@blamejs/core 0.15.10 → 0.15.12

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.12 (2026-06-14) — **Hardens a set of defense-in-depth seams: a single-pass structured-field unescape, a constant-time content-digest member match, complete reserved-character stripping, a Trojan-Source escape on the boot logger, generic body-parse error responses, and an audit trail whenever outbound TLS certificate validation is disabled.** A sweep of low-severity but real hardening items. RFC 8941 structured-field string values (HTTP Message Signatures, Client Hints, Cache-Control) were un-escaped with two chained replaces that mis-decoded an escaped backslash adjacent to another escape; they now use one left-to-right pass that decodes each escape exactly once. The HTTP Message Signature content-digest check dropped a dead identity-replace and now matches the sha3-512 member by an exact, top-level, constant-time comparison instead of an unanchored substring scan. b.guardFilename's reserved-character strip used a non-global regex that left every separator after the first; it now strips all of them. The boot logger's TTY branch wrote raw text, bypassing the Trojan-Source / control-character escape the main logger applies — it now escapes the bidi and C0/newline control classes on every sink. The body parser no longer echoes a caught exception's detail (an fs errno + temp path, or a parse hook's thrown message) to the HTTP client — the client gets a generic status phrase while the full detail stays on the audit chain. And any outbound TLS connection that runs with peer-certificate validation disabled (an explicit operator opt-in, never a default) now emits a tls.insecure_skip_verify audit + observability event so the degraded posture is visible for compliance and incident response. **Added:** *b.structuredFields.unescapeSfStringBody(body)* — A single-pass decode of the RFC 8941 §3.3.3 quoted-string backslash escapes (the bytes between the surrounding quotes). It replaces the chained two-`.replace()` form, which is not equivalent to one decode — whichever pass runs first can rewrite a backslash the other escape sequence owns, so a lone escaped backslash decoded to two. The HTTP Message Signature, Client Hints, and Cache-Control sf-string readers now route through it. · *tls.insecure_skip_verify audit event* — b.network.tls.auditInsecureTls(meta) emits an audit + observability event at the point an outbound TLS connection honors rejectUnauthorized:false / allowInsecure. The connectWithEch, OTLP-gRPC log stream, syslog-TLS log stream, and SMTP transports all emit it when an operator disables certificate validation — parallel to the existing tls.classical_downgrade audit. No default changes; the framework never disables validation itself. **Security:** *Single-pass structured-field string unescape* — The RFC 8941 sf-string readers in HTTP Message Signatures (Signature-Input covered-component names), Client Hints, and Cache-Control directive values un-escaped with `.replace(/\\\\/g,"\\").replace(/\\"/g,'"')` — two sequential passes that mis-decode adjacent escapes (a lone escaped backslash became two). All four sites now use the single-pass b.structuredFields.unescapeSfStringBody. It is fail-closed (a mis-decoded covered-component name just fails the signature check, never bypasses it); the fix restores RFC-conformant interop with peers that legitimately escape these values. · *Constant-time, member-anchored content-digest verification* — b.crypto.httpSig.verify's covered content-digest check dropped a dead no-op replace and now parses the Content-Digest header into its top-level members and matches the sha3-512 member EXACTLY, in constant time (b.crypto.timingSafeEqual), rather than scanning for the digest text as a substring anywhere in the header. The Content-Digest header is already bound by the signature, so the substring form was not reachably exploitable; the change removes the latent ambiguity and the timing channel. · *Reserved-character filename strip removes every occurrence* — b.guardFilename's reservedCharPolicy:"strip" (the permissive profile) used a non-global regex, so only the FIRST reserved character — including path separators — was replaced and the rest leaked through. The strip is now global: every reserved character is removed. Not a traversal bypass (the unconditional security floor still throws on `..`, null bytes, NTFS ADS, UNC, overlong UTF-8), but the strip is now complete and consistent. · *Boot logger escapes control + bidi characters on every sink* — The boot-time logger's TTY branch wrote the raw message, bypassing the Trojan-Source (bidi) and control-character escapes the main logger applies — a hostile message could forge extra log lines on a terminal (CWE-117) or re-order the visible line (CVE-2021-42574). Both boot branches now escape the bidi and C0/newline control classes, matching the create() path and the logger's advertised guarantee. · *Body-parser error responses never echo internal detail* — The body-parser's terminal error path surfaced a caught exception's message verbatim to the HTTP client — a multipart filesystem error leaked the errno + temp path, and a parse hook's thrown error (which can carry secrets) was echoed back. The client now gets a curated message only for a framework-classified 4xx error and a generic status phrase otherwise; the parse-hook wrapper carries a fixed message, and full diagnostics stay on the audit chain server-side (CWE-209). The cluster leader-discovery endpoint's error body is generalized the same way.
+
+- v0.15.11 (2026-06-14) — **Replaces a family of quadratic-time regexes that hostile input could use to stall a worker with linear scans, refuses a relocatable sealed-cell downgrade on the read side, fails closed when enabling row-level security behind a non-native driver, and scans the vendored crypto for known CVEs on every build.** Several text-handling primitives stripped trailing whitespace or extracted a mail address with a regex whose backtracking is quadratic in the input length on adversarial strings — a request body, a YAML document, a CSV cell, or a From header crafted as a long run of spaces could pin a worker's CPU. Each is now a linear character scan with identical output. The HTML-content check the MCP tool surface applies gained the vbscript: and data:text/html vectors it was missing. On the data-at-rest side, an AAD-bound (or per-row-key) column now refuses a plain, unbound vault cell on read — a relocatable envelope an attacker with write access could copy in from another row defeats the cross-row binding, so the field is nulled rather than surfaced; operators mid-migration opt back in with registerTable({ allowPlainMigration: true }). declareRowPolicy now treats row-level-security as enabled only on a value that unambiguously means true, so a non-native Postgres driver that returns the string "f" can no longer be read as "already on" and silently skip the ENABLE that protects the table's rows. Finally, because the framework's crypto is vendored rather than installed, npm audit and Dependabot never see it: every build now matches the vendored versions against the OSV vulnerability database, with a complementary Semgrep pass and workflow-file static analysis alongside. **Added:** *b.safeBuffer.indexAfterOpenTag(html, tagName)* — A linear helper that returns the offset just past a `<tag ...>` opening tag (case-insensitive), or -1 when absent or unterminated — the insertion point a response rewriter uses to splice content after <body> or <head> without a regex. It replaces the O(n^2) html.match(/<body[^>]*>/i) shape and is stricter than it: a real tag boundary is required after the name, so <bodyfoo> is not mistaken for <body>. **Security:** *Linear-time replacements across a family of quadratic regexes (ReDoS class)* — Several primitives located or stripped text with a regex whose backtracking is quadratic in V8 on adversarial input (CWE-1333): b.safeBuffer and the safe-env / safe-yaml / guard-csv parsers stripped trailing horizontal whitespace with /[ \t]+$/; b.mail extracted the address from a `Name <addr>` header with /<([^>]+)>/; the bot-disclosure and speculation-rules response middleware found the <body> insertion point with /<body[^>]*>/i; and the BIMI certificate-chain splitter walked PEM blocks with a lazy /BEGIN[\s\S]*?END/ scan. A crafted field — a long run of spaces, an unterminated bracket, a body carrying many <body starts with no closing >, a chain of BEGIN markers — could drive a worker's CPU to seconds of work. Each is now a linear scan: a shared b.safeBuffer.stripTrailingHspace (backward char walk), b.safeBuffer.indexAfterOpenTag (forward indexOf walk for the tag insertion point), a forward indexOf for address extraction, and an indexOf walk for the PEM split. Output is byte-identical (the tag-find is stricter — it no longer mistakes <bodyfoo> for <body>), and 400K-character adversarial inputs that took 8–85 seconds now complete in under 2 ms. · *MCP HTML-content check covers vbscript: and data:text/html* — The dangerous-markup check applied to text/html tool content matched <script>/<iframe>/<object>/<embed> and javascript: URLs but not the vbscript: scheme or data:text/html payloads. Both are now refused; data: URLs