@blamejs/core 0.18.40 → 0.18.42

package/CHANGELOG.md

@@ -8,6 +8,34 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.42 (2026-08-20) — **`b.middleware.botGuard` no longer refuses a request for omitting Accept-Language, which was returning 403 to every search-engine crawler.** `b.middleware.botGuard` treated a missing `Accept-Language` header as grounds for a 403 in its default blocking mode. Google documents that Googlebot sends requests without setting that header, and bingbot behaves the same, so every content page of a site running the default middleware chain answered 403 to a crawler while a browser was served normally. The header's absence is now an advisory signal, matching how the same middleware already treats a missing `Sec-Fetch-Mode`. **Changed:** *Vendored `@blamejs/pki` 0.5.16 to 0.5.17* — A failed integrity check now destroys the plaintext it had recovered rather than returning it, `AuthEnvelopedData` validates the attributes it is asked to authenticate, and the refusal for a content cipher in the wrong container cites the rule it actually applies — RFC 5083 §2 defines `AuthEnvelopedData` in terms of authenticated encryption and never names GCM, so the previous message sent operators to argue with a specification that says the opposite. **Fixed:** *A missing `Accept-Language` tags a request instead of refusing it* — The check was `if (!headers["accept-language"]) return "missing-accept-language"`, and `mode` defaults to `"block"`, so the request was answered 403. Whole client families omit the header — every major search-engine crawler, and with them uptime monitors, link previewers and feed readers — which made a site unreachable to all of them. On a deployment fronted by a cache this is easy to miss from the outside: the cached home page still answers 200, so the site looks partly indexed while every other URL is refused.
+
+It now sets `req.suspectedBot` in `mode: "tag"` and never blocks, which is exactly how the middleware already treats a missing `Sec-Fetch-Mode` — absent for Safari before 16.4 and for every plain-HTTP non-localhost origin — and how `b.middleware.fetchMetadata` already treats a missing `Sec-Fetch-Site` through its `allowMissing` default. A header a whole client family omits is not evidence of automation.
+
+Requests are still refused on positive evidence: the `User-Agent` deny-list (curl, wget, python-requests, axios, Go-http-client and the rest) is unchanged, and operators can extend it with `blockedAgents`. Separating a crawler from an abuser is a rate-limiting question rather than a header one, and `b.rateLimit` answers it.
+
+If you were relying on the old behaviour, `mode: "tag"` surfaces the same signal on `req.suspectedBot` for you to act on. **Detectors:** *No single absent header may block, asserted against the middleware* — `bot-guard.test.js` now starts from a complete browser request and removes one header at a time, asserting that no single omission refuses the request. It covers the headers the middleware inspects — `User-Agent`, `Accept`, `Accept-Language`, `Accept-Encoding` and the three `Sec-Fetch-*` — so the rule holds for whichever one a future change reaches for, not only the one that was wrong.
+
+It is a behavioural check rather than a source-pattern one deliberately. Written as a pattern check first, it was wrong six different ways: anchored to the first expression in the condition, bounded at the first `)`, bounded to a single line, defeated by a statement before the return, by a guard that was OR'd rather than AND'd, and by a `)` inside a string literal. Each fix was a step further into parsing JavaScript with text matching. Running the middleware decides all six, because it asks what the code does rather than how it is written. **References:** [How Google crawls locale-adaptive pages — Googlebot and Accept-Language](https://developers.google.com/search/docs/specialty/international/locale-adaptive-pages)
+
+- v0.18.41 (2026-08-20) — **Logout can now clear the session cookie on a plain-HTTP origin, and every Set-Cookie the framework writes goes through one validating writer.** `b.session.logout` built its expiry cookie by string concatenation with `Secure` hardcoded. A browser refuses a `Secure` cookie that arrives over plain HTTP, so on a cleartext deployment the header was discarded and the session cookie the logout existed to clear stayed in the jar. `b.middleware.csrfProtect` had its own cookie formatter with the same shape and a different consequence: it interpolated the configured `cookie.path` into the response header with no CRLF scrub. Both now compose `b.cookies`, which is the framework's single Set-Cookie writer. **Added:** *`b.cookies.assertAppendable(res)`* — Throws unless a response can carry an appended `Set-Cookie` — the same check `appendSetCookie` performs, exposed so a caller can run it before doing something it cannot undo. A response has to be readable as well as writable to be appended to: without `appendHeader` the merge happens in the framework and needs to see what is already queued, and a response carrying only `setHeader` would have its existing cookies silently replaced. `b.session.logout` calls it up front, because it revokes the session row before queueing the expiry cookie — a refusal at queue time would leave the session destroyed, the browser still holding its cookie, and the request failing. · *`b.cookies.appendSetCookie(res, header)`* — Queues one `Set-Cookie` header without discarding the ones already queued. `res.setHeader("Set-Cookie", value)` replaces the header, so a route that issues a session cookie and then a CSRF cookie sends only the second; `Set-Cookie` is the one response header that is legitimately repeated. The appender uses `res.appendHeader` where the runtime offers it and array-merges where it does not.
+
+It pairs with `b.cookies.serialize`, which validates and builds the header string. `b.cookies.create().write()` and `.clear()` compose both; reach for the two separately when you need to build the header at one point in a flow and queue it at another — validating early, emitting only once the side effect it accompanies has succeeded, which is what `b.session.logout` does with the session row. **Changed:** *`b.session.logout` queues its expiry cookie rather than overwriting the header* — It called `res.setHeader("Set-Cookie", ...)`, which discarded any cookie the route had already queued — a rotated CSRF token, a locale. It now appends. Code reading `res.getHeader("Set-Cookie")` after a logout sees an array of header strings rather than a single string; Node accepts either form on the way out.
