@blamejs/core 0.18.55 → 0.18.57

package/CHANGELOG.md

@@ -8,6 +8,64 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.57 (2026-08-28) — **A mail listener refused the key-agreement group TLS 1.3 makes mandatory, and negotiated a weaker one than it would have with no policy at all.** `b.mail.server.tls.context` applied the outbound key-agreement preference to a server context. A flat colon-separated list is an offer order to a client and an ACCEPT SET to a server, so the listener refused every group the list did not name — including `secp256r1`, which RFC 8446 §9.1 makes mandatory to implement. On an SMTP listener a refused handshake is not a downgrade to cleartext: the peer meets `530 5.7.0 Must issue a STARTTLS command first` on any retry and the message stays queued until it bounces.
+
+The same flatness collapsed HelloRetryRequest ordering, so a peer offering `X25519:X25519MLKEM768` was served X25519 — while the same peer against a context with no policy at all was pulled up to the hybrid. Applying the list made the negotiated group worse than applying nothing.
+
+Also: a TLS-RPT report is now sent to a receiver that publishes its `rua` address in the DNS absolute form, where it was silently never sent. **Fixed:** *A mail listener accepts every registered ECDHE group, and still prefers a post-quantum hybrid (#677)* — `b.network.tls.keyAgreementGroups` returns a flat colon-separated list. That is the right shape for a client, where node sends a key share for the first entry and takes the first mutually-supported group. OpenSSL 3.5 reads the same string on a server as the set of groups it will accept AT ALL, and only tuples separated by `/` as an order between them.
+
+So the listener refused `secp256r1`, `secp384r1`, `secp521r1` and `X448` outright. RFC 8446 §9.1 makes `secp256r1` mandatory to implement and only recommends X25519, so a fully conforming peer with a NIST-only group policy could not complete a handshake at all — and on an SMTP listener that is lost mail rather than a downgrade, because the peer meets `530 5.7.0 Must issue a STARTTLS command first` on any cleartext retry.
+
+It also lost post-quantum coverage, which is the reverse of the intent. A peer offering `X25519:X25519MLKEM768` was served X25519, where the same peer against a context with no list was pulled up to `X25519MLKEM768` by a HelloRetryRequest.
+
+`b.network.tls.serverKeyAgreementGroups` is the server form, and `b.mail.server.tls.context` uses it. It emits tuples — every ML-KEM hybrid first, then every registered ECDHE curve — so the listener still prefers a hybrid and will spend a retry to reach one, while accepting any group RFC 8446 §4.2.7 registers. `SecP256r1MLKEM768` stays accepted, which the runtime's own server default refuses, so applying a policy still buys something. The finite-field `ffdhe*` groups remain absent deliberately: refusing those on a listener is a policy worth keeping, refusing registered ECDHE curves is not.
+
+The interoperability curves widen the SHIPPED DEFAULT only. An operator who called `b.network.tls.pqc.setKeyShares` narrowed the policy deliberately — the FIPS example in that module drops the X25519-based groups — and their list is taken as written on a listener too. Adding the curves back there would have let a peer negotiate exactly what was excluded, with the restriction holding outbound and silently not holding inbound. A narrowed listener may refuse a conforming peer; that is a choice the operator made and can see, where the reverse would not be.
+
+Every configured rank becomes its own tuple, because ordering exists only between tuples: two groups sharing one are a set the server takes in whatever order the handshake reaches them, so `["secp384r1", "X25519"]` packed together would negotiate X25519 despite secp384r1 ranking first.
+
+An operator-supplied `ecdhCurve` is still honoured verbatim, and a malformed one still refused rather than replaced. · *A TLS-RPT report reaches a receiver that publishes its address absolutely (#676)* — `b.network.smtp.tlsRpt.submit` refused a `rua=mailto:` target written in the DNS absolute form, with `mailto: target is not a valid RFC 5322 addr-spec`.
+
+That address is published by the receiving domain in its own `_smtp._tls` record. It is not input from the operator running the sender, and a peer spelling its hostname absolutely is using the form RFC 1035 §3.1 defines — a zone file writes it that way routinely. The effect was that a receiver asking to be told about TLS failures was never told, the report owed under RFC 8460 was not sent, and nothing signalled that it had been dropped.
+
+One trailing dot is now folded off before the address is validated. That cannot turn a valid address into a different valid one, because a trailing dot is not legal in an addr-spec domain, so a name carrying one has exactly one reading. The result records `published` beside `to`, so an operator can see what the peer wrote and what was used. A doubled trailing dot is still refused. · *The mail TLS test file exits when it finishes* — It printed its OK line and then hung, because the handshake-measuring helper closed its two listeners but never destroyed the sockets they had already accepted — `server.close()` stops a listener accepting and leaves established connections alone. Four sockets survived each run and held the event loop open, so the file could not be used in a batch without stalling whatever invoked it.
+
+- v0.18.56 (2026-08-27) — **A CSRF exemption turned on a header the attacker writes, and a certificate renewal reached four mail listeners but not the fifth.** `csrfProtect`'s `skipStateless` waived the token check for any request carrying an `Authorization` header. Presence is not authenticity: an attacker composing a cross-site request writes their own headers. Worse, the header says nothing about which credential authenticated the request, and `attachUser` with `tokenFrom: "both"` reads the cookie first — so a request carrying both was authenticated by exactly the ambient credential the gate protects, and skipped the gate on a header nobody read. The exemption now turns on the absence of a cookie, and it no longer waives the origin check.
+
+The mail listeners had two cases of the same shape: a value read once at construction that the operator changes while the server runs. ManageSieve captured `opts.tlsContext`, so a certificate renewal reached its four siblings and not it — and nothing reported that, because the watcher fired and the context rebuilt exactly as expected. `mail.server.mx` captured `localDomains`, so a withdrawn domain kept drawing 250 at RCPT until a restart while every management surface agreed it was gone.
+
+Also: an audit checkpoint read the chain tip outside the lock that makes appends atomic, so it could sign a counter and a hash that were never the tip together. **Changed:** *Vendored `@noble` cryptography refreshed* — `@noble/ciphers` and `@noble/curves` to 2.4.0, `@noble/post-quantum` to 0.7.1, `@noble/hashes` to 2.4.0. The four move together because 0.7.1 pins its siblings to exactly 2.4.0, which keeps the browser hash bundle and the copy inlined in the server's PQC bundle the same code.
+
+No output bytes change on anything blamejs computes or has stored. ML-KEM, ML-DSA and SLH-DSA known-answer vectors are byte-identical across the bump, in both directions, and so are XChaCha20-Poly1305 ciphertexts; no constant, domain-separation string, nonce construction or serialization order moved. Nothing already encrypted, wrapped or signed needs re-doing.