carrying non-HTML media (data:image/png and similar) are unaffected. · *AAD-bound columns refuse a plain sealed cell on read* — b.cryptoField.unsealRow now refuses a plain, unbound vault: envelope found on an AAD-bound (or per-row-key) column and nulls the field instead of returning it. A plain envelope carries no per-cell binding, so a writer who could place one — copied from anywhere under the same vault root — would otherwise relocate a value across rows or columns and defeat the copy-protection the AAD binding advertises. Operators migrating pre-AAD rows up to bound ciphertext opt into a bounded acceptance window with registerTable({ allowPlainMigration: true }) and clear it when migration completes. · *Row-level-security enablement fails closed on non-native drivers* — b.db.declareRowPolicy read pg_class.relrowsecurity to skip a redundant ENABLE ROW LEVEL SECURITY, but tested it with a bare truthiness check. A native pg driver returns a JS boolean; a proxy or ORM may return the string "f" for a disabled table — and "f" is truthy, so the check read it as already-enabled and silently skipped the ENABLE, leaving every row in the table unprotected while the migration reported success. RLS now counts as enabled only on a value that unambiguously means true (true, 1, or "t"/"true"/"1"/"on"/"yes"); every other shape re-issues ENABLE, a harmless no-op on an already-enabled table. · *Vendored-crypto CVE scanning, complementary SAST, and workflow static analysis in CI* — The framework ships zero npm runtime dependencies — its crypto (the noble suite, the WebAuthn server, the PKI layer) is vendored under lib/vendor/, where npm audit, Dependabot, and Socket cannot see it. Every build now generates a CycloneDX SBOM of the vendored tree (each library carrying an npm purl) and runs it through OSV-Scanner, matching the exact pinned version against the OSV vulnerability database; a published CVE or GHSA affecting a vendored version fails the build so the copy is refreshed before merge. A Semgrep pass (registry security-audit + javascript packs at ERROR severity) runs alongside CodeQL as complementary SAST, and actionlint statically checks the workflow files. All three install the OSS tool from its upstream release, matching the existing secret-scan gate's posture. **Detectors:** *Quadratic trailing-whitespace and tag-find regex detectors* — Two codebase-pattern detectors refuse reintroduction of the quadratic shapes: the /[ \t]+$/ trailing-whitespace strip (as .replace, .test, or via the named TRAILING_HSPACE_RE export) outside the linear helper that owns it, and the str.match(/<tag[^>]*>/) document-tag find that the response middleware must route through b.safeBuffer.indexAfterOpenTag. Each is proven to fire on the removed shape and stay silent on the linear replacement, so the ReDoS class cannot creep back into a new parser, guard, or response rewriter.
+
 - v0.15.10 (2026-06-13) — **Makes S3 Object-Lock version erasure reachable through the object store, and pins the build toolchain's native binary to a reviewed hash.** The object store gains the versioned-delete surface its S3 Object Lock support always needed for real erasure. An unversioned delete on a versioning-enabled (Object-Lock) bucket only writes a delete-marker — the data version survives — so the framework's own delete could report success while a record protected for compliance, or one a data subject asked to erase, stayed on disk. b.objectStore / b.storage now carry a versionId: put and saveRaw return the version they created, deleteFile(key, { versionId, bypassGovernanceRetention }) targets a specific version (refused — not silently delete-markered — when it is under an active retention), and listVersions enumerates versions and delete-markers so an erasure workflow can find them. Backends with no version surface (the filesystem backend, and the current Azure and GCS adapters) refuse a versioned delete loudly rather than silently dropping the current object. Separately, the build toolchain's native bundler binary is now verified against a reviewed SHA-256 pin so a tampered or drifted binary is caught before it bundles the framework. **Added:** *Versioned object delete + listVersions for S3 Object-Lock erasure* — b.storage.deleteFile and the b.objectStore sigv4 backend now accept opts.versionId to erase a specific object version, and opts.bypassGovernanceRetention to lift a GOVERNANCE-mode retention for callers with the permission (COMPLIANCE stays immutable to everyone). b.storage.saveRaw and the backend put now return the versionId they created on a versioning-enabled bucket, and a new b.storage.listVersions(prefix) / backend listVersions enumerates every version and delete-marker (key, versionId, isLatest, deleteMarker, size, lastModified, etag) so a right-to-erasure or crypto-shred workflow can target prior versions. On a backend with no version surface, listVersions throws VERSIONS_UNSUPPORTED and a versioned delete throws VERSIONID_UNSUPPORTED rather than silently acting on the current object. · *b.localDb.thin reaches SQLite resource-limit parity (limits option)* — b.localDb.thin now opens its node:sqlite handle with the same parse-time statement-size cap as b.db and the CLI — a SQL statement over 1 MiB is rejected at parse time, the SQLITE_LIMIT_LENGTH floor that guards prepare()/exec() of raw SQL against an attacker-influenced megaquery (SQLite's default is 1 GB). The cap is on by default; a new limits option (e.g. { sqlLength: 2 * 1024 * 1024 } or other SQLITE_LIMIT_* keys) lets an operator raise or extend it. Previously the thin opener had no limits plumbing, so a consumer on that path could not reach parity with the rest of the framework's SQLite surface. **Fixed:** *S3 Object-Lock version erasure is reachable through the framework delete path* — On a versioning-enabled (Object-Lock) bucket, an unversioned DELETE only writes a delete-marker — the protected data version survives untouched — yet the framework's delete had no versionId surface, so it issued the unversioned form and reported success while the bytes the lock protects remained. A retention or legal hold could therefore look enforced to the framework caller while the operation WORM actually blocks was unreachable. The delete path now targets the exact version: deleting a version under a COMPLIANCE retention is refused (it throws, even with bypassGovernanceRetention), a no-retention version erases cleanly, and the enforcement is proven end-to-end against MinIO through the framework's own API. · *b.configDrift.verifyVendorIntegrity is now working-directory-independent* — The vendored-dependency integrity check resolved each manifest file path against process.cwd(), so it only worked when run from the application root. Run from anywhere else it read-failed every entry (reporting ok:false), and under a crafted working directory that happened to contain a clean vendor tree it could hash a different tree than the one actually loaded. It now resolves each file under the framework's own vendor directory by default — the tree loaded at runtime — and honors an explicit libVendorDir for verifying a deployed tree elsewhere, so the result no longer depends on where the process was started. **Security:** *Build toolchain native binary pinned to a reviewed hash* — The native bundler binary the build toolchain runs (esbuild's per-platform compiler, a development dependency that never ships in the runtime) is now verified against a SHA-256 pin captured by diffing the published package tarballs and hashing the binary. The build gate fails if the on-disk binary does not match the reviewed hash for its (version, platform); for a version that has not been reviewed it notes the gap and skips rather than trusting an unverified binary. A cross-artifact check keeps the version in agreement across package.json, the CI install step, and the hash map, so the gate can never quietly test a version that was never diffed — closing a real drift where CI had been installing an older patch than package.json declared. The reviewed diff is benign: version strings plus an installer size-bound and error-message hardening, no new install hooks, files, or network paths, and no runtime-dependency impact. **Detectors:** *Object-store erasure guard, esbuild-pin agreement, + structural re-anchoring of the lint detectors* — A new guard locks the object-store delete path to the versioned-erasure contract: b.storage.deleteFile must thread versionId to the backend, so it can never silently revert to the WORM-blind unversioned delete. A second guard enforces that the esbuild build-tool version agrees across package.json, the CI install step, and the binary-hash map, so a future bump can't update one and leave the gate testing an unreviewed version. Separately, the framework's internal codebase-pattern lint detectors were re-anchored from fixed character spans to structural code boundaries, so they keep matching the code they guard as those functions grow rather than aging out of range; reviving them surfaced a few internal validation and transaction sites that now route through shared helpers (a required positive-integer-with-range validator and an async transaction wrapper) instead of hand-rolling the check. No public API change.
 