+
+`logout` also validates its options object, so a misspelled key is reported instead of silently ignored, and the expiry cookie is now built before the session row is revoked. Building it can fail — a `__Host-` name without `Secure` is refused — and a failure after the revoke would leave the session destroyed with the browser still holding its cookie. · *esbuild 0.28.1 to 0.28.2 (build tooling only)* — esbuild builds the single-file executable the bundler-output gate checks; it is a devDependency and does not ship. The published tarballs differ only in version strings, one new documented API option (`logStyle`), and the refreshed per-platform binary hash map, with a byte-identical `install.js` and an unchanged `postinstall` script. The reviewed SHA-256 for the two platforms the build runs on — CI's `linux-x64` and the maintainer host's `win32-x64` — are recorded in `scripts/esbuild-binary-pin.json` and verified against the binaries npm actually served. **Security:** *`b.session.logout` resolves the `Secure` attribute instead of hardcoding it* — The expiry cookie was emitted as `sid=; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=0`, with `Secure` present unconditionally. A user agent rejects a `Secure` cookie set from a non-secure origin, so on a plain-HTTP deployment neither this header nor the `Clear-Site-Data` queued beside it (also gated on a secure context) could clear the session cookie. The server-side row was already destroyed, so the revoked token was never usable — what remained was a cookie the user could not get rid of by logging out, sent on every later request.
+
+`logout` now takes the transport as input. Pass `req` and the scheme is resolved through `b.requestHelpers.trustedProtocol`, which honours a forwarded scheme only from a peer you have declared trusted; pass `secure` to state it outright. With neither, the cookie is `Secure` — the previous behaviour, and still the default.
+
+The cookie's scope is now describable too. A browser matches an expiry cookie on name, path and domain, so a session cookie written with `Domain=example.com` or `Path=/app` could not be cleared by an expiry cookie that named neither. `logout` accepts `path`, `domain` and `sameSite`. · *A configured CSRF cookie path can no longer split the response header* — `b.middleware.csrfProtect` formatted its own `Set-Cookie` and interpolated `cookie.path` into it directly. A configured path containing a bare CR or LF ended the header there and let whatever followed be read as a header of its own. The attributes now pass through `b.cookies.serialize`, which scrubs CR and NUL from `Domain` and `Path` before they reach the wire, validates the cookie name as an RFC 6265 token, and refuses CRLF, NUL, semicolon or comma in the value.
+
+One further consequence of routing through it: a CSRF cookie configured `sameSite: "None"` now always carries `Secure`, which the SameSite specification requires and which the middleware's own formatter did not add. A `SameSite=None` cookie without `Secure` is rejected by browsers, so this affects a configuration that could not have been working. · *A `__Host-` or `__Secure-` CSRF cookie name now requires an explicit `cookie.secure: true`* — Those prefixes are a promise to the browser that the cookie is always `Secure`, and RFC 6265bis §4.1.3 has user agents drop a cookie that carries the prefix without it. Leaving `cookie.secure` to per-request auto-detection breaks that promise on any cleartext request: the cookie went out prefixed and without `Secure`, the browser discarded it, and the double-submit token silently never persisted — every request then looked like a first visit. The existing boot check could not see this, because the decision was made per request rather than at configuration time.
+
+Configuring a prefixed name now fails at boot unless `cookie.secure: true` is set. A cookie name with no prefix keeps auto-detection, so the default configuration is unchanged. **Detectors:** *`Set-Cookie` may only be written by `b.cookies`* — A `codebase-patterns` entry refuses `setHeader`/`appendHeader` for `Set-Cookie` anywhere outside `lib/cookies.js`. Both defects above came from a file building the header itself and each losing a different guarantee, and one of them carried a comment recording that it did not route through `b.cookies.serialize`. · *A local may not reuse the name of a required module binding* — An eslint rule using scope analysis reports a `var`, `let` or `const` that takes the name of a module the file requires. `var` hoists, so such a local owns the name for the whole enclosing function — including the lines above its own declaration — and a call further down reads the local with no clue nearby that it is no longer the module. This is not hypothetical: it happened while making the change above, and surfaced as `cookies.serialize is not a function` where `cookies` was a parsed request jar.
+
+Parameters are deliberately out of scope. They shadow the same way but are part of the signature the reader has just read, and naming a SQL-string parameter `sql` or a connection-handle parameter `db` is the clearest name available.
+
+Seventeen further instances across `lib/` are resolved with it. Six were an inline `require` of a module the file already required at the top, and are removed rather than renamed. **References:** [RFC 6265bis §4.1.3 — Cookie Name Prefixes](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis) · [W3C Clear-Site-Data](https://www.w3.org/TR/clear-site-data/)
+
 - v0.18.40 (2026-08-19) — **DMARC policy discovery now walks the DNS tree, so a policy at an intermediate label is no longer missed.** `b.mailAuth` resolved DMARC policy with a two-step lookup — the Author Domain, then the organizational domain from the Public Suffix List. RFC 9989 §4.10 specifies a tree walk that queries every ancestor in turn, and the difference is not academic: for `a.b.example.com` a `p=reject` published at `_dmarc.b.example.com` was never queried, evaluated as `none`, and mail the domain owner intended to reject was delivered.
 
