. · *Authentication-Results builder refuses CR/LF/NUL in the `version` field (header injection)* — `b.mail.authResults.emit` validated the `authserv-id` against control characters but not the operator-supplied `version`, which is interpolated onto the `Authentication-Results:` header line — the last field left unguarded by the earlier mail-header CRLF sweep. A `version` containing CRLF could smuggle an arbitrary header. It is now refused with a typed error, like every other field on that line. · *`res.redirect` rejects horizontal TAB (open-redirect / same-origin bypass)* — The redirect target's control-character guard rejected CR/LF/NUL but not TAB (0x09). Node permits a TAB in a header value, but the WHATWG URL parser strips ASCII TAB/LF/CR from a URL before resolving it, so a `Location: /\t/evil.example` collapses to the protocol-relative `//evil.example` and navigates to the attacker origin — bypassing the same-origin/allowlist heuristic. TAB is now rejected alongside CR/LF/NUL. · *OAuth refresh-token replay gate treats any truthy `seen()` result as seen (fail-open)* — The legacy `seen(refreshToken)` replay gate compared the callback's return with `=== true`, but the documented contract is that it returns a truthy value when the token was presented before. A store returning a truthy non-`true` value — a Redis `EXISTS`/`SISMEMBER` `1`, a SQL `COUNT` — slipped a replayed (stolen) refresh token past the one-time-use gate. Any truthy result now counts as seen; the same normalization was applied to the sibling replay checks in the module. · *SAML Single-Logout over HTTP-POST/SOAP fails closed on a key without its algorithm* — The POST and SOAP SLO parsers gated signature verification with an OR condition and the verify helper early-returned when the algorithm was absent, so supplying a verification key without `idpVerifyAlg` silently accepted a forged, unsigned LogoutRequest — while the HTTP-Redirect binding failed closed. All four SLO parse paths now route through one config check that throws when a key is supplied without its algorithm. · *OAuth authorization-URL / PAR builders refuse `extraParams` that collide with managed parameters* — `authorizationUrl` and `pushAuthorizationRequest` merged operator `extraParams` with `URLSearchParams.set`, which replaces — so an `extraParams` entry for `redirect_uri`, `state`, or `code_challenge` overwrote the framework-generated value while the call still returned the framework's `state`/PKCE verifier, diverging the returned session seed from the emitted URL. Reserved parameter keys in `extraParams` are now refused with a typed error at both builders.

package/lib/arg-parser.js

@@ -638,6 +638,12 @@ function create(opts) {
  * value`, `--key=value`, and bare `--bool`. `--` terminates flag
  * parsing.
  *
+ * A flag repeated on the command line accumulates every occurrence into
+ * an array, in order — `--watch a --watch b` yields `["a", "b"]`, not
+ * just the last value. A flag seen once stays a scalar. This keeps
+ * repeatable flags (the `dev` command's `--arg` / `--watch` / `--ignore`)
+ * from silently dropping all but the final occurrence.
+ *
  * @example
  *   var r = b.argParser.parseRaw(
  *     ["build", "--target=node", "-v", "--out", "dist", "--", "extra"]);
@@ -646,6 +652,24 @@ function create(opts) {
  *   r.flags.v;         // → true
  *   r.flags.out;       // → "dist"
  */
+// Record a parsed flag, accumulating repeats. First occurrence stores the
+// scalar as-is (so single-value flags keep their string/boolean shape);
+// the second and later occurrences promote the entry to an array holding
+// every value in argv order. Without this a repeated flag would overwrite
+// the earlier value and a repeatable flag could never yield more than one.
+function _assignFlag(flags, name, val) {
+  if (Object.prototype.hasOwnProperty.call(flags, name)) {
+    var prev = flags[name];
+    if (Array.isArray(prev)) {
+      prev.push(val);
+    } else {
+      flags[name] = [prev, val];
+    }
+  } else {
+    flags[name] = val;
+  }
+}
+
 function parseRaw(argv) {
   if (!Array.isArray(argv)) {
     throw new ArgParserError("arg-parser/argv-not-array",
@@ -679,14 +703,14 @@ function parseRaw(argv) {
         throw new ArgParserError("arg-parser/argv-forbidden-name",
           "flag '--" + name + "' is reserved");
       }
-      flags[name] = val;
+      _assignFlag(flags, name, val);
     } else if (tok.indexOf("-") === 0 && tok.length === 2) {
       var s = tok.slice(1);
       if (pick.isPoisonedKey(s)) {
         throw new ArgParserError("arg-parser/argv-forbidden-name",
           "flag '-" + s + "' is reserved");
       }
-      flags[s] = true;
+      _assignFlag(flags, s, true);
     } else {
       pos.push(tok);
     }