 - v0.15.9 (2026-06-13) — **Raises the Node floor to 24.16, adds SQLite parse-time resource caps, retries Windows rename locks on every atomic write and download, and ships a one-call secure logout that wipes client-side state.** This release moves the engines floor to the current Node 24 LTS patch level and adds three hardening primitives. node:sqlite handles now construct with SQLITE_LIMIT_* caps: a statement over 1 MiB is rejected at parse time (a DoS floor on the raw-SQL surface, complementary to the existing row-count gate) and ATTACH DATABASE is denied. Every final temp-to-destination rename — the file written by an atomic write, a downloaded file, a sealed vault key, a rotated log, an extracted archive entry — now routes through a single retry that rides out a transient Windows lock (antivirus, the search indexer, or a file-sync client briefly holding the destination), instead of surfacing the lock as a hard failure; the retry, previously hand-rolled and unreachable, is now the reusable b.atomicFile.renameWithRetry. And b.session.logout destroys a session and tells the browser to wipe its client-side state in one call: it emits an RFC 9527 Clear-Site-Data header and expires the session cookie before destroying the row, the secure-default logout that previously had to be assembled by hand. **Added:** *b.session.logout — one-call secure logout* — `b.session.logout(res, token, opts?)` destroys the server-side session AND tells the browser to wipe its client-side state in one call: it emits an RFC 9527 Clear-Site-Data response header (cookies + storage + cache + execution contexts by default) and expires the session cookie, then destroys the session row. `b.session.destroy` alone is a store operation with no response object, so it could not wipe the browser's cached pages, storage, or a stale tab still holding the now-revoked cookie — that wiring previously had to be mounted by hand. Pass `cookieName` to match a non-default cookie and `types` to choose the Clear-Site-Data directives. **Changed:** *Node engines floor raised to >=24.16.0* — The minimum supported Node is now 24.16.0 (the current Node 24 LTS patch level), up from 24.14.1. This is an LTS-currency bump — there are no Node CVE fixes between 24.14.1 and 24.16.0 (24.14.1 already carried the CVE-2026-21713 HMAC fix); it keeps the framework on the latest patched LTS and makes the node:sqlite resource-cap hardening below available everywhere. Pre-1.0, operators upgrade across the floor; Node 26 continues to satisfy it. **Fixed:** *b.watcher canonicalizes its root on Windows* — `b.watcher.create` now resolves its `root` to the real long path before watching. On Windows a root with an 8.3 short-name component (the system temp directory commonly resolves to one) made the native recursive backend deliver long-name event paths that no longer prefix-matched the watched root, which could abort the process under a strict libuv fs-event assertion. The watcher now canonicalizes the root (expanding short names and resolving symlinks), so events match the watched directory on Windows. **Security:** *SQLite parse-time statement-size cap* — Every node:sqlite database the framework opens — the main db handle and the CLI's handle — now constructs with a SQLITE_LIMIT_LENGTH cap: a SQL statement over 1 MiB is rejected at parse time. Because the query builder parameterizes every value, the size cap guards the raw-SQL surface (`b.db.runSql`) against an attacker-influenced megaquery the parser would otherwise process (SQLite's default is 1 GB); it is a parse-time DoS floor complementary to the existing row-count gate. Legitimate framework and operator statements are far under the cap. · *Windows rename-lock retry on every atomic rename and download* — On Windows a freshly-written file's destination is briefly held by antivirus, the search indexer, or a file-sync client (Dropbox, OneDrive), surfacing as a transient EPERM / EACCES / EBUSY on rename even though the temp file is fine. `b.atomicFile.writeSync` already retried this, but `b.httpClient.downloadStream` did not — a download into a cloud-synced or AV-scanned directory could fail hard on the lock. The retry is now the reusable `b.atomicFile.renameWithRetry`, and every final temp-to-destination rename in the framework routes through it: downloads, sealed vault keys, CA key/cert writes, log rotation, archive extraction, config-drift sidecars, the self-update binary swap, and restore/rollback moves. A non-transient error still throws immediately; POSIX renames are unaffected. **Detectors:** *Rename-retry, SQLite-limits, and Clear-Site-Data guards* — Three recurrence detectors ship with the fixes: a bare `nodeFs.renameSync` final rename that doesn't route through `atomicFile.renameWithRetry`; a main `DatabaseSync` handle constructed without the SQLITE_LIMIT_LENGTH `limits`; and a hand-rolled Clear-Site-Data header value that skips the shared RFC 9527 builder.

