@blamejs/core 0.15.12 → 0.15.14

package/lib/chain-writer.js

@@ -45,12 +45,14 @@ var safeAsync = require("./safe-async");
 var safeSql = require("./safe-sql");
 var sql = require("./sql");
 var C = require("./constants");
+var boundedMap = require("./bounded-map");
 var { FrameworkError } = require("./framework-error");
 
-// Allowlist of chain table names. Adding a new chain-backed table
-// (e.g. some future _blamejs_security_log) requires registering it here
-// so an operator can't accidentally point a chain-writer at a non-chain
-// table and corrupt the chain semantics.
+// Allowlist of chain table names. The two framework chains ship registered; a
+// consumer's own append-only hash-chained table is added at config time via
+// registerTable() BEFORE create() accepts it. The allowlist is never bypassed
+// — an unregistered table throws at create(), so a misconfig can't point a
+// chain-writer at a non-chain table and corrupt the chain semantics.
 var ALLOWED_CHAIN_TABLES = new Set(["audit_log", "consent_log"]);
 
 var FRAMEWORK_SQL_TIMEOUT_MS = C.TIME.seconds(30);
@@ -74,24 +76,83 @@ class ChainWriterError extends FrameworkError {
   }
 }
 
+/**
+ * @primitive b.chainWriter.registerTable
+ * @signature b.chainWriter.registerTable(table)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.chainWriter.create, b.safeSql.validateIdentifier
+ *
+ * Register a consumer-owned append-only table as chain-writable so
+ * `b.chainWriter.create({ table })` accepts it. Call once at boot (config
+ * time) for each app table carrying the chain columns (`monotonicCounter`,
+ * `recordedAt`, `nonce`, `prevHash`, `rowHash` — plus `fencingToken` in
+ * cluster mode). The framework chains (`audit_log`, `consent_log`) are
+ * pre-registered. Throws `ChainWriterError` (`chain-writer/invalid-config`) on
+ * a non-identifier name; the name is validated against the SQL identifier
+ * rules because it is interpolated into the chain SQL. Idempotent. Returns the
+ * registered name.
+ *
+ * Operator footgun to avoid on a MULTI-chain table (one configured with a
+ * `chainKey`): the per-key writer restarts `monotonicCounter` at 1 for each
+ * key, so a UNIQUE index on `monotonicCounter` ALONE (the shape the framework
+ * `audit_log` uses for its single chain) will reject the second key's first
+ * row. A keyed chain's uniqueness must be the composite
+ * `(chainKey, monotonicCounter)`, never `monotonicCounter` by itself.
+ *
+ * @example
+ *   b.chainWriter.registerTable("device_event_log");
+ *   var writer = b.chainWriter.create({
+ *     table:            "device_event_log",
+ *     chainKey:         "deviceId",
+ *     columnsForInsert: ["_id", "deviceId", "monotonicCounter", "recordedAt",
+ *                        "kind", "payload",
+ *                        "prevHash", "rowHash", "nonce", "fencingToken"],
+ *     hashableColumns:  ["_id", "deviceId", "monotonicCounter", "recordedAt",
+ *                        "kind", "payload"],
+ *   });
+ */
+function registerTable(table) {
+  if (typeof table !== "string" || table.length === 0) {
+    throw new ChainWriterError(
+      "registerTable requires a non-empty table name",
+      "chain-writer/invalid-config"
+    );
+  }
+  // Identifier-validate before admitting to the allowlist — the name is
+  // interpolated into the chain SQL, so the same shape rules create() relies
+  // on must hold here, at the config-time entry point.
+  safeSql.validateIdentifier(table);
+  ALLOWED_CHAIN_TABLES.add(table);
+  return table;
+}
+
 /**
  * @primitive b.chainWriter.create
  * @signature b.chainWriter.create(opts)
  * @since     0.8.48
  * @status    stable
- * @related   b.audit, b.consent, b.auditChain
+ * @related   b.audit, b.consent, b.auditChain, b.chainWriter.registerTable
  *
  * Build a chain-writer bound to a single hash-chained table. Returns
- * `{ table, append, _resetForTest, _getMutexForTest }`. `append(logical)`
- * is the public surface — async, leader-gated, mutex-serialized; on
- * success it returns the logical row decorated with the computed
- * `rowHash` and `prevHash`.
+ * `{ table, chainKey, append, _resetForTest, _getMutexForTest }`.
+ * `append(logical)` is the public surface — async, leader-gated,
+ * mutex-serialized; on success it returns the logical row decorated with the
+ * computed `rowHash` and `prevHash`.
+ *
+ * A `chainKey` makes one table hold many independent chains (one per account /
+ * device / tenant): tip-read, counter monotonicity, and the append Mutex all
+ * scope per key, so concurrent appends to DIFFERENT keys run in parallel while
+ * same-key appends serialize. Bind `chainKey` into `hashableColumns` so the
+ * partition is tamper-evident in the row hash, and key the table's uniqueness
+ * constraint on `(chainKey, monotonicCounter)`, never `monotonicCounter` alone.
  *
  * @opts
- *   table:            string,    // one of ALLOWED_CHAIN_TABLES (audit_log | consent_log)
+ *   table:            string,    // a registered chain table (audit_log | consent_log | registerTable name)
+ *   chainKey:         string,    // optional partition column — one independent chain per key value
  *   columnsForInsert: string[],  // INSERT column order (every name is identifier-validated)
  *   hashableColumns:  string[],  // columns that participate in the rowHash canonicalization
- *   validateInput:    Function,  // optional; (logical) → throws on invalid shape
+ *   validateInput:    Function,  // optional; (logical) -> throws on invalid shape
  *
  * @example
  *   var writer = b.chainWriter.create({
@@ -136,27 +197,57 @@ function create(opts) {
   var hashableColumns   = opts.hashableColumns.slice();
   var validateInput     = opts.validateInput || null;
 
