@blamejs/core 0.15.11 → 0.15.12

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.12 (2026-06-14) — **Hardens a set of defense-in-depth seams: a single-pass structured-field unescape, a constant-time content-digest member match, complete reserved-character stripping, a Trojan-Source escape on the boot logger, generic body-parse error responses, and an audit trail whenever outbound TLS certificate validation is disabled.** A sweep of low-severity but real hardening items. RFC 8941 structured-field string values (HTTP Message Signatures, Client Hints, Cache-Control) were un-escaped with two chained replaces that mis-decoded an escaped backslash adjacent to another escape; they now use one left-to-right pass that decodes each escape exactly once. The HTTP Message Signature content-digest check dropped a dead identity-replace and now matches the sha3-512 member by an exact, top-level, constant-time comparison instead of an unanchored substring scan. b.guardFilename's reserved-character strip used a non-global regex that left every separator after the first; it now strips all of them. The boot logger's TTY branch wrote raw text, bypassing the Trojan-Source / control-character escape the main logger applies — it now escapes the bidi and C0/newline control classes on every sink. The body parser no longer echoes a caught exception's detail (an fs errno + temp path, or a parse hook's thrown message) to the HTTP client — the client gets a generic status phrase while the full detail stays on the audit chain. And any outbound TLS connection that runs with peer-certificate validation disabled (an explicit operator opt-in, never a default) now emits a tls.insecure_skip_verify audit + observability event so the degraded posture is visible for compliance and incident response. **Added:** *b.structuredFields.unescapeSfStringBody(body)* — A single-pass decode of the RFC 8941 §3.3.3 quoted-string backslash escapes (the bytes between the surrounding quotes). It replaces the chained two-`.replace()` form, which is not equivalent to one decode — whichever pass runs first can rewrite a backslash the other escape sequence owns, so a lone escaped backslash decoded to two. The HTTP Message Signature, Client Hints, and Cache-Control sf-string readers now route through it. · *tls.insecure_skip_verify audit event* — b.network.tls.auditInsecureTls(meta) emits an audit + observability event at the point an outbound TLS connection honors rejectUnauthorized:false / allowInsecure. The connectWithEch, OTLP-gRPC log stream, syslog-TLS log stream, and SMTP transports all emit it when an operator disables certificate validation — parallel to the existing tls.classical_downgrade audit. No default changes; the framework never disables validation itself. **Security:** *Single-pass structured-field string unescape* — The RFC 8941 sf-string readers in HTTP Message Signatures (Signature-Input covered-component names), Client Hints, and Cache-Control directive values un-escaped with `.replace(/\\\\/g,"\\").replace(/\\"/g,'"')` — two sequential passes that mis-decode adjacent escapes (a lone escaped backslash became two). All four sites now use the single-pass b.structuredFields.unescapeSfStringBody. It is fail-closed (a mis-decoded covered-component name just fails the signature check, never bypasses it); the fix restores RFC-conformant interop with peers that legitimately escape these values. · *Constant-time, member-anchored content-digest verification* — b.crypto.httpSig.verify's covered content-digest check dropped a dead no-op replace and now parses the Content-Digest header into its top-level members and matches the sha3-512 member EXACTLY, in constant time (b.crypto.timingSafeEqual), rather than scanning for the digest text as a substring anywhere in the header. The Content-Digest header is already bound by the signature, so the substring form was not reachably exploitable; the change removes the latent ambiguity and the timing channel. · *Reserved-character filename strip removes every occurrence* — b.guardFilename's reservedCharPolicy:"strip" (the permissive profile) used a non-global regex, so only the FIRST reserved character — including path separators — was replaced and the rest leaked through. The strip is now global: every reserved character is removed. Not a traversal bypass (the unconditional security floor still throws on `..`, null bytes, NTFS ADS, UNC, overlong UTF-8), but the strip is now complete and consistent. · *Boot logger escapes control + bidi characters on every sink* — The boot-time logger's TTY branch wrote the raw message, bypassing the Trojan-Source (bidi) and control-character escapes the main logger applies — a hostile message could forge extra log lines on a terminal (CWE-117) or re-order the visible line (CVE-2021-42574). Both boot branches now escape the bidi and C0/newline control classes, matching the create() path and the logger's advertised guarantee. · *Body-parser error responses never echo internal detail* — The body-parser's terminal error path surfaced a caught exception's message verbatim to the HTTP client — a multipart filesystem error leaked the errno + temp path, and a parse hook's thrown error (which can carry secrets) was echoed back. The client now gets a curated message only for a framework-classified 4xx error and a generic status phrase otherwise; the parse-hook wrapper carries a fixed message, and full diagnostics stay on the audit chain server-side (CWE-209). The cluster leader-discovery endpoint's error body is generalized the same way.
+
 - v0.15.11 (2026-06-14) — **Replaces a family of quadratic-time regexes that hostile input could use to stall a worker with linear scans, refuses a relocatable sealed-cell downgrade on the read side, fails closed when enabling row-level security behind a non-native driver, and scans the vendored crypto for known CVEs on every build.** Several text-handling primitives stripped trailing whitespace or extracted a mail address with a regex whose backtracking is quadratic in the input length on adversarial strings — a request body, a YAML document, a CSV cell, or a From header crafted as a long run of spaces could pin a worker's CPU. Each is now a linear character scan with identical output. The HTML-content check the MCP tool surface applies gained the vbscript: and data:text/html vectors it was missing. On the data-at-rest side, an AAD-bound (or per-row-key) column now refuses a plain, unbound vault cell on read — a relocatable envelope an attacker with write access could copy in from another row defeats the cross-row binding, so the field is nulled rather than surfaced; operators mid-migration opt back in with registerTable({ allowPlainMigration: true }). declareRowPolicy now treats row-level-security as enabled only on a value that unambiguously means true, so a non-native Postgres driver that returns the string "f" can no longer be read as "already on" and silently skip the ENABLE that protects the table's rows. Finally, because the framework's crypto is vendored rather than installed, npm audit and Dependabot never see it: every build now matches the vendored versions against the OSV vulnerability database, with a complementary Semgrep pass and workflow-file static analysis alongside. **Added:** *b.safeBuffer.indexAfterOpenTag(html, tagName)* — A linear helper that returns the offset just past a `<tag ...>` opening tag (case-insensitive), or -1 when absent or unterminated — the insertion point a response rewriter uses to splice content after <body> or <head> without a regex. It replaces the O(n^2) html.match(/<body[^>]*>/i) shape and is stricter than it: a real tag boundary is required after the name, so <bodyfoo> is not mistaken for <body>. **Security:** *Linear-time replacements across a family of quadratic regexes (ReDoS class)* — Several primitives located or stripped text with a regex whose backtracking is quadratic in V8 on adversarial input (CWE-1333): b.safeBuffer and the safe-env / safe-yaml / guard-csv parsers stripped trailing horizontal whitespace with /[ \t]+$/; b.mail extracted the address from a `Name <addr>` header with /<([^>]+)>/; the bot-disclosure and speculation-rules response middleware found the <body> insertion point with /<body[^>]*>/i; and the BIMI certificate-chain splitter walked PEM blocks with a lazy /BEGIN[\s\S]*?END/ scan. A crafted field — a long run of spaces, an unterminated bracket, a body carrying many <body starts with no closing >, a chain of BEGIN markers — could drive a worker's CPU to seconds of work. Each is now a linear scan: a shared b.safeBuffer.stripTrailingHspace (backward char walk), b.safeBuffer.indexAfterOpenTag (forward indexOf walk for the tag insertion point), a forward indexOf for address extraction, and an indexOf walk for the PEM split. Output is byte-identical (the tag-find is stricter — it no longer mistakes <bodyfoo> for <body>), and 400K-character adversarial inputs that took 8–85 seconds now complete in under 2 ms. · *MCP HTML-content check covers vbscript: and data:text/html* — The dangerous-markup check applied to text/html tool content matched <script>/<iframe>/<object>/<embed> and javascript: URLs but not the vbscript: scheme or data:text/html payloads. Both are now refused; data: URLs carrying non-HTML media (data:image/png and similar) are unaffected. · *AAD-bound columns refuse a plain sealed cell on read* — b.cryptoField.unsealRow now refuses a plain, unbound vault: envelope found on an AAD-bound (or per-row-key) column and nulls the field instead of returning it. A plain envelope carries no per-cell binding, so a writer who could place one — copied from anywhere under the same vault root — would otherwise relocate a value across rows or columns and defeat the copy-protection the AAD binding advertises. Operators migrating pre-AAD rows up to bound ciphertext opt into a bounded acceptance window with registerTable({ allowPlainMigration: true }) and clear it when migration completes. · *Row-level-security enablement fails closed on non-native drivers* — b.db.declareRowPolicy read pg_class.relrowsecurity to skip a redundant ENABLE ROW LEVEL SECURITY, but tested it with a bare truthiness check. A native pg driver returns a JS boolean; a proxy or ORM may return the string "f" for a disabled table — and "f" is truthy, so the check read it as already-enabled and silently skipped the ENABLE, leaving every row in the table unprotected while the migration reported success. RLS now counts as enabled only on a value that unambiguously means true (true, 1, or "t"/"true"/"1"/"on"/"yes"); every other shape re-issues ENABLE, a harmless no-op on an already-enabled table. · *Vendored-crypto CVE scanning, complementary SAST, and workflow static analysis in CI* — The framework ships zero npm runtime dependencies — its crypto (the noble suite, the WebAuthn server, the PKI layer) is vendored under lib/vendor/, where npm audit, Dependabot, and Socket cannot see it. Every build now generates a CycloneDX SBOM of the vendored tree (each library carrying an npm purl) and runs it through OSV-Scanner, matching the exact pinned version against the OSV vulnerability database; a published CVE or GHSA affecting a vendored version fails the build so the copy is refreshed before merge. A Semgrep pass (registry security-audit + javascript packs at ERROR severity) runs alongside CodeQL as complementary SAST, and actionlint statically checks the workflow files. All three install the OSS tool from its upstream release, matching the existing secret-scan gate's posture. **Detectors:** *Quadratic trailing-whitespace and tag-find regex detectors* — Two codebase-pattern detectors refuse reintroduction of the quadratic shapes: the /[ \t]+$/ trailing-whitespace strip (as .replace, .test, or via the named TRAILING_HSPACE_RE export) outside the linear helper that owns it, and the str.match(/<tag[^>]*>/) document-tag find that the response middleware must route through b.safeBuffer.indexAfterOpenTag. Each is proven to fire on the removed shape and stay silent on the linear replacement, so the ReDoS class cannot creep back into a new parser, guard, or response rewriter.
 