+
+Two behaviour changes are reachable only through the raw primitives `b.pqcSoftware` exposes, and are worth knowing if you call them directly. `prehash(shake256)` on the 128-bit parameter sets now throws rather than producing a non-conformant signature. And an options object with an unknown or misspelled key — or one that is a class instance rather than a plain object — is now refused instead of silently ignored. **Fixed:** *A checkpoint reads the chain tip under the lock that makes appends atomic (#673)* — A checkpoint is a signed statement about a specific tip, and the value of that signature is that the pair it names was real. The tip read that feeds one ran outside the mutex the chain writer holds across its own read-tip → insert, so it could land in the middle of an append and pair a counter with a hash that were never the tip together. The signature over that pair is valid, the arithmetic is self-consistent, and it describes a state the chain was never in.
+
+The read now takes the same lock, through `withChainLock` on the writer handle. It is held for the read only: signing is post-quantum and slow, every concurrent append queues behind that lock, and holding it across the signature would charge that cost to unrelated writers without adding a guarantee — a checkpoint claims a prefix, not that nothing has been appended since. A lock is per chain key, so an append to a different partition is never blocked by one.
+
+A second, unreachable insert path into `audit_log` is removed. It took no lock and computed no row hash, and a future reader finding two insert paths into the chain table would reasonably have assumed both were live. · *A certificate renewal reaches the ManageSieve listener (#671)* — `b.mail.server.mx`, `.submission`, `.imap` and `.pop3` read `opts.tlsContext` at the point they need a context, so a consumer supplying an accessor gets the renewed certificate on the next connection. `.managesieve` captured it at construction, calling that accessor exactly once and serving the boot certificate for the life of the process.
+
+Certificates renew every 60 to 90 days on any automated CA, so the frozen one expires while every piece of surrounding evidence says rotation is working: the watcher fired, the context rebuilt, and it simply never reached this one listener. That is worse than a listener that never supported rotation, because nothing reports it.
+
+It now reads the option per connection like its siblings.
+
+The rotation example in `b.mail.server.tls.context` was also wrong. It showed `mx.replaceTlsContext(newCtx)`, a method no listener implements and none needs: pass `get tlsContext() { return tls.secureContext; }` and a reload reaches the next connection with nothing to swap. Passing `tlsContext: tls.secureContext` instead copies the context current at boot, which is the frozen form. · *The hosted-domain set can change while the server runs (#661)* — `b.mail.server.mx.create` captured `localDomains` at construction, so the answer to "do we host this domain" was frozen at boot. Hosting a domain is administrative state, not configuration — operators add and withdraw them while the process runs.
+
+Withdrawing is the case that bit: the operator disables a domain, every management surface agrees it is gone, and the listener keeps answering 250 at RCPT for it until a restart, with nothing signalling that mail is still arriving. Adding is milder but still wrong — a new domain draws 550 5.7.1, which a sending queue reads as permanent and drops rather than retrying.
+
+`localDomains` now also accepts a function, answered per recipient. The neighbouring `recipientPolicy` already was, which is what made the frozen half odd: two parts of one question answered a line apart with different currency. The array form is unchanged and still validated once at boot. A set held in one array and mutated in place — pushed on add, spliced on withdraw — is read correctly, because the result is cached on the set's contents rather than on the array's identity.
+
+An entry a live set returns that `b.guardDomain` refuses is dropped, with an audit event naming it, rather than thrown on — this is the request path, and a throw there turns a typo in an admin form into a mail outage. Mail for that entry is refused; the rest of the set keeps serving. The same holds for a set that cannot be read at all, an entry that cannot be coerced to a string, and anything else the resolver may raise: the recipients are refused and the connection survives.
+
+`authservId` follows the same set rather than pinning to whichever domain was first at boot, and is resolved once per message so the header written and the forged headers stripped always name the same identity. **Security:** *`csrfProtect` `skipStateless` turns on the absence of a cookie, not on a header (#663)* — The exemption exists because a request with no ambient credential cannot be forged on a victim's behalf: CSRF spends a cookie the browser attaches by itself. It tested for an `Authorization` header as well.
+
+Presence is not authenticity. An attacker composing a cross-site request writes their own headers, so `Authorization: Bearer nonsense` met the condition by being typed. And the header says nothing about which credential authenticated the request: `b.middleware.attachUser` with `tokenFrom: "both"` reads the cookie FIRST, so a request carrying a session cookie and a junk bearer header was authenticated by exactly the ambient credential the gate protects, and skipped the gate because of a header nothing had read. The two middlewares disagreed about which credential was in play, and the disagreement is what opened it.
+
+The test is now the absence of a Cookie header, and nothing else. A bearer client that also sends an unrelated cookie is validated like any other request; deciding otherwise needs the auth layer's verdict about which credential authenticated it, which header presence cannot supply.
+
+The exemption also sits below the origin cross-check now instead of above it, so `checkOrigin` is no longer waived by it. A consumer that asked for an origin check asked for something the token compare does not provide, and there is no reading of "stateless" under which a cross-origin state change becomes acceptable.
+
+**Upgrading.** A caller relying on the header to skip the token check now needs to send the token, or to send no cookie. This is the shape the option was documented to cover; the header was never evidence of anything.
+
 - v0.18.55 (2026-08-25) — **Opening an encrypted database twice destroyed the first process's data, and four mail-listener limits were documented but never applied.** `b.db.init` in encrypted mode reclaimed temporary working copies by filename alone, so a second process opening the same volume unlinked a running process's live database. On Linux the unlink succeeds against an open file, so the first process kept reading and writing normally while every flush from then on wrote nothing and reported success — losing everything back to its last flush, not merely the overlap. It does not reproduce on Windows, where unlinking an open file fails, so a deployment developed on a desktop and shipped to a container met it in production first.
 