package/lib/acme.js

@@ -92,10 +92,6 @@ function _emitAudit(audit, action, outcome, metadata) {
   } catch (_e) { /* audit best-effort */ }
 }
 
-function _emitObs(name, fields) {
-  try { observability().safeEvent(name, 1, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 // JWK shape for an ES256 (P-256) public key — RFC 7518 §6.2.1.
 function _publicJwkFromKeyObject(keyObject) {
   if (!keyObject || typeof keyObject.export !== "function") {
@@ -479,7 +475,7 @@ function create(opts) {
     state.directory = body;
     _emitAudit(audit, "acme.directory.fetched", "success",
       { directoryUrl: state.directoryUrl, hasAri: typeof body.renewalInfo === "string" });
-    _emitObs("acme.directory.fetched", { hasAri: typeof body.renewalInfo === "string" });
+    observability().safeEvent("acme.directory.fetched", 1, { hasAri: typeof body.renewalInfo === "string" });
     return body;
   }
 
@@ -675,7 +671,7 @@ function create(opts) {
     }
     _emitAudit(audit, "acme.cert.issued", "success",
       { orderUrl: order.url, bytes: pem.length });
-    _emitObs("acme.cert.issued", { bytes: pem.length });
+    observability().safeEvent("acme.cert.issued", 1, { bytes: pem.length });
     return pem;
   }
 
@@ -1042,7 +1038,7 @@ function create(opts) {
         windowEnd:      ari.suggestedWindow.end,
         nowIso:         new Date(nowMs).toISOString(),
       });
-      _emitObs("acme.cert.renew.skipped", { reason: "before-window" });
+      observability().safeEvent("acme.cert.renew.skipped", 1, { reason: "before-window" });
       var ret = { shouldRenew: false, reason: "before-window", ari: ari };
       if (jitter) ret.renewAt = new Date(renewAtMs).toISOString();
       return ret;
@@ -1053,7 +1049,7 @@ function create(opts) {
         reason:         "past-window",
         windowEnd:      ari.suggestedWindow.end,
       });
-      _emitObs("acme.cert.renew.scheduled", { reason: "past-window" });
+      observability().safeEvent("acme.cert.renew.scheduled", 1, { reason: "past-window" });
       var rp = { shouldRenew: true, reason: "past-window", ari: ari };
       if (jitter) rp.renewAt = new Date(renewAtMs).toISOString();
       return rp;
@@ -1064,7 +1060,7 @@ function create(opts) {
       windowEnd:      ari.suggestedWindow.end,
       renewAt:        jitter ? new Date(renewAtMs).toISOString() : null,
     });
-    _emitObs("acme.cert.renew.scheduled", { reason: "in-window" });
+    observability().safeEvent("acme.cert.renew.scheduled", 1, { reason: "in-window" });
     var ri = { shouldRenew: true, reason: "in-window", ari: ari };
     if (jitter) ri.renewAt = new Date(renewAtMs).toISOString();
     return ri;
@@ -1140,7 +1136,7 @@ function create(opts) {
         "revokeCert returned " + rsp.statusCode, true, rsp.statusCode);
     }
     _emitAudit(audit, "acme.cert.revoked", "success", { reason: ropts.reason || null });
-    _emitObs("acme.cert.revoked", { reason: ropts.reason || 0 });
+    observability().safeEvent("acme.cert.revoked", 1, { reason: ropts.reason || 0 });
     return true;
   }
 
