@blamejs/core 0.17.22 → 0.17.23

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.17.x
 
+- v0.17.23 (2026-07-25) — **`b.session` refresh paths enforce the idle/absolute timeout floor, and a strict fingerprint policy without a request fails closed.** Two session-security fixes and one audit-signing robustness fix. b.session.rotate and b.session.updateData reset a session's activity clock but did not re-check the idle/absolute timeout floor that verify() and touch() enforce, so a session already past its idle timeout (default 30 min) -- which verify() would reject -- could be resurrected with a fresh idle window by rotating it or writing session data, defeating the idle timeout (OWASP ASVS 5.0 §3.3 / NIST SP 800-63B-4). Both now enforce the same floor and fail closed. Separately, verify() gated its strict fingerprint controls (requireFingerprintMatch / maxAnomalyScore) on a request being supplied, so passing the strict flag WITHOUT a req silently skipped the check and admitted the session from any device; a strict policy with no way to compute the device fingerprint now fails closed. Finally, b.auditSign.verify honored its documented never-throw contract only for well-formed keys -- a malformed publicKeyPem made it throw; it now returns false. **Changed:** *Vendored Public Suffix List refreshed to the current snapshot* — The bundled Public Suffix List that backs domain classification (registrable-domain and public-suffix checks across URL, cookie, and SSRF handling) is updated to the latest upstream publicsuffix.org snapshot, so newly delegated public suffixes and updated private-domain entries are recognized. **Fixed:** *b.auditSign.verify returns false on a malformed public key instead of throwing* — verify(payload, signature, publicKeyPem) documents that it never throws -- callers branch on the boolean, and a verifier-only consumer (b.backupManifest.verifyBytes) may pass an untrusted publicKeyPem taken from a signature block. A malformed / non-PEM key made node:crypto throw (ERR_OSSL_UNSUPPORTED) while building the key object, crashing such a caller instead of cleanly rejecting. verify() now catches that and returns false, honoring the contract. As a result, b.auditSign.reSignAll now treats an entry whose old key is unverifiable as skipped (unverifiable) rather than as an error. **Security:** *b.session.rotate and b.session.updateData enforce the idle/absolute timeout floor* — A session read path enforces two floors independent of the operator's ttl: an idle timeout (default 30 min) and an absolute timeout (default 12 h). verify() and touch() enforced them, but rotate() and updateData() only checked that the operator ttl had not elapsed while resetting lastActivity -- so a session past its idle floor (which verify() would expire and delete) could be revived with a fresh idle window by rotating it or writing to it. Both now route through the same floor check and fail closed (return null / false and best-effort delete) on breach, so no refresh path can resurrect a session verify() would reject. touch() also now emits the idle/absolute-expiry audit signal on breach, matching verify(). · *A strict fingerprint policy without a request now fails closed* — verify()'s strict device-binding controls -- requireFingerprintMatch: true and maxAnomalyScore -- were only applied when the caller also passed a req to compute the current device fingerprint. Setting a strict flag WITHOUT a req therefore skipped the binding check entirely and admitted the session unchecked from any device -- a fail-open of a control the operator asked to be strict. A strict policy with no req to compare against now fails closed (returns null), the same discipline already applied when the stored binding is unreadable or absent.
+
 - v0.17.22 (2026-07-25) — **`b.network.tls.checkServerIdentity9525` parses subjectAltName quote-aware, closing a hostname-verification bypass.** The strict RFC 9525 identity verifier parsed Node's subjectAltName string with a naive comma split, ignoring the JSON-quoted encoding Node emits for a SAN value that itself contains separators (the CVE-2021-44531/44532 remediation). A certificate whose single dNSName is a quoted blob such as `DNS:"x, DNS:victim.com, y"` was broken into pieces by the split, smuggling a clean `victim.com` token the certificate never asserts -- so checkServerIdentity9525 ACCEPTED a host that Node's own tls.checkServerIdentity REJECTS (ERR_TLS_CERT_ALTNAME_INVALID). The verifier now splits SAN entries on commas outside quotes and JSON-decodes quoted spans, matching Node's splitEscapedAltNames, so it asserts only the certificate's actual dNSName / IP values and is at least as strict as the function it advertises replacing. This path gates peer identity in b.crypto.spkiPinVerifier. **Security:** *checkServerIdentity9525 no longer accepts a hostname smuggled through a quoted subjectAltName* — Node renders a subjectAltName value that contains commas or control characters as a JSON-quoted string, so a single dNSName whose value is `x, DNS:victim.com, y` appears in cert.subjectaltname as `DNS:"x, DNS:victim.com, y"`. The verifier's SAN parser split that raw string on every comma, turning one entry into several and extracting a `DNS:victim.com` token the certificate does not actually present -- a hostname-verification bypass, since a strict RFC 9525 drop-in must be no weaker than the Node function it replaces (which rejects this cert). The parser now mirrors Node's splitEscapedAltNames: it splits only on commas outside quotes and JSON-decodes quoted spans, so each parsed dNSName is exactly one GeneralName and a smuggled name can no longer match. Malformed SAN quoting fails closed (asserts no identifiers). Operators using b.network.tls.checkServerIdentity9525 (directly or via b.crypto.spkiPinVerifier) should upgrade.
 
