@blamejs/core 0.15.12 → 0.15.14

package/lib/csp.js

@@ -52,7 +52,12 @@
 var nodeCrypto   = require("node:crypto");
 var validateOpts = require("./validate-opts");
 var bCrypto      = require("./crypto");
+var pick         = require("./pick");
 var { defineClass } = require("./framework-error");
+// The strict framework defaults the per-route merge derives from. One-
+// directional edge: security-headers requires only request-helpers +
+// validate-opts, never csp, so this is not a cycle (§9 top-of-file require).
+var securityHeaderDefaults = require("./middleware/security-headers");
 
 var CspError = defineClass("CspError", { alwaysPermanent: true });
 
@@ -78,6 +83,61 @@ var ALL_DIRECTIVES = [
 var UNSAFE_KEYWORDS = ["'unsafe-inline'", "'unsafe-eval'", "'unsafe-hashes'"];
 var CATCH_ALL_SOURCES = ["*", "https:"];
 
+// _parseCspString — split a CSP header value into an ordered
+// { directive: [sources] } map. Tolerant reader (defensive tier): a
+// malformed base yields whatever directives DO parse. The merge never
+// re-validates these base sources (they are the trusted default), so the
+// parser only needs to be faithful, not strict. First write wins on a
+// duplicate directive (matches UA "honor the first").
+function _parseCspString(value) {
+  var out = {};
+  if (typeof value !== "string") return out;
+  var segments = value.split(";");
+  for (var i = 0; i < segments.length; i += 1) {
+    var tokens = segments[i].trim().split(/\s+/);
+    var name = tokens[0];
+    if (!name) continue;
+    if (Object.prototype.hasOwnProperty.call(out, name)) continue;
+    out[name] = tokens.slice(1);
+  }
+  return out;
+}
+
+// _parsePermissionsPolicyString — split a Permissions-Policy header value
+// into a { feature: "allowlist" } map plus the feature order, preserving
+// each feature's RFC-9651 value-list verbatim ("()" / "*" / "(self ...)").
+function _parsePermissionsPolicyString(value) {
+  var out = {};
+  var order = [];
+  if (typeof value !== "string") return { map: out, order: order };
+  // Split on the literal comma (linear) — the per-item .trim() below handles
+  // the surrounding whitespace, so the prior `/\s*,\s*/` was redundant and
+  // ran in O(n^2) on a comma-less run of whitespace (js/polynomial-redos).
+  var parts = value.split(",");
+  for (var i = 0; i < parts.length; i += 1) {
+    var p = parts[i].trim();
+    if (!p) continue;
+    var eq = p.indexOf("=");
+    if (eq === -1) continue;
+    var feature = p.slice(0, eq).trim();
+    var allow = p.slice(eq + 1).trim();
+    if (!feature) continue;
+    if (!Object.prototype.hasOwnProperty.call(out, feature)) order.push(feature);
+    out[feature] = allow;
+  }
+  return { map: out, order: order };
+}
+
+// RFC-9651 value-list shape for ONE Permissions-Policy feature value (no
+// leading "feature=" — just the allowlist): "*", "()", "self", or a
+// parenthesised origin list "(self \"https://x\")". A hostile value with a
+// comma / CRLF can't pass (no comma inside, the parens are balanced-only).
+var PP_VALUE_RE = /^(?:\*|self|\([^),\r\n]*\))$/;
+// Permissions-Policy feature names are RFC-9651 structured-field tokens —
+// ASCII lowercase, hyphenated. Reject anything else so a hostile key can't
+// inject a comma / CRLF into the header.
+var PP_FEATURE_RE = /^[a-z][a-z0-9-]*$/;   // allow:duplicate-regex — generic ASCII lowercase-hyphen token shape; shared shape, distinct domain (Permissions-Policy feature name)
+
 /**
  * @primitive b.csp.build
  * @signature b.csp.build(directives, opts?)
@@ -184,9 +244,15 @@ function build(directives, opts) {
     directives["trusted-types"] = opts.trustedTypesPolicies;
   }
 