@@ -1190,7 +1186,7 @@ function create(opts) {
     privateKey = newPrivateKey;
     publicJwk  = newPublicJwk;
     _emitAudit(audit, "acme.account.key_rotated", "success", { accountUrl: state.accountUrl });
-    _emitObs("acme.account.key_rotated", {});
+    observability().safeEvent("acme.account.key_rotated", 1, {});
     return true;
   }
 

package/lib/client-hints.js

@@ -106,7 +106,9 @@ function _parseSfString(s) {
   if (t.length === 0) return "";
   if (t.charAt(0) === "\"") {
     if (t.charAt(t.length - 1) !== "\"") return null;
-    return t.slice(1, -1).replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
+    // Single-pass RFC 8941 unescape — chained .replace() mis-decodes
+    // an escaped backslash adjacent to another escape.
+    return structuredFields.unescapeSfStringBody(t.slice(1, -1));
   }
   return t;
 }

package/lib/cluster.js

@@ -1089,8 +1089,10 @@ function discoveryHandler() {
         body = { leader: null, self: selfInfo };
         status = 503;
       }
-    } catch (e) {
-      body = { leader: null, self: selfInfo, error: e.message };
+    } catch (_e) {
+      // Generic client-facing reason — the caught error's message (a DB error
+      // detail / DSN / host:port) is not echoed to the client (CWE-209).
+      body = { leader: null, self: selfInfo, error: "leader lookup unavailable" };
       status = 503;
     }
     var json = JSON.stringify(body);

package/lib/crypto-field.js

@@ -331,6 +331,15 @@ function isRowSealed(value) {
  *                                          // threaded into AAD. Default "1". Bump
  *                                          // when the column layout changes to
  *                                          // invalidate all prior ciphertext.
+ *   allowPlainMigration: boolean,          // default false. On an aad / per-row-key
+ *                                          // table the read path refuses a PLAIN
+ *                                          // (unbound) vault: cell — a relocatable
+ *                                          // envelope an attacker could copy in from
+ *                                          // another row defeats the AAD copy-
+ *                                          // protection, so it is nulled, not surfaced.
+ *                                          // Set true ONLY for the bounded window while
+ *                                          // migrating pre-AAD rows up to AAD-bound
+ *                                          // ciphertext; clear it once migration ends.
  *
  * @example
  *   b.cryptoField.registerTable("patients", {
@@ -403,6 +412,13 @@ function registerTable(name, opts) {
     rowIdField:      rowIdField,
     schemaVersion:   schemaVersion,
     derivedHashMode: derivedHashMode,
+    // allowPlainMigration — read-side downgrade window. On an aad / per-row-key
+    // table the read path refuses a plain `vault:` cell (no AAD = relocatable,
+    // which would defeat the cross-row/cross-column copy-protection the AAD
+    // binding advertises). Operators with genuine pre-AAD rows opt into a
+    // bounded lazy-migration window with { allowPlainMigration: true }; a
+    // re-seal (sealRow) then re-emits the cell AAD-bound. Default closed.
+    allowPlainMigration: opts.allowPlainMigration === true,
   };
 }
 
@@ -1240,6 +1256,20 @@ function unsealRow(table, row, actor, dbHandle) {
           unsealed = _decodeTyped(vaultAad.unseal(out[field],
             _aadParts(s, table, field, out)));
         } else if (typeof out[field] === "string" && out[field].startsWith(VAULT_PREFIX)) {
+          // A plain `vault:` cell (no AAD) on an AAD-bound / per-row-key table
+          // is a downgrade: plain vault.seal carries no AAD, so a DB-write
+          // attacker could relocate such a cell from another row/column into
+          // this one and the read would silently accept it — defeating the
+          // cross-row/cross-column copy-protection the AAD binding advertises.
+          // Refuse (throw -> catch nulls the field + audits) unless the table
+          // opted into the documented pre-AAD lazy-migration window.
+          if ((s.aad || perRowKeyTables[table]) && !s.allowPlainMigration) {
+            throw new CryptoFieldError("crypto-field/aad-downgrade-refused",
+              "unsealRow: '" + table + "'.'" + field + "' is AAD-bound but the stored " +
+              "cell is a plain (unbound) vault envelope — refusing a relocatable-seal " +
+              "downgrade (set registerTable({ allowPlainMigration: true }) for a " +
+              "documented pre-AAD migration window)");
+          }
           unsealed = _decodeTyped(vault.unseal(out[field]));
         } else {
           // Not a sealed value — pass through.

package/lib/db-declare-row-policy.js

@@ -73,6 +73,18 @@ function _err(code, message) {
   return new DeclareRowPolicyError(code, message);
 }
 
+// _isRlsEnabled — fail-closed coercion of pg_class.relrowsecurity. Native pg
+// drivers return a JS boolean; a proxy / ORM / non-native driver may return
+// "t"/"f", "true"/"false", or 1/0. RLS counts as enabled ONLY on a value that
+// unambiguously means true; every other shape (including the truthy string
+// "f") reads as not-enabled, so ENABLE is (re-)issued rather than silently
+// skipped — a skipped ENABLE would leave the table's rows unprotected.
+function _isRlsEnabled(v) {
+  if (v === true || v === 1) return true;
+  if (typeof v === "string") return /^(t|true|1|on|yes)$/i.test(v.trim());
+  return false;
+}
+
 function _validateIdent(where, value) {
   try {
     safeSql.validateIdentifier(value, { allowReserved: true });
@@ -227,7 +239,14 @@ function declareRowPolicy(opts) {
         "source table '" + spec.schema + "." + spec.table +
         "' not found (does it exist? does the migration role have visibility?)");
     }
-    if (!rows[0].relrowsecurity) {
+    // relrowsecurity is a Postgres boolean. Native pg drivers return true/false,
+    // but a proxy / ORM / non-native driver may hand back "t"/"f", "true"/"false",
+    // or 1/0. The string "f" is TRUTHY, so a bare `!rows[0].relrowsecurity` would
+    // read "f" as "already enabled" and silently SKIP ENABLE — leaving the table's
+    // rows unprotected while the migration reports success. Treat RLS as enabled
+    // ONLY on a value that unambiguously means true; anything else fails closed and
+    // (re-)issues ENABLE, which is a harmless no-op on an already-enabled table.
+    if (!_isRlsEnabled(rows[0].relrowsecurity)) {
       var enableStmt = sql.enableRowLevelSecurity(tableRef, { dialect: "postgres" });
       await xdb.query(enableStmt.sql, enableStmt.params);
     }