 - v0.17.21 (2026-07-25) — **`blamejs erase` treats only `--confirm true` as confirmation, so `--confirm false` no longer triggers the irreversible erase.** Three fixes to the blamejs command line. The `erase` subcommand (a cryptographic single-row erase) gated its irreversible action on a bare-truthiness check, so `--confirm false` -- a string -- counted as confirmation and the erase proceeded; the gate now accepts only `true` / "true", matching `audit purge`, and refuses anything else. A stray `-v` / `--version` token alongside a subcommand no longer short-circuits to the version print: `blamejs migrate up --db x -v` previously returned 0 after printing the version without running the migration, handing automation a false pass; the version flag is now honored only when it is the whole invocation. And `blamejs dev` now survives a crash of the watched child -- it stays up to hot-restart on the next file change instead of draining the event loop and exiting 0 -- and awaits the child's full termination on SIGINT/SIGTERM so a shutdown cannot orphan it. **Fixed:** *blamejs erase refuses --confirm false instead of performing the irreversible erase* — The erase subcommand confirmed its irreversible action with a bare-truthiness check, so the string `--confirm false` was treated as confirmation and the erase ran. Confirmation is now satisfied only by `--confirm true` (or the bare `--confirm`), matching the check `audit purge` already used; any other value -- including `false` -- is refused with a non-zero exit and no erase. A shared confirmation helper backs every destructive subcommand so the acknowledgement contract cannot drift between them. · *A stray -v / --version no longer turns a subcommand into a silent no-op* — The top-level version flag was evaluated before subcommand dispatch and returned 0 whenever `-v` / `--version` appeared anywhere in the arguments, so a consequential command such as `migrate up`, `seed run`, or `erase` alongside a stray `-v` printed the version and exited 0 without doing anything -- a false success for any script checking the exit code. The version flag is now honored only when the invocation carries no subcommand; otherwise the subcommand runs (or fails) as written. · *blamejs dev survives a watched-child crash and shuts the child down cleanly* — The dev supervisor held the event loop open with an unref'd timer, so when the watched child process crashed the supervisor drained the loop and exited 0 -- defeating crash-resilience (it should stay up and hot-restart on the next file change) and reporting success even though the app had crashed. It now holds a referenced heartbeat so a child crash leaves the supervisor running, and on SIGINT/SIGTERM it awaits the child's full termination (graceful signal, then escalation) before exiting, so a shutdown can no longer race ahead and orphan the child.

