@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/http-client.js

@@ -57,7 +57,7 @@ var ssrfGuard = require("./ssrf-guard");
 var networkProxy = require("./network-proxy");
 var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
-var { FrameworkError, HttpClientError } = require("./framework-error");
+var { HttpClientError } = require("./framework-error");
 
 // Per-origin transport cache. Entry is either the resolved transport
 // object or a pending Promise that resolves to one. The Promise form
@@ -370,8 +370,11 @@ function _getTransport(u, opts, ips) {
 }
 
 function _makeError(errorClass, code, message, permanent, statusCode) {
-  if (!errorClass) return new FrameworkError(message, code);
-  return new errorClass(code, message, permanent, statusCode);
+  // Default to HttpClientError (the documented default errorClass) rather than
+  // the base FrameworkError, so error.statusCode and error.permanent are
+  // populated even when the caller passed no explicit opts.errorClass.
+  var Cls = errorClass || HttpClientError;
+  return new Cls(code, message, permanent, statusCode);
 }
 
 // RFC 9110 §15.5 4xx codes that are NOT permanent (request-timeout,
@@ -553,10 +556,25 @@ function _buildMultipartBody(spec) {
     totalSize += CRLF.length;
   }
 
+  // Reject CR/LF/NUL in any value interpolated onto a part-header line
+  // (Content-Disposition name/filename, Content-Type). Without this an attacker
+  // who controls a field name / filename / content-type can smuggle a CRLF and
+  // inject extra part headers or forge additional form parts (multipart header
+  // injection) — the same class the mail-header sweep closed for RFC 822 lines.
+  function _assertHeaderSafe(v, label) {
+    for (var i = 0; i < v.length; i++) {
+      var c = v.charCodeAt(i);
+      if (c === 13 || c === 10 || c === 0) {   // CR / LF / NUL
+        throw new Error("multipart: " + label + " must not contain CR, LF, or NUL (header injection)");
+      }
+    }
+  }
+
   function _pushField(name, value) {
     if (typeof name !== "string" || name.length === 0) {
       throw new Error("multipart: field name must be a non-empty string");
     }
+    _assertHeaderSafe(name, "field name");
     var disposition = 'Content-Disposition: form-data; name="' + name + '"';
     var head = _entryHeaderBytes(disposition, null);
     var bodyBuf = Buffer.isBuffer(value) ? value : Buffer.from(String(value), "utf8");
@@ -588,6 +606,9 @@ function _buildMultipartBody(spec) {
       filename = "blob";
     }
     var mimeType = file.contentType || file.mimeType || "application/octet-stream";
+    _assertHeaderSafe(file.field, "file.field");
+    _assertHeaderSafe(filename, "filename");
+    _assertHeaderSafe(mimeType, "contentType");
     var disposition = 'Content-Disposition: form-data; name="' + file.field + '"' +
                       '; filename="' + filename.replace(/"/g, "%22") + '"';
     var head = _entryHeaderBytes(disposition, mimeType);
@@ -1242,7 +1263,11 @@ function _revalidate(cache, method, opts, entry, requestHeaders) {
 // throw so caching cannot surface as a request failure.
 function _maybeStore(cache, method, url, requestHeaders, res) {
   try {
-    var evaluation = cache._evaluateStorage(method, res.statusCode, res.headers || {});
+    // requestHeaders drives the RFC 9111 §3.5 Authorization gate inside the
+    // storage decision — a shared cache must not persist a per-principal
+    // authenticated response absent an explicit public / s-maxage /
+    // must-revalidate opt-in from the origin.
+    var evaluation = cache._evaluateStorage(method, res.statusCode, res.headers || {}, requestHeaders);
     if (!evaluation.cacheable) return;
     cache._store(method, url, requestHeaders, res.statusCode, res.headers || {}, res.body, evaluation);
   } catch (_e) { /* drop-silent — caching never breaks the request */ }
@@ -1337,14 +1362,21 @@ function _requestWithRedirects(opts, hopsLeft) {
           headersStripped: headersStripped,
           method:          nextMethod,
         });
+        function _redirectAborted(e) {
+          return Promise.reject(_makeError(opts.errorClass, "REDIRECT_ABORTED",
+            "onRedirect hook refused redirect: " + ((e && e.message) || String(e)), true));
+        }
         try {
           var hookResult = onRedirect(hookEvent);
           if (hookResult && typeof hookResult.then === "function") {
-            return hookResult.then(function () { return _continueFollow(); });
+            // An async hook's rejection must abort the follow with the SAME
+            // REDIRECT_ABORTED shape a sync throw produces — otherwise an
+            // operator who awaits inside the hook (or returns a rejected
+            // Promise) silently gets an un-coded raw rejection instead.
+            return hookResult.then(function () { return _continueFollow(); }, _redirectAborted);
           }
         } catch (e) {
-          return Promise.reject(_makeError(opts.errorClass, "REDIRECT_ABORTED",
-            "onRedirect hook refused redirect: " + ((e && e.message) || String(e)), true));
+          return _redirectAborted(e);
         }
       }
       return _continueFollow();