package/lib/db.js

@@ -1402,6 +1402,13 @@ async function init(opts) {
       aad:             t.aad,
       rowIdField:      t.rowIdField,
       schemaVersion:   t.schemaVersion,
+      // The read-side pre-AAD migration opt-in must pass through too —
+      // otherwise a schema declaring { aad: true, allowPlainMigration: true }
+      // registers with the default (false) via this declarative db.init path,
+      // and legacy plain vault: cells are nulled on read despite the operator
+      // opting into the migration window. registerTable defaults this to false,
+      // so non-migrating tables are unaffected.
+      allowPlainMigration: t.allowPlainMigration,
     });
     tableMetadata[t.name] = {
       primaryKey:             _normalizePk(t),

package/lib/guard-csv.js

@@ -56,6 +56,7 @@
 
 var codepointClass = require("./codepoint-class");
 var csv = require("./csv");
+var safeBuffer = require("./safe-buffer");
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var numericBounds = require("./numeric-bounds");
@@ -432,7 +433,9 @@ function _stripIssues(text, opts) {
   out = out.replace(ZW_RE_G, "");
   if (opts.trailingWhitespacePolicy === "trim") {
     out = out.split("\n").map(function (line) {
-      return line.replace(/[ \t]+$/g, "");
+      // Linear per-line trailing-whitespace trim — .replace(/[ \t]+$/) is
+      // O(n^2) in V8 on adversarial input (untrusted CSV here).
+      return safeBuffer.stripTrailingHspace(line);
     }).join("\n");
   }
   return out;
@@ -521,9 +524,15 @@ function escapeCell(value, opts) {
   if (opts.bidiCharPolicy === "strip") str = str.replace(BIDI_RE_G, "");
 
   if (opts.trailingWhitespacePolicy === "trim") {
-    str = str.replace(/[ \t]+$/g, "");
-  } else if (opts.trailingWhitespacePolicy === "reject" && /[ \t]+$/.test(str)) {
-    throw _err("csv.trailing-whitespace", "cell has trailing whitespace");
+    // Linear strip — .replace(/[ \t]+$/) is O(n^2) on adversarial untrusted CSV.
+    str = safeBuffer.stripTrailingHspace(str);
+  } else if (opts.trailingWhitespacePolicy === "reject") {
+    // Linear "ends in space/tab?" check — /[ \t]+$/.test is ALSO O(n^2) (the
+    // engine scans from every offset when there is no trailing run).
+    var lastCode = str.length > 0 ? str.charCodeAt(str.length - 1) : 0;
+    if (lastCode === 0x20 || lastCode === 0x09) {
+      throw _err("csv.trailing-whitespace", "cell has trailing whitespace");
+    }
   }
 
   if (typeof value === "number" &&

package/lib/guard-filename.js

@@ -80,7 +80,10 @@ var _err = GuardFilenameError.factory;
 //   Windows: < > : " / \ | ? *
 //   Unix:    /
 //   Both:    null and C0 controls (handled separately via codepoint-class)
-var RESERVED_CHARS_RE = /[<>:"/\\|?*]/;
+// Global so reservedCharPolicy:"strip" replaces EVERY reserved char, not just
+// the first (CodeQL js/incomplete-multi-character-sanitization). Only consumer
+// is the .replace() in _sanitize — no stateful .test()/.exec() lastIndex hazard.
+var RESERVED_CHARS_RE = /[<>:"/\\|?*]/g;
 
 // Windows reserved device names (case-insensitive). Match either the
 // bare name or `<name>.<anything>`.
@@ -586,8 +589,9 @@ function _sanitize(input, opts) {
 
   // Strip reserved chars when policy says strip.
   if (opts.reservedCharPolicy === "strip") {
+    // Single global strip — RESERVED_CHARS_RE (now /g) covers the whole
+    // reserved class INCLUDING path separators, so no second pass is needed.
     name = name.replace(RESERVED_CHARS_RE, "_");                            // allow:dynamic-regex — RESERVED_CHARS_RE is a compile-time literal
-    name = name.replace(/[<>:"|?*]/g, "_");
   } else if (opts.reservedCharPolicy === "reject") {
     if (/[<>:"|?*]/.test(name)) {
       throw _err("filename.reserved-char", "filename contains reserved character");

package/lib/http-client-cache.js

@@ -107,7 +107,9 @@ function _parseCacheControl(value) {
     else { k = p.slice(0, eq).trim(); v = p.slice(eq + 1).trim(); }
     // Strip surrounding quotes from value.
     if (v.length >= 2 && v.charAt(0) === '"' && v.charAt(v.length - 1) === '"') {
-      v = v.slice(1, v.length - 1).replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
+      // Single-pass RFC 8941 unescape (chained .replace() mis-decodes
+      // an escaped backslash adjacent to another escape).
+      v = structuredFields.unescapeSfStringBody(v.slice(1, v.length - 1));
     }
     out[k.toLowerCase()] = v;
   }