 - v0.15.10 (2026-06-13) — **Makes S3 Object-Lock version erasure reachable through the object store, and pins the build toolchain's native binary to a reviewed hash.** The object store gains the versioned-delete surface its S3 Object Lock support always needed for real erasure. An unversioned delete on a versioning-enabled (Object-Lock) bucket only writes a delete-marker — the data version survives — so the framework's own delete could report success while a record protected for compliance, or one a data subject asked to erase, stayed on disk. b.objectStore / b.storage now carry a versionId: put and saveRaw return the version they created, deleteFile(key, { versionId, bypassGovernanceRetention }) targets a specific version (refused — not silently delete-markered — when it is under an active retention), and listVersions enumerates versions and delete-markers so an erasure workflow can find them. Backends with no version surface (the filesystem backend, and the current Azure and GCS adapters) refuse a versioned delete loudly rather than silently dropping the current object. Separately, the build toolchain's native bundler binary is now verified against a reviewed SHA-256 pin so a tampered or drifted binary is caught before it bundles the framework. **Added:** *Versioned object delete + listVersions for S3 Object-Lock erasure* — b.storage.deleteFile and the b.objectStore sigv4 backend now accept opts.versionId to erase a specific object version, and opts.bypassGovernanceRetention to lift a GOVERNANCE-mode retention for callers with the permission (COMPLIANCE stays immutable to everyone). b.storage.saveRaw and the backend put now return the versionId they created on a versioning-enabled bucket, and a new b.storage.listVersions(prefix) / backend listVersions enumerates every version and delete-marker (key, versionId, isLatest, deleteMarker, size, lastModified, etag) so a right-to-erasure or crypto-shred workflow can target prior versions. On a backend with no version surface, listVersions throws VERSIONS_UNSUPPORTED and a versioned delete throws VERSIONID_UNSUPPORTED rather than silently acting on the current object. · *b.localDb.thin reaches SQLite resource-limit parity (limits option)* — b.localDb.thin now opens its node:sqlite handle with the same parse-time statement-size cap as b.db and the CLI — a SQL statement over 1 MiB is rejected at parse time, the SQLITE_LIMIT_LENGTH floor that guards prepare()/exec() of raw SQL against an attacker-influenced megaquery (SQLite's default is 1 GB). The cap is on by default; a new limits option (e.g. { sqlLength: 2 * 1024 * 1024 } or other SQLITE_LIMIT_* keys) lets an operator raise or extend it. Previously the thin opener had no limits plumbing, so a consumer on that path could not reach parity with the rest of the framework's SQLite surface. **Fixed:** *S3 Object-Lock version erasure is reachable through the framework delete path* — On a versioning-enabled (Object-Lock) bucket, an unversioned DELETE only writes a delete-marker — the protected data version survives untouched — yet the framework's delete had no versionId surface, so it issued the unversioned form and reported success while the bytes the lock protects remained. A retention or legal hold could therefore look enforced to the framework caller while the operation WORM actually blocks was unreachable. The delete path now targets the exact version: deleting a version under a COMPLIANCE retention is refused (it throws, even with bypassGovernanceRetention), a no-retention version erases cleanly, and the enforcement is proven end-to-end against MinIO through the framework's own API. · *b.configDrift.verifyVendorIntegrity is now working-directory-independent* — The vendored-dependency integrity check resolved each manifest file path against process.cwd(), so it only worked when run from the application root. Run from anywhere else it read-failed every entry (reporting ok:false), and under a crafted working directory that happened to contain a clean vendor tree it could hash a different tree than the one actually loaded. It now resolves each file under the framework's own vendor directory by default — the tree loaded at runtime — and honors an explicit libVendorDir for verifying a deployed tree elsewhere, so the result no longer depends on where the process was started. **Security:** *Build toolchain native binary pinned to a reviewed hash* — The native bundler binary the build toolchain runs (esbuild's per-platform compiler, a development dependency that never ships in the runtime) is now verified against a SHA-256 pin captured by diffing the published package tarballs and hashing the binary. The build gate fails if the on-disk binary does not match the reviewed hash for its (version, platform); for a version that has not been reviewed it notes the gap and skips rather than trusting an unverified binary. A cross-artifact check keeps the version in agreement across package.json, the CI install step, and the hash map, so the gate can never quietly test a version that was never diffed — closing a real drift where CI had been installing an older patch than package.json declared. The reviewed diff is benign: version strings plus an installer size-bound and error-message hardening, no new install hooks, files, or network paths, and no runtime-dependency impact. **Detectors:** *Object-store erasure guard, esbuild-pin agreement, + structural re-anchoring of the lint detectors* — A new guard locks the object-store delete path to the versioned-erasure contract: b.storage.deleteFile must thread versionId to the backend, so it can never silently revert to the WORM-blind unversioned delete. A second guard enforces that the esbuild build-tool version agrees across package.json, the CI install step, and the binary-hash map, so a future bump can't update one and leave the gate testing an unreviewed version. Separately, the framework's internal codebase-pattern lint detectors were re-anchored from fixed character spans to structural code boundaries, so they keep matching the code they guard as those functions grow rather than aging out of range; reviving them surfaced a few internal validation and transaction sites that now route through shared helpers (a required positive-integer-with-range validator and an async transaction wrapper) instead of hand-rolling the check. No public API change.

package/lib/acme.js

@@ -92,10 +92,6 @@ function _emitAudit(audit, action, outcome, metadata) {
   } catch (_e) { /* audit best-effort */ }
 }
 