-  // Emit in canonical order (ALL_DIRECTIVES order) so operators
-  // diffing two policies see structural diffs rather than ordering
-  // noise.
+  return _emitCanonical(directives);
+}
+
+// Emit a directive map as a CSP header string in canonical (ALL_DIRECTIVES)
+// order so operators diffing two policies see structural diffs rather than
+// ordering noise. Pure serializer — it does NOT validate sources (build()
+// and mergeDirectives() validate before calling it), so a trusted base
+// policy round-trips through it untouched.
+function _emitCanonical(directives) {
   var out = [];
   for (var di = 0; di < ALL_DIRECTIVES.length; di += 1) {
     var d = ALL_DIRECTIVES[di];
@@ -264,8 +330,178 @@ function hash(scriptBody, alg) {
   return "'" + algName + "-" + digest + "'";
 }
 
+/**
+ * @primitive  b.csp.mergeDirectives
+ * @signature  b.csp.mergeDirectives(base, additions, opts?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.csp.build, b.csp.mergePermissionsPolicy
+ *
+ * Derive a per-route CSP from a strict base by ADDING hosts to named
+ * directives, leaving every other directive exactly as the base. The fix for
+ * the "load a third-party SDK on one route" case: take the framework's strict
+ * default (pass `base` omitted / `undefined`) and add `https://js.stripe.com`
+ * to `script-src` + `frame-src` for the checkout route only, without
+ * re-typing the whole policy or relaxing `frame-ancestors` / `object-src` /
+ * `base-uri`.
+ *
+ * Additive only: each `additions[directive]` array is APPENDED (de-duped) to
+ * that directive's existing sources; a directive absent from the base is
+ * seeded from `default-src` (or `'self'`) first so it never lands wide-open.
+ * Only the ADDED sources are validated (CR/LF/NUL, catch-all `*`/`https:`,
+ * `data:` in img/media/font, unsafe-* in script directives) — the trusted
+ * base round-trips untouched. Returns a policy string for the middleware
+ * `csp:` opt. Throws `CspError` on an unknown directive, a hostile directive
+ * name, or a rejected added source.
+ *
+ * @opts
+ *   acknowledgeUnsafe:  boolean,   // allow an added 'unsafe-*' in a script directive
+ *   allowDataImages:    boolean,   // allow an added data: in img-src/media-src/font-src
+ *
+ * @example
+ *   // Admit Stripe on the checkout route's script + frame directives only.
+ *   var routeCsp = b.csp.mergeDirectives(undefined, {
+ *     "script-src": ["https://js.stripe.com"],
+ *     "frame-src":  ["https://js.stripe.com"],
+ *   });
+ *   // -> the strict default with those two hosts appended; everything else unchanged
+ */
+function mergeDirectives(base, additions, opts) {
+  var baseString = base === undefined ? securityHeaderDefaults.DEFAULT_CSP : base;
+  if (typeof baseString !== "string" || baseString.length === 0) {
+    throw new CspError("csp/bad-base",
+      "csp.mergeDirectives: base must be a non-empty CSP string (or undefined to " +
+      "derive from the framework DEFAULT_CSP)");
+  }
+  if (!additions || typeof additions !== "object" || Array.isArray(additions)) {
+    throw new CspError("csp/bad-additions",
+      "csp.mergeDirectives: additions must be an object keyed by CSP directive name, " +
+      "each value a non-empty array of source strings to ADD");
+  }
+  opts = opts || {};
+  validateOpts(opts, ["acknowledgeUnsafe", "allowDataImages"], "csp.mergeDirectives");
+
+  var addKeys = Object.keys(additions);
+  // Validate directive names (proto-safe) + that each addition is a
+  // non-empty array, before touching the base.
+  for (var ki = 0; ki < addKeys.length; ki += 1) {
+    var nm = addKeys[ki];
+    if (pick.isPoisonedKey(nm)) {
+      throw new CspError("csp/bad-directive-name",
+        "csp.mergeDirectives: '" + nm + "' is not a valid directive name");
+    }
+    if (ALL_DIRECTIVES.indexOf(nm) === -1) {
+      throw new CspError("csp/unknown-directive",
+        "csp.mergeDirectives: '" + nm + "' is not a recognized CSP3 directive");
+    }
+    if (!Array.isArray(additions[nm]) || additions[nm].length === 0) {
+      throw new CspError("csp/bad-directive-value",
+        "csp.mergeDirectives: additions['" + nm + "'] must be a non-empty array of sources");
+    }
+  }
+  // Validate ONLY the added sources by routing a throwaway additions-only
+  // map through build() (reuses every per-source rule). build() may seed
+  // Trusted-Types into the copy; we discard its output and keep the original
+  // additions for the merge.
+  var validationMap = {};
+  for (var vk = 0; vk < addKeys.length; vk += 1) validationMap[addKeys[vk]] = additions[addKeys[vk]].slice();
+  build(validationMap, { acknowledgeUnsafe: opts.acknowledgeUnsafe === true,