package/lib/vendor/blamejs/lib/http-message-signature.js

@@ -104,7 +104,7 @@ function _sfQuotedString(s) {
         "httpSig: parameter string contains non-printable byte at offset " + i);
     }
   }
-  return "\"" + s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"") + "\"";
+  return safeBuffer.quoteString(s);
 }
 
 // _serializeCovered — RFC 9421 §2.5 covered-components list.
@@ -379,6 +379,24 @@ function sign(msg, opts) {
   }
   validateOpts.requireNonEmptyString(opts.privateKey,
     "httpSig.sign: privateKey (PEM)", HttpSigError, "BAD_OPT");
+  // Bind the declared alg to the signing key's real type. SUPPORTED_ALGS names
+  // ARE node's asymmetricKeyType values ("ed25519" / "ml-dsa-65"), so signing
+  // an ed25519 key under alg="ml-dsa-65" would emit an authenticated `alg`
+  // label that misstates the real algorithm -- a false PQC-signed claim that a
+  // verifier trusting the label would honor. Refuse the mislabeled artifact at
+  // sign time (matching every other signature verifier in the framework and the
+  // verify-side check below; alg-confusion family, CWE-347).
+  // Parse only to read the type; an unparseable key is left for the sign step
+  // below to reject (SIGN_FAILED), preserving that contract. A parseable key
+  // whose type differs from the declared alg is the mislabel we refuse here.
+  var signKeyType = null;
+  try { signKeyType = nodeCrypto.createPrivateKey(opts.privateKey).asymmetricKeyType; }
+  catch (_e) { signKeyType = null; }
+  if (signKeyType !== null && signKeyType !== opts.alg) {
+    throw _err("BAD_OPT",
+      "httpSig.sign: alg '" + opts.alg + "' does not match the private key's type '" +
+      signKeyType + "' (the alg label must be bound to the key's real algorithm)");
+  }
   if (!Array.isArray(opts.covered) || opts.covered.length === 0) {
     throw _err("BAD_OPT", "httpSig.sign: covered must be a non-empty array");
   }
@@ -614,6 +632,22 @@ function verify(msg, opts) {
   if (typeof publicKeyPem !== "string" || publicKeyPem.length === 0) {
     return { valid: false, reason: "unknown-keyid", keyid: p.keyid };
   }
+  // Bind the (authenticated) declared alg to the resolved key's real type
+  // BEFORE the crypto check. nodeCrypto.verify(null, ...) selects the algorithm
+  // from the key, not from p.alg, so a key whose type differs from p.alg means
+  // the alg label misstates the real signature algorithm (e.g. a classical
+  // ed25519 key under a declared PQC alg="ml-dsa-65"). Refuse rather than verify
+  // under a mislabeled alg (alg-confusion family, CWE-347) -- SUPPORTED_ALGS
+  // names ARE the asymmetricKeyType values.
+  // Parse only to read the type; an unparseable key is left for the crypto
+  // step below to reject (verify-threw), preserving that contract. A parseable
+  // key whose type differs from the declared alg is the mislabel we refuse here.
+  var verifyKeyType = null;
+  try { verifyKeyType = nodeCrypto.createPublicKey(publicKeyPem).asymmetricKeyType; }
+  catch (_e) { verifyKeyType = null; }
+  if (verifyKeyType !== null && verifyKeyType !== p.alg) {
+    return { valid: false, reason: "alg-key-mismatch", alg: p.alg, keyType: verifyKeyType };
+  }
 
