@blamejs/core 0.15.11 → 0.15.13

package/lib/jobs.js

@@ -77,6 +77,7 @@ var { boot } = require("./log");
 var queue = require("./queue");
 var validateOpts = require("./validate-opts");
 var { JobsError } = require("./framework-error");
+var boundedMap = require("./bounded-map");
 
 var log = boot("jobs");
 
@@ -102,10 +103,10 @@ function create(opts) {
     if (typeof handler !== "function") {
       throw _err("INVALID_HANDLER", "jobs.define: handler must be a function", true);
     }
-    if (registry.has(name)) {
+    boundedMap.requireAbsent(registry, name, function () {
       throw _err("DUPLICATE_NAME",
         "jobs.define: '" + name + "' is already defined", true);
-    }
+    });
     if (started) {
       // Defining after start would mean the new handler doesn't run
       // until the next start cycle. Reject loudly so operators don't

package/lib/keychain.js

@@ -242,24 +242,12 @@ async function _writeFile(fallbackFile, doc, passphrase) {
 // Drain a stream into a Buffer, honoring an upper byte cap so a
 // runaway tool can't OOM the framework.
 function _drain(stream, capBytes) {
-  return new Promise(function (resolve, reject) {
-    if (!stream) { resolve(Buffer.alloc(0)); return; }
-    var collector = safeBuffer.boundedChunkCollector({
-      maxBytes:    capBytes,
-      errorClass:  KeychainError,
-      sizeCode:    "keychain/native-output-too-large",
-      sizeMessage: "native tool output exceeded " + capBytes + " bytes",
-    });
-    stream.on("data", function (chunk) {
-      try {
-        collector.push(chunk);
-      } catch (e) {
-        try { stream.destroy(); } catch (_e) { /* destroy best-effort */ }
-        reject(e);
-      }
-    });
-    stream.on("end",   function () { resolve(collector.result()); });
-    stream.on("error", function (e) { reject(e); });
+  if (!stream) return Promise.resolve(Buffer.alloc(0));
+  return safeBuffer.collectStream(stream, {
+    maxBytes:    capBytes,
+    errorClass:  KeychainError,
+    sizeCode:    "keychain/native-output-too-large",
+    sizeMessage: "native tool output exceeded " + capBytes + " bytes",
   });
 }
 

package/lib/legal-hold.js

@@ -60,7 +60,6 @@
  * on policy denials (already-held / not-held / invalid-citation).
  */
 var bCrypto = require("./crypto");
-var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var sql = require("./sql");
@@ -77,7 +76,7 @@ var { defineClass } = require("./framework-error");
 var HOLD_TABLE = "_blamejs_legal_hold";   // allow:hand-rolled-sql — canonical local table-name; passed to b.sql with quoteName
 var AUDIT_TABLE = "audit_log";
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var LegalHoldError = defineClass("LegalHoldError", { alwaysPermanent: true });
 var _err = LegalHoldError.factory;
@@ -151,19 +150,11 @@ function create(opts) {
   validateOpts.optionalObjectWithMethod(opts.signWith, "sign",
     "create: opts.signWith", LegalHoldError, "BAD_OPT", "b.auditSign-shaped object");
 
-  function _emit(action, info, outcome) {
-    if (!auditOn) return;
-    var sink = auditInstance || audit();
-    try {
-      sink.safeEmit({
-        action:   action,
-        outcome:  outcome,
-        resource: { kind: "legal-hold", id: info && info.subjectId },
-        reason:   (info && info.reason) || null,
-        metadata: info || {},
-      });
-    } catch (_e) { /* best-effort */ }
-  }
+  var _emit = auditEmit.gatedReasonEmitter({
+    audit: auditOn,
+    sink:  auditInstance,
+    extra: function (info) { return { resource: { kind: "legal-hold", id: info && info.subjectId } }; },
+  });
 
   function _ensureSchema() {
     // Idempotent migration. The framework SQLite path installs the