package/lib/auth/oauth.js

@@ -1123,6 +1123,16 @@ function create(opts) {
     backchannelAuthenticationEndpoint:
                            opts.backchannelAuthenticationEndpoint ||
                            (preset && preset.backchannelAuthenticationEndpoint) || null,
+    // _resolveEndpoint maps these three snake-case discovery keys, and the
+    // introspect / register / device-grant primitives resolve through it. A
+    // static (non-discovery) client must be able to supply them as opts —
+    // introspectToken's own no-endpoint refusal tells operators to set
+    // opts.introspectionEndpoint, so create() has to actually read it.
+    introspectionEndpoint: opts.introspectionEndpoint || (preset && preset.introspectionEndpoint) || null,
+    registrationEndpoint:  opts.registrationEndpoint  || (preset && preset.registrationEndpoint)  || null,
+    deviceAuthorizationEndpoint:
+                           opts.deviceAuthorizationEndpoint ||
+                           (preset && preset.deviceAuthorizationEndpoint) || null,
   };
 
   // Discovery + JWKS caches use b.cache.create + .wrap so concurrent
@@ -2859,6 +2869,16 @@ function create(opts) {
       if (allowHttp) req.allowedProtocols = safeUrl.ALLOW_HTTP_ALL;
       if (allowInternal !== null) req.allowInternal = allowInternal;
       Object.assign(req, httpClientOpts);
+      // RFC 8628 §3.5 / RFC 6749 §5.2 return the device-grant errors
+      // (authorization_pending / slow_down and the terminal codes) as an
+      // HTTP 400 whose body carries `error`. The loop below reads that body,
+      // so the token request MUST NOT let b.httpClient reject the 4xx first —
+      // the default buffer mode would throw before the pending/slow_down/
+      // terminal handling runs, aborting the grant on the first poll (which
+      // is almost always authorization_pending). Force always-resolve AFTER
+      // merging httpClientOpts so an operator override cannot silently
+      // reinstate buffer mode.
+      req.responseMode = "always-resolve";
       var res    = await hc.request(req);
       var text   = res.body ? res.body.toString("utf8") : "";
       var parsed;

package/lib/auth/saml.js

@@ -54,6 +54,7 @@ var zlib         = require("node:zlib");
 var nodeCrypto   = require("node:crypto");
 var pqcSoftware  = require("../pqc-software");
 var bCrypto      = require("../crypto");
+var C            = require("../constants");
 var { generateToken, timingSafeEqual } = bCrypto;
 var { AuthError } = require("../framework-error");
 