+                         allowDataImages: opts.allowDataImages === true,
+                         requireTrustedTypes: false });
+
+  var directives = _parseCspString(baseString);
+  for (var ai = 0; ai < addKeys.length; ai += 1) {
+    var name = addKeys[ai];
+    var existing = Object.prototype.hasOwnProperty.call(directives, name)
+      ? directives[name].slice()
+      : (directives["default-src"] ? directives["default-src"].slice() : ["'self'"]);
+    var added = additions[name];
+    // A directive value of 'none' MUST stand alone (CSP3 §2.3.1) — appending a
+    // host to it emits the malformed "'none' https://x". When merging real
+    // sources in, the added sources supersede 'none', so drop it first.
+    if (added.length && existing.length === 1 && existing[0] === "'none'") existing = [];
+    for (var si = 0; si < added.length; si += 1) {
+      if (existing.indexOf(added[si]) === -1) existing.push(added[si]);
+    }
+    directives[name] = existing;
+  }
+  return _emitCanonical(directives);
+}
+
+/**
+ * @primitive  b.csp.mergePermissionsPolicy
+ * @signature  b.csp.mergePermissionsPolicy(base, overrides, opts?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.csp.mergeDirectives, b.csp.build
+ *
+ * Derive a per-route Permissions-Policy from a strict base by replacing the
+ * allowlist of NAMED features only, leaving every other feature at its `()`
+ * deny default. The companion to `mergeDirectives` for the Permissions-Policy
+ * header: re-enable `payment` to `(self "https://js.stripe.com")` on the
+ * checkout route while `camera` / `microphone` / `geolocation` stay denied.
+ *
+ * Each override value is validated as an RFC-9651 feature value-list (`*`,
+ * `()`, `self`, or a parenthesised origin list) — a value carrying a comma or
+ * CR/LF is refused so it can't inject a second feature or a header break. A
+ * feature not present in the base is added (opting it in); one present is
+ * replaced. Returns a header string for the middleware `permissionsPolicy:`
+ * opt. Throws `CspError` on a hostile feature name or a malformed value.
+ *
+ * @opts
+ *   (none)
+ *
+ * @example
+ *   var routePp = b.csp.mergePermissionsPolicy(undefined, {
+ *     payment: '(self "https://js.stripe.com")',
+ *   });
+ *   // -> the strict default with payment re-enabled to that allowlist; all else denied
+ */
+function mergePermissionsPolicy(base, overrides, opts) {
+  var baseString = base === undefined
+    ? securityHeaderDefaults.DEFAULT_PERMISSIONS.join(", ")
+    : base;
+  if (typeof baseString !== "string" || baseString.length === 0) {
+    throw new CspError("csp/bad-base",
+      "csp.mergePermissionsPolicy: base must be a non-empty Permissions-Policy string " +
+      "(or undefined to derive from the framework default)");
+  }
+  if (!overrides || typeof overrides !== "object" || Array.isArray(overrides)) {
+    throw new CspError("csp/bad-overrides",
+      "csp.mergePermissionsPolicy: overrides must be an object keyed by feature name, " +
+      "each value an RFC-9651 allowlist string");
+  }
+  if (opts !== undefined) validateOpts(opts || {}, [], "csp.mergePermissionsPolicy");
+
+  var parsed = _parsePermissionsPolicyString(baseString);
+  var map = parsed.map;
+  var order = parsed.order;
+  var keys = Object.keys(overrides);
+  for (var ki = 0; ki < keys.length; ki += 1) {
+    var feature = keys[ki];
+    if (pick.isPoisonedKey(feature) ||
+        !PP_FEATURE_RE.test(feature)) {                                                          // allow:regex-no-length-cap — anchored token shape (no backtracking); a feature name is a short RFC-9651 token
+      throw new CspError("csp/bad-feature-name",
+        "csp.mergePermissionsPolicy: '" + feature + "' is not a valid feature name");
+    }
+    var value = overrides[feature];
+    if (typeof value !== "string" || !PP_VALUE_RE.test(value)) {                                  // allow:regex-no-length-cap — anchored alternation (no backtracking); a feature value is a short RFC-9651 value-list
+      throw new CspError("csp/bad-feature-value",
+        "csp.mergePermissionsPolicy: " + feature + " value must be one of *, (), self, or a " +
+        "parenthesised origin list (got " + JSON.stringify(value) + ")");
+    }
+    if (!Object.prototype.hasOwnProperty.call(map, feature)) order.push(feature);
+    map[feature] = value;
+  }
+  var out = [];
+  for (var oi = 0; oi < order.length; oi += 1) out.push(order[oi] + "=" + map[order[oi]]);
+  return out.join(", ");
+}
+
 module.exports = {
   build:  build,
+  mergeDirectives:       mergeDirectives,
+  mergePermissionsPolicy: mergePermissionsPolicy,
   nonce:  nonce,
   hash:   hash,
   CspError: CspError,