package/lib/log-stream-cloudwatch.js

@@ -198,20 +198,9 @@ function create(config) {
       "ResourceAlreadyExistsException treated as success).");
   }
   var cfg = Object.assign({}, DEFAULTS, config);
-  var onDrop = typeof cfg.onDrop === "function" ? cfg.onDrop : null;
-  var _emitDrop = safeAsync.makeDropCallback(onDrop);
-  var buffer = [];
-  var dropCount = 0;
-  var inFlight = false;
-  var closed = false;
   var sequenceToken = null;
-  // Captures the in-flight drain (the IIFE inside _flush) so close() can await
-  // the actual run before flipping `closed` — otherwise the _flush while-loop's
-  // `&& !closed` bails and buffered records are stranded at shutdown.
-  var inFlightPromise = null;
-  var flushScheduler = safeAsync.makeScheduledFlush(cfg.maxBatchAgeMs, function () { return _flush(); });
 
-  function _takeBatch() {
+  function _takeBatch(buffer) {
     var batch = [];
     var totalBytes = 0;
     while (buffer.length > 0) {
@@ -239,45 +228,25 @@ function create(config) {
     return autoCreatePromise;
   }
 
-  async function _flush() {
-    if (inFlight) return inFlightPromise;
-    if (buffer.length === 0) return;
-    inFlight = true;
-    inFlightPromise = (async function () {
-      try {
-        try { await _ensureAutoCreated(); }
-        catch (acErr) {
-          // autoCreate failure is permanent — every subsequent batch
-          // would hit the same error. Drop the queue with the
-          // operator-supplied onDrop callback so they see exactly which
-          // events were lost AND why, then bail.
-          var allBuffered = buffer.splice(0, buffer.length);
-          dropCount += allBuffered.length;
-          _emitDrop("autocreate-failed", allBuffered, acErr);
-          return;
-        }
-        while (buffer.length > 0 && !closed) {
-          var batch = _takeBatch();
-          if (batch.length === 0) break;
-          try {
-            await retryHelper.withRetry(function () {
-              return _send(batch);
-            }, Object.assign({
-              isPermanent: _isPermanentAwsError,
-            }, cfg.retry || {}));
-          } catch (e) {
-            dropCount += batch.length;
-            _emitDrop("retry-exhausted", batch, e);
-            break;
-          }
-        }
-      } finally {
-        inFlight = false;
-        inFlightPromise = null;
-        if (buffer.length > 0) flushScheduler.schedule();
-      }
-    })();
-    return inFlightPromise;
+  // CloudWatch rejects any single event above its 256 KiB hard cap — drop it
+  // (with a truncated preview) before it can poison a batch; otherwise build
+  // the { timestamp, message } event the API expects.
+  function _prepareRecord(record) {
+    var message = typeof record.message === "string" ? record.message : JSON.stringify(record);
+    var size = _eventByteSize(message);
+    if (size > CW_MAX_EVENT_BYTES) {
+      return {
+        rejected: true,
+        reason:   "event too large",
+        dropKind: "event-too-large",
+        drop: [{
+          timestamp: record.ts || Date.now(),
+          message:   message.slice(0, DROP_PREVIEW_BYTES) + "...[truncated for drop event]",
+        }],
+        error: new Error("event exceeds 256 KiB CloudWatch hard cap (was " + size + " bytes)"),
+      };
+    }
+    return { entry: { timestamp: record.ts || Date.now(), message: message } };
   }
 
   async function _send(batch) {
@@ -306,70 +275,33 @@ function create(config) {
     return res;
   }
 