-  // Per-chain Mutex serializes the read-prev-tip + compute-hash + insert
+  // chainKey: the partition column for many independent chains in one table
+  // (one chain per account / device / tenant). When set, the tip read,
+  // counter priming, and the append Mutex all scope to a single key value, so
+  // appends to DIFFERENT keys run in parallel while same-key appends
+  // serialize. Identifier-validated at config time (THROW tier) because it is
+  // interpolated as a column name; it must also appear in columnsForInsert so
+  // every row carries its partition key.
+  var chainKey = opts.chainKey || null;
+  if (chainKey !== null) {
+    safeSql.validateIdentifier(chainKey);
+    if (columnsForInsert.indexOf(chainKey) === -1) {
+      throw new ChainWriterError(
+        "chainKey '" + chainKey + "' must be listed in columnsForInsert so " +
+        "every appended row carries its partition key",
+        "chain-writer/invalid-config"
+      );
+    }
+  }
+
+  // Per-CHAIN-KEY Mutex serializes the read-prev-tip + compute-hash + insert
   // sequence. Without serialization, two concurrent awaiting append() calls
-  // would hash against the same prev-tip and produce sibling rows with the
-  // same prevHash — forking the chain.
-  var _chainMutex = new safeAsync.Mutex();
+  // would hash against the same prev-tip and fork the chain. A single-chain
+  // writer (no chainKey) uses one shared lock under the sentinel key; a
+  // multi-chain writer keys the lock by the partition value so appends to
+  // DIFFERENT keys run concurrently while same-key appends serialize.
+  var _SINGLE_CHAIN_KEY = "__single_chain__";   // sentinel; not a valid driver value
+  var _mutexByKey = new Map();
+  function _mutexFor(keyValue) {
+    var k = chainKey !== null ? String(keyValue) : _SINGLE_CHAIN_KEY;
+    return boundedMap.getOrInsert(_mutexByKey, k, function () { return new safeAsync.Mutex(); });
+  }
 
-  // Lazy counter primer — first append reads MAX(monotonicCounter) and
-  // increments from there. Once ensures concurrent first-callers share
-  // one in-flight init Promise.
-  var _nextCounter = 1;
-  var _counterInit = null;
+  // Lazy counter primer — first append for a given key reads
+  // MAX(monotonicCounter) [WHERE chainKey = ?] and increments from there.
+  // Per-key so each chain's counter is independent; a per-key Once shares one
+  // in-flight init across concurrent first-callers for the same key.
+  var _nextCounterByKey = new Map();
+  var _counterInitByKey = new Map();
 