-function _emitObs(name, fields) {
-  try { observability().safeEvent(name, 1, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 // JWK shape for an ES256 (P-256) public key — RFC 7518 §6.2.1.
 function _publicJwkFromKeyObject(keyObject) {
   if (!keyObject || typeof keyObject.export !== "function") {
@@ -479,7 +475,7 @@ function create(opts) {
     state.directory = body;
     _emitAudit(audit, "acme.directory.fetched", "success",
       { directoryUrl: state.directoryUrl, hasAri: typeof body.renewalInfo === "string" });
-    _emitObs("acme.directory.fetched", { hasAri: typeof body.renewalInfo === "string" });
+    observability().safeEvent("acme.directory.fetched", 1, { hasAri: typeof body.renewalInfo === "string" });
     return body;
   }
 
@@ -675,7 +671,7 @@ function create(opts) {
     }
     _emitAudit(audit, "acme.cert.issued", "success",
       { orderUrl: order.url, bytes: pem.length });
-    _emitObs("acme.cert.issued", { bytes: pem.length });
+    observability().safeEvent("acme.cert.issued", 1, { bytes: pem.length });
     return pem;
   }
 
@@ -1042,7 +1038,7 @@ function create(opts) {
         windowEnd:      ari.suggestedWindow.end,
         nowIso:         new Date(nowMs).toISOString(),
       });
-      _emitObs("acme.cert.renew.skipped", { reason: "before-window" });
+      observability().safeEvent("acme.cert.renew.skipped", 1, { reason: "before-window" });
       var ret = { shouldRenew: false, reason: "before-window", ari: ari };
       if (jitter) ret.renewAt = new Date(renewAtMs).toISOString();
       return ret;
@@ -1053,7 +1049,7 @@ function create(opts) {
         reason:         "past-window",
         windowEnd:      ari.suggestedWindow.end,
       });
-      _emitObs("acme.cert.renew.scheduled", { reason: "past-window" });
+      observability().safeEvent("acme.cert.renew.scheduled", 1, { reason: "past-window" });
       var rp = { shouldRenew: true, reason: "past-window", ari: ari };
       if (jitter) rp.renewAt = new Date(renewAtMs).toISOString();
       return rp;
@@ -1064,7 +1060,7 @@ function create(opts) {
       windowEnd:      ari.suggestedWindow.end,
       renewAt:        jitter ? new Date(renewAtMs).toISOString() : null,
     });
-    _emitObs("acme.cert.renew.scheduled", { reason: "in-window" });
+    observability().safeEvent("acme.cert.renew.scheduled", 1, { reason: "in-window" });
     var ri = { shouldRenew: true, reason: "in-window", ari: ari };
     if (jitter) ri.renewAt = new Date(renewAtMs).toISOString();
     return ri;
@@ -1140,7 +1136,7 @@ function create(opts) {
         "revokeCert returned " + rsp.statusCode, true, rsp.statusCode);
     }
     _emitAudit(audit, "acme.cert.revoked", "success", { reason: ropts.reason || null });
-    _emitObs("acme.cert.revoked", { reason: ropts.reason || 0 });
+    observability().safeEvent("acme.cert.revoked", 1, { reason: ropts.reason || 0 });
     return true;
   }
 
@@ -1190,7 +1186,7 @@ function create(opts) {
     privateKey = newPrivateKey;
     publicJwk  = newPublicJwk;
     _emitAudit(audit, "acme.account.key_rotated", "success", { accountUrl: state.accountUrl });
-    _emitObs("acme.account.key_rotated", {});
+    observability().safeEvent("acme.account.key_rotated", 1, {});
     return true;
   }
 

package/lib/client-hints.js

@@ -106,7 +106,9 @@ function _parseSfString(s) {
   if (t.length === 0) return "";
   if (t.charAt(0) === "\"") {
     if (t.charAt(t.length - 1) !== "\"") return null;
-    return t.slice(1, -1).replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
+    // Single-pass RFC 8941 unescape — chained .replace() mis-decodes
+    // an escaped backslash adjacent to another escape.
+    return structuredFields.unescapeSfStringBody(t.slice(1, -1));
   }
   return t;
 }

package/lib/cluster.js

@@ -1089,8 +1089,10 @@ function discoveryHandler() {
         body = { leader: null, self: selfInfo };
         status = 503;
       }
-    } catch (e) {
-      body = { leader: null, self: selfInfo, error: e.message };
+    } catch (_e) {
+      // Generic client-facing reason — the caught error's message (a DB error
+      // detail / DSN / host:port) is not echoed to the client (CWE-209).
+      body = { leader: null, self: selfInfo, error: "leader lookup unavailable" };
       status = 503;
     }
     var json = JSON.stringify(body);

package/lib/guard-filename.js

@@ -80,7 +80,10 @@ var _err = GuardFilenameError.factory;
 //   Windows: < > : " / \ | ? *
 //   Unix:    /
 //   Both:    null and C0 controls (handled separately via codepoint-class)
-var RESERVED_CHARS_RE = /[<>:"/\\|?*]/;
+// Global so reservedCharPolicy:"strip" replaces EVERY reserved char, not just
+// the first (CodeQL js/incomplete-multi-character-sanitization). Only consumer
+// is the .replace() in _sanitize — no stateful .test()/.exec() lastIndex hazard.
+var RESERVED_CHARS_RE = /[<>:"/\\|?*]/g;
 
 // Windows reserved device names (case-insensitive). Match either the
 // bare name or `<name>.<anything>`.
@@ -586,8 +589,9 @@ function _sanitize(input, opts) {
 
   // Strip reserved chars when policy says strip.
   if (opts.reservedCharPolicy === "strip") {
+    // Single global strip — RESERVED_CHARS_RE (now /g) covers the whole
+    // reserved class INCLUDING path separators, so no second pass is needed.
     name = name.replace(RESERVED_CHARS_RE, "_");                            // allow:dynamic-regex — RESERVED_CHARS_RE is a compile-time literal
-    name = name.replace(/[<>:"|?*]/g, "_");
   } else if (opts.reservedCharPolicy === "reject") {
     if (/[<>:"|?*]/.test(name)) {
       throw _err("filename.reserved-char", "filename contains reserved character");

package/lib/http-client-cache.js

@@ -107,7 +107,9 @@ function _parseCacheControl(value) {
     else { k = p.slice(0, eq).trim(); v = p.slice(eq + 1).trim(); }
     // Strip surrounding quotes from value.
     if (v.length >= 2 && v.charAt(0) === '"' && v.charAt(v.length - 1) === '"') {
-      v = v.slice(1, v.length - 1).replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
+      // Single-pass RFC 8941 unescape (chained .replace() mis-decodes
+      // an escaped backslash adjacent to another escape).
+      v = structuredFields.unescapeSfStringBody(v.slice(1, v.length - 1));
     }
     out[k.toLowerCase()] = v;
   }