-  function emit(record) {
-    if (closed) return Promise.resolve({ accepted: false, reason: "sink closed" });
-    var message;
-    if (typeof record.message === "string") {
-      message = record.message;
-    } else {
-      message = JSON.stringify(record);
-    }
-    var size = _eventByteSize(message);
-    if (size > CW_MAX_EVENT_BYTES) {
-      _emitDrop("event-too-large", [{
-        timestamp: record.ts || Date.now(),
-        message:   message.slice(0, DROP_PREVIEW_BYTES) + "...[truncated for drop event]",
-      }], new Error("event exceeds 256 KiB CloudWatch hard cap (was " + size + " bytes)"));
-      dropCount += 1;
-      return Promise.resolve({ accepted: false, reason: "event too large" });
-    }
-    if (buffer.length >= cfg.bufferLimit) {
-      var dropped = buffer.shift();
-      dropCount += 1;
-      _emitDrop("overflow", [dropped], null);
-    }
-    buffer.push({
-      timestamp: record.ts || Date.now(),
-      message:   message,
-    });
-    if (buffer.length >= cfg.batchSize) {
-      _flush().catch(function () {});
-    } else {
-      flushScheduler.schedule();
-    }
-    return Promise.resolve({ accepted: true, queued: buffer.length });
-  }
-
-  async function close() {
-    // Drain BEFORE flipping closed=true — _flush()'s `while (... && !closed)`
-    // loop bails on !closed, so flipping the flag first strands the records the
-    // operator queued just before shutdown (the b.logStream drain contract).
-    // Stop the timer, await any in-flight drain, drain the remainder, THEN
-    // refuse new enqueues. Mirrors the webhook sink.
-    flushScheduler.cancel();
-    if (inFlightPromise) {
-      try { await inFlightPromise; } catch (_e) { /* surfaced via onDrop */ }
-    }
-    await _flush();
-    closed = true;
-  }
-
-  function stats() {
-    return {
-      queued:        buffer.length,
-      dropped:       dropCount,
-      inFlight:      inFlight,
-      sequenceToken: sequenceToken,
-      endpoint:      _resolveEndpoint(cfg),
-    };
-  }
+  // beforeDrain runs the autoCreate handshake once; its failure is permanent
+  // (every batch would hit the same error) so the whole buffer is dropped under
+  // "autocreate-failed". takeBatch enforces CloudWatch's per-batch byte + count
+  // caps; sendBatch wraps the signed PutLogEvents in retry, treating throttling
+  // / sequence-token errors per _isPermanentAwsError.
+  var sink = safeAsync.makeBatchingSink({
+    batchSize:           cfg.batchSize,
+    bufferLimit:         cfg.bufferLimit,
+    maxBatchAgeMs:       cfg.maxBatchAgeMs,
+    onDrop:              cfg.onDrop,
+    prepareRecord:       _prepareRecord,
+    takeBatch:           _takeBatch,
+    beforeDrain:         _ensureAutoCreated,
+    beforeDrainDropKind: "autocreate-failed",
+    sendBatch:           function (batch) {
+      return retryHelper.withRetry(function () {
+        return _send(batch);
+      }, Object.assign({ isPermanent: _isPermanentAwsError }, cfg.retry || {}));
+    },
+  });
 
   return {
     protocol: "cloudwatch",
-    emit:     emit,
-    close:    close,
-    stats:    stats,
-    flush:    _flush,
+    emit:     sink.emit,
+    close:    sink.close,
+    stats:    function () { return sink.stats({ sequenceToken: sequenceToken, endpoint: _resolveEndpoint(cfg) }); },
+    flush:    sink.flush,
   };
 }
 

package/lib/log-stream-otlp-grpc.js

@@ -38,6 +38,9 @@ var lazyRequire = require("./lazy-require");
 // scrub attribute values through the telemetry redactor before they cross the
 // OTLP egress boundary (CWE-532).
 var observability = lazyRequire(function () { return require("./observability"); });
+// Lazy — network-tls is widely required; audit an insecure (cert-validation-
+// disabled) outbound TLS session at honor time, same surface as connectWithEch.
+var networkTls = lazyRequire(function () { return require("./network-tls"); });
 