@@ -1681,16 +1682,16 @@ function _decryptEncryptedAssertion(encAssertion, spPrivateKeyPem) {
         "OAEP unwrap failed: " + ((eR && eR.message) || String(eR)));
     }
   } else if (keyAlg === "urn:blamejs:experimental:xmlenc:ml-kem-1024") {
-    // Framework PQC envelope — wrappedKey carries the ML-KEM
-    // ciphertext concatenated with the AEAD-wrapped CEK. We invoke
-    // b.pqcSoftware.ml_kem_1024.decapsulate to recover the shared
-    // secret, then ChaCha20-Poly1305 unwrap. The exact wire shape is
-    // the framework's `b.crypto.envelope` format.
+    // Framework PQC key transport — the EncryptedKey CipherValue carries
+    // a b.crypto envelope (ML-KEM-1024 KEM-only suite) whose plaintext IS
+    // the content-encryption key. b.crypto.decrypt parses the envelope
+    // magic + suite header, decapsulates with the SP's ML-KEM-1024 private
+    // key, and returns the CEK bytes. `raw: true` keeps the CEK as a
+    // Buffer (it is binary key material, not utf8 text); the SP private
+    // key travels as the PEM the envelope opener expects.
     try {
-      cek = bCrypto.decryptEnvelope({
-        envelope:   wrappedKey,
-        privateKey: nodeCrypto.createPrivateKey({ key: spPrivateKeyPem, format: "pem" }),
-      });
+      cek = bCrypto.decrypt(wrappedKey.toString("base64"),
+        { privateKey: spPrivateKeyPem }, { raw: true });
     } catch (eM) {
       throw new AuthError("auth-saml/encrypted-key-unwrap-failed",
         "ML-KEM-1024 unwrap failed: " + ((eM && eM.message) || String(eM)));
@@ -1744,17 +1745,16 @@ function _decryptEncryptedAssertion(encAssertion, spPrivateKeyPem) {
       throw new AuthError("auth-saml/encrypted-content-too-short",
         "XChaCha20-Poly1305 CipherValue too short");
     }
-    var xnonce = contentBlob.subarray(0, 24);                                                       // XChaCha20 nonce size
-    var xtag   = contentBlob.subarray(contentBlob.length - 16);                                    // Poly1305 tag size
-    var xct    = contentBlob.subarray(24, contentBlob.length - 16);
+    // XMLEnc content wire is nonce(24) || ciphertext || Poly1305-tag(16).
+    // b.crypto.decryptPacked reads a 1-byte format tag followed by that
+    // exact 24-byte-nonce + (ciphertext||tag) tail, so prepending the
+    // XChaCha20-Poly1305 format byte routes the content through the
+    // framework's own AEAD (which verifies the Poly1305 tag) instead of a
+    // hand-rolled cipher call.
+    var packedContent = Buffer.concat([
+      Buffer.from([C.FORMAT.XCHACHA20_POLY1305]), contentBlob]);
     try {
-      clearBytes = bCrypto.aeadDecrypt({
-        alg:   "xchacha20-poly1305",
-        key:   cek,
-        nonce: xnonce,
-        ct:    xct,
-        tag:   xtag,
-      });
+      clearBytes = bCrypto.decryptPacked(packedContent, cek);
     } catch (eX) {
       throw new AuthError("auth-saml/encrypted-content-tag-mismatch",
         "XChaCha20-Poly1305 tag mismatch: " + ((eX && eX.message) || String(eX)));

package/lib/base32.js

@@ -128,6 +128,7 @@ function decode(str, opts) {
   var bytes = [];
   var value = 0, bits = 0;
   var inPad = false;   // once "=" padding starts, only more "=" may follow
+  var dataCount = 0;   // count of data symbols (excludes padding + skipped separators)
   for (var i = 0; i < str.length; i++) {
     var ch = str.charAt(i);
     if (ch === "=") { inPad = true; continue; }             // trailing padding
@@ -140,11 +141,31 @@ function decode(str, opts) {
     if (idx === undefined) throw new Base32Error("base32/bad-char", "base32.decode: invalid Base32 character '" + str.charAt(i) + "' at index " + i);
     value = (value << BITS) | idx;
     bits += BITS;
+    dataCount += 1;
     if (bits >= 8) {                                        // emit a full output byte
       bytes.push((value >>> (bits - 8)) & 0xff);            // eight-bit output byte mask
       bits -= 8;                                            // consumed eight bits
     }
   }
+  // A group of 5 input bytes encodes to 8 symbols; the only valid partial-group
+  // symbol counts are 2, 4, 5, 7 (for 1, 2, 3, 4 trailing bytes). A count of
+  // 1/3/6 (mod 8) cannot represent any whole-byte input, so the OLD decoder
+  // silently returned a truncated/garbage buffer — refuse it.
+  var rem = dataCount % GROUP;
+  if (rem === 1 || rem === 3 || rem === 6) {
+    throw new Base32Error("base32/bad-length",
+      "base32.decode: " + dataCount + " data symbol(s) is not a valid Base32 length " +
+      "(a partial group is 2, 4, 5 or 7 symbols)");
+  }
+  // Non-canonical trailing bits (RFC 4648 §3.5): a conforming encoder zeroes the
+  // final symbol's unused low bits. Non-zero leftover bits mean two distinct
+  // strings decode to the same bytes — decoder malleability. Refuse it so every
+  // byte sequence has exactly one Base32 form (matters where the string is a
+  // key / secret / dedup handle, e.g. TOTP, identifiers).
+  if (bits > 0 && (value & ((1 << bits) - 1)) !== 0) {
+    throw new Base32Error("base32/non-canonical",
+      "base32.decode: non-canonical encoding — the final symbol's unused low bits must be zero");
+  }
   return Buffer.from(bytes);
 }
 

