@blamejs/core 0.18.54 → 0.18.56

package/lib/mail-server-submission.js

@@ -106,7 +106,6 @@
 var net   = require("node:net");
 var nodeTls   = require("node:tls");
 var C         = require("./constants");
-var bCrypto   = require("./crypto");
 var numericBounds = require("./numeric-bounds");
 var safeAsync = require("./safe-async");
 var safeBuffer = require("./safe-buffer");
@@ -251,6 +250,7 @@ function _actorDomain(actor, mailFrom) {
  *   maxMessageBytes: number,       // default 50 MiB
  *   maxRcptsPerMessage: number,    // default 100
  *   idleTimeoutMs:   number,       // default 5 minutes
+ *   maxConnections:  number,       // default 1024 — listener-wide ceiling
  *   profile:         string,       // "strict" | "balanced" | "permissive"; default "strict"
  *
  * @example
@@ -290,7 +290,7 @@ function create(opts) {
       "create: opts.tenantScope requires opts.agentTenantId");
   }
   numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxLineBytes", "maxMessageBytes", "maxRcptsPerMessage", "idleTimeoutMs"],
+    ["maxLineBytes", "maxMessageBytes", "maxRcptsPerMessage", "idleTimeoutMs", "maxConnections"],
     "mail.server.submission.", MailServerSubmissionError, "mail-server-submission/bad-bound");
 
   var profile = opts.profile || "strict";
@@ -384,21 +384,26 @@ function create(opts) {
 
   function _handleConnection(rawSocket) {
     // 421 4.7.0 — transient; sender retries elsewhere.
-    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+    var accepted = mailServerNet.acceptConnection(rawSocket, {
+      rateLimit:    rateLimit,
+      connections:  connections,
+      emit:         _emit,
       refusedEvent: "mail.server.submission.rate_limit_refused",
       refusalLine:  "421 4.7.0 Too many connections from your IP\r\n",
-    });
-    if (remoteAddress === null) return;
-    rawSocket.once("close", function () { rateLimit.releaseConnection(remoteAddress); });
-
-    var connectionId = "submitconn-" + bCrypto.generateToken(8);                                      // connection-id length
-    var socket = implicitTls
+      idPrefix:     "submitconn-",
       // Certificate compression is configured on the secure CONTEXT by
       // b.mail.server.tls.context — a TLSSocket wrapping a pre-built context
       // ignores the option, so setting it here would be inert.
-      ? new nodeTls.TLSSocket(rawSocket, { isServer: true, secureContext: opts.tlsContext })
-      : rawSocket;
-    connections.add(socket);
+      wrap: implicitTls
+        ? function (raw) {
+            return new nodeTls.TLSSocket(raw, { isServer: true, secureContext: opts.tlsContext });
+          }
+        : null,
+    });
+    if (accepted === null) return;
+    var remoteAddress = accepted.remoteAddress;
+    var connectionId  = accepted.connectionId;
+    var socket        = accepted.socket;
 
     var state = {
       id:            connectionId,
@@ -424,6 +429,13 @@ function create(opts) {
     // string only for the per-command parse.
     var lineBuffer = Buffer.alloc(0);
     var bodyCollector = null;
+    // Watches the DATA body for its terminator and the smuggling shape as bytes
+    // arrive, so neither screen re-reads what it has already seen. Lives exactly
+    // as long as bodyCollector.
+    var bodyScanner = null;
+    // The slow-loris byte-rate floor, measured over bounded windows so an early
+    // burst cannot buy credit for a slow tail.
+    var bodyRateWindow = mailServerNet.createBodyRateWindow(rateLimit);
     var inDataBody = false;
     // RFC 3030 CHUNKING — state for the BDAT command. `bdatCollector`
     // accumulates the message body across multiple BDAT chunks; it lives
@@ -432,6 +444,15 @@ function create(opts) {
     // bytes still owed by the current BDAT chunk; `bdatIsLast` flags
     // whether the current chunk is the terminator.
     var inBdatChunk    = false;
+    // Whether the rate window has been opened for the BDAT sequence in flight.
+    // Explicit rather than inferred from the byte count, because a sequence of
+    // zero-length chunks leaves that count at zero.
+    var bdatRateStarted = false;
+    // Every byte this connection has received, counted once at the wire. The
+    // rate window takes its baseline from this rather than from a per-transfer
+    // counter, so nothing the parser does downstream — including re-feeding a
+    // chunk's tail through itself — can credit a byte twice.
+    var wireBytes = 0;
     var bdatRemaining  = 0;
     var bdatIsLast     = false;
     var bdatCollector  = null;
@@ -447,7 +468,6 @@ function create(opts) {
         { connectionId: state.id, code: (err && err.code) || "unknown" }, "warning");
       _closeConnection(socket);
     });
-    socket.on("close", function () { connections.delete(socket); });
 