 var _err = LogStreamError.factory;
 var _log = boot("log-stream-otlp-grpc");
@@ -215,7 +218,17 @@ function _makeClient(cfg) {
   var sessionOpts = {};
   if (cfg.ca) sessionOpts.ca = cfg.ca;
   if (cfg.servername) sessionOpts.servername = cfg.servername;
-  if (cfg.allowInsecure) sessionOpts.rejectUnauthorized = false;
+  if (cfg.allowInsecure && url.protocol === "https:") {
+    // allowInsecure only has meaning on a TLS session. For an h2c endpoint
+    // (http://, cleartext HTTP/2) there is no certificate to validate and
+    // nothing to skip, so neither rejectUnauthorized nor the insecure-TLS
+    // audit applies — emitting it there would be a false security event.
+    // Operator-governed (not a hardcoded literal): cfg.allowInsecure is true in
+    // this branch, so this resolves to false — but derived from the operator's
+    // own flag, audited, and never a framework default.
+    sessionOpts.rejectUnauthorized = !cfg.allowInsecure;
+    networkTls().auditInsecureTls({ host: authority, source: "log-stream.otlp-grpc" });
+  }
   var session = http2.connect(authority, sessionOpts);
   session.on("error", function () { /* surfaced through request err */ });
   if (typeof session.unref === "function") session.unref();
@@ -347,24 +360,24 @@ function create(config) {
     }
   }
 
+  // Fire-and-forget enqueue: full batch drains immediately (not awaited —
+  // emit is hot-path), partial batch coalesces via the scheduler. Errors
+  // surface through onDrop. No dropCount here — gRPC drop accounting is the
+  // export stream's concern, not the buffer's.
+  var _enqueue = safeAsync.makeBufferedEnqueue(buffer, {
+    batchSize:   cfg.batchSize,
+    bufferLimit: cfg.bufferLimit,
+    flush:       _flush,
+    schedule:    flushScheduler.schedule,
+    onOverflow:  function (dropped) { _emitDrop("overflow", [dropped], null); },
+  });
+
   function emit(record) {
     if (closed) {
       _emitDrop("sink-closed", [record], null);
       return Promise.resolve({ accepted: false, reason: "closed" });
     }
-    if (buffer.length >= cfg.bufferLimit) {
-      var dropped = buffer.shift();
-      _emitDrop("overflow", [dropped], null);
-    }
-    buffer.push(record);
-    if (buffer.length >= cfg.batchSize) {
-      // Drain immediately; don't await — emit is fire-and-forget on the
-      // hot path. Errors surface via onDrop.
-      _flush().catch(function () {});
-    } else if (!closed) {
-      flushScheduler.schedule();
-    }
-    return Promise.resolve({ accepted: true, queued: buffer.length });
+    return _enqueue(record);
   }
 
   async function close() {
@@ -409,6 +422,7 @@ module.exports = {
   create:                create,
   // Exposed for layer-0 tests that verify the wire encoding without
   // standing up an HTTP/2 server.
+  _makeClient:           _makeClient,
   _encodeAnyValue:       _encodeAnyValue,
   _encodeKeyValue:       _encodeKeyValue,
   _encodeLogRecord:      _encodeLogRecord,