package/lib/db.js

@@ -1877,15 +1877,19 @@ function stream(sql) {
     objectMode: true,
     read: function () {
       try {
+        var step = iter.next();
+        if (step.done) { this.push(null); return; }
+        // Enforce the cap AFTER pulling the row + the done-check: a result set of
+        // EXACTLY streamLimit rows completes cleanly; only a row BEYOND the cap
+        // (the streamLimit+1'th) trips the guard (the top-of-read `>=` form errored
+        // at == limit, turning a valid complete export into a stream error).
         if (emitted >= perCallLimit) {
           this.destroy(new DbError("db/stream-limit-exceeded",
-            "db.stream: emitted " + emitted + " rows, exceeding streamLimit " +
-            perCallLimit + ". Pass opts.streamLimit higher OR raise via " +
+            "db.stream: result set exceeds streamLimit " + perCallLimit +
+            " (reached row " + (emitted + 1) + "). Pass opts.streamLimit higher OR raise via " +
             "db.init({ streamLimit }) after auditing the export path."));
           return;
         }
-        var step = iter.next();
-        if (step.done) { this.push(null); return; }
         emitted += 1;
         var row = step.value;
         this.push(unseal ? unseal.unsealRow(table, row) : row);

package/lib/external-db.js

@@ -637,11 +637,24 @@ class Pool {
   }
 
   _reapIdle() {
+    // Reap idle clients past idleTimeoutMs, but honor `min` as a floor on
+    // idle clients: retain at least `min` warm connections even when they
+    // have all gone idle past the timeout, so a quiet period does not drain
+    // the pool below its configured warm floor. The freshest entries sit at
+    // the end of the idle stack (release() pushes, acquire() pops), so the
+    // stalest expired clients are reaped first and the floor keeps the most
+    // recently used. min:0 opts out of the floor (reap every expired idle).
+    var min = (typeof this.config.min === "number" && isFinite(this.config.min) && this.config.min > 0)
+      ? this.config.min : 0;
+    var reapable = this.idle.length - min;
+    if (reapable <= 0) return;   // at or below the floor — keep every idle client warm
     var now = Date.now();
     var keep = [];
+    var reaped = 0;
     var self = this;
     this.idle.forEach(function (entry) {
-      if ((now - entry.lastUsedAt) >= self.config.idleTimeoutMs) {
+      if (reaped < reapable && (now - entry.lastUsedAt) >= self.config.idleTimeoutMs) {
+        reaped += 1;
         Promise.resolve().then(function () { return self.close(entry.client); }).catch(function () {});
       } else {
         keep.push(entry);
@@ -907,7 +920,21 @@ function init(opts) {
     };
   }
 
-  defaultBackend = opts.defaultBackend || Object.keys(backends)[0];
+  // defaultBackend — when supplied it must name a REGISTERED backend, so a
+  // typo surfaces as a typed config-time error at init() rather than as an
+  // opaque TypeError when the first query dereferences a missing pool.
+  // Omitted → the first declared backend (declaration order).
+  if (opts.defaultBackend !== undefined && opts.defaultBackend !== null) {
+    validateOpts.requireNonEmptyString(opts.defaultBackend, "defaultBackend", ExternalDbError, "INVALID_CONFIG");
+    if (!Object.prototype.hasOwnProperty.call(backends, opts.defaultBackend)) {
+      throw _err("INVALID_CONFIG",
+        "defaultBackend: no backend named '" + opts.defaultBackend + "' " +
+        "(declared backends: " + Object.keys(backends).join(", ") + ")", true);
+    }
+    defaultBackend = opts.defaultBackend;
+  } else {
+    defaultBackend = Object.keys(backends)[0];
+  }
 
   // dbRoleBackends — request-time role → backend mapping. Each role name
   // validates as a SQL identifier at init (matches the dbRoleFor

package/lib/guard-regex.js

@@ -59,7 +59,11 @@ var _err = GuardRegexError.factory;
 
 // Nested-quantifier detector: `(group)+`-style followed by another
 // quantifier or repetition that operates on the grouped match.
-var NESTED_QUANT_RE = /\([^()]*[*+?][^()]*\)\s*[*+?{]/;
+// (The flat single-group nested-quantifier case is handled by the paren-aware
+// structural scanner _hasNestedQuantifier, which — unlike a flat regex — requires
+// the OUTER quantifier to be UNBOUNDED (`*`/`+`/`{n,}`, not `?`/`{0,1}`/`{n,m}`)
+// and does not miscount a `(?:` group prefix as an inner quantifier, so it does
+// not false-positive on linear shapes like `(?:X+)?` / `(X+)?` / `(?:bar)*`.)
 