 The walk is now implemented, including the spec's denial-of-service bound and its rules for choosing the Organizational Domain.

package/NOTICE

@@ -68,7 +68,7 @@ Used for:    FIPS 203 ML-KEM (ml_kem_512 / ml_kem_768 / ml_kem_1024),
              reference implementation.
 --------------------------------------------------------------------------------
 Component:   @blamejs/pki
-Version:     0.5.16
+Version:     0.5.17
 Source:      https://github.com/blamejs/pki
 License:     Apache-2.0
 Copyright:   Copyright (c) blamejs contributors

package/README.md

@@ -88,7 +88,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
   - Opaque-userId anonymous sessions via `create({ anonymous: true })`
   - Idle / absolute timeouts, fingerprint drift detection + anomaly scoring, brute-force lockout
   - Session-fixation rotation (`b.session.rotate`) re-keys the sid-bound device fingerprint to the new id — pass the same `{ req, fingerprintFields }` used at `create` (a fingerprint-bound session rotated without `req` is refused, so the binding can never silently break or false-drift)
-  - One-call secure logout (`b.session.logout(res, token)`) destroys the session AND wipes client-side state — emits an W3C Clear-Site-Data header (cookies + storage + cache) and expires the session cookie before deleting the row
+  - One-call secure logout (`b.session.logout(res, token, { req })`) destroys the session AND wipes client-side state — revokes the row first, then emits a W3C Clear-Site-Data header (cookies + storage + cache) and an expiry cookie beside it. Pass `req` and the `Secure` attribute follows the request's scheme through `b.requestHelpers.trustedProtocol`, so the expiry cookie is not discarded by a browser on a plain-HTTP origin; `path` / `domain` / `sameSite` describe the cookie being cleared when it was written with a narrower scope
 - **Authorization** — RBAC + per-role DB binding + role-spec `requireMfa` + per-route MFA freshness window + ABAC predicate registry (`b.permissions`); API keys with rotation (`b.apiKey`)
 - **Workflow gates** — break-glass column gates with second-factor + audit (`b.breakGlass`); two-person-rule m-of-n approval with cooling-off lock + cancellation (`b.dualControl`)
 - **Financial / Open Banking** — FAPI 2.0 Final composite posture (PAR + PKCE-S256 + DPoP-or-mTLS + RFC 9207); runtime enforcement helpers `b.fapi2.assertCallback` (refuses missing iss + bare-param under message-signing) and `b.fapi2.assertAuthzRequest` (refuses non-JAR); CFPB §1033 / FDX 6.0 consumer-financial-data-sharing wrapper (`b.fdx`)
@@ -322,7 +322,7 @@ All runtime dependencies are committed to the repo — no transitive npm install
 | [`@noble/hashes`](https://github.com/paulmillr/noble-hashes) | 2.3.0 | [Paul Miller](https://github.com/paulmillr) | Browser (ESM) build only — SHAKE256 / SHA-3 / SHA-2 / HMAC / HKDF for the client half of a hybrid exchange. The server side reaches all of these through `node:crypto`, so there is no server bundle |
 | [`@noble/curves`](https://github.com/paulmillr/noble-curves) | 2.3.0 (bundles @noble/hashes 2.3.0) | [Paul Miller](https://github.com/paulmillr) | RFC 9497 Oblivious Pseudo-Random Function (OPRF / VOPRF / POPRF) over ristretto255 / P-256 / P-384 / P-521, behind `b.crypto.oprf` |
 | [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) | 0.7.0 (bundles @noble/hashes, @noble/curves, @noble/ciphers 2.3.0) | [Paul Miller](https://github.com/paulmillr) | Pure-JS FIPS 203 ML-KEM (`ml_kem_512` / `ml_kem_768` / `ml_kem_1024`), FIPS 204 ML-DSA (`ml_dsa_44/65/87`), FIPS 205 SLH-DSA (`slh_dsa_*`). First-class on both server-side and client-side via `b.pqcSoftware` — security-first defaults pin to the highest cat-5 levels (ML-KEM-1024, ML-DSA-87, SLH-DSA-SHAKE-256f); interoperable with Node's built-in WebCrypto ML-KEM that `b.crypto.encrypt` / `b.middleware.apiEncrypt` use. A browser (ESM) build ships beside it carrying the KEM suites only — a client half encapsulates and does not sign |
-| [`@blamejs/pki`](https://github.com/blamejs/pki) | 0.5.16 | [blamejs](https://github.com/blamejs) | Zero-dependency pure-JS X.509 / CRL / PKCS#12 / CSR / CMS toolkit backing `b.mtlsCa` — ML-DSA-87 (FIPS 204) post-quantum + ECDSA-P384 cert signing, PBMAC1 PKCS#12 packaging, chain validation (no openssl CLI) — and the WebAuthn attestation / assertion verification behind `b.auth.passkey` |
+| [`@blamejs/pki`](https://github.com/blamejs/pki) | 0.5.17 | [blamejs](https://github.com/blamejs) | Zero-dependency pure-JS X.509 / CRL / PKCS#12 / CSR / CMS toolkit backing `b.mtlsCa` — ML-DSA-87 (FIPS 204) post-quantum + ECDSA-P384 cert signing, PBMAC1 PKCS#12 packaging, chain validation (no openssl CLI) — and the WebAuthn attestation / assertion verification behind `b.auth.passkey` |
 | [`SecLists` 10k-most-common.txt](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt) | master snapshot | [Daniel Miessler / SecLists contributors](https://github.com/danielmiessler/SecLists) (CC-BY-3.0) | Top-10000 common-password dictionary read by `b.auth.password.policy()` for the NIST 800-63B §5.1.1.2 "previously breached" check |
 | [`prismjs`](https://prismjs.com/) | 1.30.0 | [Lea Verou + contributors](https://github.com/PrismJS/prism) | Syntax highlighting in the example wiki's code blocks (browser-side) |
 