     _emit("mail.server.submission.connect", {
       connectionId:  state.id,
@@ -458,18 +478,67 @@ function create(opts) {
 
     _writeReply(socket, REPLY_220_READY, greeting + " ready");
 
-    socket.on("data", function (chunk) {
-      try { _ingestBytes(state, socket, chunk); }
+    // The one funnel both transports feed. Counted HERE and nowhere else:
+    // _ingestBytes re-feeds the tail of a chunk through itself when a BDAT
+    // payload and the next command arrive in one packet, so a counter kept
+    // inside it credits those bytes twice — a peer pipelining a one-byte
+    // payload with its next command would draw roughly double the rate it was
+    // really sending.
+    //
+    // `activeSock` is whichever socket is current, because STARTTLS replaces
+    // it. Counting on the plaintext `data` listener alone stopped counting the
+    // moment a connection upgraded, which is the moment it becomes the shape
+    // operators actually deploy: the reading froze, and after the grace period
+    // a client sending well above the floor was judged to have sent nothing.
+    function _feedChunk(activeSock, chunk) {
+      wireBytes += chunk.length;
+      try { _ingestBytes(state, activeSock, chunk); }
       catch (err) {
         _emit("mail.server.submission.handler_threw",
           { connectionId: state.id, error: (err && err.message) || String(err) }, "failure");
-        try { _writeReply(socket, REPLY_421_SERVICE_NOT_AVAIL, "4.3.0 Server error"); }
+        try { _writeReply(activeSock, REPLY_421_SERVICE_NOT_AVAIL, "4.3.0 Server error"); }
         catch (_e) { /* socket already gone */ }
-        _closeConnection(socket);
+        _closeConnection(activeSock);
       }
-    });
+    }
+
+    socket.on("data", function (chunk) { _feedChunk(socket, chunk); });
 
