@blamejs/blamejs-shop 0.3.35 → 0.3.36

package/lib/vendor/blamejs/lib/mail-store-fts.js

@@ -54,10 +54,23 @@
  *   nothing readable; search works against ciphertext.
  */
 
-var bCrypto      = require("./crypto");
-var vault        = require("./vault");
+var cryptoField  = require("./crypto-field");
 var C            = require("./constants");
 
+// Sealed-token FTS on-disk format version. Bumped when the token-hash
+// transform changes so the mail-store reindex path can detect a stale
+// index and rebuild it from the sealed messages table. v1 was the
+// legacy salted-sha3-truncated hand-roll; v2 is the keyed
+// hmac-shake256 digest computed via cryptoField.computeNamespacedHash.
+var FTS_FORMAT_VERSION = 2;
+
+// Per-token hash width, in bytes. 8 bytes -> 16 hex chars. Full 64-char
+// SHA3 / SHAKE digest is overkill for the FTS hash space, and the
+// shorter token compresses the FTS5 row 4x without observable collision
+// risk at corpus sizes the framework targets (<= 10^9 unique tokens,
+// where 64-bit collision space leaves the birthday bound > 10^9).
+var FTS_HASH_BYTES = 8;
+
 // Stopwords are dropped before hashing — they'd dominate every row's
 // token set without adding query selectivity. Kept conservative to
 // stay locale-neutral for v1.
@@ -154,26 +167,29 @@ function tokenize(text) {
   return out;
 }
 
-// Hash one token using the same scheme cryptoField uses for derived-
-// hash mirrors: `sha3Hash(vaultSalt + namespace + token)`. The
+// Hash one token through the canonical cryptoField primitive
+// (computeNamespacedHash) so the FTS index inherits the keyed-MAC
+// digest used for derived-hash mirrors on sealed columns. The
 // namespace is per-table, per-field, per-purpose ("fts") so that
-// rotating an operator's vault salt invalidates every FTS row in
-// the same step as every sealed column. Returns a 16-char hex prefix
-// — full 64-char SHA3 is overkill for FTS hash space, and shorter
-// tokens compress the FTS5 row 4x without observable collision risk
-// at corpus sizes the framework targets (≤ 10^9 unique tokens, where
-// 64-bit collision space leaves the birthday bound > 10^9).
+// rotating an operator's vault key invalidates every FTS row in the
+// same step as every sealed column. Returns a 16-char hex prefix
+// (FTS_HASH_BYTES bytes) — full 64-char digest is overkill for the
+// FTS hash space, and shorter tokens compress the FTS5 row 4x without
+// observable collision risk at corpus sizes the framework targets
+// (<= 10^9 unique tokens, where 64-bit collision space leaves the
+// birthday bound > 10^9).
 /**
  * @primitive b.mailStore.fts.hashToken
  * @signature b.mailStore.fts.hashToken(table, field, token)
  * @since     0.11.25
  * @status    stable
  *
- * Vault-salted hash of one token under the (table, field) namespace.
- * The same scheme `b.cryptoField.computeDerived` uses for derived-
- * hash mirrors on sealed columns — rotating the vault salt
- * invalidates every FTS hash in step with every sealed-column hash.
- * Returns a 16-char hex prefix.
+ * Keyed hash of one token under the (table, field) namespace. Routes
+ * through `b.cryptoField.computeNamespacedHash` in `hmac-shake256`
+ * mode — the same keyed-MAC machinery that protects sealed-column
+ * derived hashes — so rotating the vault key invalidates every FTS
+ * hash in step with every sealed-column hash. Returns a 16-char hex
+ * prefix.
  *
  * @example
  *   var h = b.mailStore.fts.hashToken("mail_messages", "body", "kubernetes");
@@ -185,9 +201,10 @@ function hashToken(table, field, token) {
   // fields are pseudo-fields (no sealed-column registration), so the
   // canonical fallback path is always the right answer here.
   var ns = "bj-" + table + "-" + field + ":fts:";
-  var salt = vault.getDerivedHashSalt();
-  var saltHex = (salt && typeof salt.toString === "function") ? salt.toString("hex") : "";
-  return bCrypto.sha3Hash(saltHex + ns + token).slice(0, 16);                                          // 16-char hex prefix length, not bytes
+  return cryptoField.computeNamespacedHash(ns, token, {
+    mode:          "hmac-shake256",
+    truncateBytes: FTS_HASH_BYTES,
+  });
 }
 