package/lib/http-message-signature.js

@@ -60,6 +60,7 @@
  */
 
 var nodeCrypto       = require("node:crypto");
+var bCrypto          = require("./crypto");
 var safeUrl          = require("./safe-url");
 var safeBuffer       = require("./safe-buffer");
 var C                = require("./constants");
@@ -406,7 +407,9 @@ function _parseSignatureInput(headerValue) {
       throw _err("BAD_HEADER",
         "httpSig: Signature-Input: unterminated quoted token");
     }
-    var bareName = coveredRaw.slice(qStart, qEnd).replace(/\\\\/g, "\\").replace(/\\"/g, "\"");
+    // Single-pass RFC 8941 §3.3.3 unescape — NOT two chained .replace() passes,
+    // which mis-decode an escaped backslash adjacent to another escape.
+    var bareName = structuredFields.unescapeSfStringBody(coveredRaw.slice(qStart, qEnd));
     i2 = qEnd + 1;
     // Optional ;param=value;param=... suffix immediately following.
     var suffixStart = i2;
@@ -525,13 +528,27 @@ function verify(msg, opts) {
     if (!presented) {
       return { valid: false, reason: "content-digest-header-missing" };
     }
-    var actual = contentDigest(m.body);
-    // RFC 9530 allows multiple algorithms in one header (sha-512=...,
-    // sha-256=...). For SHA3-512 specifically — exact substring match
-    // against the presented header. For peer-supplied SHA-512 / SHA-256
-    // identifiers the operator is responsible for re-validating; this
-    // primitive only auto-checks SHA3-512.
-    if (presented.indexOf(actual.replace(/^sha3-512=/, "sha3-512=")) === -1) {
+    // contentDigest() returns the canonical structured-field form
+    // `sha3-512=:<base64>:`. RFC 9530 permits a multi-member header
+    // (e.g. `sha-256=:...:, sha3-512=:...:`); split on top-level commas and
+    // match the sha3-512 member EXACTLY, in constant time, rather than by an
+    // unanchored substring scan that could spuriously match the digest text
+    // buried inside another member's value or parameters. Peer-supplied
+    // sha-512 / sha-256 identifiers stay the operator's responsibility.
+    var expectedDigest = contentDigest(m.body);           // "sha3-512=:<b64>:"
+    var matchedDigest  = false;
+    var digestMembers  = structuredFields.splitTopLevel(presented, ",");
+    for (var di = 0; di < digestMembers.length; di++) {
+      var member = digestMembers[di].trim();
+      var deq = member.indexOf("=");
+      if (deq < 1) continue;
+      if (member.slice(0, deq).trim().toLowerCase() !== "sha3-512") continue;
+      var memberCanonical = "sha3-512=" + member.slice(deq + 1).trim();
+      // crypto.timingSafeEqual is the length-tolerant constant-time wrapper
+      // (returns false for unequal lengths without leaking via a length branch).
+      if (bCrypto.timingSafeEqual(memberCanonical, expectedDigest)) { matchedDigest = true; break; }
+    }
+    if (!matchedDigest) {
       return { valid: false, reason: "content-digest-mismatch" };
     }
   }

package/lib/log-stream-otlp-grpc.js

@@ -38,6 +38,9 @@ var lazyRequire = require("./lazy-require");
 // scrub attribute values through the telemetry redactor before they cross the
 // OTLP egress boundary (CWE-532).
 var observability = lazyRequire(function () { return require("./observability"); });
+// Lazy — network-tls is widely required; audit an insecure (cert-validation-
+// disabled) outbound TLS session at honor time, same surface as connectWithEch.
+var networkTls = lazyRequire(function () { return require("./network-tls"); });
 
 var _err = LogStreamError.factory;
 var _log = boot("log-stream-otlp-grpc");
@@ -215,7 +218,14 @@ function _makeClient(cfg) {
   var sessionOpts = {};
   if (cfg.ca) sessionOpts.ca = cfg.ca;
   if (cfg.servername) sessionOpts.servername = cfg.servername;
-  if (cfg.allowInsecure) sessionOpts.rejectUnauthorized = false;
+  if (cfg.allowInsecure && url.protocol === "https:") {
+    // allowInsecure only has meaning on a TLS session. For an h2c endpoint
+    // (http://, cleartext HTTP/2) there is no certificate to validate and
+    // nothing to skip, so neither rejectUnauthorized nor the insecure-TLS
+    // audit applies — emitting it there would be a false security event.
+    sessionOpts.rejectUnauthorized = false;
+    networkTls().auditInsecureTls({ host: authority, source: "log-stream.otlp-grpc" });
+  }
   var session = http2.connect(authority, sessionOpts);
   session.on("error", function () { /* surfaced through request err */ });
   if (typeof session.unref === "function") session.unref();
@@ -409,6 +419,7 @@ module.exports = {
   create:                create,
   // Exposed for layer-0 tests that verify the wire encoding without
   // standing up an HTTP/2 server.
+  _makeClient:           _makeClient,
   _encodeAnyValue:       _encodeAnyValue,
   _encodeKeyValue:       _encodeKeyValue,
   _encodeLogRecord:      _encodeLogRecord,

package/lib/log-stream-syslog.js

@@ -37,6 +37,9 @@ var safeAsync = require("./safe-async");
 var safeBuffer = require("./safe-buffer");
 var safeUrl = require("./safe-url");
 var { LogStreamError } = require("./framework-error");
+var lazyRequire = require("./lazy-require");
+// Lazy — audit a cert-validation-disabled syslog/TLS session at honor time.
+var networkTls = lazyRequire(function () { return require("./network-tls"); });
 
 var _err = LogStreamError.factory;
 var log  = boot("log-stream-syslog");
@@ -223,6 +226,9 @@ function create(config) {
       });
       if (cfg.ca) tlsOpts.ca = cfg.ca;
       if (cfg.servername) tlsOpts.servername = cfg.servername;
+      if (cfg.rejectUnauthorized === false) {
+        networkTls().auditInsecureTls({ host: cfg.host, port: cfg.port, source: "log-stream.syslog" });
+      }
       sock = nodeTls.connect(tlsOpts, onConnect);
     } else {
       sock = net.connect(connectOpts, onConnect);

package/lib/log.js

@@ -464,7 +464,11 @@ function boot(name) {
     var stream = (LEVELS[levelName] >= LEVELS.warn) ? process.stderr : process.stdout;
     var isTty = !!(stream && stream.isTTY);
     if (isTty) {
-      sink(prefix + String(msg));
+      // Raw human-readable line — escape BOTH the C0/newline (line-forging)
+      // and bidi (re-ordering) control classes the create() path neutralizes,
+      // so a hostile boot message can't inject lines or re-order the visible
+      // line on a TTY / syslog reader (CWE-117 / Trojan-Source CVE-2021-42574).
+      sink(_escapeBidiControls(_escapeC0Controls(prefix + String(msg))));
       return;
     }
     var entry = {
@@ -474,7 +478,9 @@ function boot(name) {
       component: name,
       boot:      true,
     };
-    sink(JSON.stringify(entry));
+    // JSON.stringify already escapes C0/newlines; bidi/format controls survive
+    // raw into a piped aggregator, so apply the same bidi escape create() uses.
+    sink(_escapeBidiControls(JSON.stringify(entry)));
   }
 
   function debug(msg, fields) {
@@ -560,6 +566,22 @@ function _escapeBidiControls(s) {
   });
 }
 