     function _ingestBytes(state, socket, chunk) {
+      // The body-rate floor is enforced HERE, on every inbound byte, rather
+      // than inside the DATA and BDAT handlers.
+      //
+      // A check reached only from a body handler is one the peer chooses
+      // whether to reach. Enforced on the DATA path, a client used BDAT; moved
+      // onto BDAT payloads, a client used `BDAT 0`; keyed off the byte count, a
+      // client interleaved NOOP, which resets the socket idle timer without
+      // ever passing through a body handler. Each fix closed the path it was
+      // written for and left the next one open, because the peer picks the
+      // command stream.
+      //
+      // What the peer CANNOT do is hold the connection without sending bytes:
+      // stop sending and idleTimeoutMs cuts it. So every byte is measured, from
+      // the moment a body transfer opens until it closes, whatever the bytes
+      // happen to spell. No timer, and nothing to leak on teardown.
+      if (bdatRateStarted || inDataBody) {
+        // Read, never incremented: the wire handler owns the counter. The
+        // window measures against the baseline it took when the transfer
+        // opened, so this is "every byte since then", command bytes included.
+        // Counting only BODY bytes made the number go flat — and, with an
+        // interleaved command, backwards — across a window roll, which reads as
+        // no progress and refuses a client that is in fact sending steadily.
+        if (bodyRateWindow.starved(wireBytes, Date.now())) {
+          _emit("mail.server.submission.data_refused",
+            { connectionId: state.id, reason: "body-rate-below-floor",
+              minBytesPerSecond: rateLimit.minBytesPerSecond() }, "denied");
+          _writeReply(socket, REPLY_421_SERVICE_NOT_AVAIL,
+            "4.7.0 Message body arriving below the minimum rate; closing connection");
+          _resetTransaction(state);
+          inDataBody = false; bodyCollector = null; bodyScanner = null;
+          _closeConnection(socket);
+          return;
+        }
+      }
       // RFC 3030 — when a BDAT chunk is in progress we consume exactly
       // `bdatRemaining` bytes off the wire, no dot-stuffing, no end-of-
       // data marker. Any excess bytes in the chunk after the BDAT
@@ -507,6 +576,7 @@ function create(opts) {
             var bdatBody = bdatCollector.result();
             bdatCollector = null;
             bdatTotalBytes = 0;
+            if (_refuseSmuggledBdatBody(state, socket, bdatBody)) return;
             _finalizeAcceptedBody(state, socket, bdatBody, "BDAT");
           } else {
             // Non-final chunk — per-chunk acknowledgement only.
@@ -530,27 +600,37 @@ function create(opts) {
           _writeReply(socket, REPLY_552_SIZE_EXCEEDED,
             "5.3.4 Message size exceeds fixed maximum (" + maxMessageBytes + " bytes)");
           _resetTransaction(state);
-          inDataBody = false; bodyCollector = null;
+          inDataBody = false; bodyCollector = null; bodyScanner = null;
           return;
         }
-        var collected = bodyCollector.result();
-        if (guardSmtpCommand.detectBodySmuggling(collected)) {
+        // Scanned INCREMENTALLY — only this chunk plus a four-byte overlap.
+        // Re-deriving the whole accumulated body per chunk (`result()` is a
+        // fresh concat of everything received) and scanning it twice made
+        // acceptance quadratic in the message size: the byte cap still held,
+        // but a message inside the cap cost 4949 ms at 8 MiB against 143 ms at
+        // 1 MiB. `result()` is now called ONCE, when the terminator is found.
+        //
+        // The slow-loris floor is NOT applied here. It lives at the top of
+        // _ingestBytes, where every inbound byte passes regardless of which
+        // command it belongs to — a check reached only from this handler is one
+        // a peer skips by sending anything else.
+        var seen = bodyScanner.push(chunk);
+        if (seen.smuggling) {
           _emit("mail.server.submission.smtp_smuggling_detected",
             { connectionId: state.id, mailFrom: state.mailFrom, rcptCount: state.rcpts.length },
             "denied");
           _writeReply(socket, REPLY_554_TRANSACTION_FAILED,
             "5.7.0 Bare-LF in DATA body refused (RFC 5321 §2.3.8; CVE-2023-51764 SMTP smuggling)");
           _resetTransaction(state);
-          inDataBody = false; bodyCollector = null;
+          inDataBody = false; bodyCollector = null; bodyScanner = null;
           return;
         }
-        var endIdx = safeSmtp.findDotTerminator(collected);
-        if (endIdx !== -1) {
-          var body = collected.subarray(0, endIdx);
+        if (seen.terminatorAt !== -1) {
+          var body = bodyCollector.result().subarray(0, seen.terminatorAt);
           // DATA path dot-unstuffs here; BDAT path skips this step.
           var dedotted = safeSmtp.dotUnstuff(body);
           _finalizeAcceptedBody(state, socket, dedotted, "DATA");
-          inDataBody = false; bodyCollector = null;
+          inDataBody = false; bodyCollector = null; bodyScanner = null;
         }
         return;
       }
@@ -705,12 +785,13 @@ function create(opts) {
       // body collector AND strip the plain-socket "data" listener
       // before wrapping in TLSSocket so bytes the peer pipelined
       // pre-handshake cannot reach the post-TLS state machine.
-      lineBuffer = Buffer.alloc(0); bodyCollector = null; inDataBody = false;
+      lineBuffer = Buffer.alloc(0); bodyCollector = null; bodyScanner = null; inDataBody = false;
       // BDAT-side state cleared on STARTTLS upgrade too — same threat
       // model as CVE-2021-38371 (Exim) / CVE-2021-33515 (Dovecot):
       // pre-handshake bytes the peer pipelined MUST NOT reach the
       // post-TLS state machine via the BDAT collector either.
       inBdatChunk = false; bdatRemaining = 0; bdatCollector = null; bdatTotalBytes = 0;
+      bdatRateStarted = false;
       mailServerTls.upgradeSocket({
         plainSocket:   socket,
         secureContext: opts.tlsContext,
@@ -723,12 +804,9 @@ function create(opts) {
           // tradeoff acknowledged.
         },
         onData: function (tlsSocket, chunk) {
-          try { _ingestBytes(state, tlsSocket, chunk); }
-          catch (err) {
-            _emit("mail.server.submission.handler_threw",
-              { connectionId: state.id, error: (err && err.message) || String(err) }, "failure");
-            _closeConnection(tlsSocket);
-          }
+          // Through the SAME funnel as the plaintext path, so the byte count
+          // the rate window measures against does not stop at the upgrade.
+          _feedChunk(tlsSocket, chunk);
         },
         onError: function (err) {
           _emit("mail.server.submission.tls_handshake_failed",
@@ -1133,6 +1211,32 @@ function create(opts) {
         sizeCode:    "mail-server-submission/body-too-large",
         sizeMessage: "DATA body exceeded maxMessageBytes (" + maxMessageBytes + ")",
       });
+      bodyScanner    = safeSmtp.createBodyScanner();
+      bodyRateWindow.start(Date.now(), wireBytes);
+    }
+
+    // The DATA branch's smuggling screen, for the BDAT paths. Both BDAT exits
+    // — the sized LAST chunk and the zero-length LAST that terminates a
+    // previous one — reach the agent, so both need it, and both call HERE
+    // rather than carrying a copy. A screen that exists on one framing and not
+    // its sibling is what this fixes; a second copy is how that happens again.
+    //
+    // BDAT counts its octets, so a dot-line cannot end THIS transfer early. It
+    // matters because the body is relayed onward and the next hop is usually
+    // DATA, where it can. The question is what the body CONTAINS, not how it
+    // arrived: framing changes downstream, content does not.
+    //
+    // Returns true when the transaction was refused and the caller must stop.
+    function _refuseSmuggledBdatBody(state, socket, body) {
+      if (!guardSmtpCommand.detectBodySmuggling(body)) return false;
+      _emit("mail.server.submission.smtp_smuggling_detected",
+        { connectionId: state.id, mailFrom: state.mailFrom,
+          rcptCount: state.rcpts.length, framing: "BDAT" },
+        "denied");
+      _writeReply(socket, REPLY_554_TRANSACTION_FAILED,
+        "5.7.0 Bare-LF in BDAT body refused (RFC 5321 §2.3.8; CVE-2023-51764 SMTP smuggling)");
+      _resetTransaction(state);
+      return true;
     }
 