package/lib/http-message-signature.js

@@ -60,6 +60,7 @@
  */
 
 var nodeCrypto       = require("node:crypto");
+var bCrypto          = require("./crypto");
 var safeUrl          = require("./safe-url");
 var safeBuffer       = require("./safe-buffer");
 var C                = require("./constants");
@@ -406,7 +407,9 @@ function _parseSignatureInput(headerValue) {
       throw _err("BAD_HEADER",
         "httpSig: Signature-Input: unterminated quoted token");
     }
-    var bareName = coveredRaw.slice(qStart, qEnd).replace(/\\\\/g, "\\").replace(/\\"/g, "\"");
+    // Single-pass RFC 8941 §3.3.3 unescape — NOT two chained .replace() passes,
+    // which mis-decode an escaped backslash adjacent to another escape.
+    var bareName = structuredFields.unescapeSfStringBody(coveredRaw.slice(qStart, qEnd));
     i2 = qEnd + 1;
     // Optional ;param=value;param=... suffix immediately following.
     var suffixStart = i2;
@@ -525,13 +528,27 @@ function verify(msg, opts) {
     if (!presented) {
       return { valid: false, reason: "content-digest-header-missing" };
     }
-    var actual = contentDigest(m.body);
-    // RFC 9530 allows multiple algorithms in one header (sha-512=...,
-    // sha-256=...). For SHA3-512 specifically — exact substring match
-    // against the presented header. For peer-supplied SHA-512 / SHA-256
-    // identifiers the operator is responsible for re-validating; this
-    // primitive only auto-checks SHA3-512.
-    if (presented.indexOf(actual.replace(/^sha3-512=/, "sha3-512=")) === -1) {
+    // contentDigest() returns the canonical structured-field form
+    // `sha3-512=:<base64>:`. RFC 9530 permits a multi-member header
+    // (e.g. `sha-256=:...:, sha3-512=:...:`); split on top-level commas and
+    // match the sha3-512 member EXACTLY, in constant time, rather than by an
+    // unanchored substring scan that could spuriously match the digest text
+    // buried inside another member's value or parameters. Peer-supplied
+    // sha-512 / sha-256 identifiers stay the operator's responsibility.
+    var expectedDigest = contentDigest(m.body);           // "sha3-512=:<b64>:"
+    var matchedDigest  = false;
+    var digestMembers  = structuredFields.splitTopLevel(presented, ",");
+    for (var di = 0; di < digestMembers.length; di++) {
+      var member = digestMembers[di].trim();
+      var deq = member.indexOf("=");
+      if (deq < 1) continue;
+      if (member.slice(0, deq).trim().toLowerCase() !== "sha3-512") continue;
+      var memberCanonical = "sha3-512=" + member.slice(deq + 1).trim();
+      // crypto.timingSafeEqual is the length-tolerant constant-time wrapper
+      // (returns false for unequal lengths without leaking via a length branch).
+      if (bCrypto.timingSafeEqual(memberCanonical, expectedDigest)) { matchedDigest = true; break; }
+    }
+    if (!matchedDigest) {
       return { valid: false, reason: "content-digest-mismatch" };
     }
   }

package/lib/log-stream-otlp-grpc.js

@@ -38,6 +38,9 @@ var lazyRequire = require("./lazy-require");
 // scrub attribute values through the telemetry redactor before they cross the
 // OTLP egress boundary (CWE-532).
 var observability = lazyRequire(function () { return require("./observability"); });
+// Lazy — network-tls is widely required; audit an insecure (cert-validation-
+// disabled) outbound TLS session at honor time, same surface as connectWithEch.
+var networkTls = lazyRequire(function () { return require("./network-tls"); });
 
 var _err = LogStreamError.factory;
 var _log = boot("log-stream-otlp-grpc");
@@ -215,7 +218,14 @@ function _makeClient(cfg) {
   var sessionOpts = {};
   if (cfg.ca) sessionOpts.ca = cfg.ca;
   if (cfg.servername) sessionOpts.servername = cfg.servername;
-  if (cfg.allowInsecure) sessionOpts.rejectUnauthorized = false;
+  if (cfg.allowInsecure && url.protocol === "https:") {
+    // allowInsecure only has meaning on a TLS session. For an h2c endpoint
+    // (http://, cleartext HTTP/2) there is no certificate to validate and
+    // nothing to skip, so neither rejectUnauthorized nor the insecure-TLS
+    // audit applies — emitting it there would be a false security event.
+    sessionOpts.rejectUnauthorized = false;
+    networkTls().auditInsecureTls({ host: authority, source: "log-stream.otlp-grpc" });
+  }
   var session = http2.connect(authority, sessionOpts);
   session.on("error", function () { /* surfaced through request err */ });
   if (typeof session.unref === "function") session.unref();
@@ -409,6 +419,7 @@ module.exports = {
   create:                create,
   // Exposed for layer-0 tests that verify the wire encoding without
   // standing up an HTTP/2 server.
+  _makeClient:           _makeClient,
   _encodeAnyValue:       _encodeAnyValue,
   _encodeKeyValue:       _encodeKeyValue,
   _encodeLogRecord:      _encodeLogRecord,

package/lib/log-stream-syslog.js

@@ -37,6 +37,9 @@ var safeAsync = require("./safe-async");
 var safeBuffer = require("./safe-buffer");
 var safeUrl = require("./safe-url");
 var { LogStreamError } = require("./framework-error");
+var lazyRequire = require("./lazy-require");
+// Lazy — audit a cert-validation-disabled syslog/TLS session at honor time.
+var networkTls = lazyRequire(function () { return require("./network-tls"); });
 
 var _err = LogStreamError.factory;
 var log  = boot("log-stream-syslog");
@@ -223,6 +226,9 @@ function create(config) {
       });
       if (cfg.ca) tlsOpts.ca = cfg.ca;
       if (cfg.servername) tlsOpts.servername = cfg.servername;
+      if (cfg.rejectUnauthorized === false) {
+        networkTls().auditInsecureTls({ host: cfg.host, port: cfg.port, source: "log-stream.syslog" });
+      }
       sock = nodeTls.connect(tlsOpts, onConnect);
     } else {
       sock = net.connect(connectOpts, onConnect);

package/lib/log.js

@@ -464,7 +464,11 @@ function boot(name) {
     var stream = (LEVELS[levelName] >= LEVELS.warn) ? process.stderr : process.stdout;
     var isTty = !!(stream && stream.isTTY);
     if (isTty) {
-      sink(prefix + String(msg));
+      // Raw human-readable line — escape BOTH the C0/newline (line-forging)
+      // and bidi (re-ordering) control classes the create() path neutralizes,
+      // so a hostile boot message can't inject lines or re-order the visible
+      // line on a TTY / syslog reader (CWE-117 / Trojan-Source CVE-2021-42574).
+      sink(_escapeBidiControls(_escapeC0Controls(prefix + String(msg))));
       return;
     }
     var entry = {
@@ -474,7 +478,9 @@ function boot(name) {
       component: name,
       boot:      true,
     };
-    sink(JSON.stringify(entry));
+    // JSON.stringify already escapes C0/newlines; bidi/format controls survive
+    // raw into a piped aggregator, so apply the same bidi escape create() uses.
+    sink(_escapeBidiControls(JSON.stringify(entry)));
   }
 
   function debug(msg, fields) {
@@ -560,6 +566,22 @@ function _escapeBidiControls(s) {
   });
 }
 
+// C0 control chars (incl. CR / LF / TAB) + DEL — escaped to `\uXXXX` so a
+// hostile message can't forge extra log lines on a raw (non-JSON) TTY sink
+// (log-injection, CWE-117). The create() path gets this for free from
+// JSON.stringify; the boot() TTY branch writes raw text and needs it
+// explicitly. Pairs with _escapeBidiControls (which only covers the bidi set).
+var _C0_CONTROL_RE = /[\u0000-\u001f\u007f]/g;   // eslint-disable-line no-control-regex -- the C0/DEL set is what we escape
+
+function _escapeC0Controls(s) {
+  if (typeof s !== "string" || s.length === 0) return s;
+  return s.replace(_C0_CONTROL_RE, function (ch) {
+    var code = ch.charCodeAt(0).toString(16);
+    while (code.length < 4) code = "0" + code;
+    return "\\u" + code;
+  });
+}
+
 // runs before safeEnv on the boot path; safeEnv requires log, so log
 // can't go through safeEnv to read its own level.
 function _bootMinLevel() {

package/lib/mail.js

@@ -76,6 +76,8 @@ var networkDns = lazyRequire(function () { return require("./network-dns"); });
 var nodeUrl = require("node:url");
 var numericBounds = require("./numeric-bounds");
 var nodeTls = lazyRequire(function () { return require("node:tls"); });
+// Lazy — audit a cert-validation-disabled SMTP/TLS session at honor time.
+var networkTls = lazyRequire(function () { return require("./network-tls"); });
 var safeJson = require("./safe-json");
 var safeSchema = require("./safe-schema");
 var validateOpts = require("./validate-opts");
@@ -778,6 +780,9 @@ function smtpTransport(opts) {
   var port = opts.port || 587;
   var useImplicitTLS = port === 465 || opts.implicitTls === true;
   var rejectUnauthorized = opts.rejectUnauthorized !== false;
+  if (rejectUnauthorized === false) {
+    networkTls().auditInsecureTls({ host: opts.host, port: port, source: "mail.smtp" });
+  }
   var ehloName = opts.ehloName || "blamejs";
   // GHSA-c7w3-x93f-qmm8 / GHSA-vvjj-xcjg-gr5g (nodemailer CRLF-injection
   // class) — any string concatenated into an outbound SMTP wire command