 // Hash a token array → space-separated string suitable for FTS5
@@ -391,4 +408,9 @@ module.exports = {
   MAX_TOKEN_LEN:       MAX_TOKEN_LEN,
   MAX_TOKENS_PER_FIELD: MAX_TOKENS_PER_FIELD,
   FTS_FIELDS:          FTS_FIELDS,
+  FTS_HASH_BYTES:      FTS_HASH_BYTES,
+  // On-disk format marker — the mail-store reindex path stamps this
+  // into `<prefix>_meta` once a full rebuild completes; a stale/missing
+  // marker triggers a rebuild from the sealed messages table.
+  FTS_FORMAT_VERSION:  FTS_FORMAT_VERSION,
 };

package/lib/vendor/blamejs/lib/mail-store.js

@@ -60,6 +60,7 @@
 var C = require("./constants");
 var bCrypto = require("./crypto");
 var cryptoField = require("./crypto-field");
+var vault = require("./vault");
 var safeMime = require("./safe-mime");
 var safeSql = require("./safe-sql");
 var guardMessageId = require("./guard-message-id");
@@ -72,6 +73,14 @@ var DEFAULT_TABLE_PREFIX = "blamejs_mail";
 var DEFAULT_MAX_MESSAGE_BYTES = C.BYTES.mib(50);
 var DEFAULT_MAX_BODY_BYTES    = C.BYTES.mib(25);
 
+// `<prefix>_meta` marker key carrying the FTS on-disk format version.
+// The reindex path writes a `'rebuilding'` sentinel BEFORE clearing the
+// index and the final format-version string only AFTER every row is
+// reinserted, so a partial / interrupted rebuild is never marked
+// complete and never queried as a finished index.
+var FTS_FORMAT_META_KEY = "fts_format";
+var FTS_REBUILDING_SENTINEL = "rebuilding";
+
 // Standard IMAP4rev2 default folders + JMAP role mapping.
 var DEFAULT_FOLDERS = Object.freeze([
   { name: "INBOX",   role: "inbox" },
@@ -129,6 +138,7 @@ function create(opts) {
   var qFlags   = safeSql.quoteIdentifier(prefix + "_flags",     "sqlite");
   var qQuota   = safeSql.quoteIdentifier(prefix + "_quota",     "sqlite");
   var qFts     = safeSql.quoteIdentifier(prefix + "_messages_fts", "sqlite");
+  var qMeta    = safeSql.quoteIdentifier(prefix + "_meta",      "sqlite");
   var messagesTable = prefix + "_messages";
 
   var maxMessageBytes = opts.maxMessageBytes !== undefined ? opts.maxMessageBytes : DEFAULT_MAX_MESSAGE_BYTES;
@@ -150,7 +160,7 @@ function create(opts) {
   });
 
   if (doInit) {
-    _ensureSchema(db, qMsgs, qFolders, qFlags, qQuota, qFts);
+    _ensureSchema(db, qMsgs, qFolders, qFlags, qQuota, qFts, qMeta);
     _ensureDefaultFolders(db, qFolders);
   }
 
@@ -207,6 +217,150 @@ function create(opts) {
     "INSERT INTO " + qFts + " (objectid, subject_toks, addr_toks, body_toks) VALUES (?, ?, ?, ?)");
   var stmtDeleteFts        = db.prepare("DELETE FROM " + qFts + " WHERE objectid = ?");
 