   // If content-digest is covered, recompute and compare. RFC 9421 §B.2.5
   // mandates that verifiers re-run the digest over the body — a stale

package/lib/vendor/blamejs/lib/i18n-messageformat.js

@@ -48,6 +48,7 @@
  */
 var lazyRequire = require("./lazy-require");
 var boundedMap = require("./bounded-map");
+var safeObject = require("./safe-object");
 var { defineClass } = require("./framework-error");
 
 var I18nMessageFormatError = defineClass("I18nMessageFormatError",
@@ -362,17 +363,41 @@ function _renderSequence(nodes, vars, locale, hashContext, depth) {
   return out;
 }
 
+// Own-property case lookup. A select value is operator/end-user supplied, so
+// String(sv) can be `__proto__` / `constructor` / `toString` / `hasOwnProperty`
+// etc. A bare `node.cases[key]` would then return a truthy INHERITED
+// Object.prototype member, bypassing the `other` fallback and either rendering
+// garbage (a proto value with no `.length`) or throwing on `_renderSequence` of
+// a non-array (a request DoS). Every case-map lookup goes through this so no key
+// can reach the prototype chain.
+function _ownCase(cases, key) {
+  return safeObject.ownProp(cases, key);
+}
+
+// Own-property variable lookup. A template argument NAME is parse-derived from
+// the (possibly operator/tenant-supplied) message, so it can be `toString` /
+// `constructor` / `valueOf` / `__proto__` / any prototype-polluted key. A bare
+// `vars[name]` would then return the INHERITED Object.prototype member instead
+// of treating the variable as absent — leaking a function source (or a planted
+// prototype value) into rendered output and diverging from both the "missing
+// arg renders empty" contract and the sibling simple interpolator in b.i18n,
+// which is already own-property-only. Every argument / plural / select value
+// lookup goes through this so no template name can reach the prototype chain.
+function _ownVar(vars, name) {
+  return safeObject.ownProp(vars, name);
+}
+
 function _renderNode(node, vars, locale, hashContext, depth) {
   if (node.type === "literal") return node.value;
   if (node.type === "hash") {
     return hashContext != null ? String(hashContext) : "#";
   }
   if (node.type === "argument") {
-    var v = vars[node.name];
+    var v = _ownVar(vars, node.name);
     return v === undefined ? "" : (v === null ? "" : String(v));
   }
   if (node.type === "plural" || node.type === "ordinal") {
-    var raw = vars[node.name];
+    var raw = _ownVar(vars, node.name);
     var n = Number(raw);
     if (!Number.isFinite(n)) {
       throw _err("BAD_VAR",
@@ -381,18 +406,18 @@ function _renderNode(node, vars, locale, hashContext, depth) {
     }
     var adjusted = n - (node.offset || 0);
     var exact = "=" + n;
-    var caseBody = node.cases[exact];
+    var caseBody = _ownCase(node.cases, exact);
     if (!caseBody) {
       var pr = _pluralRules(locale, node.type === "ordinal" ? "ordinal" : "cardinal");
       var category = pr.select(adjusted);
-      caseBody = node.cases[category] || node.cases.other;
+      caseBody = _ownCase(node.cases, category) || _ownCase(node.cases, "other");
     }
     return _renderSequence(caseBody, vars, locale, adjusted, depth + 1);
   }
   if (node.type === "select") {
-    var sv = vars[node.name];
+    var sv = _ownVar(vars, node.name);
     var key = (sv === undefined || sv === null) ? "other" : String(sv);
-    var body = node.cases[key] || node.cases.other;
+    var body = _ownCase(node.cases, key) || _ownCase(node.cases, "other");
     return _renderSequence(body, vars, locale, hashContext, depth + 1);
   }
   return "";

package/lib/vendor/blamejs/lib/i18n.js

@@ -250,12 +250,19 @@ function _validateRtlList(value) {
   if (!Array.isArray(value)) {
     throw _err("BAD_OPT", "i18n.create: rtlLanguages must be an array of language subtags");
   }
+  // dir() folds the requested locale's primary subtag to lower case before
+  // the membership test, so fold the configured list the same way. Language
+  // subtags are conventionally lower case but BCP 47 is case-insensitive;
+  // normalizing only the lookup side would silently drop RTL for an
+  // operator-supplied entry like "AR" or "CKB".
+  var normalized = [];
   for (var i = 0; i < value.length; i++) {
     if (typeof value[i] !== "string" || value[i].length === 0) {
       throw _err("BAD_OPT", "i18n.create: rtlLanguages[" + i + "] must be a non-empty string");
     }
+    normalized.push(value[i].toLowerCase());
   }
-  return new Set(value);
+  return new Set(normalized);
 }
 
