@blamejs/core 0.18.55 → 0.18.57

package/lib/mail-server-tls.js

@@ -24,7 +24,8 @@
  *   });
  *
  *   var mx = b.mail.server.mx.create({
- *     tlsContext: tlsCtx.secureContext,
+ *     // A getter, not `tlsCtx.secureContext` — see "Picking up a rotation".
+ *     get tlsContext() { return tlsCtx.secureContext; },
  *     ...
  *   });
  *   ```
@@ -75,10 +76,20 @@
  *
  *   // Once per process at boot:
  *   var tls = b.mail.server.tls.context({ certFile, keyFile, watch: true });
- *   var mx  = b.mail.server.mx.create({ tlsContext: tls.secureContext, ... });
- *   tls.onReload(function (newCtx) { mx.replaceTlsContext(newCtx); });
+ *   var mx  = b.mail.server.mx.create({
+ *     get tlsContext() { return tls.secureContext; },
+ *     ...
+ *   });
  *   ```
  *
+ *   **Picking up a rotation.** Every listener reads `opts.tlsContext` at the
+ *   point it needs a context rather than capturing it at construction, so a
+ *   getter is all a rotation needs: the next connection sees the reloaded
+ *   context and nothing has to be swapped or restarted. Passing
+ *   `tlsContext: tls.secureContext` instead copies the context that happened
+ *   to be current at boot, and that one keeps being served after it expires.
+ *   There is no listener method to swap a context, and none is needed.
+ *
  *   The cleartext-refused error message from `b.mail.server.mx` /
  *   `b.mail.server.submission` points at this primitive so the
  *   operator's boot dead-end becomes a one-line fix.
@@ -137,12 +148,16 @@ var DEFAULT_POLL_MS = C.TIME.seconds(30);
  *     keyFile:  "/etc/letsencrypt/live/mail.example.com/privkey.pem",
  *     watch:    true,
  *   });
- *   // Wire `tls.secureContext` into b.mail.server.mx.create / submission.create
- *   tls.onReload(function (newCtx) {
- *     // operator swaps the running listener's SecureContext via the
- *     // listener's reload hook (when the listener exposes one) or via
- *     // restart-on-rotation flow
+ *   // Pass a getter so each connection reads the current context. Listeners
+ *   // read opts.tlsContext at the point of use, so a reload reaches the next
+ *   // connection with nothing to swap.
+ *   var mx = b.mail.server.mx.create({
+ *     get tlsContext() { return tls.secureContext; },
+ *     localDomains: ["mail.example.com"]
  *   });
+ *   // onReload is for observing a rotation — logging it, re-checking expiry.
+ *   // Delivering it to the listeners is not something it has to do.
+ *   tls.onReload(function (newCtx) { void newCtx; });
  *
  *   // ... later, on shutdown:
  *   tls.stop();   // clears the poll timer
@@ -154,6 +169,14 @@ var DEFAULT_POLL_MS = C.TIME.seconds(30);
 // way to answer the question except by re-deriving the options itself — and a
 // re-derivation agrees with the build right up until someone changes one.
 //
+// The SERVER form, `b.network.tls.serverKeyAgreementGroups`, not the outbound
+// one. A flat colon list is an offer order to a client and an accept SET to a
+// server, so the client list applied here refused every group it did not name
+// — secp256r1 among them, which RFC 8446 §9.1 makes mandatory to implement —
+// and collapsed the HelloRetryRequest ordering that pulls a peer up to a
+// hybrid. The server form is tuples, which accepts every registered ECDHE
+// curve while still preferring a hybrid.
+//
 // The key-agreement preference comes from `b.network.tls.keyAgreementGroups`,
 // which is where the framework's PQC-first policy lives — the ML-KEM hybrids
 // with a classical X25519 fallback — along with the reasoning about which key
@@ -176,7 +199,7 @@ var DEFAULT_POLL_MS = C.TIME.seconds(30);
 // verification posture.
 function _contextOptions(sourceOpts, certPem, keyPem) {
   var base = { cert: certPem, key: keyPem };
-  var groups = networkTls().keyAgreementGroups(
+  var groups = networkTls().serverKeyAgreementGroups(
     sourceOpts ? sourceOpts.ecdhCurve : undefined,
     "b.mail.server.tls.context: opts.ecdhCurve");
   if (groups) base.ecdhCurve = groups;