+  // `<prefix>_meta` marker read — used by the reindex gate at create()
+  // AND by every FTS query path (search) to refuse a half-built index.
+  // Guarded behind a closure so a store opened with init:false against a
+  // pre-format-version database (no _meta table) reads as "no marker"
+  // instead of throwing.
+  function _readFtsMarker() {
+    try {
+      var row = db.prepare("SELECT value FROM " + qMeta + " WHERE key = ?")
+        .get(FTS_FORMAT_META_KEY);
+      return row ? row.value : null;
+    } catch (_e) {
+      // _meta table absent (init:false against a legacy store) — treat
+      // as no marker so the FTS query path falls back rather than
+      // querying a possibly-stale index as if it were current.
+      return null;
+    }
+  }
+  // The FTS index is queryable only when the on-disk marker equals the
+  // current format version. A `'rebuilding'` sentinel or any other
+  // value (stale format, missing marker) means the index is non-final;
+  // search() falls back to the modseq cursor rather than returning
+  // partial / mixed-scheme FTS hits.
+  var CURRENT_FTS_FMT = String(mailStoreFts.FTS_FORMAT_VERSION);
+  function _ftsIndexUsable() {
+    return _readFtsMarker() === CURRENT_FTS_FMT;
+  }
+
+  // Reindex-on-upgrade. Runs once at create() (when doInit) AFTER the
+  // schema is ensured. Rebuilds the sealed-token FTS index from the
+  // canonical (sealed) messages table whenever the on-disk format
+  // marker is missing or stale — the token-hash transform changed, so
+  // every previously-indexed row hashes to a different value and the
+  // old rows are unsearchable under the new scheme.
+  //
+  // Data-safety contract:
+  //   - A `'rebuilding'` sentinel is written BEFORE the DELETE, so an
+  //     interrupted rebuild leaves a non-final marker; search() refuses
+  //     the index until a later create() completes the rebuild.
+  //   - The DELETE + every reinsert run inside an explicit
+  //     BEGIN/COMMIT/ROLLBACK (ordinary SQLite — works on node:sqlite
+  //     and b.db alike; neither exposes a usable `.transaction(fn)()`
+  //     for this shape). A throw inside the insert loop rolls the whole
+  //     rebuild back, leaving the OLD index intact + queryable... except
+  //     the marker still reads as non-final, so search falls back until
+  //     the next successful create() — the index is never silently
+  //     half-built.
+  //   - The final format-version marker is written ONLY after every row
+  //     reinserts and the COMMIT lands.
+  function _reindexFts() {
+    var fmt = _readFtsMarker();
+    if (fmt === CURRENT_FTS_FMT) return { reindexed: false, reason: "current" };
+
+    // Count existing FTS rows AFTER the early-return so the common
+    // already-current path pays nothing for the scan.
+    var ftsCountRow = db.prepare("SELECT COUNT(*) AS n FROM " + qFts).get();
+    var ftsCount = (ftsCountRow && ftsCountRow.n) || 0;
+    var msgCountRow = db.prepare("SELECT COUNT(*) AS n FROM " + qMsgs).get();
+    var msgCount = (msgCountRow && msgCountRow.n) || 0;
+
+    // Fresh store — no marker AND nothing indexed AND no messages to
+    // index. Just stamp the current format; there is nothing to rebuild.
+    if (fmt === null && ftsCount === 0 && msgCount === 0) {
+      _writeFtsMarker(CURRENT_FTS_FMT);
+      return { reindexed: false, reason: "fresh" };
+    }
+
+    // Reindex unseals EVERY message row — a runtime dependency on the
+    // vault that a bare create() otherwise wouldn't have. Fail loud at
+    // boot (entry-point tier) rather than silently leaving a stale,
+    // wrong-scheme index searchable: an operator who constructs the
+    // store before vault.init() must see the misordering immediately.
+    if (!vault.isInitialized()) {