package/lib/acme.js

@@ -100,16 +100,16 @@ function _publicJwkFromKeyObject(keyObject) {
   if (!keyObject || typeof keyObject.export !== "function") {
     throw _err("acme/bad-account-key", "accountKey must expose a Node KeyObject (export)", true);
   }
-  var jwk;
-  try { jwk = keyObject.export({ format: "jwk" }); }
+  var exported;
+  try { exported = keyObject.export({ format: "jwk" }); }
   catch (e) { throw _err("acme/bad-account-key", "accountKey export(jwk) failed: " + e.message, true); }
-  if (!jwk || jwk.kty !== "EC" || jwk.crv !== "P-256") {
+  if (!exported || exported.kty !== "EC" || exported.crv !== "P-256") {
     throw _err("acme/bad-account-key",
       "accountKey must be a P-256 EC keypair (RFC 8555 §6.2 ES256); got kty=" +
-      (jwk && jwk.kty) + " crv=" + (jwk && jwk.crv), true);
+      (exported && exported.kty) + " crv=" + (exported && exported.crv), true);
   }
   // RFC 7638 thumbprint inputs MUST be sorted alphabetically + minimal-JSON.
-  return Object.freeze({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
+  return Object.freeze({ crv: exported.crv, kty: exported.kty, x: exported.x, y: exported.y });
 }
 
 function _jwkThumbprint(publicJwk) {
@@ -1247,7 +1247,6 @@ function create(opts) {
       throw _err("acme/bad-token", "tlsAlpn01KeyAuthorization: token must be a non-empty string", true);
     }
     var keyAuth = token + "." + _jwkThumbprint(publicJwk);
-    var nodeCrypto  = require("node:crypto");
     return nodeCrypto.createHash("sha256").update(keyAuth, "utf8").digest();
   }
 
@@ -1348,7 +1347,6 @@ function create(opts) {
       throw _err("acme/bad-ttl",
         "dnsAccount01ChallengeRecord: ttl must be a positive integer <= 86400 seconds", true);
     }
-    var nodeCrypto = require("node:crypto");
     // Account label: lowercase base32 of first 10 bytes of SHA-256(accountUrl)
     // (per draft-ietf-acme-dns-account-label §3.1 — 80-bit truncated label).
     var hash = nodeCrypto.createHash("sha256").update(state.accountUrl, "utf8").digest();

package/lib/audit.js

@@ -1963,8 +1963,8 @@ function generateActorBindingTriggerSql(opts) {
  */
 async function assertSegregation(opts) {
   opts = opts || {};
-  var db = opts.db || null;
-  if (!db || typeof db.query !== "function") {
+  var externalDb = opts.db || null;
+  if (!externalDb || typeof externalDb.query !== "function") {
     throw new AuditSegregationError("audit/segregation-no-db",
       "audit.assertSegregation: opts.db with a query() method is required");
   }
@@ -1976,11 +1976,11 @@ async function assertSegregation(opts) {
   // Operator-DB system-catalog introspection (Postgres pg_proc / pg_trigger,
   // $N-native, against the operator-supplied db.query) — not a framework
   // table, so b.sql's verb builders don't apply.
-  var fnRes = await db.query(
+  var fnRes = await externalDb.query(
     "SELECT 1 FROM pg_proc WHERE proname = $1 LIMIT 1", [fnName]             // allow:hand-rolled-sql
   );
   var fnPresent = !!(fnRes && fnRes.rows && fnRes.rows.length > 0);
-  var trigRes = await db.query(
+  var trigRes = await externalDb.query(
     "SELECT 1 FROM pg_trigger WHERE tgname = $1 LIMIT 1", [trigName]         // allow:hand-rolled-sql
   );
   var trigPresent = !!(trigRes && trigRes.rows && trigRes.rows.length > 0);

package/lib/auth/dpop.js

@@ -219,16 +219,16 @@ async function buildProof(opts) {
       "alg '" + alg + "' is not supported by DPoP");
   }
 