 // Alternation-with-quantifier — `(a|b|...)+`, `(a|b)*`.
 var ALTERNATION_QUANT_RE = /\([^()]*\|[^()]*\)\s*[*+]/;
@@ -184,8 +188,7 @@ function _detectIssues(input, opts) {
   if (pre.done) return pre.issues;
   var issues = pre.issues;
 
-  if (opts.nestedQuantPolicy !== "allow" &&
-      (NESTED_QUANT_RE.test(input) || _hasNestedQuantifier(input))) {            // allow:regex-no-length-cap — input bounded by maxPatternBytes
+  if (opts.nestedQuantPolicy !== "allow" && _hasNestedQuantifier(input)) {
     issues.push({
       kind: "nested-quantifier", severity: "critical",
       ruleId: "regex.nested-quantifier",

package/lib/http-client.js

@@ -57,7 +57,7 @@ var ssrfGuard = require("./ssrf-guard");
 var networkProxy = require("./network-proxy");
 var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
-var { FrameworkError, HttpClientError } = require("./framework-error");
+var { HttpClientError } = require("./framework-error");
 
 // Per-origin transport cache. Entry is either the resolved transport
 // object or a pending Promise that resolves to one. The Promise form
@@ -370,8 +370,11 @@ function _getTransport(u, opts, ips) {
 }
 
 function _makeError(errorClass, code, message, permanent, statusCode) {
-  if (!errorClass) return new FrameworkError(message, code);
-  return new errorClass(code, message, permanent, statusCode);
+  // Default to HttpClientError (the documented default errorClass) rather than
+  // the base FrameworkError, so error.statusCode and error.permanent are
+  // populated even when the caller passed no explicit opts.errorClass.
+  var Cls = errorClass || HttpClientError;
+  return new Cls(code, message, permanent, statusCode);
 }
 
 // RFC 9110 §15.5 4xx codes that are NOT permanent (request-timeout,
@@ -553,10 +556,25 @@ function _buildMultipartBody(spec) {
     totalSize += CRLF.length;
   }
 
+  // Reject CR/LF/NUL in any value interpolated onto a part-header line
+  // (Content-Disposition name/filename, Content-Type). Without this an attacker
+  // who controls a field name / filename / content-type can smuggle a CRLF and
+  // inject extra part headers or forge additional form parts (multipart header
+  // injection) — the same class the mail-header sweep closed for RFC 822 lines.
+  function _assertHeaderSafe(v, label) {
+    for (var i = 0; i < v.length; i++) {
+      var c = v.charCodeAt(i);
+      if (c === 13 || c === 10 || c === 0) {   // CR / LF / NUL
+        throw new Error("multipart: " + label + " must not contain CR, LF, or NUL (header injection)");
+      }
+    }
+  }
+
   function _pushField(name, value) {
     if (typeof name !== "string" || name.length === 0) {
       throw new Error("multipart: field name must be a non-empty string");
     }
+    _assertHeaderSafe(name, "field name");
     var disposition = 'Content-Disposition: form-data; name="' + name + '"';
     var head = _entryHeaderBytes(disposition, null);
     var bodyBuf = Buffer.isBuffer(value) ? value : Buffer.from(String(value), "utf8");
@@ -588,6 +606,9 @@ function _buildMultipartBody(spec) {
       filename = "blob";
     }
     var mimeType = file.contentType || file.mimeType || "application/octet-stream";
+    _assertHeaderSafe(file.field, "file.field");
+    _assertHeaderSafe(filename, "filename");
+    _assertHeaderSafe(mimeType, "contentType");
     var disposition = 'Content-Disposition: form-data; name="' + file.field + '"' +
                       '; filename="' + filename.replace(/"/g, "%22") + '"';
     var head = _entryHeaderBytes(disposition, mimeType);