-  function _ensureCounterInit() {
-    if (!_counterInit) {
-      _counterInit = new safeAsync.Once(async function () {
+  function _ensureCounterInit(keyValue) {
+    var k = chainKey !== null ? String(keyValue) : _SINGLE_CHAIN_KEY;
+    var once = boundedMap.getOrInsert(_counterInitByKey, k, function () {
+      return new safeAsync.Once(async function () {
         // BARE logical table name — clusterStorage rewrites the framework
-        // name to the configured-prefix form and placeholderizes; b.sql
-        // quotes the camelCase column + emits the MAX aggregate.
-        var maxBuilt = sql.select(table, _sqlOpts())
-          .max("monotonicCounter", "m")
-          .toSql();
+        // name to the configured-prefix form (consumer tables pass through
+        // unchanged) and placeholderizes; b.sql quotes the camelCase column +
+        // emits the MAX aggregate. A keyed writer scopes the MAX to the
+        // partition via a bound WHERE.
+        var maxQ = sql.select(table, _sqlOpts()).max("monotonicCounter", "m");
+        if (chainKey !== null) maxQ = maxQ.where(chainKey, keyValue);
+        var maxBuilt = maxQ.toSql();
         var row = await safeAsync.withTimeout(
           safeAsync.asyncRetry(function () {
             return clusterStorage.executeOne(maxBuilt.sql, maxBuilt.params);
@@ -164,18 +255,21 @@ function create(opts) {
           FRAMEWORK_SQL_TIMEOUT_MS,
           { name: table + ".readMaxCounter" }
         );
-        _nextCounter = (row && row.m ? Number(row.m) : 0) + 1;
+        _nextCounterByKey.set(k, (row && row.m ? Number(row.m) : 0) + 1);
       });
-    }
-    return _counterInit.invoke();
+    });
+    return once.invoke();
   }
 
-  async function _readChainTipRow() {
-    var tipBuilt = sql.select(table, _sqlOpts())
+  async function _readChainTipRow(keyValue) {
+    var tipQ = sql.select(table, _sqlOpts())
       .columns(["rowHash"])
       .orderBy("monotonicCounter", "desc")
-      .limit(1)
-      .toSql();
+      .limit(1);
+    // Scope the tip to the partition so per-key chains link correctly —
+    // bound value, never interpolated.
+    if (chainKey !== null) tipQ = tipQ.where(chainKey, keyValue);
+    var tipBuilt = tipQ.toSql();
     return await safeAsync.withTimeout(
       safeAsync.asyncRetry(function () {
         return clusterStorage.executeOne(tipBuilt.sql, tipBuilt.params);
@@ -209,15 +303,33 @@ function create(opts) {
   async function append(logical) {
     if (validateInput) validateInput(logical);
     cluster.requireLeader();
-    await _ensureCounterInit();
 
-    return await _chainMutex.runExclusive(async function () {
-      return await _appendInsideMutex(logical);
+    // Resolve the partition key from the logical row for a multi-chain writer.
+    // Fail closed: a keyed writer with a missing / empty key can't pick a
+    // chain to append to, so refuse rather than silently fold the row into the
+    // wrong chain.
+    var keyValue = _SINGLE_CHAIN_KEY;
+    if (chainKey !== null) {
+      keyValue = logical ? logical[chainKey] : undefined;
+      if (keyValue === undefined || keyValue === null || String(keyValue).length === 0) {
+        throw new ChainWriterError(
+          "append: a chainKey writer requires logical['" + chainKey + "'] to be a " +
+          "non-empty partition value",
+          "chain-writer/invalid-input"
+        );
+      }
+    }
+    await _ensureCounterInit(keyValue);
+
+    return await _mutexFor(keyValue).runExclusive(async function () {
+      return await _appendInsideMutex(logical, keyValue);
     });
   }
 