+      throw new MailStoreError("mail-store/fts-reindex-vault-uninitialized",
+        "mailStore.create: FTS index format is stale (marker=" +
+        JSON.stringify(fmt) + ", current=" + CURRENT_FTS_FMT + ") and a " +
+        "reindex from the sealed messages table requires the vault - call " +
+        "b.vault.init(...) BEFORE b.mailStore.create(...). Refusing to leave " +
+        "a stale, wrong-scheme search index queryable.");
+    }
+
+    // Sentinel BEFORE any destructive work — a crash between here and
+    // the final marker leaves the index marked non-final.
+    _writeFtsMarker(FTS_REBUILDING_SENTINEL);
+
+    // BEGIN IMMEDIATE takes the write lock up front so the message
+    // snapshot, the FTS delete, and the reinsert are one isolated window.
+    // The snapshot is read INSIDE the lock: a concurrent writer in another
+    // process cannot append a message between the snapshot and the delete
+    // (which would otherwise drop that row's freshly-inserted FTS entry
+    // without re-adding it, silently losing it from search).
+    var allRows;
+    db.prepare("BEGIN IMMEDIATE").run();
+    try {
+      allRows = db.prepare("SELECT * FROM " + qMsgs).all();
+      db.prepare("DELETE FROM " + qFts).run();
+      for (var i = 0; i < allRows.length; i += 1) {
+        // unsealRow returns the DB column names (subject / from_addr /
+        // to_addrs / body_text); map them into the FTS param shape
+        // (subject / from / to / body) rowFromMessage expects.
+        var clear = cryptoField.unsealRow(messagesTable, allRows[i]);
+        var ftsRow = mailStoreFts.rowFromMessage(messagesTable, {
+          objectid: clear.objectid,
+          subject:  clear.subject   || "",
+          from:     clear.from_addr || "",
+          to:       clear.to_addrs  || "",
+          body:     clear.body_text || "",
+        });
+        stmtInsertFts.run(ftsRow.objectid, ftsRow.subject_toks,
+          ftsRow.addr_toks, ftsRow.body_toks);
+      }
+      db.prepare("COMMIT").run();
+    } catch (e) {
+      // Roll the partial rebuild back — the OLD index rows are restored
+      // (the DELETE is undone), so the prior scheme stays intact and
+      // queryable. The marker still reads as the sentinel, so search()
+      // falls back until a later create() completes the rebuild: a
+      // retriable, never-silently-half-built state.
+      try { db.prepare("ROLLBACK").run(); } catch (_re) { /* best-effort */ }
+      throw new MailStoreError("mail-store/fts-reindex-failed",
+        "mailStore.create: FTS reindex from the sealed messages table " +
+        "failed and was rolled back (the prior index is intact); retry " +
+        "after resolving: " + ((e && e.message) || String(e)));
+    }
+
+    // Full rebuild committed — stamp the current format LAST so the
+    // index only reads as final once every row is present.
+    _writeFtsMarker(CURRENT_FTS_FMT);
+    return { reindexed: true, rows: allRows.length };
+  }
+
+  function _writeFtsMarker(value) {
+    db.prepare(
+      "INSERT INTO " + qMeta + " (key, value) VALUES (?, ?) " +
+      "ON CONFLICT(key) DO UPDATE SET value = excluded.value"
+    ).run(FTS_FORMAT_META_KEY, value);
+  }
+
+  // Wire the reindex into create() AFTER schema bootstrap. A fresh store
+  // (no marker, 0 FTS rows, 0 messages) just stamps the format; a store
+  // carrying an old-format index rebuilds from the sealed rows.
+  if (doInit) {
+    _reindexFts();
+  }
+
   return {
     appendMessage:    function (folderName, rawBytes, appendOpts) {
       // Wrap canonical row insert + FTS row insert in a single backend
@@ -277,6 +431,27 @@ function create(opts) {
       var limit = f.limit || 100;
       if (limit > 1000) limit = 1000;                                                                  // query row cap, not bytes
 