package/lib/mail-bounce.js

@@ -183,6 +183,14 @@ function _parseSes(p) {
       throw _err("ses/bad-message-json",
         "SES SNS Message field is not valid JSON: " + (e && e.message));
     }
+    // A syntactically valid Message can still decode to a non-object —
+    // JSON literal null / number / string / boolean / array. Reject it
+    // with a typed error rather than dereferencing null downstream, and
+    // do not echo the decoded value (avoid leaking payload internals).
+    if (!msg || typeof msg !== "object" || Array.isArray(msg)) {
+      throw _err("ses/bad-message-json",
+        "SES SNS Message field must decode to a JSON object");
+    }
   }
   var notificationType = msg.notificationType || msg.eventType;
   if (!notificationType) {

package/lib/mail-dav.js

@@ -247,8 +247,19 @@ function create(opts) {
     var segs = path.split("/").filter(function (s) { return s.length > 0; });
     var decoded = [];
     for (var i = 0; i < segs.length; i++) {
-      try { decoded.push(decodeURIComponent(segs[i])); }
+      var seg;
+      try { seg = decodeURIComponent(segs[i]); }
       catch (_e) { return { principalId: null, parts: [], rejected: "malformed-uri" }; }
+      // Validate the DECODED segment. The pre-decode guard above only catches a
+      // literal ".."/"%2e%2e", so a MIXED encoding (".%2e", "%2e.") passes it and
+      // then decodes to "..". Reject any decoded segment that is "." / ".." or
+      // carries a NUL or an embedded path separator — the traversal the storage
+      // backend (getComponent/putComponent/...) would otherwise receive.
+      if (seg === "." || seg === ".." || seg.indexOf("\0") >= 0 ||
+          seg.indexOf("/") >= 0 || seg.indexOf("\\") >= 0) {
+        return { principalId: null, parts: [], rejected: "traversal" };
+      }
+      decoded.push(seg);
     }
     return {
       principalId: decoded[0] || null,
@@ -551,7 +562,11 @@ function create(opts) {
       _emit("mail.dav.handler_threw",
         { method: method, kind: "caldav",
           error: (e && e.message) || String(e) }, "failure");
-      return _refuseStatus(res, 500, "Server error");
+      // A malformed / empty client request BODY (bad PROPFIND/REPORT XML) is a
+      // client fault → 400, mirroring the 400 that MKCALENDAR/MKCOL already return
+      // for the same input; only a genuine server-side throw is 500.
+      var isClientFault = e && /mail-dav\/bad-(propfind|report)-body/.test(e.code || "");
+      return _refuseStatus(res, isClientFault ? 400 : 500, isClientFault ? "Bad request" : "Server error");
     }
   }
 
@@ -889,7 +904,11 @@ function create(opts) {
       _emit("mail.dav.handler_threw",
         { method: method, kind: "carddav",
           error: (e && e.message) || String(e) }, "failure");
-      return _refuseStatus(res, 500, "Server error");
+      // A malformed / empty client request BODY (bad PROPFIND/REPORT XML) is a
+      // client fault → 400, mirroring the 400 that MKCALENDAR/MKCOL already return
+      // for the same input; only a genuine server-side throw is 500.
+      var isClientFault = e && /mail-dav\/bad-(propfind|report)-body/.test(e.code || "");
+      return _refuseStatus(res, isClientFault ? 400 : 500, isClientFault ? "Bad request" : "Server error");
     }
   }
 