-  async function _appendInsideMutex(logical) {
-    var counter = _nextCounter++;
+  async function _appendInsideMutex(logical, keyValue) {
+    var _ck = chainKey !== null ? String(keyValue) : _SINGLE_CHAIN_KEY;
+    var counter = _nextCounterByKey.get(_ck);
+    _nextCounterByKey.set(_ck, counter + 1);
     var nowMs   = Date.now();
     var nonce   = generateBytes(C.BYTES.bytes(16));
 
@@ -239,8 +351,8 @@ function create(opts) {
       if (!(hashableColumns[hci] in sealed)) sealed[hashableColumns[hci]] = null;
     }
 
-    // Compute rowHash over the sealed content fields
-    var tipRow = await _readChainTipRow();
+    // Compute rowHash over the sealed content fields, linking to THIS key's tip.
+    var tipRow = await _readChainTipRow(keyValue);
     var prevHash = tipRow ? tipRow.rowHash : auditChain.ZERO_HASH;
     var rowHash = auditChain.computeRowHash(prevHash, sealed, nonce);
 
@@ -259,22 +371,25 @@ function create(opts) {
   }
 
   function _resetForTest() {
-    _chainMutex = new safeAsync.Mutex();
-    _counterInit = null;
-    _nextCounter = 1;
+    _mutexByKey = new Map();
+    _counterInitByKey = new Map();
+    _nextCounterByKey = new Map();
   }
 
   return {
     table:          table,
+    chainKey:       chainKey,
     append:         append,
     _resetForTest:  _resetForTest,
-    // Expose for diagnostic introspection
-    _getMutexForTest: function () { return _chainMutex; },
+    // Expose for diagnostic introspection — the lock for a given key (or the
+    // single-chain lock when no chainKey is configured).
+    _getMutexForTest: function (keyValue) { return _mutexFor(keyValue); },
   };
 }
 
 module.exports = {
   create:               create,
+  registerTable:        registerTable,
   ChainWriterError:     ChainWriterError,
   ALLOWED_CHAIN_TABLES: ALLOWED_CHAIN_TABLES,
   FRAMEWORK_SQL_TIMEOUT_MS: FRAMEWORK_SQL_TIMEOUT_MS,

package/lib/cli.js

@@ -39,6 +39,7 @@ var os = require("node:os");
 var nodePath = require("node:path");
 var apiSnapshot = require("./api-snapshot");
 var argParser = require("./arg-parser");
+var atomicFile = require("./atomic-file");
 var auditChain = require("./audit-chain");
 var auditTools = require("./audit-tools");
 var backup = require("./backup");
@@ -1110,12 +1111,16 @@ async function _runApiKey(args, ctx) {
         return report.error("--scopes must contain at least one non-empty scope", 2);
       }
       var label = typeof args.flags.label === "string" ? args.flags.label : null;
+      // --expires-ms is the absolute expiry as a unix-ms timestamp; the
+      // registry's validated opt is `expiresAt` (apiKey.issue rejects any other
+      // key). Passing `expiresMs` silently did nothing before — the lib only
+      // ever read `expiresAt` — so the flag was a no-op; map it correctly.
       var expiresMs = args.flags["expires-ms"];
       var issued = await registry.issue({
         ownerId:   String(ownerId),
         scopes:    scopeList,
         metadata:  label ? { label: label } : null,
-        expiresMs: expiresMs && expiresMs !== true ? Number(expiresMs) : undefined,
+        expiresAt: expiresMs && expiresMs !== true ? Number(expiresMs) : undefined,
       });
       report.write("id:     " + issued.id);
       report.write("key:    " + issued.key);
@@ -1480,7 +1485,10 @@ async function _runMtls(args, ctx) {
           validityDays: daysP,
         });
         if (outPath) {
-          nodeFs.writeFileSync(outPath, p12.p12, { mode: 0o600 });
+          // Atomic, symlink-refusing write — a bare writeFileSync follows a
+          // symlink an attacker pre-planted at the operator-supplied --out
+          // path (CWE-59) and could expose the client key bundle through it.
+          atomicFile.writeSync(outPath, p12.p12, { fileMode: 0o600 });
           report.write("p12 written: " + outPath);
         } else {
           // No --out: stream the bytes to stdout for piping. Operators