package/lib/daemon.js

@@ -42,7 +42,6 @@ var nodePath = require("node:path");
 var numericBounds = require("./numeric-bounds");
 var appShutdown = require("./app-shutdown");
 var processSpawn = require("./process-spawn");
-var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
 var atomicFile = require("./atomic-file");
 var validateOpts = require("./validate-opts");
@@ -50,7 +49,7 @@ var C = require("./constants");
 var { boot } = require("./log");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var DaemonError = defineClass("DaemonError", { alwaysPermanent: true });
 var log = boot("daemon");
@@ -63,13 +62,7 @@ var DEFAULT_POLL_MS         = 100;
 var DEFAULT_LOG_FILE_MODE   = 0o600;
 
 function _safeAuditEmit(action, outcome, metadata) {
-  try {
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome || "success",
-      metadata: metadata || {},
-    });
-  } catch (_e) { /* drop-silent — by design */ }
+  auditEmit.emit(action, metadata, outcome);
 }
 
 function _isLivePid(pid) {
@@ -80,48 +73,59 @@ function _isLivePid(pid) {
 
 function _readPidFile(pidFile) {
   try {
-    var raw = nodeFs.readFileSync(pidFile, "utf8");
+    // Same fd-safe + capped + symlink-refusing read as app-shutdown's lockfile
+    // reader (one shape): a PID file is never a legit symlink mount, so
+    // refuseSymlink is safe; any throw → null ("nothing live there").
+    var raw = atomicFile.fdSafeReadSync(pidFile, { maxBytes: C.BYTES.kib(1), refuseSymlink: true, encoding: "utf8" });
     var pid = parseInt(String(raw).trim(), 10);
     return isFinite(pid) && pid > 0 ? pid : null;
   } catch (_e) { return null; }
 }
 