package/NOTICE

@@ -90,7 +90,7 @@ Used for:    Top-10000 most-common (breach-derived) passwords. Loaded by
              baseline.
 --------------------------------------------------------------------------------
 Component:   publicsuffix-list (Mozilla Public Suffix List)
-Version:     master snapshot (bundled 2026-07-24)
+Version:     master snapshot (bundled 2026-07-25)
 Source:      https://publicsuffix.org/list/public_suffix_list.dat
 License:     MPL-2.0
 Copyright:   Copyright (c) Mozilla Foundation and Public Suffix List contributors

package/lib/audit-sign.js

@@ -528,7 +528,16 @@ function verify(payload, signature, publicKeyPem) {
   var buf = Buffer.isBuffer(payload) ? payload : Buffer.from(String(payload), "utf8");
   var sigBuf = Buffer.isBuffer(signature) ? signature : Buffer.from(signature);
   var pub = publicKeyPem || keys.publicKey;
-  return nodeCrypto.verify(null, buf, pub, sigBuf);
+  // Contract: never throw — the caller branches on the boolean. A malformed /
+  // unsupported publicKeyPem (node:crypto raises ERR_OSSL_UNSUPPORTED building
+  // the KeyObject) is a verification FAILURE, not an exception: a verifier-only
+  // consumer (e.g. b.backupManifest.verifyBytes) may feed an untrusted PEM from
+  // a signature block and must get `false`, not a crash.
+  try {
+    return nodeCrypto.verify(null, buf, pub, sigBuf);
+  } catch (_e) {
+    return false;
+  }
 }
 
 /**

package/lib/session.js

@@ -541,6 +541,24 @@ function _timeoutFloorBreach(row, nowMs, opts) {
   return null;
 }
 