package/lib/middleware/csrf-protect.js

@@ -253,7 +253,7 @@ function _writeReject(req, res, message, reason, onDeny, problemMode) {
  *     protocolResolver:       function(req): "http"|"https",  // own the HTTPS decision
  *     trustProxy:             boolean|number,    // legacy; refused unless paired with trustedProxies/protocolResolver (spoofable)
  *     audit:                  boolean,
- *     skipStateless:          boolean,   // default false — skip validation for Authorization-header / cookieless (not-CSRF-able) requests
+ *     skipStateless:          boolean,   // default false — skip the token check for cookieless (not-CSRF-able) requests. Turns on the absence of the ambient credential only: an Authorization header is not part of the test, and it never waives `checkOrigin`.
  *     onDeny:                 function(req, res, info): void,  // own the 403; info = { status, reason }
  *     problemDetails:         boolean,   // default false — emit RFC 9457 application/problem+json instead of the default JSON envelope
  *   }
@@ -363,17 +363,21 @@ function create(opts) {
   // is opt-in rather than silent.
   var requireOriginOpt = opts.requireOrigin === true;
 
-  // skipStateless — skip token VALIDATION for requests that carry an
-  // Authorization header (bearer / token auth) or no Cookie header at
-  // all. Such requests are not CSRF-able: CSRF abuses a victim's ambient
-  // cookie credential, and a token-authenticated or cookieless request
-  // has none to abuse. The token is still ISSUED on safe methods so a
-  // later cookie-authenticated browser flow on the same app works. Default
-  // false (strict — every state-changing request is validated). createApp
-  // wires its default csrf with this on so mixed browser-form + token-API
-  // surfaces don't reject legitimate API clients. Cross-site form CSRF is
-  // unaffected: the browser auto-sends the victim's cookies, so the attack
-  // request always carries a Cookie header and is validated.
+  // skipStateless — skip token VALIDATION for requests that carry no Cookie
+  // header at all. Such requests are not CSRF-able: CSRF abuses a victim's
+  // ambient cookie credential, and a request that sends none has nothing to
+  // abuse. The token is still ISSUED on safe methods so a later
+  // cookie-authenticated browser flow on the same app works. Default false
+  // (strict — every state-changing request is validated). createApp wires its
+  // default csrf with this on so mixed browser-form + token-API surfaces don't
+  // reject legitimate API clients. Cross-site form CSRF is unaffected: the
+  // browser auto-sends the victim's cookies, so the attack request always
+  // carries a Cookie header and is validated.
+  //
+  // An `Authorization` header is NOT part of the test, and a bearer client that
+  // also sends an unrelated cookie is validated like anything else. Deciding
+  // otherwise needs the auth layer's verdict about which credential
+  // authenticated the request, which header presence cannot supply.
   var skipStateless = opts.skipStateless === true;
 
   // Per-path exemption (string-prefix / RegExp / skip predicate), validated at
@@ -548,14 +552,6 @@ function create(opts) {
 
     if (methods.indexOf(req.method) === -1) return next();
 
-    // Stateless / token-authenticated requests are not CSRF-able — the
-    // token was still issued above for any later browser flow.
-    if (skipStateless) {
-      var hasAuthHeader = !!(req.headers && req.headers.authorization);
-      var hasCookieHeader = !!(req.headers && req.headers.cookie);
-      if (hasAuthHeader || !hasCookieHeader) return next();
-    }
-
     // requireJsonContentType — refuse before the token check.
     if (requireJsonCt) {
       var ct = req.headers && req.headers["content-type"];
@@ -578,6 +574,27 @@ function create(opts) {
       }
     }
 