 function _validateStartOpts(opts) {
-  validateOpts.requireObject(opts, "daemon.start", DaemonError, "daemon/bad-opts");
-  validateOpts.requireNonEmptyString(opts.pidFile,
-    "daemon.start: opts.pidFile (absolute path recommended)",
-    DaemonError, "daemon/bad-pid-file");
-  validateOpts.optionalNonEmptyString(opts.logFile,
-    "daemon.start: opts.logFile", DaemonError, "daemon/bad-log-file");
-  validateOpts.optionalNonEmptyStringArray(opts.signals,
-    "daemon.start: opts.signals", DaemonError, "daemon/bad-signals");
-  if (Array.isArray(opts.signals) && opts.signals.length === 0) {
-    throw new DaemonError("daemon/bad-signals",
-      "daemon.start: opts.signals must be a non-empty array of POSIX signal names");
-  }
-  validateOpts.optionalNonEmptyString(opts.command,
-    "daemon.start: opts.command (path to executable)",
-    DaemonError, "daemon/bad-command");
-  if (opts.args !== undefined && !Array.isArray(opts.args)) {
-    throw new DaemonError("daemon/bad-args",
-      "daemon.start: opts.args must be an array of strings when present");
-  }
-  if (opts.command === undefined && opts.args !== undefined) {
-    throw new DaemonError("daemon/bad-args",
-      "daemon.start: opts.args requires opts.command");
-  }
+  validateOpts.shape(opts, {
+    pidFile: { rule: "required-string", code: "daemon/bad-pid-file",
+               label: "daemon.start: opts.pidFile (absolute path recommended)" },
+    logFile: { rule: "optional-string", code: "daemon/bad-log-file",
+               label: "daemon.start: opts.logFile" },
+    signals: function (value) {
+      validateOpts.optionalNonEmptyStringArray(value,
+        "daemon.start: opts.signals", DaemonError, "daemon/bad-signals");
+      if (Array.isArray(value) && value.length === 0) {
+        throw new DaemonError("daemon/bad-signals",
+          "daemon.start: opts.signals must be a non-empty array of POSIX signal names");
+      }
+    },
+    command: { rule: "optional-string", code: "daemon/bad-command",
+               label: "daemon.start: opts.command (path to executable)" },
+    args: function (value) {
+      if (value !== undefined && !Array.isArray(value)) {
+        throw new DaemonError("daemon/bad-args",
+          "daemon.start: opts.args must be an array of strings when present");
+      }
+      if (opts.command === undefined && value !== undefined) {
+        throw new DaemonError("daemon/bad-args",
+          "daemon.start: opts.args requires opts.command");
+      }
+    },
+  }, "daemon.start", DaemonError, "daemon/bad-opts");
 }
 
 function _validateStopOpts(opts) {
-  validateOpts.requireObject(opts, "daemon.stop", DaemonError, "daemon/bad-opts");
-  validateOpts.requireNonEmptyString(opts.pidFile,
-    "daemon.stop: opts.pidFile", DaemonError, "daemon/bad-pid-file");
-  validateOpts.optionalNonEmptyString(opts.signal,
-    "daemon.stop: opts.signal", DaemonError, "daemon/bad-signal");
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.timeoutMs,
-    "daemon.stop: opts.timeoutMs", DaemonError, "daemon/bad-timeout");
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.pollMs,
-    "daemon.stop: opts.pollMs", DaemonError, "daemon/bad-poll");
+  validateOpts.shape(opts, {
+    pidFile: { rule: "required-string", code: "daemon/bad-pid-file",
+               label: "daemon.stop: opts.pidFile" },
+    signal:  { rule: "optional-string", code: "daemon/bad-signal",
+               label: "daemon.stop: opts.signal" },
+    timeoutMs: function (value) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value,
+        "daemon.stop: opts.timeoutMs", DaemonError, "daemon/bad-timeout");
+    },
+    pollMs: function (value) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value,
+        "daemon.stop: opts.pollMs", DaemonError, "daemon/bad-poll");
+    },
+  }, "daemon.stop", DaemonError, "daemon/bad-opts");
 }
 
 function _maybeReapStale(pidFile) {

package/lib/data-act.js

@@ -89,6 +89,32 @@ var DESIGNATED_GATEKEEPERS = Object.freeze([
   "booking",
 ]);
 