 // ---- Translation tree validation ----
@@ -575,15 +582,19 @@ function create(opts) {
     translations = {};
   }
   var onMissingKey = opts.onMissingKey || null;
-  // Validate translation trees up-front so plural-shape errors surface
-  // at boot, not at the first request that hits the broken key. Lazy
-  // locales validate on first load.
-  for (var li = 0; li < locales.length; li++) {
-    var loc = locales[li];
+  // Validate translation trees up-front so plural-shape errors surface at
+  // boot, not at the first request that hits the broken key. Validate EVERY
+  // inline tree, not just the configured `locales`: a locale present in
+  // `translations` but absent from `locales` is still reachable via an explicit
+  // locale override, and the invariants the lookup relies on (notably
+  // _selectPlural assuming a mandatory `other`) must hold for it too — an
+  // unvalidated tree could otherwise make t() return undefined instead of the
+  // key. Lazy locales validate on first load.
+  Object.keys(translations).forEach(function (loc) {
     if (translations[loc]) {
       _validateTranslationTree(loc, translations[loc], "");
     }
-  }
+  });
 
   function _ensureLocaleLoaded(locale) {
     if (loadedSet.has(locale)) return;
@@ -658,7 +669,14 @@ function create(opts) {
       _ensureLocaleLoaded(loc);
       if (!translations[loc]) continue;
       var v = _resolveKey(translations[loc], key);
-      if (v !== undefined) {
+      if (v === undefined) continue;
+      // Only a renderable leaf is a hit: a string, or a plural-shaped
+      // object. A nested namespace object at this path is not a
+      // translation value — skip it and keep walking the fallback chain so
+      // a leaf defined in a less-specific parent or fallback locale still
+      // resolves, instead of the namespace shadowing it and the raw key
+      // leaking into the UI.
+      if (typeof v === "string" || _isPluralShape(v)) {
         return { value: v, foundIn: loc };
       }
     }
@@ -717,14 +735,12 @@ function create(opts) {
     var raw;
     if (typeof found.value === "string") {
       raw = found.value;
-    } else if (_isPluralShape(found.value)) {
+    } else {
+      // Guaranteed plural-shaped: _lookupRaw only reports a hit for a
+      // renderable leaf (string or plural-shaped object), so a namespace
+      // object never reaches here — it is skipped during the chain walk.
       var count = (vars && typeof vars.count === "number") ? vars.count : 0;
       raw = _selectPlural(found.value, count, found.foundIn, callerOpts.ordinal === true);
-    } else {
-      // Operator stored a nested tree at this key but called t() against
-      // the namespace. Return the key-path as a missing-key signal.
-      _emitObs("i18n.missing", { locale: locale, key: key });
-      return key;
     }
 
     // ICU MessageFormat path — when the operator opts in via
@@ -767,14 +783,12 @@ function create(opts) {
     callerOpts = callerOpts || {};
     if (typeof key !== "string" || key.length === 0) return false;
     var locale = _resolveLocale(callerOpts.locale);
-    var found = _lookupRaw(key, locale);
-    if (found === null) return false;
-    // A nested namespace object (not plural-shaped) is NOT a resolvable
-    // translation value — has() should report false so callers can gate
+    // _lookupRaw only reports a hit for a renderable leaf (a string or a
+    // plural-shaped object); a nested namespace object is skipped during
+    // the chain walk. So has() correctly reports false for a namespace key
+    // yet true when a fallback locale supplies the leaf — callers can gate
     // "show this UI block only if translated" on leaf entries.
-    if (typeof found.value === "string") return true;
-    if (_isPluralShape(found.value)) return true;
-    return false;
+    return _lookupRaw(key, locale) !== null;
   }
 