package/lib/log-stream-otlp.js

@@ -212,89 +212,25 @@ function create(config) {
     "Content-Type": "application/json",
     "Accept":       "application/json",
   }, _authHeaders(cfg));
-  var onDrop = typeof cfg.onDrop === "function" ? cfg.onDrop : null;
-  var _emitDrop = safeAsync.makeDropCallback(onDrop);
-  var buffer = [];
-  var dropCount = 0;
-  var inFlight = false;
-  var closed = false;
-  // Captures the in-flight drain so close() awaits the real run before flipping
-  // `closed` (the _flush while-loop bails on !closed → flipping first strands
-  // buffered records at shutdown).
-  var inFlightPromise = null;
-  var flushScheduler = safeAsync.makeScheduledFlush(cfg.maxBatchAgeMs, function () { return _flush(); });
-
-  async function _flush() {
-    if (inFlight) return inFlightPromise;
-    if (buffer.length === 0) return;
-    inFlight = true;
-    inFlightPromise = (async function () {
-      try {
-        while (buffer.length > 0 && !closed) {
-          var batch = buffer.splice(0, cfg.batchSize);
-          var body = _serializeBatch(batch, cfg, scopeVersion);
-          try {
-            await retryHelper.withRetry(function () {
-              return _post(resolvedUrl, body, headers, cfg.timeoutMs, cfg.allowedProtocols, cfg.allowInternal);
-            }, cfg.retry);
-          } catch (e) {
-            dropCount += batch.length;
-            _emitDrop("retry-exhausted", batch, e);
-            break;
-          }
-        }
-      } finally {
-        inFlight = false;
-        inFlightPromise = null;
-        if (buffer.length > 0) flushScheduler.schedule();
-      }
-    })();
-    return inFlightPromise;
-  }
-
-  function emit(record) {
-    if (closed) return Promise.resolve({ accepted: false, reason: "sink closed" });
-    if (buffer.length >= cfg.bufferLimit) {
-      var dropped = buffer.shift();
-      dropCount += 1;
-      _emitDrop("overflow", [dropped], null);
-    }
-    buffer.push(record);
-    if (buffer.length >= cfg.batchSize) {
-      _flush().catch(function () {});
-    } else {
-      flushScheduler.schedule();
-    }
-    return Promise.resolve({ accepted: true, queued: buffer.length });
-  }
-
-  async function close() {
-    // Drain BEFORE flipping closed=true (see _flush's `&& !closed` guard) so
-    // records queued just before shutdown reach the wire. Mirrors the webhook
-    // + cloudwatch sinks.
-    flushScheduler.cancel();
-    if (inFlightPromise) {
-      try { await inFlightPromise; } catch (_e) { /* surfaced via onDrop */ }
-    }
-    await _flush();
-    closed = true;
-  }
-
-  function stats() {
-    return {
-      queued:   buffer.length,
-      dropped:  dropCount,
-      inFlight: inFlight,
-      url:      resolvedUrl,
-    };
-  }
+  var sink = safeAsync.makeBatchingSink({
+    batchSize:     cfg.batchSize,
+    bufferLimit:   cfg.bufferLimit,
+    maxBatchAgeMs: cfg.maxBatchAgeMs,
+    onDrop:        cfg.onDrop,
+    sendBatch:     function (batch) {
+      var body = _serializeBatch(batch, cfg, scopeVersion);
+      return retryHelper.withRetry(function () {
+        return _post(resolvedUrl, body, headers, cfg.timeoutMs, cfg.allowedProtocols, cfg.allowInternal);
+      }, cfg.retry);
+    },
+  });
 
   return {
     protocol: "otlp",
-    emit:     emit,
-    close:    close,
-    stats:    stats,
-    flush:    _flush,
+    emit:     sink.emit,
+    close:    sink.close,
+    stats:    function () { return sink.stats({ url: resolvedUrl }); },
+    flush:    sink.flush,
   };
 }
 

package/lib/log-stream-syslog.js

@@ -37,6 +37,9 @@ var safeAsync = require("./safe-async");
 var safeBuffer = require("./safe-buffer");
 var safeUrl = require("./safe-url");
 var { LogStreamError } = require("./framework-error");
+var lazyRequire = require("./lazy-require");
+// Lazy — audit a cert-validation-disabled syslog/TLS session at honor time.
+var networkTls = lazyRequire(function () { return require("./network-tls"); });
 