 The mail listeners had a matching shape in smaller form: `minBytesPerSecond` was validated, defaulted and exposed as a getter no listener called, so a peer trickling a few bytes at a time held a connection and its slot in the per-address cap for as long as it liked. `mail.server.imap` released a peer's rate-limit slot on disconnect but never removed it from the live-connection set, so an unauthenticated peer could grow that set without bound by connecting and dropping. No listener set a ceiling of its own, leaving the per-address cap as the only limit and the process-wide total at that cap times however many addresses a caller could speak from.

package/NOTICE

@@ -17,7 +17,7 @@ lib/vendor/MANIFEST.json.
 
 --------------------------------------------------------------------------------
 Component:   @noble/ciphers
-Version:     2.3.0
+Version:     2.4.0
 Source:      https://github.com/paulmillr/noble-ciphers
 License:     MIT
 Copyright:   Copyright (c) 2023 Paul Miller (https://paulmillr.com)
@@ -26,7 +26,7 @@ Used for:    XChaCha20-Poly1305 authenticated encryption (lib/crypto.js,
              Thank you to Paul Miller for the audited noble-ciphers suite.
 --------------------------------------------------------------------------------
 Component:   @noble/curves
-Version:     2.3.0
+Version:     2.4.0
 Source:      https://github.com/paulmillr/noble-curves
 License:     MIT
 Copyright:   Copyright (c) 2022 Paul Miller (https://paulmillr.com)
@@ -36,7 +36,7 @@ Used for:    RFC 9497 Oblivious Pseudo-Random Function (OPRF / VOPRF / POPRF)
              audited noble-curves suite.
 --------------------------------------------------------------------------------
 Component:   @noble/hashes
-Version:     2.3.0
+Version:     2.4.0
 Source:      https://github.com/paulmillr/noble-hashes
 License:     MIT
 Copyright:   Copyright (c) 2022 Paul Miller (https://paulmillr.com)
@@ -53,7 +53,7 @@ Used for:    The client half of a hybrid exchange, as a browser build
              Miller for the audited noble-hashes suite.
 --------------------------------------------------------------------------------
 Component:   @noble/post-quantum
-Version:     0.7.0
+Version:     0.7.1
 Source:      https://github.com/paulmillr/noble-post-quantum
 License:     MIT
 Copyright:   Copyright (c) 2024 Paul Miller (https://paulmillr.com)

package/README.md

@@ -132,7 +132,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
   - CSP nonce — generated per request, merged into the CSP (`b.middleware.cspNonce`)
   - Fetch-metadata resource-isolation guard (`b.middleware.fetchMetadata`)
   - Body parser — JSON / urlencoded / text / multipart; multipart file parts stream to a tmp dir or buffer in memory (`storage: "memory"`) for read-only / serverless filesystems
-  - CSRF protection — double-submit cookie + Origin/Referer cross-check; auto-skips Authorization-header / cookieless requests, which are not CSRF-able (`b.middleware.csrfProtect`)
+  - CSRF protection — double-submit cookie + Origin/Referer cross-check; auto-skips cookieless requests, which carry no ambient credential to abuse and so are not CSRF-able. A request that sends a cookie is validated whatever else it carries, and the Origin check is never skipped (`b.middleware.csrfProtect`)
   - CORS (W3C Private Network Access preflight refusal default + `allowPrivateNetwork` opt) and rate-limit are wired when configured via `middleware.cors` / `middleware.rateLimit`
   - `Cache-Control: no-store` on every 401 from `requireAuth` / `requireAal` / `requireStepUp` per RFC 9111 §5.2.2.5
   - Every access-refusal layer takes a uniform `problemDetails: true` for an RFC 9457 `application/problem+json` body or `onDeny(req, res, info)` to render the refusal itself — so a service can standardize one error envelope across its API without working around hardcoded bodies (`b.problemDetails`)
@@ -314,15 +314,15 @@ All runtime dependencies are committed to the repo — no transitive npm install
 ```bash
 ./scripts/vendor-update.sh --check                  # see what's outdated
 ./scripts/vendor-update.sh --diff @noble/ciphers    # see changelog before bumping
-./scripts/vendor-update.sh @noble/ciphers 2.3.0     # bundle + commit a new version
+./scripts/vendor-update.sh @noble/ciphers 2.4.0     # bundle + commit a new version
 ```
 