   function formatNumber(value, formatOpts, callerOpts) {

package/lib/vendor/blamejs/lib/incident-report.js

@@ -128,7 +128,14 @@ var REGIME_DEADLINES = Object.freeze({
 });
 
 function _resolveDeadlines(regime, override) {
-  var base = (regime && REGIME_DEADLINES[regime]) || DEFAULT_DEADLINES;
+  // Own-key lookup only: `regime` is operator-supplied and free-form, so a
+  // value colliding with an Object.prototype member ("valueOf", "toString",
+  // "constructor", ...) must fall back to DEFAULT_DEADLINES, not resolve to the
+  // inherited prototype function (which would make every dueBy NaN and report a
+  // missed deadline as met). Unknown-but-benign regimes fall back the same way.
+  var base = (typeof regime === "string" &&
+              Object.prototype.hasOwnProperty.call(REGIME_DEADLINES, regime))
+    ? REGIME_DEADLINES[regime] : DEFAULT_DEADLINES;
   if (!override || typeof override !== "object") return base;
   return Object.freeze({
     initial:      typeof override.initial      === "number" ? override.initial      : base.initial,

package/lib/vendor/blamejs/lib/ip-utils.js

@@ -30,8 +30,12 @@ function expandIpv6Hex(ip) {
   // RFC 4291 §2.5.5.2 IPv4-mapped / dual-stack: accept ".d.d.d.d" tail.
   var dual = ip.match(/^(.*?):(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);                                    // allow:regex-no-length-cap — dotted-quad has fixed shape; LHS bounded by IPv6 group cap below
   if (dual) {
+    // The embedded IPv4 tail must be a strict RFC 791 dotted-quad. Reuse the
+    // canonical isIPv4 (rejects octets > 255 AND leading-zero / octal-ambiguous
+    // octets like "01") so this mapped-form parse doesn't diverge from net.isIP
+    // or from the standalone isIPv4 validator on the same dotted-quad.
+    if (!isIPv4(dual[2])) return null;
     var v4 = dual[2].split(".").map(Number);
-    if (v4.some(function (o) { return !(o >= 0 && o <= 255); })) return null;                            // IPv4 octet range
     var hi = (v4[0] << 8) | v4[1];                                                                       // 16-bit group pack
     var lo = (v4[2] << 8) | v4[3];                                                                       // 16-bit group pack
     ip = dual[1] + ":" + hi.toString(16) + ":" + lo.toString(16);
@@ -43,6 +47,12 @@ function expandIpv6Hex(ip) {
   if (dblColon.length === 1 && leftGroups.length !== 8) return null;                                      // RFC 4291 IPv6 group count
   var fillCount = 8 - leftGroups.length - rightGroups.length;                                             // RFC 4291 IPv6 group count
   if (fillCount < 0) return null;
+  // RFC 4291 §2.2 — "::" abbreviates ONE OR MORE groups of all-zero 16-bit
+  // fields, so when a "::" is present it must insert at least one group. Eight
+  // explicit groups plus a "::" (e.g. 1:2:3:4:5:6:7:8:: or 1:2:3:4:5:6:7::8)
+  // compresses zero groups and is not valid IPv6 text; net.isIP rejects these,
+  // so reject them here too rather than diverge from the kernel/peer parser.
+  if (dblColon.length === 2 && fillCount === 0) return null;
   var fill = [];
   for (var f = 0; f < fillCount; f += 1) fill.push("0");
   var groups = leftGroups.concat(fill).concat(rightGroups);

package/lib/vendor/blamejs/lib/json-path.js

@@ -623,12 +623,34 @@ function query(doc, path) {
   return _evalSegments(ast.segments, doc).map(function (n) { return n.value; });
 }
 