     function _finalizeAcceptedBody(state, socket, dedotted, source) {
@@ -1279,6 +1383,21 @@ function create(opts) {
         });
       }
       state.stage   = "bdat";
+      // Open the rate window on the FIRST BDAT of a sequence, the way the DATA
+      // prompt opens it on that path, and judge EVERY BDAT command against it —
+      // including a zero-length one.
+      //
+      // Keyed on an explicit flag rather than on the byte count: `BDAT 0`
+      // without LAST leaves the count at zero, so a count-based test restarted
+      // the window on every command while the zero-length path returned before
+      // reaching any measurement. One such command before each idle timeout
+      // then held the connection indefinitely without ever meeting the floor —
+      // the same slow-loris this check exists to stop, wearing a different
+      // command.
+      if (!bdatRateStarted) {
+        bodyRateWindow.start(Date.now(), wireBytes);
+        bdatRateStarted = true;
+      }
       bdatRemaining = sizeN;
       bdatIsLast    = isLast;
       // size=0 + LAST is a valid sequence — finalises the message
@@ -1288,8 +1407,13 @@ function create(opts) {
       // _finalizeAcceptedBody for size=0 LAST.
       if (sizeN === 0) {
         if (isLast) {
+          // NOT necessarily empty: this carries everything the prior chunks
+          // accumulated, so it needs the same screen as the sized-LAST path
+          // above. A smuggled body sent as chunk one and terminated with
+          // `BDAT 0 LAST` reaches the agent through here.
           var emptyBody = bdatCollector ? bdatCollector.result() : Buffer.alloc(0);
           bdatCollector = null; bdatTotalBytes = 0;
+          if (_refuseSmuggledBdatBody(state, socket, emptyBody)) return;
           _finalizeAcceptedBody(state, socket, emptyBody, "BDAT");
         } else {
           _writeReply(socket, REPLY_250_OK, "2.0.0 0 octets received");
@@ -1312,6 +1436,10 @@ function create(opts) {
       bdatIsLast     = false;
       bdatCollector  = null;
       bdatTotalBytes = 0;
+      // A new transaction opens a new rate window rather than inheriting the
+      // last one's elapsed time, which would refuse the first chunk of a
+      // perfectly fast sender that happened to follow a slow one.
+      bdatRateStarted = false;
     }
   }
 