 | Package | Version | Author | Purpose |
 |---|---|---|---|
-| [`@noble/ciphers`](https://github.com/paulmillr/noble-ciphers) | 2.3.0 | [Paul Miller](https://github.com/paulmillr) | XChaCha20-Poly1305 AEAD. Ships a browser (ESM) build beside the server one, built from the same install |
-| [`@noble/hashes`](https://github.com/paulmillr/noble-hashes) | 2.3.0 | [Paul Miller](https://github.com/paulmillr) | Browser (ESM) build only — SHAKE256 / SHA-3 / SHA-2 / HMAC / HKDF for the client half of a hybrid exchange. The server side reaches all of these through `node:crypto`, so there is no server bundle |
-| [`@noble/curves`](https://github.com/paulmillr/noble-curves) | 2.3.0 (bundles @noble/hashes 2.3.0) | [Paul Miller](https://github.com/paulmillr) | RFC 9497 Oblivious Pseudo-Random Function (OPRF / VOPRF / POPRF) over ristretto255 / P-256 / P-384 / P-521, behind `b.crypto.oprf` |
-| [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) | 0.7.0 (bundles @noble/hashes, @noble/curves, @noble/ciphers 2.3.0) | [Paul Miller](https://github.com/paulmillr) | Pure-JS FIPS 203 ML-KEM (`ml_kem_512` / `ml_kem_768` / `ml_kem_1024`), FIPS 204 ML-DSA (`ml_dsa_44/65/87`), FIPS 205 SLH-DSA (`slh_dsa_*`). First-class on both server-side and client-side via `b.pqcSoftware` — security-first defaults pin to the highest cat-5 levels (ML-KEM-1024, ML-DSA-87, SLH-DSA-SHAKE-256f); interoperable with Node's built-in WebCrypto ML-KEM that `b.crypto.encrypt` / `b.middleware.apiEncrypt` use. A browser (ESM) build ships beside it carrying the KEM suites only — a client half encapsulates and does not sign |
+| [`@noble/ciphers`](https://github.com/paulmillr/noble-ciphers) | 2.4.0 | [Paul Miller](https://github.com/paulmillr) | XChaCha20-Poly1305 AEAD. Ships a browser (ESM) build beside the server one, built from the same install |
+| [`@noble/hashes`](https://github.com/paulmillr/noble-hashes) | 2.4.0 | [Paul Miller](https://github.com/paulmillr) | Browser (ESM) build only — SHAKE256 / SHA-3 / SHA-2 / HMAC / HKDF for the client half of a hybrid exchange. The server side reaches all of these through `node:crypto`, so there is no server bundle |
+| [`@noble/curves`](https://github.com/paulmillr/noble-curves) | 2.4.0 (bundles @noble/hashes 2.4.0) | [Paul Miller](https://github.com/paulmillr) | RFC 9497 Oblivious Pseudo-Random Function (OPRF / VOPRF / POPRF) over ristretto255 / P-256 / P-384 / P-521, behind `b.crypto.oprf` |
+| [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) | 0.7.1 (bundles @noble/hashes, @noble/curves, @noble/ciphers 2.4.0) | [Paul Miller](https://github.com/paulmillr) | Pure-JS FIPS 203 ML-KEM (`ml_kem_512` / `ml_kem_768` / `ml_kem_1024`), FIPS 204 ML-DSA (`ml_dsa_44/65/87`), FIPS 205 SLH-DSA (`slh_dsa_*`). First-class on both server-side and client-side via `b.pqcSoftware` — security-first defaults pin to the highest cat-5 levels (ML-KEM-1024, ML-DSA-87, SLH-DSA-SHAKE-256f); interoperable with Node's built-in WebCrypto ML-KEM that `b.crypto.encrypt` / `b.middleware.apiEncrypt` use. A browser (ESM) build ships beside it carrying the KEM suites only — a client half encapsulates and does not sign |
 | [`@blamejs/pki`](https://github.com/blamejs/pki) | 0.5.31 | [blamejs](https://github.com/blamejs) | Zero-dependency pure-JS X.509 / CRL / PKCS#12 / CSR / CMS toolkit backing `b.mtlsCa` — ML-DSA-87 (FIPS 204) post-quantum + ECDSA-P384 cert signing, PBMAC1 PKCS#12 packaging, chain validation (no openssl CLI) — and the WebAuthn attestation / assertion verification behind `b.auth.passkey` |
 | [`SecLists` 10k-most-common.txt](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt) | master snapshot | [Daniel Miessler / SecLists contributors](https://github.com/danielmiessler/SecLists) (CC-BY-3.0) | Top-10000 common-password dictionary read by `b.auth.password.policy()` for the NIST 800-63B §5.1.1.2 "previously breached" check |
 | [`prismjs`](https://prismjs.com/) | 1.30.0 | [Lea Verou + contributors](https://github.com/PrismJS/prism) | Syntax highlighting in the example wiki's code blocks (browser-side) |

package/lib/audit.js

@@ -190,23 +190,12 @@ async function _readAuditRowHashAtCounter(counter) {
   );
 }
 
-async function _insertAuditRow(allCols, values) {
-  // No retry — non-idempotent. Timeout only. Map each column to its
-  // positional value and bind as a row object (the unambiguous b.sql form;
-  // a flat value array whose first element is a Buffer would be misread as
-  // an array-of-rows). BARE logical table name → clusterStorage rewrites.
-  var rowObj = {};
-  for (var i = 0; i < allCols.length; i++) rowObj[allCols[i]] = values[i];
-  var built = sql.insert("audit_log", _sqlOpts())
-    .columns(allCols)
-    .values(rowObj)
-    .toSql();
-  return await safeAsync.withTimeout(
-    clusterStorage.execute(built.sql, built.params),
-    FRAMEWORK_SQL_TIMEOUT_MS,
-    { name: "audit.insertRow" }
-  );
-}
+// A second insert path into audit_log used to live here, unreachable. It held
+// this file's only sql.insert("audit_log") and nothing called it: every append
+// goes through chain-writer, which is what serializes read-tip → hash → insert.
+// Removed rather than left, because a future reader finding two insert paths
+// into the chain table would reasonably assume both were live, and the dead one
+// took no lock and computed no row hash.
 