package/lib/mail-send-deliver.js

@@ -244,22 +244,32 @@ async function _applyMtaStsPolicy(domain, mxs, policyMode, auditEmit) {
       { domain: domain, mode: policyMode });
     return mxs;
   }
-  if (sts.mode === "testing" && policyMode === "enforce") {
-    // Testing-mode STS doesn't refuse delivery but does record the
-    // mismatch via TLS-RPT. Honor the STS allowlist as an information
-    // signal; don't refuse.
+  if (sts.mode === "testing") {
+    // RFC 8461 §5.2 — a policy published in "testing" mode records
+    // validation failures via TLS-RPT but MUST NOT block delivery. The
+    // domain has explicitly opted out of enforcement, so the local
+    // posture (even the default mtaSts:"enforce") cannot promote a
+    // testing policy to a hard bounce. Deliver against the full MX set
+    // and surface the match result as a report-only signal.
+    var testingMatched = mxs.filter(function (m) {
+      return smtpPolicy().mtaSts.matchMx(m.exchange, sts.mx || []);
+    });
     auditEmit("mail.send.deliver.mtaSts.testing", "info",
-      { domain: domain, mxPatterns: sts.mx });
+      { domain: domain, mxPatterns: sts.mx,
+        matched: testingMatched.length, total: mxs.length });
+    return mxs;
   }
   var filtered = mxs.filter(function (m) {
     return smtpPolicy().mtaSts.matchMx(m.exchange, sts.mx || []);
   });
-  if (filtered.length === 0 && (sts.mode === "enforce" || policyMode === "enforce")) {
+  if (filtered.length === 0 && sts.mode === "enforce") {
     throw new DeliverError("deliver/mta-sts-mx-mismatch",
       "no MX for " + domain + " matches the published MTA-STS policy (mode=" + sts.mode + ")");
   }
   if (filtered.length === 0) {
-    // testing or off mode — log and continue with original list
+    // Any remaining published mode that is neither enforce nor testing
+    // with no match — log and continue with the original list rather
+    // than block delivery.
     auditEmit("mail.send.deliver.mtaSts.no-match", "warn",
       { domain: domain, mode: sts.mode });
     return mxs;
@@ -352,7 +362,23 @@ async function _deliverOne(envelope, recipient, ctx) {
     // composes directly into smtpTransport.dane); this branch carries
     // the discovery so the audit chain records the policy posture
     // applied to each delivery attempt.
-    await _fetchDaneTlsa(mx.exchange, ctx.port, ctx.policy.dane, ctx.auditEmit);
+    try {
+      await _fetchDaneTlsa(mx.exchange, ctx.port, ctx.policy.dane, ctx.auditEmit);
+    } catch (daneErr) {
+      // DANE "enforce": a TLSA lookup failure means this MX host cannot
+      // be used for authenticated delivery (RFC 7672 §2.2). Fail this
+      // single MX over to the next candidate; if every MX for this
+      // recipient fails DANE the recipient is deferred (and eventually
+      // bounced once the operator's retry budget is spent). A per-
+      // recipient DANE failure must never throw out of the whole
+      // deliver() batch and discard the sibling recipients' outcomes —
+      // it is contained here exactly like the MTA-STS enforce path.
+      lastErr = daneErr;
+      ctx.auditEmit("mail.send.deliver.dane-failover", "warn", {
+        recipient: recipient, mxHost: mx.exchange, reason: daneErr.message,
+      });
+      continue;
+    }
     try {
       var rv = await _tryHost({
         from:       envelope.from,

package/lib/mail.js

@@ -786,13 +786,23 @@ function _buildRfc822(message) {
     body = parts.join("\r\n");
   }
 
-  // Normalize line endings then dot-stuff per SMTP transparency.
+  // Normalize line endings only. Dot-stuffing (SMTP DATA transparency, RFC 5321
+  // §4.5.2) is applied at DATA send time — NOT here — because it must NOT touch
+  // the RFC 3030 BDAT/CHUNKING path (length-framed; receivers do not un-stuff, so
+  // a baked-in doubled dot corrupts the body) and must NOT be inside the
+  // DKIM-signed message (the receiver verifies the un-stuffed body).
   body = body.replace(/\r?\n/g, "\r\n");
-  body = body.split("\r\n").map(function (l) { return l.charAt(0) === "." ? "." + l : l; }).join("\r\n");
 
   return headers.join("\r\n") + "\r\n\r\n" + body;
 }
 
+// Dot-stuff a message for the SMTP DATA path (RFC 5321 §4.5.2): any line whose
+// first byte is "." gets a doubled dot so the receiver's `.`-on-its-own-line
+// terminator can't be forged by body content. Applied ONLY on DATA, never BDAT.
+function _dotStuffForData(msg) {
+  return msg.split("\r\n").map(function (l) { return l.charAt(0) === "." ? "." + l : l; }).join("\r\n");
+}
+
 function smtpTransport(opts) {
   opts = opts || {};
   if (!opts.host) {
@@ -1371,7 +1381,7 @@ function _smtpSend(message, cfg) {
       }
       else if (step === SMTP_STEP_DATA) {
         if (code !== 354) { fail("data-rejected (code " + code + ")"); return; }
-        send(dataMessage + "\r\n.");
+        send(_dotStuffForData(dataMessage) + "\r\n.");
         step = SMTP_STEP_BODY;
       }
       else if (step === SMTP_STEP_BDAT) {
@@ -1609,10 +1619,10 @@ function resendTransport(opts) {
         throw new MailError("mail/resend-bad-response",
           "resend response was not JSON: " + text.slice(0, DIAG_SNIPPET_LEN), false);
       }
-      if (!data.id) {
+      if (!data || !data.id) {
         return {
           ok:     false,
-          reason: data.message || JSON.stringify(data).slice(0, DIAG_SNIPPET_LEN),
+          reason: (data && data.message) || JSON.stringify(data).slice(0, DIAG_SNIPPET_LEN),
         };
       }
       return { ok: true, id: data.id };