@@ -1321,6 +1449,7 @@ function create(opts) {
   // listening event reports implicitTls so an operator can confirm the wire mode.
   var _tcpListener = mailServerNet.createTcpListener(net, {
     defaultPort:      implicitTls ? 465 : 587,                                                        // RFC 8314 implicit-TLS / RFC 6409 submission ports
+    maxConnections:   opts.maxConnections,
     handleConnection: _handleConnection,
     errorFactory:     function (code, message) { return new MailServerSubmissionError("mail-server-submission/" + code, message); },
     emit:             _emit,

package/lib/mail-server-tls.js

@@ -24,7 +24,8 @@
  *   });
  *
  *   var mx = b.mail.server.mx.create({
- *     tlsContext: tlsCtx.secureContext,
+ *     // A getter, not `tlsCtx.secureContext` — see "Picking up a rotation".
+ *     get tlsContext() { return tlsCtx.secureContext; },
  *     ...
  *   });
  *   ```
@@ -75,10 +76,20 @@
  *
  *   // Once per process at boot:
  *   var tls = b.mail.server.tls.context({ certFile, keyFile, watch: true });
- *   var mx  = b.mail.server.mx.create({ tlsContext: tls.secureContext, ... });
- *   tls.onReload(function (newCtx) { mx.replaceTlsContext(newCtx); });
+ *   var mx  = b.mail.server.mx.create({
+ *     get tlsContext() { return tls.secureContext; },
+ *     ...
+ *   });
  *   ```
  *
+ *   **Picking up a rotation.** Every listener reads `opts.tlsContext` at the
+ *   point it needs a context rather than capturing it at construction, so a
+ *   getter is all a rotation needs: the next connection sees the reloaded
+ *   context and nothing has to be swapped or restarted. Passing
+ *   `tlsContext: tls.secureContext` instead copies the context that happened
+ *   to be current at boot, and that one keeps being served after it expires.
+ *   There is no listener method to swap a context, and none is needed.
+ *
  *   The cleartext-refused error message from `b.mail.server.mx` /
  *   `b.mail.server.submission` points at this primitive so the
  *   operator's boot dead-end becomes a one-line fix.
@@ -100,6 +111,9 @@ var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
+// Lazy — network-tls pulls the posture machinery, and only the context build
+// needs it.
+var networkTls = lazyRequire(function () { return require("./network-tls"); });
 
 var MailServerTlsError = defineClass("MailServerTlsError", { alwaysPermanent: true });
 