package/lib/middleware/body-parser.js

@@ -375,6 +375,19 @@ function _detectSmuggling(req) {
   return null;
 }
 
+// Generic, operator-safe status phrase for a client error body — used when the
+// thrown error is NOT a framework-classified BodyParserError (or is a 5xx), so
+// an internal exception's message (fs errno + tmp path, a parse hook's thrown
+// detail) is never echoed to the client (CWE-209 / CodeQL js/stack-trace-exposure).
+var _GENERIC_REASON = {};
+_GENERIC_REASON[HTTP_STATUS.BAD_REQUEST]            = "Bad Request";
+_GENERIC_REASON[HTTP_STATUS.PAYLOAD_TOO_LARGE]      = "Payload Too Large";
+_GENERIC_REASON[HTTP_STATUS.UNSUPPORTED_MEDIA_TYPE] = "Unsupported Media Type";
+_GENERIC_REASON[HTTP_STATUS.INTERNAL_SERVER_ERROR]  = "Internal Server Error";
+function _genericReason(status) {
+  return _GENERIC_REASON[status] || (status >= 500 ? "Internal Server Error" : "Bad Request");
+}
+
 function _writeError(res, status, message, code) {
   if (res.headersSent) return;
   var body = JSON.stringify({ error: message, code: code });
@@ -469,10 +482,13 @@ async function _parseJson(req, opts) {
   }
   if (typeof opts.parseHook === "function") {
     try { parsed = opts.parseHook(parsed); }
-    catch (e) {
+    catch (_e) {
       throw new BodyParserError(
         "body-parser/json-hook",
-        "JSON parseHook failed: " + ((e && e.message) || String(e)),
+        // Operator parseHook threw — surface a fixed, safe message; the hook's
+        // own thrown detail (which may carry secrets) is the operator's to log,
+        // never echoed to the client (CWE-209).
+        "request body rejected by parse hook",
         true, HTTP_STATUS.BAD_REQUEST
       );
     }
@@ -1476,8 +1492,32 @@ function create(opts) {
       }
       var status = (e && typeof e.statusCode === "number") ? e.statusCode : HTTP_STATUS.BAD_REQUEST;
       var code   = (e && typeof e.code === "string") ? e.code : "body-parser/error";
-      var message = (e && e.message) ? e.message : String(e);
-      _writeError(res, status, message, code);
+      // Only a framework-classified 4xx BodyParserError carries a curated,
+      // operator-safe message (malformed JSON, poisoned key, smuggling). Any
+      // other thrown error — and every 5xx — gets a generic status phrase, so
+      // an internal exception (fs errno + tmp path, a parse hook's thrown
+      // secret) is never echoed to the client (CWE-209). The full diagnostic
+      // stays on the audit chain, redacted by safeEmit.
+      // Object(e) tolerates a non-object throw (throw null, or a string from
+      // an operator parse hook) without a truthiness guard on the caught
+      // binding — the caught value is always defined to CodeQL, so `e && …`
+      // reads as a dead sub-condition; this keeps the null-safety explicit.
+      var eo = Object(e);
+      var clientMessage = (eo.isBodyParserError === true && status < 500 && typeof eo.message === "string")
+        ? eo.message
+        : _genericReason(status);
+      try {
+        audit().safeEmit({
+          action:  "body-parser.error",
+          outcome: status >= 500 ? "failure" : "denied",
+          metadata: {
+            status:  status,
+            code:    code,
+            message: (e && e.message) ? String(e.message).slice(0, 256) : "",
+          },
+        });
+      } catch (_e) { /* audit best-effort — never mask the response */ }
+      _writeError(res, status, clientMessage, code);
     }
   };
 }
@@ -1501,9 +1541,11 @@ async function _parseJsonFromBuf(buf, opts) {
   }
   if (typeof opts.parseHook === "function") {
     try { parsed = opts.parseHook(parsed); }
-    catch (e) {
+    catch (_e) {
+      // Operator parseHook threw — fixed safe message; the hook's thrown
+      // detail (possible secrets) is never echoed to the client (CWE-209).
       throw new BodyParserError("body-parser/json-hook",
-        "JSON parseHook failed: " + ((e && e.message) || String(e)), true, HTTP_STATUS.BAD_REQUEST);
+        "request body rejected by parse hook", true, HTTP_STATUS.BAD_REQUEST);
     }
   }
   return parsed;

package/lib/network-dns.js

@@ -149,7 +149,7 @@ function setServers(serverList) {
     throw new DnsError("dns/setservers-failed", "dns.setServers failed: " + e.message);
   }
   _clearCache();
-  _emitObs("network.dns.servers.set", { count: serverList.length });
+  observability().safeEvent("network.dns.servers.set", 1, { count: serverList.length });
 }
 
 function getServers() {
@@ -169,7 +169,7 @@ function setResultOrder(order) {
     try { dns.setDefaultResultOrder(order); } catch (_e) { /* node may not support setter on this version — best-effort */ }
   }
   _clearCache();
-  _emitObs("network.dns.result_order.set", { order: order });
+  observability().safeEvent("network.dns.result_order.set", 1, { order: order });
 }
 
 function setFamily(fam) {
@@ -215,7 +215,7 @@ function useSystemResolver() {
   STATE.systemResolver = true;
   _resetDotPool();
   _clearCache();
-  _emitObs("network.dns.system_resolver.set", {});
+  observability().safeEvent("network.dns.system_resolver.set", 1, {});
 }
 
 function useDnsOverHttps(opts) {
@@ -246,7 +246,7 @@ function useDnsOverHttps(opts) {
   }
   STATE.doh = { url: url, method: method, ca: opts.ca || null };
   _clearCache();
-  _emitObs("network.dns.doh.set", { url: url, method: method || "auto" });
+  observability().safeEvent("network.dns.doh.set", 1, { url: url, method: method || "auto" });
 }
 
 function useDnsOverTls(opts) {
@@ -267,7 +267,7 @@ function useDnsOverTls(opts) {
   };
   _resetDotPool();
   _clearCache();
-  _emitObs("network.dns.dot.set", { host: STATE.dot.host, port: STATE.dot.port });
+  observability().safeEvent("network.dns.dot.set", 1, { host: STATE.dot.host, port: STATE.dot.port });
 }
 