 var _err = LogStreamError.factory;
 var log  = boot("log-stream-syslog");
@@ -223,6 +226,9 @@ function create(config) {
       });
       if (cfg.ca) tlsOpts.ca = cfg.ca;
       if (cfg.servername) tlsOpts.servername = cfg.servername;
+      if (cfg.rejectUnauthorized === false) {
+        networkTls().auditInsecureTls({ host: cfg.host, port: cfg.port, source: "log-stream.syslog" });
+      }
       sock = nodeTls.connect(tlsOpts, onConnect);
     } else {
       sock = net.connect(connectOpts, onConnect);

package/lib/log-stream-webhook.js

@@ -98,101 +98,29 @@ function create(config) {
     errorClass:       LogStreamError,
   });
   var headers = Object.assign({ "Content-Type": cfg.contentType }, _authHeaders(cfg));
-  // onDrop callback: invoked when a batch is dropped, either by buffer
-  // overflow ("overflow") or by retry exhaustion ("retry-exhausted").
-  // Operator wiring this directly (without the framework's dispatcher
-  // wrapping) needs visibility into permanent-drop events; the
-  // dispatcher path emits its own audit, but a sink used in isolation
-  // would otherwise lose drops silently. The callback is invoked
-  // best-effort — a throw inside it is swallowed.
-  var onDrop = typeof cfg.onDrop === "function" ? cfg.onDrop : null;
-  var _emitDrop = safeAsync.makeDropCallback(onDrop);
-  var buffer = [];
-  var dropCount = 0;
-  var inFlight = false;
-  var closed = false;
-  var flushScheduler = safeAsync.makeScheduledFlush(cfg.maxBatchAgeMs, function () { return _flush(); });
-
-  // Track the in-flight flush as a promise so close() can await it.
-  // Without this, a record arriving mid-flush gets buffered, the
-  // emit-time _flush() early-returns on `if (inFlight) return`, and
-  // the buffered record is stranded if shutdown fires before
-  // flushScheduler.schedule() drains it.
-  var inFlightPromise = null;
-  async function _flush() {
-    if (inFlight) return inFlightPromise;
-    if (buffer.length === 0) return;
-    inFlight = true;
-    inFlightPromise = (async function () {
-      try {
-        while (buffer.length > 0 && !closed) {
-          var batch = buffer.splice(0, cfg.batchSize);
-          var body = _serializeBatch(batch, cfg.bodyShape);
-          try {
-            await retryHelper.withRetry(function () {
-              return _post(cfg.url, body, headers, cfg.timeoutMs, cfg.allowedProtocols, cfg.allowInternal);
-            }, cfg.retry);
-          } catch (e) {
-            // Batch permanently rejected — surface via dropCount AND the
-            // operator-supplied onDrop callback. The dispatcher path
-            // wraps its own audit hook around emit(); operators using
-            // this sink directly rely on dropCount + onDrop.
-            dropCount += batch.length;
-            _emitDrop("retry-exhausted", batch, e);
-            break;
-          }
-        }
-      } finally {
-        inFlight = false;
-        inFlightPromise = null;
-        if (buffer.length > 0) flushScheduler.schedule();
-      }
-    })();
-    return inFlightPromise;
-  }
-
-  function emit(record) {
-    if (closed) return Promise.resolve({ accepted: false, reason: "sink closed" });
-    if (buffer.length >= cfg.bufferLimit) {
-      var dropped = buffer.shift();   // drop oldest
-      dropCount += 1;
-      _emitDrop("overflow", [dropped], null);
-    }
-    buffer.push(record);
-    if (buffer.length >= cfg.batchSize) {
-      // Don't await — non-blocking flush. Caller's emit returns immediately.
-      _flush().catch(function () {});
-    } else {
-      flushScheduler.schedule();
-    }
-    return Promise.resolve({ accepted: true, queued: buffer.length });
-  }
-
-  async function close() {
-    // Drain BEFORE flipping closed=true. _flush()'s while loop bails on
-    // !closed, so flipping the flag first leaves any buffered records
-    // stranded — the very records the operator queued just before
-    // calling shutdown(). Order: stop the timer, await any in-flight
-    // flush so its records POST before we touch the buffer, drain
-    // anything still queued, THEN refuse new enqueues.
-    flushScheduler.cancel();
-    if (inFlightPromise) {
-      try { await inFlightPromise; } catch (_e) { /* surfaced via onDrop */ }
-    }
-    await _flush();
-    closed = true;
-  }
-
-  function stats() {
-    return { queued: buffer.length, dropped: dropCount, inFlight: inFlight };
-  }
+  // A batch permanently rejected by retry surfaces via dropCount AND the
+  // operator-supplied onDrop — the dispatcher wraps its own audit around
+  // emit(), but a sink wired directly (or by buffer overflow) would otherwise
+  // lose drops silently. onDrop is best-effort; a throw inside it is swallowed.
+  var sink = safeAsync.makeBatchingSink({
+    batchSize:     cfg.batchSize,
+    bufferLimit:   cfg.bufferLimit,
+    maxBatchAgeMs: cfg.maxBatchAgeMs,
+    onDrop:        cfg.onDrop,
+    sendBatch:     function (batch) {
+      var body = _serializeBatch(batch, cfg.bodyShape);
+      return retryHelper.withRetry(function () {
+        return _post(cfg.url, body, headers, cfg.timeoutMs, cfg.allowedProtocols, cfg.allowInternal);
+      }, cfg.retry);
+    },
+  });
 