+// C0 control chars (incl. CR / LF / TAB) + DEL — escaped to `\uXXXX` so a
+// hostile message can't forge extra log lines on a raw (non-JSON) TTY sink
+// (log-injection, CWE-117). The create() path gets this for free from
+// JSON.stringify; the boot() TTY branch writes raw text and needs it
+// explicitly. Pairs with _escapeBidiControls (which only covers the bidi set).
+var _C0_CONTROL_RE = /[\u0000-\u001f\u007f]/g;   // eslint-disable-line no-control-regex -- the C0/DEL set is what we escape
+
+function _escapeC0Controls(s) {
+  if (typeof s !== "string" || s.length === 0) return s;
+  return s.replace(_C0_CONTROL_RE, function (ch) {
+    var code = ch.charCodeAt(0).toString(16);
+    while (code.length < 4) code = "0" + code;
+    return "\\u" + code;
+  });
+}
+
 // runs before safeEnv on the boot path; safeEnv requires log, so log
 // can't go through safeEnv to read its own level.
 function _bootMinLevel() {

package/lib/mail-bimi.js

@@ -799,10 +799,23 @@ async function fetchAndVerifyMark(opts) {
 
 function _splitPemChain(pemText) {
   if (typeof pemText !== "string") return [];
+  // Linear indexOf walk over non-overlapping BEGIN..END blocks — NOT
+  // /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g. The
+  // lazy-quantifier scan re-walks from every BEGIN marker that has no
+  // matching END, which is superlinear on a chain of BEGIN-only markers;
+  // the indexOf walk advances monotonically and never re-scans.
+  var BEGIN = "-----BEGIN CERTIFICATE-----";
+  var END = "-----END CERTIFICATE-----";
   var out = [];
-  var re = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
-  var m;
-  while ((m = re.exec(pemText)) !== null) out.push(m[0]);
+  var from = 0;
+  for (;;) {
+    var b = pemText.indexOf(BEGIN, from);
+    if (b === -1) break;
+    var e = pemText.indexOf(END, b + BEGIN.length);
+    if (e === -1) break;   // unterminated final block — no further certs
+    out.push(pemText.slice(b, e + END.length));
+    from = e + END.length;
+  }
   return out;
 }
 

package/lib/mail.js

@@ -76,6 +76,8 @@ var networkDns = lazyRequire(function () { return require("./network-dns"); });
 var nodeUrl = require("node:url");
 var numericBounds = require("./numeric-bounds");
 var nodeTls = lazyRequire(function () { return require("node:tls"); });
+// Lazy — audit a cert-validation-disabled SMTP/TLS session at honor time.
+var networkTls = lazyRequire(function () { return require("./network-tls"); });
 var safeJson = require("./safe-json");
 var safeSchema = require("./safe-schema");
 var validateOpts = require("./validate-opts");
@@ -313,10 +315,9 @@ function _normalizeRecipientList(value, label) {
         label + "[" + i + "] contains forbidden control characters", true);
     }
     // Accept "Name <email@addr>" form too — extract the angle-bracket
-    // address for validation; preserve the full string in the message.
-    var bracket = arr[i].match(/<([^>]+)>/);
-    var addr = bracket ? bracket[1] : arr[i];
-    if (!_isValidEmail(addr.trim())) {
+    // address for validation (linear, via _extractAddr); preserve the full
+    // string in the message.
+    if (!_isValidEmail(_extractAddr(arr[i]))) {
       throw new MailError("mail/invalid-recipient",
         label + " '" + arr[i] + "' is not a valid email address", true);
     }
@@ -423,9 +424,7 @@ function _validateMessage(message) {
     throw new MailError("mail/invalid-from",
       "message.from contains forbidden control characters", true);
   }
-  var fromBracket = message.from.match(/<([^>]+)>/);
-  var fromAddr = fromBracket ? fromBracket[1] : message.from;
-  if (!_isValidEmail(fromAddr.trim())) {
+  if (!_isValidEmail(_extractAddr(message.from))) {
     throw new MailError("mail/invalid-from",
       "message.from '" + message.from + "' is not a valid email address", true);
   }
@@ -557,8 +556,18 @@ function _mergeMessage(defaults, message) {
 
 function _extractAddr(s) {
   if (s === undefined || s === null) return s;
-  var m = String(s).match(/<([^>]+)>/);
-  return m ? m[1].trim() : String(s).trim();
+  s = String(s);
+  // Linear angle-bracket extraction — NOT s.match(/<([^>]+)>/), which is O(n^2)
+  // in V8 on a long run of '<' with no '>' (the engine retries the greedy
+  // [^>]+ from every '<' offset; 200K '<' ~ 11s). Recipient/from addresses on
+  // b.mail.send can be caller/request-supplied, so this is a reachable DoS.
+  // Mirrors the regex: the chars between the first '<' and the next '>'.
+  var lt = s.indexOf("<");
+  if (lt !== -1) {
+    var gt = s.indexOf(">", lt + 1);
+    if (gt > lt + 1) return s.slice(lt + 1, gt).trim();
+  }
+  return s.trim();
 }
 
 function _toArray(v) {
@@ -771,6 +780,9 @@ function smtpTransport(opts) {
   var port = opts.port || 587;
   var useImplicitTLS = port === 465 || opts.implicitTls === true;
   var rejectUnauthorized = opts.rejectUnauthorized !== false;
+  if (rejectUnauthorized === false) {
+    networkTls().auditInsecureTls({ host: opts.host, port: port, source: "mail.smtp" });
+  }
   var ehloName = opts.ehloName || "blamejs";
   // GHSA-c7w3-x93f-qmm8 / GHSA-vvjj-xcjg-gr5g (nodemailer CRLF-injection
   // class) — any string concatenated into an outbound SMTP wire command