+      // The FTS index is queryable only when the on-disk format marker
+      // is current. A `'rebuilding'` sentinel (mid-rebuild / interrupted
+      // rebuild) or a stale/missing marker means the index is non-final
+      // — fall back to the bare modseq cursor rather than returning
+      // partial or wrong-scheme FTS hits. Returning a subset of the true
+      // matches as if it were complete is the corruption hazard the
+      // reindex sentinel exists to prevent.
+      if (!_ftsIndexUsable()) {
+        var nonFinal = stmtQueryByModseq.all(folder.id, sinceModseq, limit);
+        return {
+          rows: nonFinal.map(function (r) {
+            return {
+              objectid: r.objectid, modseq: r.modseq, sizeBytes: r.size_bytes,
+              internalDate: r.internal_date, legalHold: r.legal_hold === 1,
+            };
+          }),
+          nextModseq: nonFinal.length > 0 ? nonFinal[nonFinal.length - 1].modseq : sinceModseq,
+          ftsUnavailable: true,
+        };
+      }
+
       var matchClauses = [];
       function addMatch(filterKey, term) {
         if (!term) return;
@@ -834,7 +1009,7 @@ function _normalizeMsgId(s) {
 
 // ---- Schema bootstrap ----------------------------------------------------
 
-function _ensureSchema(db, qMsgs, qFolders, qFlags, qQuota, qFts) {
+function _ensureSchema(db, qMsgs, qFolders, qFlags, qQuota, qFts, qMeta) {
   // Folders table — created first since messages reference folder_id.
   db.prepare(
     "CREATE TABLE IF NOT EXISTS " + qFolders + " (" +
@@ -910,6 +1085,17 @@ function _ensureSchema(db, qMsgs, qFolders, qFlags, qQuota, qFts) {
   // tokens on whitespace exactly — hashes are ASCII-hex-only, so no
   // Unicode case-fold runs at MATCH time.
   db.prepare(mailStoreFts.createSql(qFts)).run();
+
+  // Per-prefix key/value metadata table. Holds the FTS on-disk format
+  // marker (`fts_format`) so the reindex path can detect a stale index
+  // and rebuild it. Scoped per table-prefix (NOT PRAGMA user_version,
+  // which is db-global and would collide across stores sharing one
+  // sqlite file).
+  db.prepare(
+    "CREATE TABLE IF NOT EXISTS " + qMeta + " (" +
+    "key TEXT PRIMARY KEY, " +
+    "value TEXT)"
+  ).run();
 }
 
 function _ensureDefaultFolders(db, qFolders) {

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.9",
+  "version": "0.14.10",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.14.10.json