+// Enforce the idle/absolute floor on a read row and, on breach, emit the
+// audit signal and best-effort delete (leader-only) — returning the breach so
+// the caller fails closed. EVERY session read/refresh path (verify, touch,
+// rotate, updateData) routes through this: the row's TTL being live
+// (expiresAt >= now) is NOT enough, and a refresh must never resurrect a
+// session verify() would expire. The row must carry createdAt + lastActivity.
+async function _floorBreachAndCleanup(row, sidHash, nowMs, opts) {
+  var breach = _timeoutFloorBreach(row, nowMs, opts);
+  if (!breach) return null;
+  try {
+    audit.safeEmit({ action: breach.action, outcome: "success", metadata: breach.metadata });
+  } catch (_ignored) { /* audit best-effort */ }
+  if (cluster.isLeader()) {
+    try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
+  }
+  return breach;
+}
+
 async function verify(token, verifyOpts) {
   if (typeof token !== "string" || token.length === 0) return null;
   verifyOpts = verifyOpts || {};
@@ -572,16 +590,7 @@ async function verify(token, verifyOpts) {
   // SP 800-63B-4). These shorten the effective lifetime even when the
   // operator picked a long ttlMs. Defaults: idle 30m, absolute 12h.
   // Operator opt-out by passing 0 (disables that timeout).
-  var floorBreach = _timeoutFloorBreach(row, nowMs, verifyOpts);
-  if (floorBreach) {
-    try {
-      audit.safeEmit({ action: floorBreach.action, outcome: "success", metadata: floorBreach.metadata });
-    } catch (_ignored) { /* audit best-effort */ }
-    if (cluster.isLeader()) {
-      try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
-    }
-    return null;
-  }
+  if (await _floorBreachAndCleanup(row, sidHash, nowMs, verifyOpts)) return null;
   // Unseal sealed columns (userId, data) using the cryptoField pipeline
   // so we return cleartext to the caller — same shape as the previous
   // db().from(...).first() path delivered.
@@ -642,9 +651,24 @@ async function verify(token, verifyOpts) {
   // than silently skip the gate. Treating "no binding to compare" as "the
   // binding matches" is the fail-open this refuses: it admitted an unbound (or
   // unreadable-binding) session from ANY device even under a strict policy.
-  var strictBindingRequested = !!verifyOpts.req &&
-    (verifyOpts.requireFingerprintMatch === true ||
-     typeof verifyOpts.maxAnomalyScore === "number");
+  var strictFlagRequested =
+    verifyOpts.requireFingerprintMatch === true ||
+    typeof verifyOpts.maxAnomalyScore === "number";
+  // A strict policy asserted WITHOUT a req cannot compute the current device
+  // fingerprint at all — a contradictory configuration that must ALSO fail
+  // CLOSED, never silently admit from any device (the same fail-open the
+  // no-stored-fingerprint branch below refuses).
+  if (strictFlagRequested && !verifyOpts.req) {
+    try {
+      audit.safeEmit({
+        action:   "auth.session.binding_no_request",
+        outcome:  "failure",
+        metadata: { hasUserId: !!unsealed.userId },
+      });
+    } catch (_ig) { /* audit best-effort */ }
+    return null;
+  }
+  var strictBindingRequested = strictFlagRequested && !!verifyOpts.req;
   if (strictBindingRequested && !storedFingerprint) {
     try {
       audit.safeEmit({
@@ -944,10 +968,7 @@ async function touch(token, opts) {
     .toSql();
   var floorRow = await _currentStore().executeOne(floorSel.sql, floorSel.params);
   if (!floorRow) return false;
-  if (_timeoutFloorBreach(floorRow, nowMs, opts)) {
-    try { await _deleteBySidHash(sidHash); } catch (_e) { /* best-effort */ }
-    return false;
-  }
+  if (await _floorBreachAndCleanup(floorRow, sidHash, nowMs, opts)) return false;
   // Two SQL paths so the SET list stays static (no dynamic column
   // assembly) and matches the call shape clusterStorage expects.
   // extendBy resets expiresAt relative to NOW, not relative to the
@@ -1008,8 +1029,18 @@ async function touch(token, opts) {
  *     reason?:            string,     // audit metadata ("login", "mfa", "role-change")
  *     req?:               IncomingMessage, // re-key the device fingerprint to the new sid
  *     fingerprintFields?: Array<string|fn>, // default ["clientIp","userAgent","acceptLanguage"]
+ *     idleTimeoutMs?:     number,     // idle floor (default 30m; 0 disables)
+ *     absoluteTimeoutMs?: number,     // absolute floor (default 12h; 0 disables)
  *   }
  *
+ * rotate() enforces the SAME idle/absolute timeout floor verify() does and
+ * fails closed (returns null + deletes) on a session past it — a rotate must
+ * never resurrect a session verify() would expire. Pass idleTimeoutMs /
+ * absoluteTimeoutMs consistently with the values used at verify() (the policy
+ * is per-call): a deployment that disables the idle floor via
+ * verify(token, { idleTimeoutMs: 0 }) must pass the same here, or a
+ * long-idle-but-valid session is purged on rotation.
+ *
  * @example
  *   var rotated = await b.session.rotate(req.cookies.sid, {
  *     ttlMs:  b.constants.TIME.hours(8),
@@ -1050,12 +1081,15 @@ async function rotate(oldToken, opts) {
     ? opts.fingerprintFields : DEFAULT_FINGERPRINT_FIELDS;
   var existingData = null;
   var rotSelBuilt = sql.select(_sessionSqlTable(), _sessionSqlOpts())
-    .columns(["data"])
+    .columns(["data", "createdAt", "lastActivity"])
     .where("sidHash", oldSidHash)
     .where("expiresAt", ">=", nowMs)
     .toSql();
   var existingRow = await _currentStore().executeOne(rotSelBuilt.sql, rotSelBuilt.params);
   if (!existingRow) return null;   // unknown / expired old session
+  // A rotate must not resurrect a session past its idle/absolute floor — the
+  // TTL being live is not enough; enforce the same floor verify()/touch() do.
+  if (await _floorBreachAndCleanup(existingRow, oldSidHash, nowMs, opts)) return null;
   try {
     var unsealedExisting = cryptoField.unsealRow(SESSION_TABLE, existingRow);
     if (unsealedExisting.data) existingData = safeJson.parse(unsealedExisting.data);
@@ -1157,8 +1191,17 @@ async function rotate(oldToken, opts) {
  *   {
  *     merge?:              boolean,   // default false (full replace)
  *     touchLastActivity?:  boolean,   // default true
+ *     idleTimeoutMs?:      number,    // idle floor (default 30m; 0 disables)
+ *     absoluteTimeoutMs?:  number,    // absolute floor (default 12h; 0 disables)
  *   }
  *
+ * updateData() enforces the SAME idle/absolute timeout floor verify() does and
+ * fails closed (returns false + deletes) on a session past it — a write must
+ * not resurrect a session verify() would expire. The floor policy is per-call:
+ * pass idleTimeoutMs / absoluteTimeoutMs consistently with the values used at
+ * verify(), or a long-idle-but-valid session (e.g. one accepted under
+ * verify(token, { idleTimeoutMs: 0 })) is purged on the next write.
+ *
  * @example
  *   // Replace the data payload entirely.
  *   await b.session.updateData(req.cookies.sid, { roles: ["admin"], theme: "dark" });
@@ -1194,6 +1237,10 @@ async function updateData(token, data, opts) {
     .toSql();
   var row = await _currentStore().executeOne(selBuilt.sql, selBuilt.params);
   if (!row) return false;
+  // A write must not resurrect a session past its idle/absolute floor (the
+  // same floor verify()/touch() enforce) — resetting lastActivity on an
+  // idle-expired-but-TTL-live session would defeat the idle timeout.
+  if (await _floorBreachAndCleanup(row, sidHash, nowMs, opts)) return false;
 