+    // Stateless requests are not CSRF-able — the token was still issued above
+    // for any later browser flow.
+    //
+    // The test is the ABSENCE of the ambient credential, and nothing else. CSRF
+    // spends a cookie the browser attaches on its own; a request carrying none
+    // has nothing to abuse. This used to fire on an `Authorization` header too,
+    // which was two mistakes at once. Presence is not authenticity — an
+    // attacker composing a cross-site request writes their own headers, so
+    // `Authorization: Bearer nonsense` satisfied it by being typed. And the
+    // header says nothing about which credential authenticated the request:
+    // attachUser with tokenFrom: "both" reads the cookie FIRST, so a request
+    // carrying both was authenticated by exactly the ambient credential this
+    // gate protects, and skipped the gate on a header nobody had read.
+    //
+    // It also sits BELOW the origin cross-check now rather than above it. A
+    // consumer that asked for checkOrigin asked for something the token compare
+    // does not give them, and there is no reading of "stateless" under which a
+    // cross-origin state change becomes acceptable — the branch that waived the
+    // first line of defence was waiving the second one with it.
+    if (skipStateless && !(req.headers && req.headers.cookie)) return next();
+
     if (!cookieCfg) {
       // Session-stored mode — operator's tokenLookup is the source.
       expected = opts.tokenLookup(req);

package/lib/network-smtp-policy.js

@@ -716,7 +716,21 @@ async function tlsRptSubmit(report, opts) {
       } else if (/^mailto:/i.test(uri)) {
         // Operator-side transport. Surface the prepared body so the
         // operator can hand it to b.mail directly.
-        var mailtoTarget = uri.slice("mailto:".length);
+        var publishedTarget = uri.slice("mailto:".length);
+        // The address is published by the RECEIVING domain in its own
+        // `_smtp._tls` record. It is not operator input to this sender, and a
+        // peer spelling its hostname absolutely is using the form RFC 1035 §3.1
+        // defines — a zone file writes it that way routinely.
+        //
+        // So fold one trailing dot before validating rather than validating the
+        // spelling as published. Strictness normally protects the party doing
+        // the refusing; here it costs the OTHER party the report they asked for
+        // under RFC 8460 and costs this sender nothing — the entry silently
+        // never becomes a report. That is the direction that makes the lenient
+        // reading correct. The fold cannot turn a valid address into a
+        // different valid one, because a trailing dot is not legal in an
+        // addr-spec domain, so a name carrying one has exactly one reading.
+        var mailtoTarget = publishedTarget.replace(/\.$/, "");
         // RFC 5322 §3.4.1 addr-spec validation — refuse mailto: rua
         // entries that aren't valid addresses. Pre-v0.8.32 the
         // framework would forward whatever string came after
@@ -730,6 +744,9 @@ async function tlsRptSubmit(report, opts) {
           entry.ok = true;
           entry.mailto = {
             to:          mailtoTarget,
+            // What the peer actually published, kept beside what was used, so
+            // an operator reading the result can see the two are different.
+            published:   publishedTarget,
             subject:     "Report Domain: " + (report["organization-name"] || "") +
                          " Submitter: " + (report["organization-name"] || "") +
                          " Report-ID: <" + (report["report-id"] || "") + ">",

package/lib/network-tls.js

@@ -80,6 +80,10 @@ var STATE = {
   systemTrust:     false,
   baselineFingerprints: null,
   tlsKeyShares:    ["X25519MLKEM768", "SecP256r1MLKEM768", "SecP384r1MLKEM1024", "X25519"],
+  // False until pqc.setKeyShares is called. The list above is the shipped
+  // default, and a listener widens THAT for interoperability; a list the
+  // operator chose is taken as written.
+  tlsKeySharesConfigured: false,
 };
 
 function _normalizePem(pem) {
@@ -566,6 +570,68 @@ function keyAgreementGroups(override, where) {
   return STATE.tlsKeyShares.length > 0 ? STATE.tlsKeyShares.join(":") : null;
 }
 