 var _CHECKPOINT_COLS = [
   "_id", "createdAt", "atMonotonicCounter", "atRowHash",
@@ -1090,13 +1079,26 @@ async function _checkpointOnDatabase(opts, dbGenAtEntry) {
     .orderBy("monotonicCounter", "desc")
     .limit(1)
     .toSql();
-  var tip = await safeAsync.withTimeout(
-    safeAsync.asyncRetry(function () {
-      return clusterStorage.executeOne(tipReadBuilt.sql, tipReadBuilt.params);
-    }),
-    FRAMEWORK_SQL_TIMEOUT_MS,
-    { name: "audit.checkpoint.readTip" }
-  );
+  // Read the tip under the SAME lock append() holds across its own
+  // read-tip → insert. A checkpoint is a signed statement about a tip, so it
+  // has to observe one that existed: read unlocked, it can land mid-append and
+  // pair a counter with a hash that were never the tip together, and the
+  // signature over that pair is valid, self-consistent, and describes a state
+  // the chain was never in.
+  //
+  // The lock covers the READ only. Signing is post-quantum and slow, and every
+  // concurrent append queues behind this lock; holding it across the signature
+  // would charge that to unrelated writers without adding anything, because a
+  // checkpoint claims a prefix rather than claiming nothing was appended after.
+  var tip = await _chainWriter.withChainLock(null, function () {
+    return safeAsync.withTimeout(
+      safeAsync.asyncRetry(function () {
+        return clusterStorage.executeOne(tipReadBuilt.sql, tipReadBuilt.params);
+      }),
+      FRAMEWORK_SQL_TIMEOUT_MS,
+      { name: "audit.checkpoint.readTip" }
+    );
+  });
 
   if (!tip) return null; // empty audit log; nothing to anchor
 

package/lib/chain-writer.js

@@ -481,6 +481,23 @@ function create(opts) {
     table:          table,
     chainKey:       chainKey,
     append:         append,
+    // Run `fn` under the same lock append() holds across read-tip → insert.
+    //
+    // A checkpoint signs a statement about the tip, so it has to observe a tip
+    // that actually existed. Reading it outside this lock can land in the
+    // middle of an append — between the row being written and the counter
+    // advancing — and pair a counter with a hash that were never the tip
+    // together. The signature over that pair is valid and self-consistent and
+    // describes a state the chain was never in.
+    //
+    // Callers hold it for the READ only and sign afterwards. The signature is
+    // post-quantum and slow, and every concurrent append waits on this lock;
+    // signing under it would charge that cost to unrelated writers for no
+    // added guarantee, since a checkpoint claims a prefix rather than claiming
+    // nothing has been appended since.
+    withChainLock: function (keyValue, fn) {
+      return _mutexFor(keyValue).runExclusive(fn);
+    },
     _resetForTest:  _resetForTest,
     // Expose for diagnostic introspection — the lock for a given key (or the
     // single-chain lock when no chainKey is configured).

package/lib/constants.js

@@ -279,6 +279,38 @@ var TLS_GROUP_PREFERENCE = Object.freeze([
 
 var TLS_GROUP_CURVE_STR = TLS_GROUP_PREFERENCE.join(":");
 
+// ---- Inbound (server) accept-groups ----
+//
+// The list above is an OFFER ORDER, which is what a client needs. A server
+// reads the same flat string as its ACCEPT SET: OpenSSL 3.5 treats a
+// colon-separated list as the groups it will accept AT ALL, and only tuples
+// separated by `/` as an order between them. Applying the outbound list to a
+// listener therefore refused every group it did not name — including
+// secp256r1, which RFC 8446 §9.1 makes mandatory to implement, so a fully
+// conforming peer with a NIST-only policy could not complete a handshake. On
+// an SMTP listener that is not a downgrade to classical: the peer meets
+// `530 5.7.0 Must issue a STARTTLS command first` on any cleartext retry and
+// the message stays queued until it bounces.
+//
+// It also lost post-quantum coverage, which is the reverse of the intent. A
+// flat list collapses HelloRetryRequest ordering, so a peer offering
+// `X25519:X25519MLKEM768` was served X25519, where the same peer against a
+// context with NO list was pulled up to the hybrid by a retry.
+//
+// So the server form is tuples: the ACTIVE key-share preference first, then
+// these — the ECDHE curves RFC 8446 §4.2.7 registers, as a second tuple the
+// server will still accept but will spend a HelloRetryRequest to climb out of.
+// The preference stays whatever the operator configured, including a
+// `pqc.setKeyShares` that opts out of hybrids; what this adds is that a
+// listener does not refuse a conforming peer outright.
+//
+// The finite-field ffdhe* groups are absent on purpose. Refusing those on a
+// listener is a policy the framework keeps; refusing registered ECDHE curves
+// on a listener whose whole job is accepting strangers is not.
+var TLS_SERVER_FALLBACK_CURVES = Object.freeze([
+  "X25519", "X448", "secp256r1", "secp384r1", "secp521r1",
+]);
+
 // ---- RFC 8879 certificate compression ----
 // Every compression algorithm this runtime can decompress, in the order the
 // runtime reports them. Both halves of a TLS connection use the same list:
@@ -356,6 +388,7 @@ module.exports = {
   FORMAT:                 FORMAT,
   PQC_GROUPS:             PQC_GROUPS,
   TLS_GROUP_PREFERENCE:   TLS_GROUP_PREFERENCE,
+  TLS_SERVER_FALLBACK_CURVES: TLS_SERVER_FALLBACK_CURVES,
   TLS_GROUP_CURVE_STR:    TLS_GROUP_CURVE_STR,
   TLS_CERT_COMPRESSION:   TLS_CERT_COMPRESSION,
   VAULT_PREFIX:           VAULT_PREFIX,

package/lib/mail-server-managesieve.js

@@ -222,7 +222,16 @@ function create(opts) {
   var authConfig     = opts.auth           || null;
   var mailStore      = opts.mailStore;
   var allowPlaintext = opts.allowPlaintext === true;
-  var tlsContext     = opts.tlsContext     || null;
+
+  // Read at the point of use, never captured. A consumer wiring the watching
+  // loader from mail.server.tls.context installs an accessor on this option, and
+  // capturing it here would call that accessor exactly once and freeze whatever
+  // certificate was current at boot — for a listener whose siblings all rotate.
+  // Certificates renew every 60 to 90 days on any automated CA, so the frozen
+  // one expires while the operator's evidence says rotation is working: the
+  // watcher fired, the context rebuilt, and it simply never reached here. The
+  // four sibling listeners already read the option per connection.
+  function _tlsContext() { return opts.tlsContext || null; }
 