+// Is `recipient` a designated DMA gatekeeper? Match the gatekeeper token as a
+// DNS LABEL of the recipient's host authority — any position, including the
+// FINAL label. A substring `indexOf(g + ".")` test missed a gatekeeper that is
+// the last label (e.g. "blog.google" / "drive.google" on the real ".google"
+// TLD, or "data.amazon"), letting an Art 32 §1 third-party share through — and
+// also false-flagged a non-gatekeeper whose name merely contained the token
+// ("notgoogle.com"). Label matching closes the bypass and drops the false
+// positive. A bare name ("Google") still matches exactly. URL / userinfo / port
+// forms are normalized to the host authority first.
+function _isGatekeeperRecipient(recipient) {
+  var s = String(recipient).toLowerCase().trim();
+  var scheme = s.indexOf("://");
+  if (scheme !== -1) s = s.slice(scheme + 3);
+  s = s.split("/")[0].split("?")[0].split("#")[0];   // drop path / query / fragment
+  var at = s.lastIndexOf("@");
+  if (at !== -1) s = s.slice(at + 1);                 // drop userinfo
+  s = s.split(":")[0];                                // drop port
+  if (s.length === 0) return false;
+  var labels = s.split(".");
+  return DESIGNATED_GATEKEEPERS.some(function (g) {
+    if (s === g) return true;
+    for (var i = 0; i < labels.length; i++) { if (labels[i] === g) return true; }
+    return false;
+  });
+}
+
 /**
  * @primitive b.dataAct.declareProduct
  * @signature b.dataAct.declareProduct(opts)
@@ -116,9 +142,12 @@ var DESIGNATED_GATEKEEPERS = Object.freeze([
  *   });
  */
 function declareProduct(opts) {
-  validateOpts.requireObject(opts, "dataAct.declareProduct", DataActError, "dataact/bad-opts");
-  validateOpts.requireNonEmptyString(opts.productId, "productId", DataActError, "dataact/no-product-id");
-  validateOpts.requireNonEmptyString(opts.dataHolder, "dataHolder", DataActError, "dataact/no-data-holder");
+  validateOpts.shape(opts, {
+    productId:   { rule: "required-string", label: "productId",  code: "dataact/no-product-id" },
+    dataHolder:  { rule: "required-string", label: "dataHolder", code: "dataact/no-data-holder" },
+    productKind: "optional-string",
+    dataScope:   "optional-string",
+  }, "dataAct.declareProduct", DataActError, "dataact/bad-opts");
   var kind = opts.productKind || "connected-product";
   if (kind !== "connected-product" && kind !== "related-service") {
     throw new DataActError("dataact/bad-kind",
@@ -218,14 +247,15 @@ function recordUserAccess(opts) {
 function shareWithThirdParty(opts) {
   validateOpts.requireObject(opts, "dataAct.shareWithThirdParty", DataActError, "dataact/bad-opts");
   _requireProduct(opts.productId, "shareWithThirdParty");
-  validateOpts.requireNonEmptyString(opts.userId, "userId", DataActError, "dataact/no-user-id");
-  validateOpts.requireNonEmptyString(opts.recipient, "recipient", DataActError, "dataact/no-recipient");
-  validateOpts.requireNonEmptyString(opts.scope, "scope", DataActError, "dataact/no-scope");
+  validateOpts.shape(opts, {
+    productId:        { rule: "required-string", label: "productId", code: "dataact/no-product-id" },
+    userId:           { rule: "required-string", label: "userId",    code: "dataact/no-user-id" },
+    recipient:        { rule: "required-string", label: "recipient", code: "dataact/no-recipient" },
+    scope:            { rule: "required-string", label: "scope",     code: "dataact/no-scope" },
+    acceptGatekeeper: "optional-plain-object",
+  }, "dataAct.shareWithThirdParty", DataActError, "dataact/bad-opts");
 
-  var recipientLower = opts.recipient.toLowerCase();
-  var isGatekeeper = DESIGNATED_GATEKEEPERS.some(function (g) {
-    return recipientLower === g || recipientLower.indexOf(g + ".") !== -1;
-  });
+  var isGatekeeper = _isGatekeeperRecipient(opts.recipient);
   if (isGatekeeper) {
     if (!opts.acceptGatekeeper || typeof opts.acceptGatekeeper !== "object" ||
         typeof opts.acceptGatekeeper.reason !== "string" ||
@@ -291,9 +321,12 @@ function shareWithThirdParty(opts) {
  *   });
  */
 function recordSwitchRequest(opts) {
-  validateOpts.requireObject(opts, "dataAct.recordSwitchRequest", DataActError, "dataact/bad-opts");
-  validateOpts.requireNonEmptyString(opts.customerId, "customerId", DataActError, "dataact/no-customer-id");
-  validateOpts.requireNonEmptyString(opts.targetProvider, "targetProvider", DataActError, "dataact/no-target");
+  validateOpts.shape(opts, {
+    customerId:       { rule: "required-string", label: "customerId",     code: "dataact/no-customer-id" },
+    targetProvider:   { rule: "required-string", label: "targetProvider", code: "dataact/no-target" },
+    dataSlices:       "optional-string-array",
+    noticePeriodDays: "optional-non-negative",
+  }, "dataAct.recordSwitchRequest", DataActError, "dataact/bad-opts");
   if (!Array.isArray(opts.dataSlices) || opts.dataSlices.length === 0) {
     throw new DataActError("dataact/no-data-slices",
       "recordSwitchRequest: dataSlices must be a non-empty array");