package/lib/network-dns.js

@@ -158,8 +158,12 @@ function _cachePutPositive(host, family, value) {
 }
 
 function _cachePutNegative(host, family, error) {
-  if (STATE.cacheTtlMs <= 0) return;
-  var ttl = STATE.cacheNegativeTtlMs > 0 ? STATE.cacheNegativeTtlMs : Math.min(STATE.cacheTtlMs, C.TIME.seconds(30));
+  // Effective negative TTL: an explicit cacheNegativeTtlMs applies even when the
+  // positive TTL is 0 (setCacheTtlMs(0, 60000) = positives off, negatives 60s);
+  // only fall back to the positive TTL when no explicit negative TTL is set.
+  var ttl = STATE.cacheNegativeTtlMs > 0 ? STATE.cacheNegativeTtlMs
+    : (STATE.cacheTtlMs > 0 ? Math.min(STATE.cacheTtlMs, C.TIME.seconds(30)) : 0);
+  if (ttl <= 0) return;
   NEGATIVE_CACHE.set(host + "/" + family, {
     error:     error,
     expiresAt: _now() + ttl,
@@ -237,6 +241,14 @@ function setCacheTtlMs(ms, negativeMs) {
         "dns.setCacheTtlMs negativeMs: expected non-negative finite number, got " + JSON.stringify(negativeMs));
     }
     STATE.cacheNegativeTtlMs = negativeMs;
+  } else {
+    // No explicit negative TTL this call — clear any stale explicit value so it
+    // can't outlive the setCacheTtlMs call that set it. Otherwise
+    // setCacheTtlMs(0) after an earlier setCacheTtlMs(ms, negMs) would leave
+    // negative caching alive (sticky transient failures) even though caching was
+    // just disabled; with this cleared, negative TTL derives from the positive
+    // TTL, so ms=0 disables both positive and negative caching.
+    STATE.cacheNegativeTtlMs = 0;
   }
   if (ms === 0) _clearCache();
 }
@@ -1696,6 +1708,13 @@ async function resolveAaaa(host, opts) { return _resolveProtocol(host, 6, opts);
 // `type` defaults to "A"; "AAAA" routes through resolve6; SVCB / HTTPS
 // types route through the new querySvcb / queryHttps primitives.
 async function resolve(host, type, opts) {
+  // A non-string `type` would throw a raw TypeError from .toUpperCase() (code
+  // undefined, no .permanent) — reject it as a typed DnsError like every other
+  // bad-type path, so a caller keying on err.permanent gets the right verdict.
+  if (type !== undefined && type !== null && typeof type !== "string") {
+    throw new DnsError("dns/unsupported-type",
+      "dns.resolve: type must be a string (got " + typeof type + ")");
+  }
   type = (type || "A").toUpperCase();
   if (type === "A")     return _resolveProtocol(host, 4, opts);
   if (type === "AAAA")  return _resolveProtocol(host, 6, opts);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.3",
+  "version": "0.16.5",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3e7515ff-90ec-4d95-be2f-ec3082f1f6d8",
+  "serialNumber": "urn:uuid:f9a1389c-b576-4d1a-8d0e-33d85c815fb6",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-03T23:06:39.610Z",
+    "timestamp": "2026-07-04T07:19:07.771Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.3",
+      "bom-ref": "@blamejs/core@0.16.5",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.3",
+      "version": "0.16.5",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.3",
+      "purl": "pkg:npm/%40blamejs/core@0.16.5",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.3",
+      "ref": "@blamejs/core@0.16.5",
       "dependsOn": []
     }
   ]