-  var jwk = opts.jwk || _publicJwkFromPrivate(key);
+  var proofKey = opts.jwk || _publicJwkFromPrivate(key);
   // Strip private parts from the embedded jwk if the operator passed a
   // private JWK by accident — ONLY public components belong in the proof.
   var pubJwk;
-  if (jwk.kty === "EC") pubJwk = { kty: "EC", crv: jwk.crv, x: jwk.x, y: jwk.y };
-  else if (jwk.kty === "OKP") pubJwk = { kty: "OKP", crv: jwk.crv, x: jwk.x };
-  else if (jwk.kty === "RSA") pubJwk = { kty: "RSA", e: jwk.e, n: jwk.n };
-  else if (jwk.kty === "AKP") pubJwk = { kty: "AKP", alg: jwk.alg, pub: jwk.pub };
+  if (proofKey.kty === "EC") pubJwk = { kty: "EC", crv: proofKey.crv, x: proofKey.x, y: proofKey.y };
+  else if (proofKey.kty === "OKP") pubJwk = { kty: "OKP", crv: proofKey.crv, x: proofKey.x };
+  else if (proofKey.kty === "RSA") pubJwk = { kty: "RSA", e: proofKey.e, n: proofKey.n };
+  else if (proofKey.kty === "AKP") pubJwk = { kty: "AKP", alg: proofKey.alg, pub: proofKey.pub };
   else throw new AuthError("auth-dpop/refused-kty",
-    "jwk.kty='" + jwk.kty + "' is not allowed");
+    "jwk.kty='" + proofKey.kty + "' is not allowed");
 
   var jti = opts.jti || _b64urlEncode(nodeCrypto.randomBytes(C.BYTES.bytes(16)));
   var nowMs = (typeof opts.iat === "number" ? opts.iat * C.TIME.seconds(1) : Date.now());

package/lib/cert.js

@@ -514,22 +514,22 @@ function create(opts) {
   }
 
   async function _issueCert(certManifest) {
-    var acme = _bootAcme();
+    var acmeClient = _bootAcme();
     // 1. Fetch directory + ensure ACME account exists.
-    await acme.fetchDirectory();
-    await acme.newAccount({
+    await acmeClient.fetchDirectory();
+    await acmeClient.newAccount({
       contact:              opts.acme.contactEmail ? ["mailto:" + opts.acme.contactEmail] : undefined,
       termsOfServiceAgreed: true,
     });
     // 2. Create the order.
-    var order = await acme.newOrder({
+    var order = await acmeClient.newOrder({
       identifiers: certManifest.domains.map(function (d) {
         return { type: "dns", value: d };
       }),
     });
     // 3. For each authorization, solve the operator-supplied challenge.
     for (var ai = 0; ai < order.authorizations.length; ai += 1) {
-      var auth = await acme.fetchAuthorization(order.authorizations[ai]);
+      var auth = await acmeClient.fetchAuthorization(order.authorizations[ai]);
       if (auth.status === "valid") continue;
       var challenge = auth.challenges.find(function (ch) {
         return ch.type === certManifest.challenge.type;
@@ -541,8 +541,8 @@ function create(opts) {
       }
       // tls-alpn-01 has a different key-authorization shape (RFC 8737).
       var keyAuth = certManifest.challenge.type === "tls-alpn-01"
-        ? acme.tlsAlpn01KeyAuthorization(challenge.token)
-        : acme.keyAuthorization(challenge.token);
+        ? acmeClient.tlsAlpn01KeyAuthorization(challenge.token)
+        : acmeClient.keyAuthorization(challenge.token);
       var provisionParams = {
         domain:           auth.identifier.value,
         type:             challenge.type,
@@ -551,8 +551,8 @@ function create(opts) {
       };
       await certManifest.challenge.provision(provisionParams);
       try {
-        await acme.notifyChallengeReady(challenge.url);
-        await acme.waitForAuthorization(order.authorizations[ai]);
+        await acmeClient.notifyChallengeReady(challenge.url);
+        await acmeClient.waitForAuthorization(order.authorizations[ai]);
       } finally {
         try { await certManifest.challenge.cleanup(provisionParams); }
         catch (cleanupErr) {
@@ -568,13 +568,13 @@ function create(opts) {
     }
     // 4. Generate leaf keypair + CSR + finalize.
     var leafPair = _generateLeafKeypair(certManifest.keyAlg);
-    var csrPem = acme.buildCsr({
+    var csrPem = acmeClient.buildCsr({
       privateKey: leafPair.privateKey,
       publicKey:  leafPair.publicKey,
       domains:    certManifest.domains,
     });
-    var finalized = await acme.finalize(order, csrPem);
-    var certPem = await acme.retrieveCert(finalized);
+    var finalized = await acmeClient.finalize(order, csrPem);
+    var certPem = await acmeClient.retrieveCert(finalized);
     var privPem = leafPair.privateKey.export({ type: "pkcs8", format: "pem" });
     return { certPem: certPem, keyPem: privPem };
   }