+// RFC 9535 §2.7: a normalized-path name is single-quoted and MUST escape
+// `'`, `\`, and every control code (%x0-1F) — the latter as the named
+// short escape (\b \t \n \f \r) or \uXXXX. Emitting a raw control char
+// produces a path that no longer round-trips through the parser (which
+// rejects unescaped control characters in a string literal).
+function _normalizeName(name) {
+  var out = "";
+  for (var i = 0; i < name.length; i++) {
+    var ch = name.charAt(i), cc = name.charCodeAt(i);
+    if (ch === "'") out += "\\'";
+    else if (ch === "\\") out += "\\\\";
+    else if (cc === 0x08) out += "\\b";
+    else if (cc === 0x09) out += "\\t";
+    else if (cc === 0x0a) out += "\\n";
+    else if (cc === 0x0c) out += "\\f";
+    else if (cc === 0x0d) out += "\\r";
+    else if (cc < 0x20) out += "\\u" + ("0000" + cc.toString(16)).slice(-4);
+    else out += ch;
+  }
+  return out;
+}
+
 function _normalizedPath(tokens) {
   var out = "$";
   for (var i = 0; i < tokens.length; i++) {
     var t = tokens[i];
     if (typeof t === "number") out += "[" + t + "]";
-    else out += "['" + String(t).replace(/\\/g, "\\\\").replace(/'/g, "\\'") + "']";
+    else out += "['" + _normalizeName(String(t)) + "']";
   }
   return out;
 }

package/lib/vendor/blamejs/lib/jwk.js

@@ -58,8 +58,17 @@ function _requiredMembers(jwk) {
   if (typeof jwk.kty !== "string" || jwk.kty.length === 0) {
     throw new JwkError("jwk/bad-jwk", "jwk: 'kty' is required");
   }
+  // Own-property lookup only: `kty` is attacker-controlled, and a plain-object
+  // bracket read resolves inherited Object.prototype members (`__proto__`,
+  // `toString`, `valueOf`, `toLocaleString`, …). Those are truthy, so an
+  // unguarded `if (!names)` would treat them as supported key types — the
+  // zero-`length` prototype methods then iterate no required members and
+  // thumbprint the empty object, collapsing distinct inputs onto one
+  // predictable digest instead of the intended unsupported-kty refusal.
+  if (!Object.prototype.hasOwnProperty.call(REQUIRED, jwk.kty)) {
+    throw new JwkError("jwk/unsupported-kty", "jwk: unsupported kty '" + jwk.kty + "'");
+  }
   var names = REQUIRED[jwk.kty];
-  if (!names) throw new JwkError("jwk/unsupported-kty", "jwk: unsupported kty '" + jwk.kty + "'");
   var out = {};
   for (var i = 0; i < names.length; i++) {
     var n = names[i];
@@ -115,8 +124,16 @@ function canonicalize(jwk) {
  */
 function thumbprint(jwk, opts) {
   opts = opts || {};
-  var hash = HASHES[opts.hash || "sha256"];
-  if (!hash) throw new JwkError("jwk/bad-hash", "jwk.thumbprint: hash must be sha256, sha384, or sha512");
+  // Own-property lookup only — `opts.hash` is caller-controlled; a bare
+  // bracket read of the HASHES table resolves inherited members (`toString`,
+  // `constructor`, …) to truthy functions that slip past `!hash` and reach
+  // createHash as a non-string, leaking a raw ERR_INVALID_ARG_TYPE instead of
+  // the typed jwk/bad-hash refusal the primitive documents.
+  var hashName = opts.hash || "sha256";
+  if (!Object.prototype.hasOwnProperty.call(HASHES, hashName)) {
+    throw new JwkError("jwk/bad-hash", "jwk.thumbprint: hash must be sha256, sha384, or sha512");
+  }
+  var hash = HASHES[hashName];
   var canon = canonicalize(jwk);
   return nodeCrypto.createHash(hash).update(canon, "utf8").digest("base64url");
 }

package/lib/vendor/blamejs/lib/link-header.js

@@ -29,6 +29,7 @@
  *   parameter never splits the list.
  */
 
+var safeBuffer = require("./safe-buffer");
 var structuredFields = require("./structured-fields");
 var { defineClass } = require("./framework-error");
 
@@ -114,7 +115,7 @@ function parse(headerValue) {
 // common convention (RFC 8288 examples, REST pagination) quotes too.
 function _serParam(name, value) {
   if (value === "" || value === true) return name;            // valueless parameter
-  return name + "=\"" + String(value).replace(/\\/g, "\\\\").replace(/"/g, "\\\"") + "\"";
+  return name + "=" + safeBuffer.quoteString(value);
 }
 