+// The same policy in the shape a LISTENER needs.
+//
+// keyAgreementGroups above returns a flat colon-separated list, which is an
+// offer order on a client and an accept SET on a server — OpenSSL 3.5 reads
+// only `/`-separated tuples as an order. Handing a listener the client form
+// made it refuse every group the list did not name, secp256r1 included, and
+// collapsed the retry ordering that pulls a peer up to a hybrid. So a server
+// takes this instead, and the difference is not a detail a call site should
+// have to remember.
+//
+// An override is honoured verbatim and a malformed one refused, exactly as on
+// the client side: an operator who names their own groups gets them, and gets
+// told when what they named cannot be parsed rather than being silently given
+// the default.
+// The PREFERENCE half is whatever is active — the same STATE.tlsKeyShares the
+// client form reads, so an operator who called pqc.setKeyShares to opt out of
+// hybrids gets listeners that do not prefer them either. Hardcoding the default
+// here would have let a configured policy apply outbound and be silently
+// ignored inbound, which is worse than not having the helper.
+//
+// The fallback tuple only ADDS acceptance; it never changes what is preferred,
+// and anything already in the preference is not repeated into it.
+function serverKeyAgreementGroups(override, where) {
+  if (override !== undefined && override !== null) {
+    return _groupPreferenceString(override, where || "tls.serverKeyAgreementGroups");
+  }
+  var preferred = STATE.tlsKeyShares.length > 0
+    ? STATE.tlsKeyShares.slice()
+    : C.TLS_GROUP_PREFERENCE.slice();
+  if (preferred.length === 0) return null;
+
+  // EVERY configured rank is its own tuple, in order.
+  //
+  // Ordering exists only BETWEEN tuples: groups sharing one are a set the
+  // server takes in whatever order the handshake reaches them. So any two
+  // preferences packed into a single tuple stop being ranked — a hybrid beside
+  // X25519 loses to it whenever a peer offers both, and `["secp384r1",
+  // "X25519"]` silently negotiates X25519. One tuple per entry is the only
+  // shape that means what the configured list says.
+  //
+  // The acceptance-only curves come last, as a single tuple: they are there so
+  // a conforming peer is never refused, and carry no preference between
+  // themselves.
+  //
+  // They are added ONLY to the shipped default. An operator who called
+  // setKeyShares narrowed the policy deliberately — the module's own FIPS
+  // example drops the X25519-based groups — and adding those back would let a
+  // peer negotiate exactly what they excluded, with the restriction holding
+  // outbound and silently not holding inbound. A narrowed listener may refuse
+  // a conforming peer; that is the operator's choice to make, and it is
+  // visible, where the reverse would not be.
+  var named = preferred.map(function (g) { return String(g).toLowerCase(); });
+  var fallback = STATE.tlsKeySharesConfigured ? [] :
+    C.TLS_SERVER_FALLBACK_CURVES.filter(function (g) {
+      return named.indexOf(String(g).toLowerCase()) === -1;
+    });
+
+  var tuples = preferred.slice();
+  if (fallback.length > 0) tuples.push(fallback.join(":"));
+  return tuples.join("/");
+}
+
 function applyToContext(opts) {
   opts = opts || {};
   validateOpts(opts, ["base"], "tls.applyToContext");
@@ -699,6 +765,12 @@ function setKeyShares(list) {
   }
   for (var i = 0; i < list.length; i += 1) _validateKeyShare(list[i]);
   STATE.tlsKeyShares = list.slice();
+  // Records that this list is a CHOICE rather than the shipped default. A
+  // listener adds interoperability curves to the default so it does not refuse
+  // a conforming peer out of the box; it must not add them to a list the
+  // operator narrowed on purpose, or a restriction would hold outbound and be
+  // silently undone inbound.
+  STATE.tlsKeySharesConfigured = true;
   _postureGeneration += 1;
   return getKeyShares();
 }
@@ -707,6 +779,11 @@ function getKeyShares() { return STATE.tlsKeyShares.slice(); }
 