@@ -134,16 +148,58 @@ var DEFAULT_POLL_MS = C.TIME.seconds(30);
  *     keyFile:  "/etc/letsencrypt/live/mail.example.com/privkey.pem",
  *     watch:    true,
  *   });
- *   // Wire `tls.secureContext` into b.mail.server.mx.create / submission.create
- *   tls.onReload(function (newCtx) {
- *     // operator swaps the running listener's SecureContext via the
- *     // listener's reload hook (when the listener exposes one) or via
- *     // restart-on-rotation flow
+ *   // Pass a getter so each connection reads the current context. Listeners
+ *   // read opts.tlsContext at the point of use, so a reload reaches the next
+ *   // connection with nothing to swap.
+ *   var mx = b.mail.server.mx.create({
+ *     get tlsContext() { return tls.secureContext; },
+ *     localDomains: ["mail.example.com"]
  *   });
+ *   // onReload is for observing a rotation — logging it, re-checking expiry.
+ *   // Delivering it to the listeners is not something it has to do.
+ *   tls.onReload(function (newCtx) { void newCtx; });
  *
  *   // ... later, on shutdown:
  *   tls.stop();   // clears the poll timer
  */
+
+// The createSecureContext options, assembled in ONE place so the live build and
+// the test hook cannot diverge. Module scope is what makes that claim true: a
+// copy nested inside context() is unreachable from the hook, which then has no
+// way to answer the question except by re-deriving the options itself — and a
+// re-derivation agrees with the build right up until someone changes one.
+//
+// The key-agreement preference comes from `b.network.tls.keyAgreementGroups`,
+// which is where the framework's PQC-first policy lives — the ML-KEM hybrids
+// with a classical X25519 fallback — along with the reasoning about which key
+// node reads it under: a `groups` key is accepted and silently ignored while a
+// malformed `ecdhCurve` throws, so the list has to land under `ecdhCurve`. This
+// built `{ cert, key }` and set no group list at all, so the listener that
+// speaks STARTTLS to the public internet negotiated whatever the runtime
+// defaulted to, and an `ecdhCurve` a consumer passed was accepted and dropped —
+// a failed attempt to set a policy looked exactly like a successful one.
+//
+// RFC 8879 certificate compression belongs here too, on the CONTEXT: a
+// TLSSocket wrapping a pre-built context ignores the option, so setting it at
+// the wrap site is inert and the server keeps writing the full uncompressed
+// chain. A mail certificate is the same ML-DSA-87 chain as the HTTP listener's,
+// and the same dominant share of the handshake.
+//
+// Deliberately NOT `applyToContext`: that also merges the framework trust store
+// into the context, and a `ca` list on a SERVER context changes how it treats
+// client certificates. This listener asked for a group policy, not a
+// verification posture.
+function _contextOptions(sourceOpts, certPem, keyPem) {
+  var base = { cert: certPem, key: keyPem };
+  var groups = networkTls().keyAgreementGroups(
+    sourceOpts ? sourceOpts.ecdhCurve : undefined,
+    "b.mail.server.tls.context: opts.ecdhCurve");
+  if (groups) base.ecdhCurve = groups;
+  var certCompression = C.TLS_CERT_COMPRESSION();
+  if (certCompression.length > 0) base.certificateCompression = certCompression;
+  return base;
+}
+
 function context(opts) {
   validateOpts.requireObject(opts, "b.mail.server.tls.context",
     MailServerTlsError, "mail-server-tls/bad-opts");
@@ -227,9 +283,7 @@ function context(opts) {
       // it at the wrap site is inert and the server keeps writing the full
       // uncompressed chain. A mail certificate is the same ML-DSA-87 chain as
       // the HTTP listener's and the same dominant share of the handshake.
-      var ctxOpts = { cert: certPem, key: keyPem };
-      var certCompression = C.TLS_CERT_COMPRESSION();
-      if (certCompression.length > 0) ctxOpts.certificateCompression = certCompression;
+      var ctxOpts = _contextOptions(opts, certPem, keyPem);
       ctx = nodeTls.createSecureContext(ctxOpts);
     } catch (e) {
       throw new MailServerTlsError("mail-server-tls/secure-context-failed",
@@ -569,4 +623,10 @@ module.exports = {
   upgradeSocket:       upgradeSocket,
   upgradeLineProtocol: upgradeLineProtocol,
   MailServerTlsError:  MailServerTlsError,
+  // Test hook: the resolved createSecureContext options, so the group-policy
+  // assertions read what the context is actually built with rather than
+  // re-deriving it.
+  _contextOptionsForTest: function (opts) {
+    return _contextOptions(opts, "<cert>", "<key>");
+  },
 };

package/lib/mcp.js

@@ -479,7 +479,12 @@ function _toolResultSanitize(result, opts) {
       "toolResult.sanitize: posture must be 'refuse' | 'sanitize' | 'audit-only'");
   }
   var maxBytes = opts.maxTextBytes || DEFAULT_TOOL_OUTPUT_MAX_BYTES;
-  var allowedHosts = Array.isArray(opts.allowedHosts) ? opts.allowedHosts : [];
+  // `null` when no allowlist was supplied, the array when one was — including
+  // an EMPTY one, which asks that no URL be permitted. Normalising the absent
+  // case to `[]` made the two indistinguishable, and the length test below then
+  // read both as "no restriction". A tool result is attacker-influenced
+  // content, so this is the allowlist that stops one pointing wherever it likes.
+  var allowedHosts = Array.isArray(opts.allowedHosts) ? opts.allowedHosts : null;
   if (!result || typeof result !== "object") {
     throw new McpError("mcp/bad-tool-result",
       "toolResult.sanitize: result must be an object");
@@ -522,7 +527,7 @@ function _toolResultSanitize(result, opts) {
       cleaned.push({ type: "text", text: t });
     } else if (block.type === "image" || block.type === "resource_link" || block.type === "audio") {
       var url = block.url || (block.resource && block.resource.uri);
-      if (typeof url === "string" && url.length > 0 && allowedHosts.length > 0) {
+      if (typeof url === "string" && url.length > 0 && allowedHosts) {
         var u; try { u = new URL(url); } catch (_e) { u = null; }                                // allow:raw-new-url-parse-only — operator-supplied tool URL; allowlist enforced below
         if (!u || allowedHosts.indexOf(u.host) === -1) {
           issues.push({ kind: "off-allowlist-url", index: i, url: url });
@@ -950,7 +955,10 @@ function _samplingGuard(opts) {
 function _elicitationGuard(opts) {
   opts = opts || {};
   var maxBytes    = opts.maxMessageBytes || (8 * 1024);                                          // allow:raw-byte-literal — 8 KiB elicitation message cap
-  var allowedSchemaTypes = Array.isArray(opts.allowedSchemaTypes) && opts.allowedSchemaTypes.length > 0
+  // The default applies when the option is OMITTED. An explicitly empty list
+  // says no schema type is acceptable, and falling back to the default there
+  // would answer a caller's "none" with "object".
+  var allowedSchemaTypes = Array.isArray(opts.allowedSchemaTypes)
     ? opts.allowedSchemaTypes : ["object"];
   var posture     = opts.posture || "refuse";
 