   // Recover the existing data + reserved fingerprint key (vault-
   // sealed at rest). Operators that want a fresh fingerprint also

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
       },
-      "refreshedAt": "2026-07-25T04:14:23.876Z"
+      "refreshedAt": "2026-07-25T17:09:57.034Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:2880c288b1285ef51d356d057bee6f0c8a00de36638cf47b47617e8c1faf10d5"
       },
-      "refreshedAt": "2026-07-25T04:14:23.876Z"
+      "refreshedAt": "2026-07-25T17:09:57.034Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
       },
-      "refreshedAt": "2026-07-25T04:14:23.876Z"
+      "refreshedAt": "2026-07-25T17:09:57.034Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-07-25T04:14:23.876Z"
+      "refreshedAt": "2026-07-25T17:09:57.034Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-25T04:14:23.876Z"
+      "refreshedAt": "2026-07-25T17:09:57.034Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-25T04:14:23.876Z"
+      "refreshedAt": "2026-07-25T17:09:57.034Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -152,14 +152,14 @@
         "data_js": "lib/vendor/public-suffix-list.data.js"
       },
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
-      "bundledAt": "2026-07-24T00:00:00Z",
+      "bundledAt": "2026-07-25T00:00:00Z",
       "hashes": {
-        "server": "sha256:1fc04fd8ebd4b77c78c38c76d832673c27b56ca154fda6339be61f38b9918701",
-        "data_js": "sha256:1d17ee3059030d1de7208d699ffdd1595c97cd3009d1f41bbfde2ba1a3315372"
+        "server": "sha256:0240b3f1e8c90ecd4af5b94597afb5ba89997ad395f292f87318caefb7e10413",
+        "data_js": "sha256:7994e24e1865f197540a988783de567fe20fb29e7f6c3a5c142766bb0cfd9bfd"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-25T04:14:23.876Z"
+      "refreshedAt": "2026-07-25T17:09:57.034Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -190,7 +190,7 @@
       "hashes": {
         "server": "sha256:2307ef65e070757ffb13442b377e45efb9fa1a10432d9b39618387720ab990ed"
       },
-      "refreshedAt": "2026-07-25T04:14:23.876Z"
+      "refreshedAt": "2026-07-25T17:09:57.034Z"
     }
   }
 }

package/lib/vendor/public-suffix-list.dat

@@ -5,8 +5,8 @@
 // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
 // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
 
-// VERSION: 2026-07-24_16-56-26_UTC
-// COMMIT: f85a38e61c222ea2d9901a41296c6c74fd3e2c28
+// VERSION: 2026-07-25_14-20-03_UTC
+// COMMIT: e1b8015c3b2f0f4f8c18659c2480fc1a22c07b20
 
 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
 
@@ -11304,10 +11304,6 @@ ltd.ua
 a2hosted.com
 cpserver.com
 
-// Acorn Labs : https://acorn.io
-// Submitted by Craig Jellick <domains@acorn.io>
-*.on-acorn.io
-
 // ActiveTrail : https://www.activetrail.biz/
 // Submitted by Ofer Kalaora <postmaster@activetrail.com>
 activetrail.biz