   // safeSieve cap matches the guard's per-profile script cap (the
   // guard caps the literal-byte announcement; safeSieve.parse caps
@@ -280,7 +289,7 @@ function create(opts) {
     _emitCapabilityBanner(state, socket);
     _writeOk(socket, greeting + " ready");
 
-    if (allowPlaintext && !tlsContext) {
+    if (allowPlaintext && !_tlsContext()) {
       _emit("mail.server.managesieve.plaintext_warning",
         { connectionId: connectionId,
           remark: "allowPlaintext=true; no STARTTLS available — operators MUST gate at network layer" },
@@ -511,7 +520,7 @@ function create(opts) {
     } else {
       socket.write('"SASL" ""\r\n');
     }
-    if (!state.tls && tlsContext) {
+    if (!state.tls && _tlsContext()) {
       socket.write('"STARTTLS"\r\n');
     }
   }
@@ -539,7 +548,8 @@ function create(opts) {
       _writeNo(socket, "STARTTLS only valid pre-AUTH (RFC 5804 §2.2)");
       return;
     }
-    if (!tlsContext) {
+    var startTlsContext = _tlsContext();
+    if (!startTlsContext) {
       _writeNo(socket, "STARTTLS unavailable (listener configured with allowPlaintext=true and no tlsContext)");
       return;
     }
@@ -552,7 +562,7 @@ function create(opts) {
     mailServerTls.upgradeLineProtocol({
       state:         state,
       socket:        socket,
-      secureContext: tlsContext,
+      secureContext: startTlsContext,
       idleTimeoutMs: idleTimeoutMs,
       clearFields:   ["pendingLiteral", "pendingAuth"],
       drain:         _drainBuffer,

package/lib/mail-server-mx.js

@@ -157,6 +157,7 @@
 
 var net   = require("node:net");
 var lazyRequire = require("./lazy-require");
+var boundedMap = require("./bounded-map");
 var C         = require("./constants");
 var numericBounds = require("./numeric-bounds");
 var safeAsync = require("./safe-async");
@@ -321,7 +322,7 @@ function _stripForgedAuthResults(messageBuf, authservId) {
  *   greylist:          b.mail.greylist.create(…), // optional gate — defer first-seen (ip, from, rcpt)
  *   agent:             b.mail.agent,    // optional delivery handoff
  *   relayAllowedFor:   [{ cidr, scope }],  // operator-explicit relay allowlist; default [] = MX-only
- *   localDomains:      [string],        // RCPT TO local-domain allowlist (refuse non-local with 550 5.7.1)
+ *   localDomains:      [string]|fn,     // RCPT TO local-domain allowlist (refuse non-local with 550 5.7.1). A function returning the array is answered per RCPT, for a hosted set the operator changes while the server runs; an entry it returns that b.guardDomain refuses is dropped with an audit event rather than throwing on the connection that happened to arrive.
  *   recipientPolicy:   function (ctx) → { ok } | { ok: false, reason },  // optional RCPT-time mailbox check; refuses 550 5.1.1, defers 451 when it throws
  *   maxLineBytes:      number,          // default 1 KiB — per-command line cap
  *   maxMessageBytes:   number,          // default 50 MiB — DATA body cap
@@ -332,7 +333,7 @@ function _stripForgedAuthResults(messageBuf, authservId) {
  *   guardEnvelope:     true | {        // optional gate — DATA-phase SPF/DKIM/DMARC/ARC via b.mail.inbound.verify
  *     mode?:          "enforce" | "monitor",   // default: enforce (monitor when profile is permissive)
  *     onTemperror?:   "defer" | "accept",      // DNS temperror disposition; default "defer" (451 4.7.5)
- *     authservId?:    string,                  // RFC 8601 authserv-id; default localDomains[0]
+ *     authservId?:    string,                  // RFC 8601 authserv-id; defaults to the first local domain, re-read per message when localDomains is a function
  *     dnsLookup?:     function,                // async (qname, type) override for SPF/DKIM/DMARC lookups
  *     maxSignatures?: number,                  // DKIM verify cap (1-16)
  *     clockSkewMs?:   number,                  // DKIM timestamp skew tolerance
@@ -375,9 +376,11 @@ function create(opts) {
   // entirely, so the only way to get a listener was to get one that accepted
   // everything. An allowlist that disappears when it is empty is a firewall
   // rule set that opens when the last rule is deleted.
-  if (opts.localDomains !== undefined && !Array.isArray(opts.localDomains)) {
+  if (opts.localDomains !== undefined && !Array.isArray(opts.localDomains) &&
+      typeof opts.localDomains !== "function") {
     throw new MailServerMxError("mail-server-mx/bad-opts",
-      "mail.server.mx.create: localDomains must be an array of domain strings " +
+      "mail.server.mx.create: localDomains must be an array of domain strings, or a " +
+      "function returning one when the hosted set changes while the server runs " +
       "(an empty array means this server hosts no domains and refuses every recipient)");
   }
   if (opts.relayAllowedFor !== undefined && !Array.isArray(opts.relayAllowedFor)) {
@@ -409,7 +412,22 @@ function create(opts) {
   var maxMessageBytes   = opts.maxMessageBytes   || DEFAULT_MAX_MESSAGE_BYTES;
   var maxRcptsPerMsg    = opts.maxRcptsPerMessage || DEFAULT_MAX_RCPTS_PER_MESSAGE;
   var idleTimeoutMs     = opts.idleTimeoutMs     || DEFAULT_IDLE_TIMEOUT_MS;
-  var localDomains      = (opts.localDomains || []).map(function (d) { return String(d).toLowerCase(); });
+  // The hosted-domain set is administrative state, not configuration: operators
+  // add and withdraw domains while the process runs, and that is an ordinary
+  // act rather than a reconfiguration. Captured once, a withdrawn domain kept
+  // drawing 250 at RCPT until a restart — with every management surface
+  // agreeing it was gone and nothing telling the operator mail was still
+  // arriving for it — while a newly added one drew 550 5.7.1, which a sending
+  // queue reads as "never retry" rather than "not yet".
+  //
+  // So it may be a function, answered per RCPT. The neighbouring
+  // recipientPolicy already is, which is what made the frozen half odd: the two
+  // parts of one question were answered a line apart with different currency.
+  // The array form is unchanged and still validated once at boot.
+  var localDomainsFn    = typeof opts.localDomains === "function" ? opts.localDomains : null;
+  var localDomains      = localDomainsFn
+    ? []
+    : (opts.localDomains || []).map(function (d) { return String(d).toLowerCase(); });
   var relayAllowedFor   = (opts.relayAllowedFor || []).map(function (__e) {
     return (__e && typeof __e === "object" && !Array.isArray(__e))
       ? Object.assign({}, __e, { cidr: _normalizeRelayCidr(__e.cidr) })
@@ -501,7 +519,10 @@ function create(opts) {
       // Authentication-Results header. Defaults to the first local
       // domain; with neither, the header is skipped (the verdict
       // still reaches the agent handoff).
-      authservId:    ge.authservId || localDomains[0] || null,
+      // A getter, so a listener whose hosted set is a function does not pin the
+      // authserv-id to whichever domain happened to be first at boot. Freezing
+      // the object prevents redefining this, not invoking it.
+      get authservId() { return ge.authservId || _resolveLocalDomains()[0] || null; },
       dnsLookup:     ge.dnsLookup || undefined,
       maxSignatures: ge.maxSignatures,
       clockSkewMs:   ge.clockSkewMs,
@@ -559,6 +580,165 @@ function create(opts) {
     }
   }
 