package/lib/middleware/csrf-protect.js

@@ -253,7 +253,7 @@ function _writeReject(req, res, message, reason, onDeny, problemMode) {
  *     protocolResolver:       function(req): "http"|"https",  // own the HTTPS decision
  *     trustProxy:             boolean|number,    // legacy; refused unless paired with trustedProxies/protocolResolver (spoofable)
  *     audit:                  boolean,
- *     skipStateless:          boolean,   // default false — skip validation for Authorization-header / cookieless (not-CSRF-able) requests
+ *     skipStateless:          boolean,   // default false — skip the token check for cookieless (not-CSRF-able) requests. Turns on the absence of the ambient credential only: an Authorization header is not part of the test, and it never waives `checkOrigin`.
  *     onDeny:                 function(req, res, info): void,  // own the 403; info = { status, reason }
  *     problemDetails:         boolean,   // default false — emit RFC 9457 application/problem+json instead of the default JSON envelope
  *   }
@@ -363,17 +363,21 @@ function create(opts) {
   // is opt-in rather than silent.
   var requireOriginOpt = opts.requireOrigin === true;
 
-  // skipStateless — skip token VALIDATION for requests that carry an
-  // Authorization header (bearer / token auth) or no Cookie header at
-  // all. Such requests are not CSRF-able: CSRF abuses a victim's ambient
-  // cookie credential, and a token-authenticated or cookieless request
-  // has none to abuse. The token is still ISSUED on safe methods so a
-  // later cookie-authenticated browser flow on the same app works. Default
-  // false (strict — every state-changing request is validated). createApp
-  // wires its default csrf with this on so mixed browser-form + token-API
-  // surfaces don't reject legitimate API clients. Cross-site form CSRF is
-  // unaffected: the browser auto-sends the victim's cookies, so the attack
-  // request always carries a Cookie header and is validated.
+  // skipStateless — skip token VALIDATION for requests that carry no Cookie
+  // header at all. Such requests are not CSRF-able: CSRF abuses a victim's
+  // ambient cookie credential, and a request that sends none has nothing to
+  // abuse. The token is still ISSUED on safe methods so a later
+  // cookie-authenticated browser flow on the same app works. Default false
+  // (strict — every state-changing request is validated). createApp wires its
+  // default csrf with this on so mixed browser-form + token-API surfaces don't
+  // reject legitimate API clients. Cross-site form CSRF is unaffected: the
+  // browser auto-sends the victim's cookies, so the attack request always
+  // carries a Cookie header and is validated.
+  //
+  // An `Authorization` header is NOT part of the test, and a bearer client that
+  // also sends an unrelated cookie is validated like anything else. Deciding
+  // otherwise needs the auth layer's verdict about which credential
+  // authenticated the request, which header presence cannot supply.
   var skipStateless = opts.skipStateless === true;
 
   // Per-path exemption (string-prefix / RegExp / skip predicate), validated at
@@ -548,14 +552,6 @@ function create(opts) {
 
     if (methods.indexOf(req.method) === -1) return next();
 