package/lib/client-hints.js

@@ -158,15 +158,13 @@ function _parseBrandMember(piece) {
   var brand = _parseSfString(params[0].trim());
   if (brand === null) return null;
   var member = { brand: brand, version: null, params: {} };
-  for (var i = 1; i < params.length; i += 1) {
-    var kv = params[i].trim();
-    if (kv.length === 0) continue;
-    var eq = kv.indexOf("=");
-    if (eq === -1) { member.params[kv.toLowerCase()] = true; continue; }
-    var k = kv.slice(0, eq).trim().toLowerCase();
-    var v = _parseSfString(kv.slice(eq + 1));
-    member.params[k] = v;
-    if (k === "v" && v !== null) member.version = v;
+  var kvps = structuredFields.parseKeyValuePieces(params, 1);
+  for (var i = 0; i < kvps.length; i += 1) {
+    var kv = kvps[i];
+    if (kv.value === null) { member.params[kv.key] = true; continue; }
+    var v = _parseSfString(kv.value);
+    member.params[kv.key] = v;
+    if (kv.key === "v" && v !== null) member.version = v;
   }
   return member;
 }

package/lib/cloud-events.js

@@ -35,6 +35,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var rfc3339 = require("./rfc3339");
 var safeJson = require("./safe-json");
@@ -118,21 +119,41 @@ function _genId() {
  *   // → "1.0"
  */
 function wrap(opts) {
-  validateOpts.requireObject(opts, "cloudEvents.wrap", CloudEventsError);
-  validateOpts.requireNonEmptyString(opts.source,
-    "cloudEvents.wrap: source", CloudEventsError, "cloud-events/bad-source");
-  validateOpts.requireNonEmptyString(opts.type,
-    "cloudEvents.wrap: type", CloudEventsError, "cloud-events/bad-type");
-  validateOpts.optionalNonEmptyString(opts.id,
-    "cloudEvents.wrap: id", CloudEventsError, "cloud-events/bad-id");
-  validateOpts.optionalNonEmptyString(opts.subject,
-    "cloudEvents.wrap: subject", CloudEventsError, "cloud-events/bad-subject");
-  validateOpts.optionalNonEmptyString(opts.time,
-    "cloudEvents.wrap: time", CloudEventsError, "cloud-events/bad-time");
-  validateOpts.optionalNonEmptyString(opts.datacontenttype,
-    "cloudEvents.wrap: datacontenttype", CloudEventsError, "cloud-events/bad-datacontenttype");
-  validateOpts.optionalNonEmptyString(opts.dataschema,
-    "cloudEvents.wrap: dataschema", CloudEventsError, "cloud-events/bad-dataschema");
+  validateOpts.shape(opts, {
+    source:          { rule: "required-string", code: "cloud-events/bad-source" },
+    type:            { rule: "required-string", code: "cloud-events/bad-type" },
+    id:              { rule: "optional-string", code: "cloud-events/bad-id" },
+    subject:         { rule: "optional-string", code: "cloud-events/bad-subject" },
+    time:            { rule: "optional-string", code: "cloud-events/bad-time" },
+    datacontenttype: { rule: "optional-string", code: "cloud-events/bad-datacontenttype" },
+    dataschema:      { rule: "optional-string", code: "cloud-events/bad-dataschema" },
+    // data is any JSON value or a Buffer — wrap routes Buffers to
+    // data_base64 and everything else to the data attribute, imposing no
+    // type constraint of its own, so accept any value here.
+    data:            function () {},
+    // extensions — plain object whose keys conform to the §3.1 naming
+    // rules (lowercase ASCII alnum, 1-20 chars) and collide with no spec
+    // attribute. Validation lives IN the shape; the body only copies the
+    // validated keys onto the envelope.
+    extensions:      function (v) {
+      validateOpts.optionalPlainObject(v,
+        "cloudEvents.wrap: extensions", CloudEventsError, "cloud-events/bad-extensions");
+      if (v === undefined || v === null) return;
+      var extKeys = Object.keys(v);
+      for (var i = 0; i < extKeys.length; i += 1) {
+        var k = extKeys[i];
+        // bound BEFORE regex test — k.length > 0 && k.length <= 20
+        if (typeof k !== "string" || k.length === 0 || k.length > 20 || !EXT_ATTR_NAME_RE.test(k)) {
+          throw new CloudEventsError("cloud-events/bad-extension-name",
+            "cloudEvents.wrap: extension '" + k + "' must match [a-z0-9]{1,20}");
+        }
+        if (REQUIRED_ATTRS.indexOf(k) !== -1 || KNOWN_OPTIONAL_ATTRS[k]) {
+          throw new CloudEventsError("cloud-events/extension-conflicts-with-spec",
+            "cloudEvents.wrap: extension '" + k + "' conflicts with a spec attribute");
+        }
+      }
+    },
+  }, "cloudEvents.wrap", CloudEventsError);
 