@@ -0,0 +1,54 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.10",
+  "date": "2026-05-31",
+  "headline": "Full-text-search token hashes move to a keyed MAC; existing mail-store search indexes rebuild automatically on upgrade",
+  "summary": "The mail-store full-text-search index hashed its tokens with a hand-rolled salted-SHA3 derived hash. It now routes through the framework's sealed-column hashing primitive in keyed mode (HMAC-SHAKE256 off the per-deployment MAC key), so a search-index token hash is unforgeable and un-correlatable across deployments without that key — the same posture the sealed-column lookup hashes already use. Because the keyed hash changes the stored token values, a mail-store opened after upgrade detects its index as old-format and rebuilds it once from the sealed message rows. The rebuild runs under a format marker: the index is marked `rebuilding` before it is cleared and only marked current after every row is re-hashed inside an explicit transaction, and search falls back to its cursor path (rather than returning partial hits) whenever the marker is not current — so an interrupted rebuild leaves the old index intact and queryable and retries on the next open, never serving a half-built index. A new `b.cryptoField.computeNamespacedHash` primitive backs the keyed hashing for callers that hash outside the registered-column path.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.cryptoField.computeNamespacedHash`",
+          "body": "A mode-aware namespaced hash for indexed-lookup callers that hash a value outside the registered-column derived-hash path. `computeNamespacedHash(ns, value, { mode, truncateBytes })` routes through the same engine as `computeDerived` — `salted-sha3` (default) or the keyed `hmac-shake256` — with optional hex truncation. The mail-store full-text index is the first consumer."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Mail-store full-text index rehashes to a keyed MAC on upgrade",
+          "body": "The full-text-search token hash now uses `b.cryptoField.computeNamespacedHash` in `hmac-shake256` mode instead of a hand-rolled salted-SHA3. The first time a store is opened after upgrade, its index is detected as old-format and rebuilt once from the sealed message rows; subsequent opens are no-ops. Search is unaffected once the rebuild completes. The rebuild requires the vault to be initialized and fails closed (a clear error) at construction if it is not, rather than leaving a stale searchable index."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Keyed, un-correlatable full-text-search token hashes",
+          "body": "A search-index token hash is now a keyed MAC over a per-deployment key, not a static-salted digest — it cannot be forged or correlated across deployments without that key, closing the low-entropy-token correlation gap on the search index. The index remains unrecoverable from a database dump alone, as before."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Hand-rolled lookup-hash check covers the split form",
+          "body": "The check that requires sealed-column lookup hashes to compose the framework primitive now also catches the across-lines hand-roll (`var salt = getDerivedHashSalt(); var hex = salt.toString(...); sha3(hex + ns + value)`), not only the single-expression form, so the bypass that the mail-store index used can't reappear."
+        }
+      ]
+    },
+    {
+      "heading": "Migration",
+      "items": [
+        {
+          "title": "Automatic, one-time full-text index rebuild",
+          "body": "No operator action is required: the rebuild runs automatically and idempotently on first open after upgrade, atomically and crash-safe (an interrupted rebuild keeps the old index and retries). The only requirement is that the vault is initialized before the mail-store is constructed. One caveat for shared stores: do not run a pre-upgrade and post-upgrade node against the same backend file concurrently across this format change — the old node would write old-format hashes the new node cannot match. Roll the deployment fully across the upgrade. This re-open condition is lifted once all nodes are on 0.14.10 or later."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -8195,18 +8195,29 @@ var KNOWN_ANTIPATTERNS = [
     // and risks a static-salt regression if the salt source is changed
     // for one caller but not the canonical helper.
     //
-    // Detector: direct use of `getDerivedHashSalt().toString("hex") +`
-    // outside crypto-field.js (the canonical helper). The helper itself
-    // is allowlisted.
+    // Detector: hand-rolled `sha3Hash(<salt-hex> + ns + value)` outside
+    // crypto-field.js (the canonical helper). Two shapes are caught:
+    //   (a) inline — `getDerivedHashSalt().toString("hex") + ...`
+    //   (b) split across lines — a variable bound to the salt's hex is
+    //       concatenated into a `sha3Hash(...)`:
+    //         var salt = getDerivedHashSalt();
+    //         var h    = salt.toString("hex");
+    //         sha3Hash(h + ns + v);
+    // Shape (b) evaded the original inline-only regex (the salt's
+    // `.toString("hex")` is followed by `;`, not `+`, and the `+` lives
+    // on the downstream sha3Hash argument). The helper itself is
+    // allowlisted. NOTE: a `getDerivedHashSalt().toString("hex")` fed
+    // into `kdf(...)` (e.g. idempotency-key's fingerprint HMAC seed) is
+    // NOT this bug and does not match — neither shape names `sha3Hash`.
     id: "derived-hash-handrolled-outside-crypto-field",
-    primitive: "cryptoField derived/lookup hashes — compute via _computeDerivedHash (honours salted-sha3 vs hmac-shake256 mode + vault.getDerivedHashMacKey); do not hand-roll sha3Hash(getDerivedHashSalt() + ns + value) at call sites",
-    regex: /getDerivedHashSalt\s*\(\s*\)\s*\.toString\s*\(\s*["']hex["']\s*\)\s*\+/,
+    primitive: "cryptoField derived/lookup hashes — compute via _computeDerivedHash / b.cryptoField.computeNamespacedHash (honours salted-sha3 vs hmac-shake256 mode + vault.getDerivedHashMacKey); do not hand-roll sha3Hash(getDerivedHashSalt() + ns + value) at call sites",
+    regex: /getDerivedHashSalt\s*\(\s*\)\s*\.toString\s*\(\s*["']hex["']\s*\)\s*\+|var\s+(\w+)\s*=\s*[\w.]*getDerivedHashSalt\s*\(\s*\)\s*;[\s\S]{0,200}?\b(\w+)\s*=\s*\1\s*\.toString\s*\(\s*["']hex["']\s*\)\s*;[\s\S]{0,200}?sha3Hash\s*\(\s*\2\s*\+/,
     skipCommentLines: true,
     allowlist: [
       // The canonical helper — _computeDerivedHash branches on mode here.
       "lib/crypto-field.js",
     ],
-    reason: "v0.14.7 — derived-hash equality lookups gained a keyed mode (hmac-shake256 off vault.getDerivedHashMacKey) alongside the salted-sha3 default. The mode decision lives in cryptoField._computeDerivedHash. A site that hand-derives the hash with getDerivedHashSalt() bypasses the keyed option and the per-column mode policy; only the canonical helper (crypto-field.js) may name the salt directly.",
+    reason: "v0.14.7 — derived-hash equality lookups gained a keyed mode (hmac-shake256 off vault.getDerivedHashMacKey) alongside the salted-sha3 default. The mode decision lives in cryptoField._computeDerivedHash (wrapped by the public computeNamespacedHash for pseudo-field indexes such as the mail-store FTS tokens). A site that hand-derives the hash with getDerivedHashSalt() — inline OR split across local variables feeding sha3Hash — bypasses the keyed option and the per-column mode policy; only the canonical helper (crypto-field.js) may name the salt directly.",
   },
 