package/lib/db-file-lifecycle.js

@@ -172,8 +172,11 @@ function fileLifecycle(opts) {
     : nodePath.join(opts.dataDir, frameworkFiles.fileName("dbKeyEnc"));
   var flushIntervalMs = opts.flushIntervalMs || DEFAULT_FLUSH_INTERVAL_MS;
   var tmpDir = _resolveTmpDir(opts.tmpDir, opts.allowDiskFallback === true);
-  if (!nodeFs.existsSync(tmpDir)) nodeFs.mkdirSync(tmpDir, { recursive: true });
-  if (!nodeFs.existsSync(opts.dataDir)) nodeFs.mkdirSync(opts.dataDir, { recursive: true });
+  // 0o700 — these hold the DB encryption tmpfs scratch + the data dir
+  // (db.key.enc, the decrypted DB while open); a default-mode mkdir leaves
+  // them group/other-traversable.
+  if (!nodeFs.existsSync(tmpDir)) nodeFs.mkdirSync(tmpDir, { recursive: true, mode: 0o700 });
+  if (!nodeFs.existsSync(opts.dataDir)) nodeFs.mkdirSync(opts.dataDir, { recursive: true, mode: 0o700 });
 
   var dbPath = null;
   var encKey = null;
@@ -183,7 +186,9 @@ function fileLifecycle(opts) {
   function _loadOrGenerateKey() {
     if (encKey) return encKey;
     if (nodeFs.existsSync(keyPath)) {
-      var sealedKey = nodeFs.readFileSync(keyPath, "utf8");
+      // Cap + fd-bound. NO refuseSymlink: dbKeyPath may be an operator-absolute
+      // KMS-fronted volume that legitimately symlinks the sealed key.
+      var sealedKey = atomicFile.fdSafeReadSync(keyPath, { maxBytes: C.BYTES.kib(64), encoding: "utf8" });
       var keyB64;
       try { keyB64 = opts.vault.unseal(sealedKey); }
       catch (e) {
@@ -212,7 +217,10 @@ function fileLifecycle(opts) {
     dbPath = nodePath.join(tmpDir, "blamejs-fl-" + label + "-" +
       generateToken(TMP_NAME_BYTES) + ".db");
     if (nodeFs.existsSync(encPath)) {
-      var packed = nodeFs.readFileSync(encPath);
+      // Cap + fd-bound (deployment-tunable ceiling). NO refuseSymlink: the data
+      // dir may be a symlink-mounted volume (k8s PVC). db.enc is AEAD-checked
+      // downstream, so the cap is the OOM-before-cap defense.
+      var packed = atomicFile.fdSafeReadSync(encPath, { maxBytes: (opts.maxDbBytes) || C.BYTES.gib(2) });
       if (packed.length < 26) {                                                                  // minimum envelope length
         throw new DbFileLifecycleError("db-file-lifecycle/short-envelope",
           "fileLifecycle: " + encPath + " too short to be a valid envelope (" + packed.length + " bytes)");
@@ -248,7 +256,7 @@ function fileLifecycle(opts) {
       catch (_e) { /* best-effort — operators on read-only handles or pre-init still flush */ }
     }
     if (!nodeFs.existsSync(dbPath)) return null;
-    var plain = nodeFs.readFileSync(dbPath);
+    var plain = atomicFile.fdSafeReadSync(dbPath, { maxBytes: (opts.maxDbBytes) || C.BYTES.gib(2) });
     var packed = encryptPacked(plain, encKey, _aad(opts.dataDir, label));
     atomicFile.writeSync(encPath, packed);
     _emitAudit("flushed", "success", { label: label, bytes: plain.length });
@@ -269,7 +277,7 @@ function fileLifecycle(opts) {
       throw new DbFileLifecycleError("db-file-lifecycle/no-source",
         "fileLifecycle.snapshot: " + dbPath + " is missing");
     }
-    var plain = nodeFs.readFileSync(dbPath);
+    var plain = atomicFile.fdSafeReadSync(dbPath, { maxBytes: (opts.maxDbBytes) || C.BYTES.gib(2) });
     return encryptPacked(plain, encKey, _aad(opts.dataDir, label));
   }