 function resetKeyShares() {
   STATE.tlsKeyShares = DEFAULT_PQC_KEY_SHARES.slice();
+  // Back to the shipped default in every respect, including whether a listener
+  // widens it for interoperability. Restoring the list but keeping the
+  // configured flag would leave a reset process serving a different group
+  // policy from a fresh one, which is not what a reset means.
+  STATE.tlsKeySharesConfigured = false;
   _postureGeneration += 1;
   return getKeyShares();
 }
@@ -1251,6 +1328,7 @@ function _resetForTest() {
   STATE.systemTrust = false;
   STATE.baselineFingerprints = null;
   STATE.tlsKeyShares = DEFAULT_PQC_KEY_SHARES.slice();
+  STATE.tlsKeySharesConfigured = false;
 }
 
 // ---- OCSP / OCSP-stapling wrappers around node:tls ----------------
@@ -4156,6 +4234,7 @@ module.exports = {
   detectBaselineDrift: detectBaselineDrift,
   applyToContext:      applyToContext,
   keyAgreementGroups:  keyAgreementGroups,
+  serverKeyAgreementGroups: serverKeyAgreementGroups,
   buildOptions:        buildOptions,
   getCaPems:           getCaPems,
   ocsp:                ocsp,

package/lib/session-stores.js

@@ -29,9 +29,12 @@
  *   schema (sidHash PRIMARY KEY, userId, userIdHash, data, createdAt,
  *   expiresAt, lastActivity) plus the indexes session-side queries
  *   need (userIdHash for `destroyAllForUser`, expiresAt for
- *   `purgeExpired`). Operators typically point `file` at tmpfs (e.g.
- *   `/dev/shm/blamejs-sessions.db`) so session inserts run RAM-fast
- *   and don't compete with the main DB's encryption-flush cycle.
+ *   `purgeExpired`). Operators typically point `file` at tmpfs
+ *   (`/dev/shm/blamejs-sessions.db` on Linux, an in-memory volume on
+ *   Windows) so session inserts run RAM-fast and don't compete with
+ *   the main DB's encryption-flush cycle. The path is yours to name —
+ *   a leading slash is drive-relative on Windows, where `/dev/shm`
+ *   means `C:\dev\shm` and is ordinary disk.
  *
  *   Wire it once at boot, before the first session call:
  *