   return {
     protocol:  "webhook",
-    emit:      emit,
-    close:     close,
-    stats:     stats,
-    flush:     _flush,
+    emit:      sink.emit,
+    close:     sink.close,
+    stats:     sink.stats,
+    flush:     sink.flush,
   };
 }
 

package/lib/log.js

@@ -464,7 +464,11 @@ function boot(name) {
     var stream = (LEVELS[levelName] >= LEVELS.warn) ? process.stderr : process.stdout;
     var isTty = !!(stream && stream.isTTY);
     if (isTty) {
-      sink(prefix + String(msg));
+      // Raw human-readable line — escape BOTH the C0/newline (line-forging)
+      // and bidi (re-ordering) control classes the create() path neutralizes,
+      // so a hostile boot message can't inject lines or re-order the visible
+      // line on a TTY / syslog reader (CWE-117 / Trojan-Source CVE-2021-42574).
+      sink(_escapeBidiControls(_escapeC0Controls(prefix + String(msg))));
       return;
     }
     var entry = {
@@ -474,7 +478,9 @@ function boot(name) {
       component: name,
       boot:      true,
     };
-    sink(JSON.stringify(entry));
+    // JSON.stringify already escapes C0/newlines; bidi/format controls survive
+    // raw into a piped aggregator, so apply the same bidi escape create() uses.
+    sink(_escapeBidiControls(JSON.stringify(entry)));
   }
 
   function debug(msg, fields) {
@@ -560,6 +566,22 @@ function _escapeBidiControls(s) {
   });
 }
 
+// C0 control chars (incl. CR / LF / TAB) + DEL — escaped to `\uXXXX` so a
+// hostile message can't forge extra log lines on a raw (non-JSON) TTY sink
+// (log-injection, CWE-117). The create() path gets this for free from
+// JSON.stringify; the boot() TTY branch writes raw text and needs it
+// explicitly. Pairs with _escapeBidiControls (which only covers the bidi set).
+var _C0_CONTROL_RE = /[\u0000-\u001f\u007f]/g;   // eslint-disable-line no-control-regex -- the C0/DEL set is what we escape
+
+function _escapeC0Controls(s) {
+  if (typeof s !== "string" || s.length === 0) return s;
+  return s.replace(_C0_CONTROL_RE, function (ch) {
+    var code = ch.charCodeAt(0).toString(16);
+    while (code.length < 4) code = "0" + code;
+    return "\\u" + code;
+  });
+}
+
 // runs before safeEnv on the boot path; safeEnv requires log, so log
 // can't go through safeEnv to read its own level.
 function _bootMinLevel() {