package/lib/compliance-sanctions.js

@@ -200,15 +200,15 @@ function parseUn1267Entry(entry) {
   if (!entry || typeof entry !== "object") return null;
   var name = entry.NAME || entry.name || entry.FIRST_NAME || "";
   if (!name) return null;
-  var aliases = [];
-  if (Array.isArray(entry.ALIASES)) aliases = entry.ALIASES.slice();
+  var entryAliases = [];
+  if (Array.isArray(entry.ALIASES)) entryAliases = entry.ALIASES.slice();
   else if (typeof entry.ALIAS_NAMES === "string") {
-    aliases = entry.ALIAS_NAMES.split(";").map(function (s) { return s.trim(); }).filter(Boolean);
+    entryAliases = entry.ALIAS_NAMES.split(";").map(function (s) { return s.trim(); }).filter(Boolean);
   }
   return {
     id:          "UN-1267-" + String(entry.REFERENCE_NUMBER || entry.DATAID || ""),
     primaryName: String(name).trim(),
-    aliases:     aliases,
+    aliases:     entryAliases,
     type:        entry.NAME_TYPE === "Entity" ? "entity" : "individual",
     programs:    ["UN-1267"],
     country:     entry.COUNTRY || entry.NATIONALITY || null,

package/lib/cookies.js

@@ -324,18 +324,100 @@ function serialize(name, value, attrs) {
   return parts.join("; ");
 }
 
-// Append a Set-Cookie header preserving any already on the response.
-function _appendSetCookie(res, header) {
+/**
+ * @primitive b.cookies.appendSetCookie
+ * @signature b.cookies.appendSetCookie(res, header)
+ * @since     0.18.41
+ * @status    stable
+ * @related   b.cookies.serialize, b.cookies.create
+ *
+ * Queue one Set-Cookie header on a response without discarding the ones
+ * already queued. `res.setHeader("Set-Cookie", value)` REPLACES the header,
+ * so a second cookie written that way silently drops the first — a route
+ * that issues a session cookie and then a CSRF cookie ends up sending only
+ * the CSRF one. Set-Cookie is the one response header that is legitimately
+ * repeated, and this is the framework's single appender for it: it uses
+ * `res.appendHeader` where the runtime offers it, and falls back to reading
+ * the current value and array-merging where it doesn't.
+ *
+ * The header string must already be serialized — pair it with
+ * `b.cookies.serialize`, which validates the name, value and attributes.
+ * `b.cookies.create().write()` / `.clear()` compose both for you; reach for
+ * this directly when you need to build the header at one point in a flow and
+ * queue it at another (validating early, emitting only after the side effect
+ * it accompanies has succeeded).
+ *
+ * @example
+ *   var header = b.cookies.serialize("sid", "", {
+ *     httpOnly: true, secure: true, sameSite: "Strict", path: "/", maxAge: 0,
+ *   });
+ *   b.cookies.appendSetCookie(res, header);
+ *   // → res now carries this expiry cookie alongside any already queued
+ */
+/**
+ * @primitive b.cookies.assertAppendable
+ * @signature b.cookies.assertAppendable(res)
+ * @since     0.18.41
+ * @status    stable
+ * @related   b.cookies.appendSetCookie, b.session.logout
+ *
+ * Throw unless `res` can carry an appended `Set-Cookie`. This is the same
+ * check `b.cookies.appendSetCookie` performs, exposed so a caller can run it
+ * BEFORE doing something it cannot undo.
+ *
+ * A response has to be readable as well as writable to be appended to: without
+ * `appendHeader`, the merge is done here and needs to see what is already
+ * queued. Discovering that late is the problem this exists to prevent —
+ * `b.session.logout` revokes the session row before it queues the expiry
+ * cookie, so a throw at queue time would leave the session destroyed, the
+ * client still holding its cookie, and the request failing. The response's
+ * shape is fixed for the life of the process and owned by the caller, not by
+ * the request, so it can and should be asserted up front.
+ *
+ * @example
+ *   b.cookies.assertAppendable(res);   // throws on a write-only response
+ *   await doSomethingIrreversible();
+ *   b.cookies.appendSetCookie(res, header);
+ *   // → the append cannot fail for a reason that was knowable earlier
+ */
+function assertAppendable(res) {
   if (!res || typeof res.setHeader !== "function") {
     throw new CookieError("cookies/no-set-header",
       "response object has no setHeader (not a Node http.ServerResponse?)");
   }
-  var existing;
-  if (typeof res.getHeader === "function") existing = res.getHeader("Set-Cookie");
+  // Without appendHeader the merge has to be done here, which means reading
+  // what is already queued. A response that can be written but not READ — a
+  // thin adapter or a test double carrying only setHeader — cannot be appended
+  // to at all: treating the unreadable value as absent would overwrite a cookie
+  // the route had already queued, which is the precise loss the appender exists
+  // to prevent. Refuse instead of silently doing the damage.
+  if (typeof res.appendHeader !== "function" && typeof res.getHeader !== "function") {
+    throw new CookieError("cookies/unreadable-response",
+      "response exposes setHeader but neither appendHeader nor getHeader, so an " +
+      "already-queued Set-Cookie cannot be read and would be replaced. Give the " +
+      "response a getHeader (or appendHeader) implementation.");
+  }
+}
+
+function appendSetCookie(res, header) {
+  assertAppendable(res);
+  if (typeof header !== "string" || header.length === 0) {
+    throw new CookieError("cookies/invalid-header",
+      "appendSetCookie: header must be a non-empty serialized Set-Cookie string");
+  }
+  // Node >= 18 exposes appendHeader, which handles the multi-value merge
+  // itself; prefer it so the response's own bookkeeping stays authoritative.
+  if (typeof res.appendHeader === "function") {
+    res.appendHeader("Set-Cookie", header);
+    return;
+  }
+  // assertAppendable has already established that getHeader exists when
+  // appendHeader does not, so the merge below can read the response.
+  var existing = res.getHeader("Set-Cookie");
   var arr;
-  if (Array.isArray(existing))      arr = existing.slice();
-  else if (existing !== undefined)  arr = [existing];
-  else                              arr = [];
+  if (Array.isArray(existing))                        arr = existing.slice();
+  else if (existing !== undefined && existing !== null) arr = [existing];
+  else                                                arr = [];
   arr.push(header);
   res.setHeader("Set-Cookie", arr);
 }
@@ -402,7 +484,7 @@ function create(opts) {
 