 function _withTimeout(promise, ms, host) {
@@ -1178,13 +1178,13 @@ async function _querySvcbLike(host, qtype, opts) {
     throw new DnsError("dns/bad-transport",
       "dns.querySvcb: transport must be 'doh' | 'dot' | 'system' | undefined");
   }
-  _emitObs("network.dns.svcb.requested", { qtype: qtype, transport: opts.transport || "auto" });
+  observability().safeEvent("network.dns.svcb.requested", 1, { qtype: qtype, transport: opts.transport || "auto" });
   var startMs = _now();
   var reply;
   try {
     reply = await _rawQuery(host, qtype, opts.transport);
   } catch (e) {
-    _emitObs("network.dns.svcb.failure", {
+    observability().safeEvent("network.dns.svcb.failure", 1, {
       latencyMs: _now() - startMs,
       code:      e.code || "unknown",
     });
@@ -1198,7 +1198,7 @@ async function _querySvcbLike(host, qtype, opts) {
     records.push(_parseSvcbRdata(decoded.msg, ans.rdataOff, ans.rdlen));
   }
   records.sort(function (a, b) { return a.priority - b.priority; });
-  _emitObs("network.dns.svcb.success", {
+  observability().safeEvent("network.dns.svcb.success", 1, {
     latencyMs: _now() - startMs,
     count:     records.length,
     qtype:     qtype,
@@ -1322,7 +1322,7 @@ async function discoverEncrypted(opts) {
   try {
     records = await _querySvcbLike(name, DNS_QTYPE_SVCB, { transport: transport });
   } catch (e) {
-    _emitObs("network.dns.ddr.failure", {
+    observability().safeEvent("network.dns.ddr.failure", 1, {
       latencyMs: _now() - startMs,
       code:      e.code || "unknown",
     });
@@ -1333,7 +1333,7 @@ async function discoverEncrypted(opts) {
     throw e;
   }
   if (records.length === 0) {
-    _emitObs("network.dns.ddr.empty", { latencyMs: _now() - startMs });
+    observability().safeEvent("network.dns.ddr.empty", 1, { latencyMs: _now() - startMs });
     throw new DnsError("dns/ddr-not-discovered",
       "dns.discoverEncrypted: resolver returned empty DDR record set at " + name);
   }
@@ -1364,7 +1364,7 @@ async function discoverEncrypted(opts) {
     throw new DnsError("dns/ddr-not-discovered",
       "dns.discoverEncrypted: DDR records present but none advertised a recognized transport (alpn=dot/h2/h3)");
   }
-  _emitObs("network.dns.ddr.success", {
+  observability().safeEvent("network.dns.ddr.success", 1, {
     latencyMs: _now() - startMs,
     count:     resolvers.length,
   });
@@ -1454,7 +1454,7 @@ function useDesignatedResolvers(list) {
         });
       }
       _designatedResolvers = validated.slice();
-      _emitObs("network.dns.dnr.set", {
+      observability().safeEvent("network.dns.dnr.set", 1, {
         count:     validated.length,
         active:    j,
         transport: v.transport,
@@ -1462,7 +1462,7 @@ function useDesignatedResolvers(list) {
       return { active: j, count: validated.length };
     } catch (e) {
       lastErr = e;
-      _emitObs("network.dns.dnr.entry_failed", {
+      observability().safeEvent("network.dns.dnr.entry_failed", 1, {
         index:     j,
         transport: v.transport,
         code:      e.code || "unknown",
@@ -1511,7 +1511,7 @@ async function lookup(host, opts) {
     if (cached.error) throw cached.error;
     return opts.all ? cached.value : cached.value[0];
   }
-  _emitObs("network.dns.lookup.requested", { family: cacheKey });
+  observability().safeEvent("network.dns.lookup.requested", 1, { family: cacheKey });
   var startMs = _now();
   // Resolve secure-DNS default on first use. Idempotent.
   _ensureSecureDefault();
@@ -1546,11 +1546,11 @@ async function lookup(host, opts) {
       throw new DnsError("dns/no-result", "dns lookup of '" + host + "' returned no addresses");
     }
     _cachePutPositive(host, cacheKey, normalized);
-    _emitObs("network.dns.lookup.success", { latencyMs: _now() - startMs, count: normalized.length });
+    observability().safeEvent("network.dns.lookup.success", 1, { latencyMs: _now() - startMs, count: normalized.length });
     return opts.all ? normalized : normalized[0];
   } catch (e) {
     _cachePutNegative(host, cacheKey, e);
-    _emitObs("network.dns.lookup.failure", { latencyMs: _now() - startMs, code: e.code || "unknown" });
+    observability().safeEvent("network.dns.lookup.failure", 1, { latencyMs: _now() - startMs, code: e.code || "unknown" });
     throw e;
   }
 }
@@ -1571,7 +1571,7 @@ async function _resolveProtocol(host, family, opts) {
     throw new DnsError("dns/bad-transport",
       "dns.resolve" + family + ": transport must be 'doh' | 'dot' | 'system' | undefined");
   }
-  _emitObs("network.dns.resolve.requested", { family: family, transport: opts.transport || "auto" });
+  observability().safeEvent("network.dns.resolve.requested", 1, { family: family, transport: opts.transport || "auto" });
   var startMs = _now();
   try {
     var addrs;
@@ -1597,10 +1597,10 @@ async function _resolveProtocol(host, family, opts) {
     if (normalized.length === 0) {
       throw new DnsError("dns/no-result", "dns.resolve" + family + " of '" + host + "' returned no addresses");
     }
-    _emitObs("network.dns.resolve.success", { family: family, latencyMs: _now() - startMs, count: normalized.length });
+    observability().safeEvent("network.dns.resolve.success", 1, { family: family, latencyMs: _now() - startMs, count: normalized.length });
     return normalized;
   } catch (e) {
-    _emitObs("network.dns.resolve.failure", { family: family, latencyMs: _now() - startMs, code: e.code || "unknown" });
+    observability().safeEvent("network.dns.resolve.failure", 1, { family: family, latencyMs: _now() - startMs, code: e.code || "unknown" });
     if (e instanceof DnsError) throw e;
     throw new DnsError("dns/resolve-failed",
       "dns.resolve" + family + " of '" + host + "' failed: " + (e.message || String(e)));
@@ -1643,16 +1643,16 @@ async function reverse(ip) {
     throw new DnsError("dns/bad-ip",
       "dns.reverse: '" + ip + "' is not a valid IPv4 or IPv6 address");
   }
-  _emitObs("network.dns.reverse.requested", { family: net.isIPv6(ip) ? 6 : 4 });
+  observability().safeEvent("network.dns.reverse.requested", 1, { family: net.isIPv6(ip) ? 6 : 4 });
   var startMs = _now();
   try {
     var ptrs = await _withTimeout(dnsPromises.reverse(ip), STATE.lookupTimeoutMs, ip);
-    _emitObs("network.dns.reverse.success", {
+    observability().safeEvent("network.dns.reverse.success", 1, {
       latencyMs: _now() - startMs, count: Array.isArray(ptrs) ? ptrs.length : 0,
     });
     return Array.isArray(ptrs) ? ptrs : [];
   } catch (e) {
-    _emitObs("network.dns.reverse.failure", {
+    observability().safeEvent("network.dns.reverse.failure", 1, {
       latencyMs: _now() - startMs, code: e.code || "unknown",
     });
     if (e instanceof DnsError) throw e;
@@ -1674,10 +1674,6 @@ function nodeLookup(host, options, callback) {
   );
 }
 
-function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 function _stateForTest() { return STATE; }
 function _resetForTest() {
   STATE.servers = null; STATE.resultOrder = null; STATE.family = 0;

package/lib/network-heartbeat.js

@@ -259,7 +259,7 @@ function statuses() {
 
 function _emitObsProbe(entry, result) {
   try {
-    observability().emit("network.heartbeat.probe", {
+    observability().safeEvent("network.heartbeat.probe", 1, {
       name:      entry.target.name,
       type:      entry.target.type,
       ok:        result.ok,
@@ -381,7 +381,7 @@ function passive(opts) {
 
 function _emitObsPong(state) {
   try {
-    observability().emit("network.heartbeat.passive.pong", {
+    observability().safeEvent("network.heartbeat.passive.pong", 1, {
       pongCount:  state.pongCount,
       timeoutMs:  state.timeoutMs,
     });
@@ -390,7 +390,7 @@ function _emitObsPong(state) {
 
 function _emitObsTimeout(state) {
   try {
-    observability().emit("network.heartbeat.passive.timeout", {
+    observability().safeEvent("network.heartbeat.passive.timeout", 1, {
       pongCount:  state.pongCount,
       lastPongMs: state.lastPongMs,
       timeoutMs:  state.timeoutMs,

package/lib/network-proxy.js

@@ -70,7 +70,7 @@ function set(opts) {
   if (opts.no !== undefined)    STATE.noProxy = _parseNoProxy(opts.no);
   if (opts.auth !== undefined)  STATE.auth = opts.auth ? _parseAuth(opts.auth) : null;
   STATE.agentCache.clear();
-  _emitObs("network.proxy.set", {
+  observability().safeEvent("network.proxy.set", 1, {
     httpSet:  !!STATE.http,
     httpsSet: !!STATE.https,
     noProxyCount: STATE.noProxy.length,
@@ -93,7 +93,7 @@ function fromEnv(envObj) {
   if (authEnv)    { STATE.auth = _parseAuth(authEnv);         changed = true; }
   if (changed) {
     STATE.agentCache.clear();
-    _emitObs("network.proxy.from_env", {
+    observability().safeEvent("network.proxy.from_env", 1, {
       httpSet:  !!STATE.http,
       httpsSet: !!STATE.https,
       noProxyCount: STATE.noProxy.length,
@@ -255,7 +255,7 @@ function agentFor(targetUrl) {
     };
   }
   STATE.agentCache.set(key, agent);
-  _emitObs("network.proxy.agent.created", { protocol: u.protocol });
+  observability().safeEvent("network.proxy.agent.created", 1, { protocol: u.protocol });
   return agent;
 }
 