package/lib/vendor/MANIFEST.json

@@ -2,7 +2,7 @@
   "_comment": "Vendored dependencies — no npm runtime packages. Use scripts/vendor-update.sh to update.",
   "packages": {
     "@noble/ciphers": {
-      "version": "2.3.0",
+      "version": "2.4.0",
       "license": "MIT",
       "author": "Paul Miller",
       "source": "https://github.com/paulmillr/noble-ciphers",
@@ -15,16 +15,16 @@
         "browser": "lib/vendor/browser/noble-ciphers.mjs"
       },
       "bundler": "esbuild --format=cjs --platform=node (server), esbuild --format=esm --platform=browser (browser)",
-      "bundledAt": "2026-08-10T00:00:00Z",
-      "cpe": "cpe:2.3:a:paulmillr:noble-ciphers:2.3.0:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-27T00:00:00Z",
+      "cpe": "cpe:2.3:a:paulmillr:noble-ciphers:2.4.0:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:f3325f480cb8eb814fcb0baaa19336cbbf2b993f48624c6aa9600ffd69d0be5e",
-        "browser": "sha256:0ffd91540bcb586a29b56e52ee1c29df69097b50776beb4036a07558f7a4e12e"
+        "server": "sha256:acdcf1ba4bde8177cbfcfef22b543022284a1529afb68bc8329303837c8c021e",
+        "browser": "sha256:fc422d85a65c5dc1208066b0156e100c4790be3c8791f644b80524c25d4bc3ee"
       },
-      "refreshedAt": "2026-08-25T10:45:22.083Z"
+      "refreshedAt": "2026-08-28T04:49:21.011Z"
     },
     "@noble/hashes": {
-      "version": "2.3.0",
+      "version": "2.4.0",
       "license": "MIT",
       "author": "Paul Miller",
       "source": "https://github.com/paulmillr/noble-hashes",
@@ -43,15 +43,15 @@
         "browser": "lib/vendor/browser/noble-hashes.mjs"
       },
       "bundler": "esbuild --format=esm --platform=browser (browser only)",
-      "bundledAt": "2026-08-10T00:00:00Z",
-      "cpe": "cpe:2.3:a:paulmillr:noble-hashes:2.3.0:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-27T00:00:00Z",
+      "cpe": "cpe:2.3:a:paulmillr:noble-hashes:2.4.0:*:*:*:*:node.js:*:*",
       "hashes": {
-        "browser": "sha256:dfe4b7ae3c9880e388c8da4b68f44742b229b53afacd1e674179527e33da62b0"
+        "browser": "sha256:0e135cbb496a1b7d15bf36b8c611a8feaad49ced60a03bf916bada78b589aa66"
       },
-      "refreshedAt": "2026-08-25T10:45:22.083Z"
+      "refreshedAt": "2026-08-28T04:49:21.011Z"
     },
     "@noble/curves": {
-      "version": "2.3.0",
+      "version": "2.4.0",
       "license": "MIT",
       "author": "Paul Miller",
       "source": "https://github.com/paulmillr/noble-curves",
@@ -65,21 +65,21 @@
         "server": "lib/vendor/noble-curves.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node",
-      "bundledAt": "2026-08-21T00:00:00Z",
-      "cpe": "cpe:2.3:a:paulmillr:noble-curves:2.3.0:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-27T00:00:00Z",
+      "cpe": "cpe:2.3:a:paulmillr:noble-curves:2.4.0:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
+        "server": "sha256:477359f445eed241ad4ededb84921483c3c97618a160ef78b74bb1a421c17da7"
       },
-      "refreshedAt": "2026-08-25T10:45:22.083Z",
+      "refreshedAt": "2026-08-28T04:49:21.011Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
-          "version": "2.3.0"
+          "version": "2.4.0"
         }
       }
     },
     "@noble/post-quantum": {
-      "version": "0.7.0",
+      "version": "0.7.1",
       "license": "MIT",
       "author": "Paul Miller",
       "source": "https://github.com/paulmillr/noble-post-quantum",
@@ -108,25 +108,25 @@
         "browser": "lib/vendor/browser/noble-post-quantum.mjs"
       },
       "bundler": "esbuild --format=cjs --platform=node (server), esbuild --format=esm --platform=browser (browser)",
-      "bundledAt": "2026-08-10T00:00:00Z",
-      "cpe": "cpe:2.3:a:paulmillr:noble-post-quantum:0.7.0:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-27T00:00:00Z",
+      "cpe": "cpe:2.3:a:paulmillr:noble-post-quantum:0.7.1:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:fab7ebe5737793862c473444f4ee5912f79dd1edec86683acbb4eecbca0f5892",
-        "browser": "sha256:cae1d5bbdc7184b202b6ca68df6e1db7b0d0f668c77809ded189ca7f271accc9"
+        "server": "sha256:04eaaa4838b43162912c851dd2cab52ab82f56decad8542934171247017a6893",
+        "browser": "sha256:30ceef750bc57ae5f59c5aa7454eafb7aad55d30c261a1b5c538a66c569fc031"
       },
-      "refreshedAt": "2026-08-25T10:45:22.083Z",
+      "refreshedAt": "2026-08-28T04:49:21.011Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
-          "version": "2.3.0"
+          "version": "2.4.0"
         },
         "@noble/curves": {
           "url": "https://github.com/paulmillr/noble-curves",
-          "version": "2.3.0"
+          "version": "2.4.0"
         },
         "@noble/ciphers": {
           "url": "https://github.com/paulmillr/noble-ciphers",
-          "version": "2.3.0"
+          "version": "2.4.0"
         }
       }
     },
@@ -148,7 +148,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-25T10:45:22.083Z"
+      "refreshedAt": "2026-08-28T04:49:21.011Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -173,7 +173,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-25T10:45:22.083Z"
+      "refreshedAt": "2026-08-28T04:49:21.011Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -193,7 +193,7 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-25T10:45:22.083Z"
+      "refreshedAt": "2026-08-28T04:49:21.011Z"
     },
     "@blamejs/pki": {
       "version": "0.5.31",
@@ -221,7 +221,7 @@
       "hashes": {
         "server": "sha256:8cc54fdfb7ac5277fb30f054f57500a9e77ce6b2d2b8f6846a14766d217770db"
       },
-      "refreshedAt": "2026-08-25T10:45:22.083Z"
+      "refreshedAt": "2026-08-28T04:49:21.011Z"
     }
   }
 }