   function read(req, name)               { return _readCookieFromReq(req, name); }
   function write(res, name, value, attrs) {
-    _appendSetCookie(res, serialize(name, value, _mergeAttrs(attrs)));
+    appendSetCookie(res, serialize(name, value, _mergeAttrs(attrs)));
   }
   function clear(res, name, attrs) {
     // Expire-now cookie. Domain + Path must match the original write
@@ -410,7 +492,7 @@ function create(opts) {
     // attrs they used on write (or rely on the same defaults).
     var attrsExp = Object.assign({}, _mergeAttrs(attrs), { maxAge: 0 });
     delete attrsExp.expires;
-    _appendSetCookie(res, serialize(name, "", attrsExp));
+    appendSetCookie(res, serialize(name, "", attrsExp));
   }
 
   function _requireVault() {
@@ -575,9 +657,11 @@ function parseSafe(cookieHeader, opts) {
 }
 
 module.exports = {
-  create:       create,
-  parse:        parse,
-  parseSafe:    parseSafe,
-  serialize:    serialize,
-  CookieError:  CookieError,
+  create:           create,
+  parse:            parse,
+  parseSafe:        parseSafe,
+  serialize:        serialize,
+  appendSetCookie:  appendSetCookie,
+  assertAppendable: assertAppendable,
+  CookieError:      CookieError,
 };

package/lib/http-client.js

@@ -851,9 +851,7 @@ function _attachJarCookie(headers, jar, url) {
 function _buildMultipartBody(spec) {
   var boundary = "----blamejs-mp-" + bCrypto.generateToken(C.BYTES.bytes(16));
   var CRLF = "\r\n";
-  var nodeFs = require("node:fs");                                             // allow:inline-require — only on multipart paths that touch the filesystem
-  var path = require("node:path");                                         // allow:inline-require — same
-  var nodeStream = require("node:stream");                                 // allow:inline-require — Readable subclass only when streaming
+  var path = require("node:path");                                         // allow:inline-require — only on multipart paths that touch the filesystem
 
   // Each entry is { headerBytes, source } where source is one of:
   //   { kind: "buffer", buf: Buffer }

package/lib/mail-auth.js

@@ -334,11 +334,11 @@ function _ipv6Expand(ip) {
 
 function _ipv6InCidr(ip, cidr) {
   var slash = cidr.indexOf("/");
-  var net = slash === -1 ? cidr : cidr.slice(0, slash);
+  var networkAddr = slash === -1 ? cidr : cidr.slice(0, slash);
   var mask = slash === -1 ? 128 : parseInt(cidr.slice(slash + 1), 10);                        // IPv6 max prefix
   if (!isFinite(mask) || mask < 0 || mask > 128) return false;                                // IPv6 max prefix
   var ipGroups  = _ipv6Expand(ip);
-  var netGroups = _ipv6Expand(net);
+  var netGroups = _ipv6Expand(networkAddr);
   if (!ipGroups || !netGroups) return false;
   if (mask === 0) return true;
   // Compare group-by-group up to the prefix boundary.
@@ -356,11 +356,11 @@ function _ipv6InCidr(ip, cidr) {
 
 function _ipv4InCidr(ip, cidr) {
   var slash = cidr.indexOf("/");
-  var net = slash === -1 ? cidr : cidr.slice(0, slash);
+  var networkAddr = slash === -1 ? cidr : cidr.slice(0, slash);
   var mask = slash === -1 ? 32 : parseInt(cidr.slice(slash + 1), 10);             // IPv4 max prefix
   if (!isFinite(mask) || mask < 0 || mask > 32) return false;                     // IPv4 max prefix
   var ipInt = _ipv4ToInt(ip);
-  var netInt = _ipv4ToInt(net);
+  var netInt = _ipv4ToInt(networkAddr);
   if (ipInt === null || netInt === null) return false;
   if (mask === 0) return true;
   var bits = 32 - mask;                                                          // IPv4 max prefix
@@ -2395,7 +2395,6 @@ function _pemFromB64KeyMaterial(b64) {
 }
 