+  // Resolve the hosted set at the point it is needed.
+  //
+  // The array form was checked at boot and cannot change, so it is returned as
+  // is. The function form is checked when it is read, because a set that can
+  // change can acquire a bad entry after boot — an IDN homograph typed into an
+  // admin form is exactly the case the boot check exists for, and it would
+  // otherwise reach RCPT unexamined.
+  //
+  // A bad entry is DROPPED rather than thrown on. This is the request path: a
+  // throw here would take down the connection that happened to arrive, and the
+  // operator would see a mail outage rather than a typo. Dropping refuses mail
+  // for the entry that failed and keeps serving the domains that passed, which
+  // is what an allowlist with one bad line should do. Each distinct bad value
+  // is reported once so it does not become a per-recipient log flood.
+  //
+  // The cache key is the CONTENT of the returned set, never its identity. An
+  // operator holding one array and mutating it — push on add, splice on
+  // withdraw — hands back the same object every time, which is the most
+  // ordinary way to keep this state. Keyed on identity, that array would be
+  // normalized once and then frozen: added domains refused forever and
+  // withdrawn ones accepted forever, which is this very bug wearing a hat.
+  var _ldSeenKey = null;
+  var _ldSeenOut = [];
+  // Bounded, because its keys come from the operator's live set and a control
+  // plane that churns tenants — or an admin form collecting typos — would
+  // otherwise grow this without limit for the life of the process, one entry
+  // per distinct bad value ever seen. It exists only to stop a per-recipient
+  // log flood, so evicting the oldest costs at most a repeated warning about a
+  // domain nobody has mentioned in a long time.
+  var _ldWarned = boundedMap.boundedMap({ maxEntries: 256, policy: "evict-oldest" });
+
+  // Warn once per distinct reason. getOrInsert runs the factory only when the
+  // key is absent, which is the whole "first time only" rule — a hand-rolled
+  // has-then-set says the same thing in two statements that can drift apart.
+  function _warnOnce(key, emitFn) {
+    boundedMap.getOrInsert(_ldWarned, key, function () { emitFn(); return true; });
+  }
+
+  // Backstop for the whole resolution, not any one operation inside it.
+  //
+  // Three separate throws were found here one at a time — the callback itself,
+  // serializing its result, coercing an entry — and each was guarded where it
+  // stood. The rule is what matters rather than the list: NOTHING in resolving
+  // an operator-supplied set may reach the RCPT handler as an exception, since
+  // there it ends the connection of whoever happened to be delivering. An
+  // unreadable set means no domains are known, and no domains known means every
+  // recipient is refused, which is what an empty hosted set already means.
+  function _resolveLocalDomains() {
+    try { return _resolveLocalDomainsInner(); }
+    catch (err) {
+      _warnOnce("__resolver", function () {
+        _emit("mail.server.mx.local_domains_unavailable",
+          { reason: "resolver-threw",
+            remark: String((err && err.message) || err).slice(0, 200) },
+          "warning");
+      });
+      return [];
+    }
+  }
+
+  function _resolveLocalDomainsInner() {
+    if (!localDomainsFn) return localDomains;
+    var raw;
+    try { raw = localDomainsFn(); }
+    catch (err) {
+      _warnOnce("__threw", function () {
+        _emit("mail.server.mx.local_domains_unavailable",
+          { reason: "threw", remark: String((err && err.message) || err).slice(0, 200) },
+          "warning");
+      });
+      return [];
+    }
+    if (!Array.isArray(raw)) {
+      _warnOnce("__shape", function () {
+        _emit("mail.server.mx.local_domains_unavailable",
+          { reason: "not-an-array", remark: "localDomains() returned " + (typeof raw) },
+          "warning");
+      });
+      return [];
+    }
+    // Coerce first, and key the cache on the COERCED strings.
+    //
+    // Keying on the raw array does not work: JSON.stringify is not injective
+    // with respect to the String() that follows it. Two objects with different
+    // toString() results both serialize as {}, and undefined, null and
+    // functions are indistinguishable inside an array — so two genuinely
+    // different hosted sets could share a key and the second one would be
+    // answered from the first one's cache. A withdrawn domain would stay
+    // accepted, which is the bug the callback exists to fix.
+    //
+    // Coercion is per ENTRY and guarded, because it runs with operator-supplied
+    // runtime data inside RCPT handling: an object whose toString throws must
+    // drop that entry, not end the connection that happened to arrive.
+    var coerced = [];
+    for (var i = 0; i < raw.length; i += 1) {
+      try {
+        coerced.push(String(raw[i]).toLowerCase());
+      } catch (entryErr) {
+        var entryIndex = i;
+        var entryReason = String((entryErr && entryErr.message) || entryErr).slice(0, 160);
+        _warnOnce("__entry" + entryIndex, function () {
+          _emit("mail.server.mx.local_domain_refused",
+            { domain: null, kind: "unreadable",
+              remark: "localDomains() entry " + entryIndex + " could not be read (" +
+                      entryReason +
+                      "); it is refused and the rest of the set still serves" },
+            "warning");
+        });
+      }
+    }
+
+    // Every element is a string now, so this key is injective over exactly the
+    // values the decision below is made from. Coercion is cheap and runs every
+    // time; what the cache buys is skipping a b.guardDomain call per entry per
+    // recipient, which is the expensive half.
+    var contentKey = JSON.stringify(coerced);
+    if (contentKey === _ldSeenKey) return _ldSeenOut;
+
+    // One bad entry drops and the rest of the set still serves, which is the
+    // same answer the guard gives for one it rejects on its merits.
+    var out = [];
+    for (var ci = 0; ci < coerced.length; ci += 1) {
+      var d = coerced[ci];
+      if (guardDomainProfile) {
+        var verdict;
+        try { verdict = guardDomain.validate(d, guardDomainProfile); }
+        catch (guardErr) {
+          var guardReason = String((guardErr && guardErr.message) || guardErr).slice(0, 160);
+          _warnOnce("__guard:" + d, function () {
+            _emit("mail.server.mx.local_domain_refused",
+              { domain: d, kind: "guard-threw",
+                remark: "b.guardDomain threw on this entry (" + guardReason +
+                        "); it is refused and the rest of the set still serves" },
+              "warning");
+          });
+          continue;
+        }
+        if (!verdict.ok) {
+          var refusedDomain = d;
+          var refusedKind =
+            (verdict.issues && verdict.issues[0] && verdict.issues[0].kind) || null;
+          _warnOnce(refusedDomain, function () {
+            _emit("mail.server.mx.local_domain_refused",
+              { domain: refusedDomain,
+                kind: refusedKind,
+                remark: "rejected by b.guardDomain; mail for it is refused and the rest " +
+                        "of the set still serves" },
+              "warning");
+          });
+          continue;
+        }
+      }
+      out.push(d);
+    }
+    _ldSeenKey = contentKey;
+    _ldSeenOut = out;
+    return out;
+  }
+
   var connections  = new Set();
 