-    // Stateless / token-authenticated requests are not CSRF-able — the
-    // token was still issued above for any later browser flow.
-    if (skipStateless) {
-      var hasAuthHeader = !!(req.headers && req.headers.authorization);
-      var hasCookieHeader = !!(req.headers && req.headers.cookie);
-      if (hasAuthHeader || !hasCookieHeader) return next();
-    }
-
     // requireJsonContentType — refuse before the token check.
     if (requireJsonCt) {
       var ct = req.headers && req.headers["content-type"];
@@ -578,6 +574,27 @@ function create(opts) {
       }
     }
 
+    // Stateless requests are not CSRF-able — the token was still issued above
+    // for any later browser flow.
+    //
+    // The test is the ABSENCE of the ambient credential, and nothing else. CSRF
+    // spends a cookie the browser attaches on its own; a request carrying none
+    // has nothing to abuse. This used to fire on an `Authorization` header too,
+    // which was two mistakes at once. Presence is not authenticity — an
+    // attacker composing a cross-site request writes their own headers, so
+    // `Authorization: Bearer nonsense` satisfied it by being typed. And the
+    // header says nothing about which credential authenticated the request:
+    // attachUser with tokenFrom: "both" reads the cookie FIRST, so a request
+    // carrying both was authenticated by exactly the ambient credential this
+    // gate protects, and skipped the gate on a header nobody had read.
+    //
+    // It also sits BELOW the origin cross-check now rather than above it. A
+    // consumer that asked for checkOrigin asked for something the token compare
+    // does not give them, and there is no reading of "stateless" under which a
+    // cross-origin state change becomes acceptable — the branch that waived the
+    // first line of defence was waiving the second one with it.
+    if (skipStateless && !(req.headers && req.headers.cookie)) return next();
+
     if (!cookieCfg) {
       // Session-stored mode — operator's tokenLookup is the source.
       expected = opts.tokenLookup(req);

package/lib/middleware/require-mtls.js

@@ -272,7 +272,14 @@ function create(opts) {
         });
       }
     }
-    if (allowList && allowList.length > 0 && !bCrypto().isCertRevoked(peerCert.raw, allowList)) {
+    // Gated on "was an allowlist supplied", NOT on "is it non-empty". The
+    // derivation above already spells the two apart — `null` when the option is
+    // omitted, an array when it is given — and re-testing the length here
+    // collapsed them, so a pin built from configuration that returned zero
+    // entries admitted every client certificate instead of none. An allowlist
+    // that disappears when empty is a firewall rule set that opens when the
+    // last rule is deleted, and here that rule set is the front door.
+    if (allowList && !bCrypto().isCertRevoked(peerCert.raw, allowList)) {
       return _refuse(req, res, "fingerprint-not-allowed", {
         fingerprint: fp.colon,
         subject:     (peerCert.subject && peerCert.subject.CN) || null,

package/lib/network-tls.js

@@ -549,6 +549,23 @@ function _stripUnreachableCertCompression(merged, caller) {
   return merged;
 }
 
+// The key-agreement preference alone, as the string node:tls reads under
+// `ecdhCurve`. `applyToContext` is the whole-context form and also merges the
+// framework trust store, minimum version and certificate compression; a caller
+// that only wants the group policy — a listener building its own server context
+// — takes this instead, so it does not inherit a `ca` list it never asked for.
+//
+// An override is honoured, and a malformed one is REFUSED rather than replaced:
+// quietly substituting the default would start a listener on groups the
+// operator did not choose, with nothing said. Absent takes the framework
+// default (the ML-KEM hybrids with a classical X25519 fallback).
+function keyAgreementGroups(override, where) {
+  if (override !== undefined && override !== null) {
+    return _groupPreferenceString(override, where || "tls.keyAgreementGroups");
+  }
+  return STATE.tlsKeyShares.length > 0 ? STATE.tlsKeyShares.join(":") : null;
+}
+
 function applyToContext(opts) {
   opts = opts || {};
   validateOpts(opts, ["base"], "tls.applyToContext");
@@ -4138,6 +4155,7 @@ module.exports = {
   captureBaselineFingerprints: captureBaselineFingerprints,
   detectBaselineDrift: detectBaselineDrift,
   applyToContext:      applyToContext,
+  keyAgreementGroups:  keyAgreementGroups,
   buildOptions:        buildOptions,
   getCaPems:           getCaPems,
   ocsp:                ocsp,