@@ -268,10 +268,6 @@ function snapshot() {
   };
 }
 
-function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 function _resetForTest() {
   STATE.http = null; STATE.https = null; STATE.noProxy = []; STATE.auth = null;
   STATE.agentCache.clear();

package/lib/network-tls.js

@@ -23,6 +23,29 @@ var networkDns = lazyRequire(function () { return require("./network-dns"); });
 var httpClient = lazyRequire(function () { return require("./http-client"); });
 var asn1 = require("./asn1-der");
 
+// Audit + observability emit for an outbound TLS connection that runs with
+// peer-certificate validation DISABLED (an explicit operator opt-in —
+// rejectUnauthorized:false / allowInsecure — never a framework default).
+// Emitted at the point the disable is HONORED so the degraded posture is
+// observable (compliance evidence + incident response), parallel to the
+// tls.classical_downgrade audit. Drop-silent best-effort (§8 hot-path sink) —
+// an audit-sink failure must never break the TLS connect itself.
+function auditInsecureTls(meta) {
+  meta = meta || {};
+  try {
+    observability().safeEvent("tls.insecure_skip_verify", 1, {
+      host: meta.host || null, port: meta.port || null, source: meta.source || null,
+    });
+  } catch (_e) { /* drop-silent */ }
+  try {
+    audit().safeEmit({
+      action:  "tls.insecure_skip_verify",
+      outcome: "success",
+      metadata: { host: meta.host || null, port: meta.port || null, source: meta.source || null },
+    });
+  } catch (_e) { /* drop-silent — audit best-effort, never break TLS */ }
+}
+
 // STATE.tlsKeyShares is initialized to the default PQC group list at
 // module load — operator setKeyShares() overrides; resetKeyShares()
 // restores the default. Empty array means "fall back to Node's TLS
@@ -144,7 +167,7 @@ function addCa(pemOrPath, opts) {
     added.push(meta);
   }
   _emitAuditAdd(added, opts);
-  _emitObs("network.tls.ca.added", { count: added.length });
+  observability().safeEvent("network.tls.ca.added", 1, { count: added.length });
   return added;
 }
 
@@ -154,7 +177,7 @@ function addCaBundle(p, opts) {
 
 function useSystemTrust(enable) {
   STATE.systemTrust = enable !== false;
-  _emitObs("network.tls.system_trust.set", { enabled: STATE.systemTrust });
+  observability().safeEvent("network.tls.system_trust.set", 1, { enabled: STATE.systemTrust });
 }
 
 function isSystemTrustEnabled() { return !!STATE.systemTrust; }
@@ -216,7 +239,7 @@ function removeCa(fingerprint256, opts) {
   });
   if (removed.length === 0) return 0;
   if (!opts || opts.audit !== false) _emitAuditRemove(removed, "operator-remove");
-  _emitObs("network.tls.ca.removed", { count: removed.length, reason: "operator" });
+  observability().safeEvent("network.tls.ca.removed", 1, { count: removed.length, reason: "operator" });
   return removed.length;
 }
 
@@ -234,7 +257,7 @@ function removeCaByLabel(label, opts) {
   });
   if (removed.length === 0) return 0;
   if (!opts || opts.audit !== false) _emitAuditRemove(removed, "operator-remove-by-label");
-  _emitObs("network.tls.ca.removed", { count: removed.length, reason: "label" });
+  observability().safeEvent("network.tls.ca.removed", 1, { count: removed.length, reason: "label" });
   return removed.length;
 }
 
@@ -243,7 +266,7 @@ function clearAll(opts) {
   var removed = STATE.cas.map(function (e) { return Object.assign({ label: e.label }, e.meta); });
   STATE.cas = [];
   if (!opts || opts.audit !== false) _emitAuditRemove(removed, "operator-clear-all");
-  _emitObs("network.tls.ca.cleared", { count: removed.length });
+  observability().safeEvent("network.tls.ca.cleared", 1, { count: removed.length });
   return removed.length;
 }
 
@@ -260,7 +283,7 @@ function purgeExpired(opts) {
   });
   if (removed.length === 0) return 0;
   if (!opts || opts.audit !== false) _emitAuditRemove(removed, "expired");
-  _emitObs("network.tls.ca.purged_expired", { count: removed.length });
+  observability().safeEvent("network.tls.ca.purged_expired", 1, { count: removed.length });
   return removed.length;
 }
 
@@ -705,10 +728,6 @@ function _emitAuditAdd(metaList, opts) {
   }
 }
 
-function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 function _resetForTest() {
   STATE.cas = [];
   STATE.systemTrust = false;
@@ -2725,6 +2744,7 @@ function connectWithEch(opts) {
       }
       if (opts.rejectUnauthorized === false) {
         connectOpts.rejectUnauthorized = false;
+        auditInsecureTls({ host: opts.host, port: port, source: "network.tls.connectWithEch" });
       }
       var echAttached = false;
       if (echConfigBuf && nodeSupportsEch) {
@@ -2735,7 +2755,7 @@ function connectWithEch(opts) {
         // gracefully with a one-shot warn so operators know they're
         // sending an outer-only ClientHello.
         try {
-          observability().emit("network.tls.ech.unsupported", {
+          observability().safeEvent("network.tls.ech.unsupported", 1, {
             host: opts.host, source: sourceLabel,
           });
         } catch (_e) { /* drop-silent */ }
@@ -2772,7 +2792,7 @@ function connectWithEch(opts) {
         settled = true;
         if (to) clearTimeout(to);
         try {
-          observability().emit("network.tls.ech.connected", {
+          observability().safeEvent("network.tls.ech.connected", 1, {
             host: opts.host, echAttached: echAttached, source: sourceLabel,
           });
         } catch (_e) { /* drop-silent */ }
@@ -2832,7 +2852,7 @@ function connectWithEch(opts) {
       // operator still gets a working TLS session. Emit obs so the
       // operator sees the degradation.
       try {
-        observability().emit("network.tls.ech.dns_failed", {
+        observability().safeEvent("network.tls.ech.dns_failed", 1, {
           host: opts.host, error: (e && e.message) || String(e),
         });
       } catch (_e) { /* drop-silent */ }
@@ -3174,6 +3194,7 @@ function wrapSNICallback(operatorCb) {
 }
 
 module.exports = {
+  auditInsecureTls:    auditInsecureTls,
   addCa:               addCa,
   addCaBundle:         addCaBundle,
   removeCa:            removeCa,

package/lib/network.js

@@ -151,7 +151,7 @@ var ntpFacade = {
       throw new NetworkError("ntp/bad-servers", "ntp.setServers: expected non-empty array");
     }
     ntpFacade._defaultServers = list.slice();
-    _emitObs("network.ntp.servers.set", { count: list.length });
+    observability().safeEvent("network.ntp.servers.set", 1, { count: list.length });
   },
   getServers:     function () {
     return (ntpFacade._defaultServers || ntpCheck.DEFAULT_SERVERS).slice();
@@ -262,7 +262,7 @@ function bootFromEnv(opts) {
       } catch (_e) { /* audit best-effort — never break boot */ }
     }
   }
-  _emitObs("network.boot.from_env", { source: "env" });
+  observability().safeEvent("network.boot.from_env", 1, { source: "env" });
   return applied;
 }
 