   var _emit = auditEmit.emit;
@@ -1068,7 +1248,7 @@ function create(opts) {
       // every recipient. An empty hosted set now refuses everything naturally,
       // which is what an empty allowlist has to mean; `relayAllowedFor` is
       // still the way to permit a scope deliberately.
-      if (localDomains.indexOf(rcptDomain) === -1 &&
+      if (_resolveLocalDomains().indexOf(rcptDomain) === -1 &&
           !_isRelayAllowed(state.remoteAddress, rcpt)) {
         rateLimit.noteRcptFailure(state.remoteAddress);
         _trackRefusedRcpt(state, rcpt, "relay-denied");
@@ -1230,6 +1410,18 @@ function create(opts) {
       var inboundAuth = null;
       if (envelopeGate) {
         var inboundVerdict = null;
+        // Resolve the authserv-id ONCE for this message and use that value for
+        // both the header written and the forged headers stripped.
+        //
+        // It can now come from a hosted-domain callback, so two reads either
+        // side of an await can disagree — and these two reads are exactly the
+        // pair that must not. The strip removes sender-attached
+        // Authentication-Results claiming this receiver's identity (RFC 8601
+        // §5) before the computed one is prepended. Strip under the old id and
+        // write under the new one, and a forged header claiming the id the
+        // trusted verdict was written under survives next to it, which is the
+        // shadowing this defense exists to prevent.
+        var messageAuthservId = envelopeGate.authservId;
         try {
           // Wall-clock ceiling around the whole pipeline — a message
           // stuffed with signatures pointing at slow resolvers must
@@ -1245,7 +1437,7 @@ function create(opts) {
               maxSignatures: envelopeGate.maxSignatures,
               clockSkewMs:   envelopeGate.clockSkewMs,
               minRsaBits:    envelopeGate.minRsaBits,
-              authservId:    envelopeGate.authservId || undefined,
+              authservId:    messageAuthservId || undefined,
             }),
             envelopeGate.timeoutMs,
             { name: "mail.server.mx.guardEnvelope" });
@@ -1317,7 +1509,7 @@ function create(opts) {
             // RFC 8601 §5 — strip any sender-attached A-R header
             // claiming this receiver's authserv-id before prepending
             // the computed one (forged-verdict shadowing defense).
-            dedotted = _stripForgedAuthResults(dedotted, envelopeGate.authservId);
+            dedotted = _stripForgedAuthResults(dedotted, messageAuthservId);
             dedotted = Buffer.concat([
               Buffer.from(inboundVerdict.authResults + "\r\n", "utf8"),
               dedotted,