 /**

package/lib/vendor/blamejs/lib/log-stream-otlp-grpc.js

@@ -40,6 +40,10 @@ var lazyRequire = require("./lazy-require");
 // scrub attribute values through the telemetry redactor before they cross the
 // OTLP egress boundary (CWE-532).
 var observability = lazyRequire(function () { return require("./observability"); });
+// Lazy to match the observability cycle-break above. Scrubs secrets embedded in
+// the free-text log body for a directly-wired sink (defense in depth — emit()
+// already redacts, but a sink can be driven without it, same as meta/redactAttrs).
+var redact = lazyRequire(function () { return require("./redact"); });
 // Lazy — network-tls is widely required; audit an insecure (cert-validation-
 // disabled) outbound TLS session at honor time, same surface as connectWithEch.
 var networkTls = lazyRequire(function () { return require("./network-tls"); });
@@ -148,7 +152,7 @@ function _encodeLogRecord(record) {
   var attrPieces = _encodeAttributes(observability().redactAttrs(record.meta)).map(function (kvBody) {
     return pb.embeddedMessage(6, kvBody);
   });
-  var msg = (record.message != null ? String(record.message) : "");
+  var msg = (record.message != null ? redact().redactText(String(record.message)) : "");
   return Buffer.concat([
     pb.fixed64(1, tsNs),
     pb.uint32(2, sev.number),

package/lib/vendor/blamejs/lib/log-stream-otlp.js

@@ -65,6 +65,10 @@ var lazyRequire = require("./lazy-require");
 // log path can reach a log-stream sink). Used only to scrub attribute values
 // through the telemetry redactor before they cross the OTLP egress boundary.
 var observability = lazyRequire(function () { return require("./observability"); });
+// Lazy to match the observability cycle-break above. Scrubs secrets embedded in
+// the free-text log body for a directly-wired sink (defense in depth — emit()
+// already redacts, but a sink can be driven without it, same as meta/redactAttrs).
+var redact = lazyRequire(function () { return require("./redact"); });
 
 var MAX_RESPONSE_BYTES = C.BYTES.mib(1);
 var FRAMEWORK_VERSION = (pkg && pkg.version) || "unknown";
@@ -157,7 +161,7 @@ function _toLogRecord(record) {
     observedTimeUnixNano: nanos,
     severityNumber:   sev.number,
     severityText:     sev.text,
-    body:             { stringValue: record.message == null ? "" : String(record.message) },
+    body:             { stringValue: record.message == null ? "" : redact().redactText(String(record.message)) },
     attributes:       attrs,
   };
 }

package/lib/vendor/blamejs/lib/log-stream.js

@@ -210,11 +210,14 @@ function emit(level, message, meta) {
   if (LEVELS.indexOf(level) === -1) {
     throw _err("INVALID_LEVEL", "log level must be one of " + LEVELS.join(", "), true);
   }
-  // Build the record. Redact metadata BEFORE distribution to any sink.
+  // Build the record. Redact BOTH the structured metadata AND the free-text
+  // message BEFORE distribution to any sink — a secret interpolated into the
+  // message string (a JWT, an AWS key, a URL password) must not reach a file /
+  // remote sink verbatim. redactText scrubs embedded fragments in place.
   var record = {
     ts:      Date.now(),
     level:   level,
-    message: message == null ? null : String(message),
+    message: message == null ? null : redact.redactText(String(message)),
   };
   if (meta) {
     record.meta = redact.redact(meta);
@@ -539,7 +542,9 @@ function bootFromEnv(opts) {
     sink.logGroupName    = env.BLAMEJS_LOG_STREAM_CLOUDWATCH_LOG_GROUP;
     sink.logStreamName   = env.BLAMEJS_LOG_STREAM_CLOUDWATCH_LOG_STREAM;
   } else if (proto === "local") {
-    sink.path = env.BLAMEJS_LOG_STREAM_PATH;
+    // The local sink is directory-based (writes <dir>/<prefix>.log);
+    // BLAMEJS_LOG_STREAM_PATH names that directory and maps to `dir`.
+    sink.dir = env.BLAMEJS_LOG_STREAM_PATH;
   } else {
     throw _err("BAD_OPT",
       "BLAMEJS_LOG_STREAM_PROTOCOL='" + proto + "' is not one of " +