@@ -301,10 +301,6 @@ function snapshot() {
   };
 }
 
-function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 function _resetForTest() {
   ntpFacade._defaultServers = null;
   ntpFacade._defaultTimeoutMs = null;

package/lib/notify.js

@@ -408,11 +408,6 @@ function create(opts) {
     channels[n] = registry;
   }
 
-  function _emitObs(name, labels) {
-    try { observability().event(name, 1, labels || {}); }
-    catch (_e) { /* drop-silent — observability sink must not crash send() */ }
-  }
-
   var _emitAudit = validateOpts.makeAuditEmitter(audit);
 
   function _actor(callerOpts) {
@@ -465,7 +460,7 @@ function create(opts) {
     // mechanism — no double-retry inside the breaker or transport).
     async function _oneAttempt(attemptIdx) {
       attemptCount = attemptIdx;
-      _emitObs("notify.send.attempt", { channel: channel, attempt: attemptIdx });
+      observability().safeEvent("notify.send.attempt", 1, { channel: channel, attempt: attemptIdx });
       var sendPromise = entry.transport.send(message, input.sendOpts || null);
       // withTimeout from b.safeAsync — never re-implement timer races.
       var timed = (perCallTimeoutMs > 0)
@@ -478,7 +473,7 @@ function create(opts) {
         // classifies it correctly (operators can still opt OUT by setting
         // err.permanent in their transport).
         if (e && e.code === "async/timeout") {
-          _emitObs("notify.send.timeout", { channel: channel });
+          observability().safeEvent("notify.send.timeout", 1, { channel: channel });
           var te = _err("TIMEOUT",
             "notify.send: '" + channel + "' transport timed out after " + perCallTimeoutMs + "ms");
           // Mark transient via a NETWORK-style code so b.retry.isRetryable
@@ -497,7 +492,7 @@ function create(opts) {
           return await entry.breaker.wrap(function () { return _oneAttempt(attemptIdx); });
         } catch (e) {
           if (e && e.code === "CIRCUIT_OPEN") {
-            _emitObs("notify.send.breaker.open", { channel: channel });
+            observability().safeEvent("notify.send.breaker.open", 1, { channel: channel });
           }
           throw e;
         }
@@ -524,7 +519,7 @@ function create(opts) {
         }, perCallRetry);
 
         var durationMs = clock() - startedAt;
-        _emitObs("notify.send.success", { channel: channel, durationMs: durationMs });
+        observability().safeEvent("notify.send.success", 1, { channel: channel, durationMs: durationMs });
         if (auditSuccess) {
           _emitAudit("notify.send.success", {
             actor:    _actor(input),
@@ -543,7 +538,7 @@ function create(opts) {
           durationMs: durationMs,
         });
       } catch (e) {
-        _emitObs("notify.send.failure", {
+        observability().safeEvent("notify.send.failure", 1, {
           channel: channel,
           reason:  (e && e.code) || "unknown",
         });
@@ -594,7 +589,7 @@ function create(opts) {
       if (results[i] && results[i].isNotifyError) failed++;
       else ok++;
     }
-    _emitObs("notify.batch", { size: inputs.length, ok: ok, failed: failed });
+    observability().safeEvent("notify.batch", 1, { size: inputs.length, ok: ok, failed: failed });
     return results;
   }
 
@@ -626,7 +621,7 @@ function create(opts) {
       } catch (_e) { /* operator may register their own handler */ }
     }
     var jobId = await q.enqueue(queueName, input);
-    _emitObs("notify.queue.enqueued", { channel: input.channel, queueName: queueName });
+    observability().safeEvent("notify.queue.enqueued", 1, { channel: input.channel, queueName: queueName });
     return { jobId: jobId };
   }
 

package/lib/seeders.js

@@ -438,11 +438,6 @@ function create(opts) {
   var audit = opts.audit || null;
   var clock = opts.clock || function () { return Date.now(); };
 
-  function _emitObs(name, labels) {
-    try { observability().event(name, 1, labels || {}); }
-    catch (_e) { /* drop-silent — observability sink must not crash seeders */ }
-  }
-
   var _emitAudit = validateOpts.makeAuditEmitter(audit);
 
   function _actor(callerOpts) {
@@ -512,7 +507,7 @@ function create(opts) {
     }
 
     var startedAt = clock();
-    _emitObs("seeders.run.start", { env: env, count: loaded.ordered.length });
+    observability().safeEvent("seeders.run.start", 1, { env: env, count: loaded.ordered.length });
 
     var holder = _acquireLock(db, lockStaleAfterMs, clock);
     try {
@@ -538,7 +533,7 @@ function create(opts) {
 
         if (!shouldRun) {
           skipped.push(name);
-          _emitObs("seeders.skipped", { env: env, name: name, reason: "already-applied" });
+          observability().safeEvent("seeders.skipped", 1, { env: env, name: name, reason: "already-applied" });
           continue;
         }
 
@@ -585,7 +580,7 @@ function create(opts) {
 
           var auditAction = (alreadyApplied && force) ? "seeders.force_applied" : "seeders.applied";
           var auditEvt = { env: env, name: name };
-          _emitObs(auditAction, auditEvt);
+          observability().safeEvent(auditAction, 1, auditEvt);
           if (auditApplied) {
             _emitAudit(auditAction, {
               actor:    _actor(callerOpts),
@@ -598,7 +593,7 @@ function create(opts) {
           failed = name;
           var msg = (e && e.message) || String(e);
           var code = (e && e.code) || "RUN_FAILED";
-          _emitObs("seeders.failed", { env: env, name: name });
+          observability().safeEvent("seeders.failed", 1, { env: env, name: name });
           if (auditFailures) {
             _emitAudit("seeders.failed", {
               actor:    _actor(callerOpts),
@@ -622,7 +617,7 @@ function create(opts) {
         failed:     failed,
         durationMs: clock() - startedAt,
       };
-      _emitObs("seeders.run.completed", {
+      observability().safeEvent("seeders.run.completed", 1, {
         env:        env,
         applied:    applied.length,
         skipped:    skipped.length,

package/lib/structured-fields.js

@@ -204,7 +204,43 @@ function unquoteSfString(s) {
   if (t.length === 0) return "";
   if (t.charAt(0) !== "\"") return t;
   if (t.length < 2 || t.charAt(t.length - 1) !== "\"") return null;
-  return t.slice(1, -1).replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
+  return unescapeSfStringBody(t.slice(1, -1));
+}
+
+/**
+ * @primitive b.structuredFields.unescapeSfStringBody
+ * @signature b.structuredFields.unescapeSfStringBody(body)
+ * @since      0.15.12
+ * @related    b.structuredFields.unquoteSfString
+ *
+ * Undo the RFC 8941 §3.3.3 quoted-string backslash-escapes from the BODY of
+ * an sf-string (the bytes BETWEEN the surrounding double quotes). Only `\\\\`
+ * and `\\"` are legal escapes; every other backslash is literal.
+ *
+ * This is a single left-to-right scan, NOT two chained `.replace()` passes.
+ * The two-pass form (`.replace(/\\\\/g,"\\").replace(/\\"/g,'"')`, in either
+ * order) is not equivalent to a single decode: whichever pass runs first can
+ * rewrite a backslash the other escape sequence legitimately owns, so a lone
+ * escaped backslash (`\\\\`) decodes to two backslashes instead of one. The
+ * single pass consumes each escape exactly once. Non-string input passes
+ * through unchanged.
+ *
+ * @example
+ *   b.structuredFields.unescapeSfStringBody('a\\"b\\\\c');
+ *   // → 'a"b\c'
+ */
+function unescapeSfStringBody(body) {
+  if (typeof body !== "string") return body;
+  var out = "";
+  for (var i = 0; i < body.length; i++) {
+    var c = body.charAt(i);
+    if (c === "\\" && i + 1 < body.length) {
+      var n = body.charAt(i + 1);
+      if (n === "\\" || n === "\"") { out += n; i += 1; continue; }
+    }
+    out += c;
+  }
+  return out;
 }
 
 /**
@@ -674,6 +710,7 @@ module.exports = {
   refuseControlBytes:   refuseControlBytes,
   containsControlBytes: containsControlBytes,
   unquoteSfString:      unquoteSfString,
+  unescapeSfStringBody: unescapeSfStringBody,
   parse:                parse,
   serialize:            serialize,
   Token:                SfToken,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.11",
+  "version": "0.15.12",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:693c533d-2a9b-43e7-93e5-01669defbb95",
+  "serialNumber": "urn:uuid:caf34b84-1358-4d28-a517-e360819dc35a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-14T07:19:57.070Z",
+    "timestamp": "2026-06-14T16:52:10.733Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.11",
+      "bom-ref": "@blamejs/core@0.15.12",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.11",
+      "version": "0.15.12",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.11",
+      "purl": "pkg:npm/%40blamejs/core@0.15.12",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.11",
+      "ref": "@blamejs/core@0.15.12",
       "dependsOn": []
     }
   ]