package/lib/vendor/browser/noble-ciphers.mjs

@@ -1,4 +1,4 @@
-// XChaCha20-Poly1305 — vendored from @noble/ciphers v2.3.0 by Paul Miller
+// XChaCha20-Poly1305 — vendored from @noble/ciphers v2.4.0 by Paul Miller
 // License: MIT — https://github.com/paulmillr/noble-ciphers
 // Browser build (ESM), bundled with esbuild from the same install as the
 // server bundle beside it. Exports: xchacha20poly1305
@@ -71,6 +71,17 @@ function byteSwap32(arr) {
   return arr;
 }
 var swap32IfBE = isLE ? (u) => u : byteSwap32;
+function overlapBytes(a, b) {
+  if (!a.byteLength || !b.byteLength)
+    return false;
+  return a.buffer === b.buffer && // best we can do, may fail with an obscure Proxy
+  a.byteOffset < b.byteOffset + b.byteLength && // a starts before b end
+  b.byteOffset < a.byteOffset + a.byteLength;
+}
+function complexOverlapBytes(input, output) {
+  if (overlapBytes(input, output) && input.byteOffset < output.byteOffset)
+    throw new Error("complex overlap of input and output is not supported");
+}
 function checkOpts(defaults, opts) {
   aobject(defaults, "defaults");
   aobject(opts, "opts");
@@ -238,7 +249,10 @@ function createCipher(core, opts) {
     abytes(nonce, void 0, "nonce");
     abytes(data, void 0, "data");
     const len = data.length;
+    const hasOutput = output !== void 0;
     output = getOutput(len, output, false);
+    if (hasOutput)
+      complexOverlapBytes(data, output);
     anumber(counter);
     if (counter < 0 || counter >= MAX_COUNTER)
       throw new Error("arx: counter overflow");

package/lib/vendor/browser/noble-hashes.mjs

@@ -1,4 +1,4 @@
-// @noble/hashes v2.3.0 — vendored from Paul Miller
+// @noble/hashes v2.4.0 — vendored from Paul Miller
 // License: MIT — https://github.com/paulmillr/noble-hashes
 // Browser build (ESM), bundled with esbuild. The server side uses node:crypto
 // for these, so there is no .cjs beside it.
@@ -89,6 +89,14 @@ var aobject = (value, label) => {
   if (value === null || typeof value !== "object" || Array.isArray(value))
     throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
 };
+var aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
 function aexists(instance, checkFinished = true) {
   if (instance.destroyed)
     throw new Error("hash was destroyed");
@@ -128,10 +136,10 @@ function byteSwap32(arr) {
 }
 var swap32IfBE = isLE ? (u) => u : byteSwap32;
 function checkOpts(defaults, opts, title = "opts") {
-  aobject(defaults, "defaults");
+  aopts(defaults, "defaults");
   if (opts !== void 0)
-    aobject(opts, title);
-  const merged = Object.assign(defaults, opts);
+    aopts(opts, title);
+  const merged = Object.assign(/* @__PURE__ */ Object.create(null), defaults, opts);
   return merged;
 }
 function createHasher(hashCons, info = {}) {