   {

package/lib/vendor/blamejs/test/layer-0-primitives/crypto-field-derived-hash.test.js

@@ -88,6 +88,50 @@ async function run() {
   } catch (e) { badColMode = /mode must be/.test(e.message); }
   check("bad per-column mode throws at registerTable", badColMode);
 
+  // ---- computeNamespacedHash: pseudo-field indexed hash (FTS substrate) ----
+  // Wraps _computeDerivedHash for namespaces that have no registered
+  // derived-hash column (e.g. the sealed-token mail-store FTS index).
+  var ns = "bj-mail_messages-body:fts:";
+
+  // Default mode is salted-sha3 → byte-identical to the legacy hand-roll.
+  var saltHex = b.vault.getDerivedHashSalt().toString("hex");
+  var legacyRef = b.crypto.sha3Hash(saltHex + ns + "kubernetes");
+  var cnhDefault = b.cryptoField.computeNamespacedHash(ns, "kubernetes");
+  check("computeNamespacedHash default is salted-sha3 (128 hex)", cnhDefault.length === 128);
+  check("computeNamespacedHash default == legacy hand-roll", cnhDefault === legacyRef);
+
+  // truncateBytes slices the hex to that many bytes (2 hex chars each).
+  var cnhTrunc = b.cryptoField.computeNamespacedHash(ns, "kubernetes",
+    { mode: "salted-sha3", truncateBytes: 8 });
+  check("computeNamespacedHash truncateBytes:8 -> 16 hex", cnhTrunc.length === 16);
+  check("computeNamespacedHash truncate is a prefix of full", legacyRef.slice(0, 16) === cnhTrunc);
+
+  // Keyed mode differs from the salted default and is unforgeable
+  // without the MAC key.
+  var cnhKeyed = b.cryptoField.computeNamespacedHash(ns, "kubernetes",
+    { mode: "hmac-shake256", truncateBytes: 8 });
+  check("computeNamespacedHash hmac-shake256 -> 16 hex", /^[0-9a-f]{16}$/.test(cnhKeyed));
+  check("computeNamespacedHash keyed differs from salted", cnhKeyed !== cnhTrunc);
+  check("computeNamespacedHash is deterministic",
+    cnhKeyed === b.cryptoField.computeNamespacedHash(ns, "kubernetes",
+      { mode: "hmac-shake256", truncateBytes: 8 }));
+
+  // Config-time throws: bad mode, non-positive / non-integer truncateBytes.
+  var cnhBadMode = false;
+  try { b.cryptoField.computeNamespacedHash(ns, "x", { mode: "md5" }); }
+  catch (e) { cnhBadMode = /mode must be/.test(e.message); }
+  check("computeNamespacedHash bad mode throws", cnhBadMode);
+
+  var cnhBadTruncZero = false;
+  try { b.cryptoField.computeNamespacedHash(ns, "x", { truncateBytes: 0 }); }
+  catch (e) { cnhBadTruncZero = /truncateBytes must be/.test(e.message); }
+  check("computeNamespacedHash truncateBytes:0 throws", cnhBadTruncZero);
+
+  var cnhBadTruncFloat = false;
+  try { b.cryptoField.computeNamespacedHash(ns, "x", { truncateBytes: 2.5 }); }
+  catch (e) { cnhBadTruncFloat = /truncateBytes must be/.test(e.message); }
+  check("computeNamespacedHash non-integer truncateBytes throws", cnhBadTruncFloat);
+
   console.log("OK — crypto-field derived-hash tests");
 }