 function _runVerify(signedString, sigB64, algorithm, keyB64, label) {
-  var nodeCrypto = require("node:crypto");
   var pem = _pemFromB64KeyMaterial(keyB64);
   var keyObj;
   try { keyObj = nodeCrypto.createPublicKey(pem); }

package/lib/mail.js

@@ -248,10 +248,9 @@ async function reverseDns(ip) {
   // the original input. RFC 8601 §3 says the forward query must use
   // the same family as the source; mismatched families don't count
   // as confirmation.
-  var net = require("node:net");
   var forwardAddrs = [];
   try {
-    if (net.isIPv6(ip)) {
+    if (net().isIPv6(ip)) {
       forwardAddrs = await dns.resolveAaaa(ptrName);
     } else {
       forwardAddrs = await dns.resolve4(ptrName);

package/lib/middleware/bot-guard.js

@@ -7,7 +7,13 @@
  * authentication, but catches drive-by scrapers and most low-effort bots.
  *
  * Heuristics (all combined):
- *   - Missing Accept-Language header (real browsers always send one)
+ *   - Missing Accept-Language header — ADVISORY ONLY (never blocks). Tagged
+ *     in mode:"tag". It cannot block because the header is absent for entire
+ *     client families: every major search-engine crawler omits it (Google
+ *     documents that Googlebot "sends HTTP requests without setting
+ *     Accept-Language"), as do uptime monitors, link previewers and feed
+ *     readers — a 403 on it alone made a site's every page unreachable to
+ *     Googlebot while a browser sailed through.
  *   - Missing Sec-Fetch-Mode header — ADVISORY ONLY (never blocks). Tagged
  *     in mode:"tag" on secure-context HTML GETs where a modern browser
  *     would have sent it. It cannot block because the header is absent for
@@ -90,13 +96,15 @@ function _coerceAgentPattern(r, where) {
  * Cheap fingerprint-based detection of obviously-non-browser requests.
  * Constructed via `b.middleware.botGuard(opts)`; the resulting
  * middleware has the `(req, res, next)` shape shown above.
- * Two blocking heuristics — missing `Accept-Language` and a User-Agent
- * regex match against a default list (curl / wget / python-requests /
- * axios / etc.) — plus one advisory signal: a missing `Sec-Fetch-Mode`
- * on a secure-context HTML GET sets `req.suspectedBot` in `mode: "tag"`
- * but NEVER blocks (the header is absent for Safari < 16.4 and every
- * plain-HTTP non-localhost origin, so blocking on it refuses real
- * users). Not
+ * One blocking heuristic — a User-Agent regex match against a default
+ * list (curl / wget / python-requests / axios / etc.) — plus two
+ * advisory signals that set `req.suspectedBot` in `mode: "tag"` and
+ * NEVER block: a missing `Accept-Language` (absent from every major
+ * search-engine crawler, so blocking on it makes a site unreachable to
+ * them) and a missing `Sec-Fetch-Mode` on a secure-context HTML GET
+ * (absent for Safari < 16.4 and every plain-HTTP non-localhost origin).
+ * A header a whole client family omits is not evidence of automation.
+ * Not
  * a substitute for proper authentication — catches drive-by scrapers
  * and low-effort bots. In `mode: "block"` (default) the request is
  * refused; in `mode: "tag"` `req.suspectedBot = true` is set and the
@@ -206,14 +214,29 @@ function create(opts) {
       // Skip browser-fingerprint checks for API routes
       return null;
     }
-    if (!headers["accept-language"]) return "missing-accept-language";
+    // Missing Accept-Language NEVER blocks, for the reason the Sec-Fetch-Mode
+    // check below does not either: the header is absent for entire CLIENT
+    // families, so a 403 on it alone refuses them wholesale. Every major
+    // search-engine crawler omits it — Google documents that Googlebot "sends
+    // HTTP requests without setting Accept-Language in the request header",
+    // and bingbot behaves the same — so blocking on it made every content page
+    // of a blamejs site answer 403 to a crawler while a browser sailed
+    // through. Measured on a live deployment: a 337-URL sitemap of which only
+    // the cached homepage was reachable. Uptime monitors, link previewers and
+    // feed readers are refused the same way.
+    //
+    // It survives as an advisory TAG, so an operator can still rate-limit or
+    // log on it. Automation libraries remain blocked by the User-Agent
+    // deny-list, which is what actually distinguishes them; separating a
+    // crawler from an abuser is a rate-limiting question, not a header one.
+    if (mode === "tag" && !headers["accept-language"]) return "missing-accept-language";
     // Missing Sec-Fetch-Mode NEVER blocks: the header is absent for entire
     // browser families (Safari < 16.4 omits Fetch Metadata even over HTTPS)
     // and for every plain-HTTP non-localhost origin (Umbrel, LAN / *.local
     // reverse proxies), so a 403 on it alone refuses real users. It survives
     // only as an advisory TAG in mode:"tag", and even then only in a secure
     // context where a modern browser would have sent it. Drive-by bots are
-    // still blocked by missing Accept-Language + the User-Agent deny-list.
+    // still blocked by the User-Agent deny-list.
     if (mode === "tag" && req.method === "GET" && _isSecureContext(req) && !headers["sec-fetch-mode"]) return "missing-sec-fetch-mode";
     return null;
   }