   var out = {
     specversion: SPECVERSION,
@@ -158,24 +179,13 @@ function wrap(opts) {
     out.datacontenttype = opts.datacontenttype;
   }
 
-  // Extension attributes — operator-defined, must conform to the
-  // §3.1 naming rules (lowercase ASCII alnum, 1-20 chars).
+  // Extension attributes — validated in the shape above (plain object,
+  // §3.1 key naming, no spec collisions); copy the validated keys onto
+  // the envelope.
   if (opts.extensions !== undefined && opts.extensions !== null) {
-    validateOpts.optionalPlainObject(opts.extensions,
-      "cloudEvents.wrap: extensions", CloudEventsError, "cloud-events/bad-extensions");
     var extKeys = Object.keys(opts.extensions);
     for (var i = 0; i < extKeys.length; i += 1) {
-      var k = extKeys[i];
-      // bound BEFORE regex test — k.length > 0 && k.length <= 20
-      if (typeof k !== "string" || k.length === 0 || k.length > 20 || !EXT_ATTR_NAME_RE.test(k)) {
-        throw new CloudEventsError("cloud-events/bad-extension-name",
-          "cloudEvents.wrap: extension '" + k + "' must match [a-z0-9]{1,20}");
-      }
-      if (REQUIRED_ATTRS.indexOf(k) !== -1 || KNOWN_OPTIONAL_ATTRS[k]) {
-        throw new CloudEventsError("cloud-events/extension-conflicts-with-spec",
-          "cloudEvents.wrap: extension '" + k + "' conflicts with a spec attribute");
-      }
-      out[k] = opts.extensions[k];
+      out[extKeys[i]] = opts.extensions[extKeys[i]];
     }
   }
   return out;
@@ -256,7 +266,7 @@ function parse(envelope) {
   for (var j = 0; j < keys.length; j += 1) {
     var key = keys[j];
     if (REQUIRED_ATTRS.indexOf(key) !== -1) continue;
-    if (KNOWN_OPTIONAL_ATTRS[key]) continue;
+    if (Object.prototype.hasOwnProperty.call(KNOWN_OPTIONAL_ATTRS, key)) continue;
     extensions[key] = envelope[key];
   }
 
@@ -300,7 +310,7 @@ function _extIssue(name, v) {
   if (v === null) return null;
   if (typeof v === "string" || typeof v === "boolean") return null;
   if (typeof v === "number") {
-    if (!isFinite(v) || Math.floor(v) !== v) return "extension '" + name + "' must be an integer (CloudEvents has no float type)";
+    if (!numericBounds.isFiniteInt(v)) return "extension '" + name + "' must be an integer (CloudEvents has no float type)";
     if (v < INT_MIN || v > INT_MAX) return "extension '" + name + "' integer out of 32-bit range";
     return null;
   }
@@ -668,7 +678,7 @@ function decodeBinary(headers, body, opts) {
   else if (Buffer.isBuffer(body)) raw = body;
   else if (typeof body === "string") raw = Buffer.from(body, "utf8");
   else throw new CloudEventsError("cloud-events/bad-input", "cloudEvents.http.decodeBinary: body must be a string or Buffer");
-  if (raw.length > maxBytes) throw new CloudEventsError("cloud-events/too-large", "cloudEvents.http.decodeBinary: body exceeds maxBytes (" + maxBytes + ")");
+  if (safeBuffer.byteLengthOf(raw) > maxBytes) throw new CloudEventsError("cloud-events/too-large", "cloudEvents.http.decodeBinary: body exceeds maxBytes (" + maxBytes + ")");
   if (raw.length > 0) {
     if (_isJsonMedia(ct)) {
       try { event.data = safeJson.parse(raw, { maxBytes: maxBytes }); }

package/lib/cluster-storage.js

@@ -30,6 +30,7 @@
 var cluster = require("./cluster");
 var frameworkSchema = require("./framework-schema");
 var externalDb = require("./external-db");
+var safeSql = require("./safe-sql");
 var lazyRequire = require("./lazy-require");
 var { FrameworkError } = require("./framework-error");
 
@@ -277,44 +278,7 @@ function resolveTables(sql) {
  *   // → "SELECT id FROM audit_log WHERE counter > $1 AND actor = $2"
  */
 function placeholderize(sql, dialect) {
-  if (dialect !== "postgres") return sql;
-  var out = "";
-  var n = 0;
-  var i = 0;
-  var len = sql.length;
-  while (i < len) {
-    var c = sql.charAt(i);
-    var nx = i + 1 < len ? sql.charAt(i + 1) : "";
-    // Quote contexts: ' string literal, " identifier, ` mysql identifier.
-    // A doubled quote escapes itself within the span.
-    if (c === "'" || c === '"' || c === "`") {
-      out += c;
-      i += 1;
-      while (i < len) {
-        var q = sql.charAt(i);
-        if (q === c) {
-          if (sql.charAt(i + 1) === c) { out += c + c; i += 2; continue; }
-          out += c; i += 1; break;
-        }
-        out += q; i += 1;
-      }
-      continue;
-    }
-    if (c === "-" && nx === "-") {                              // line comment
-      while (i < len && sql.charAt(i) !== "\n") { out += sql.charAt(i); i += 1; }
-      continue;
-    }
-    if (c === "/" && nx === "*") {                              // block comment
-      out += "/*"; i += 2;
-      while (i < len && !(sql.charAt(i) === "*" && sql.charAt(i + 1) === "/")) { out += sql.charAt(i); i += 1; }
-      if (i < len) { out += "*/"; i += 2; }
-      continue;
-    }
-    if (c === "?") { n += 1; out += "$" + n; i += 1; continue; }
-    out += c;
-    i += 1;
-  }
-  return out;
+  return safeSql.toPositional(sql, dialect);
 }
 
 // ---- execute() ----
@@ -363,9 +327,13 @@ var _activeTx = null;
 // synchronous this runs atomically to completion with no interleaving.
 function _localExec(sql, params) {
   var stmt = _localDb().prepare(sql);
-  // Heuristic: if the statement returns rows (SELECT or has RETURNING),
-  // use .all(); otherwise .run() and report changes as rowCount.
-  if (/^\s*SELECT\b/i.test(sql) || /\bRETURNING\b/i.test(sql)) {
+  // Choose .all() vs .run() by whether the statement returns rows. A leading-
+  // keyword check (`^\s*SELECT`) mis-routes a WITH (CTE) read — "WITH c AS (...)
+  // SELECT ..." does not start with SELECT — to .run(), which on node:sqlite
+  // silently returns only a changes count and DROPS the rows. The shared
+  // CTE/EXPLAIN-aware classifier resolves the effective verb (and a top-level
+  // RETURNING) so every row-returning statement reaches the caller via .all().
+  if (externalDb._statementReturnsRows(sql)) {
     var rows = stmt.all.apply(stmt, params || []);
     return { rows: rows, rowCount: rows.length };
   }

package/lib/cms-codec.js

@@ -68,6 +68,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var safeBuffer = require("./safe-buffer");
 var asn1 = require("./asn1-der");
 var bCrypto = require("./crypto");
 var pqcSoftware = require("./pqc-software");
@@ -322,7 +323,7 @@ function decode(buf, opts) {
     throw new CmsCodecError("cms/bad-input", "decode: buf must be a Buffer");
   }
   var maxBytes = opts.maxBytes || DEFAULT_MAX_LEN;
-  if (buf.length > maxBytes) {
+  if (safeBuffer.byteLengthOf(buf) > maxBytes) {
     throw new CmsCodecError("cms/oversize",
       "decode: input " + buf.length + " bytes exceeds maxBytes=" + maxBytes);
   }