@blamejs/core 0.15.12 → 0.15.14

package/lib/db-query.js

@@ -51,6 +51,7 @@ var sql = require("./sql");
 var audit = require("./audit");
 var lazyRequire = require("./lazy-require");
 var { DbQueryError } = require("./framework-error");
+var numericBounds = require("./numeric-bounds");
 
 // Circular load — db.js requires db-query at module scope, so the
 // residency gate reaches back for getDataResidency() lazily.
@@ -682,11 +683,8 @@ class Query {
     var dbModule = require("./db");                                                                    // allow:inline-require — circular-load defense (db imports db-query)
     perCallLimit = dbModule.getStreamLimit();
     if (opts && opts.streamLimit !== undefined) {
-      if (typeof opts.streamLimit !== "number" || !isFinite(opts.streamLimit) ||
-          opts.streamLimit <= 0 || Math.floor(opts.streamLimit) !== opts.streamLimit) {
-        throw new Error("Query.stream: opts.streamLimit must be a positive finite integer; got " +
-          JSON.stringify(opts.streamLimit));
-      }
+      numericBounds.requirePositiveFiniteIntIfPresent(opts.streamLimit,
+        "Query.stream: opts.streamLimit", DbQueryError, "db-query/bad-stream-limit");
       perCallLimit = opts.streamLimit;
     }
     var stmt = this._db.prepare(built.sql);
@@ -1299,41 +1297,9 @@ class WhereBuilder {
 // Single linear pass, no backtracking regex; shares the scan shape with
 // b.safeSql.countPlaceholders.
 function _assertRawNoStringLiteral(rawSql, where) {
-  var i = 0;
-  var len = rawSql.length;
-  while (i < len) {
-    var ch = rawSql.charAt(i);
-    var next = i + 1 < len ? rawSql.charAt(i + 1) : "";
-    if (ch === '"') {
-      i += 1;
-      while (i < len) {
-        if (rawSql.charAt(i) === '"') {
-          if (rawSql.charAt(i + 1) === '"') { i += 2; continue; }
-          i += 1; break;
-        }
-        i += 1;
-      }
-      continue;
-    }
-    if (ch === "-" && next === "-") {
-      while (i < len && rawSql.charAt(i) !== "\n") i += 1;
-      continue;
-    }
-    if (ch === "/" && next === "*") {
-      i += 2;
-      while (i < len && !(rawSql.charAt(i) === "*" && rawSql.charAt(i + 1) === "/")) i += 1;
-      i += 2;
-      continue;
-    }
-    if (ch === "'") {
-      throw new safeSql.SafeSqlError(
-        where + ": raw SQL must not contain a string literal ('...') — bind every " +
-        "value with a ? placeholder, or pass { allowLiterals: true } when the literal " +
-        "is static and operator-controlled.",
-        "sql/raw-literal");
-    }
-    i += 1;
-  }
+  // Routes through the shared safeSql scanner; the default error reproduces
+  // this module's exact SafeSqlError("sql/raw-literal") message.
+  safeSql.assertNoRawStringLiteral(rawSql, where);
 }
 
 // Apply one recorded WhereBuilder part onto a b.sql Predicate. `or`
@@ -1412,12 +1378,62 @@ function _unquoteIdent(s) {
   return s;
 }
 
+// Strip LEADING SQL comments + whitespace so the ^-anchored write-detection
+// regexes see the real statement head. Without this, a residency write smuggled
+// behind a leading "/* x */" or "-- x\n" comment is NOT recognized as a write →
+// the residency gate is skipped entirely (a cross-border-write BYPASS). The
+// executed SQL is unchanged; this normalized copy is only for the gate's parse.
+// Each replace is ^-anchored single-pass; the loop terminates when nothing more
+// is stripped (an unterminated /* leaves the head intact → write still detected
+// or fails closed downstream).
+function _stripLeadingSqlComments(sql) {
+  var s = String(sql), prev;
+  do {
+    prev = s;
+    s = s.replace(/^\s+/, "");                 // allow:regex-no-length-cap — anchored, single leading run
+    s = s.replace(/^--[^\n]*\r?\n?/, "");      // allow:regex-no-length-cap — anchored leading line comment
+    s = s.replace(/^\/\*[\s\S]*?\*\//, "");    // allow:regex-no-length-cap — anchored leading block comment (lazy, single scan)
+  } while (s !== prev);
+  return s;
+}
+
+// Non-anchored write-target scan for the writable-CTE / EXPLAIN-prefixed case.
+// A SQLite `WITH c AS (...) INSERT INTO residents ...` / `WITH ... UPDATE residents
+// SET ...` is a real write, but its effective verb is hidden behind the prefix so
+// the ^-anchored _RAW_WRITE_KEYWORD_RE misses it. This matches every INSERT/REPLACE
+// INTO, MERGE INTO, and UPDATE ... SET target token anywhere in the statement and
+// returns the first that names a residency table — so such a write still ENGAGES
+// the residency gate (_assertRawWriteResidency then fails CLOSED: the ^-anchored
+// body parsers can't read a CTE body, so it throws row-residency-raw-unparseable
+// directing the operator to b.db.from().insertOne/.updateOne). DELETE moves no
+// residency value across a border, so it is not a residency write. Linear scan.
+var _CTE_WRITE_TARGET_RE = /(?:\b(?:INSERT|REPLACE)\s+(?:OR\s+[A-Za-z]+\s+)?INTO|\bMERGE\s+INTO)\s+(?:[\x22\x27\x60]?[A-Za-z_]\w*[\x22\x27\x60]?\s*\.\s*){0,3}[\x22\x27\x60]?([A-Za-z_]\w*)[\x22\x27\x60]?|\bUPDATE\s+(?:[\x22\x27\x60]?[A-Za-z_]\w*[\x22\x27\x60]?\s*\.\s*){0,3}[\x22\x27\x60]?([A-Za-z_]\w*)[\x22\x27\x60]?\s+SET\b/ig;  // allow:regex-no-length-cap — alternation, no nested quantifiers; linear
+function _firstResidencyWriteTarget(s) {
+  _CTE_WRITE_TARGET_RE.lastIndex = 0;
+  var m;
+  while ((m = _CTE_WRITE_TARGET_RE.exec(s)) !== null) {  // allow:regex-no-length-cap
+    var t = _unquoteIdent(m[1] || m[2]);
+    if (t && (cryptoField.getPerRowResidency(t) || cryptoField.getColumnResidency(t))) return t;
+  }
+  return null;
+}
+
 function _rawWriteTable(sql) {
-  // Both regexes are ^-anchored (leading write keyword + table head): they scan
-  // only the statement head, so they are constant-time regardless of SQL length.
-  if (typeof sql !== "string" || !_RAW_WRITE_KEYWORD_RE.test(sql)) return null;  // allow:regex-no-length-cap
-  var m = _RAW_TABLE_RE.exec(sql);  // allow:regex-no-length-cap
-  return m ? _unquoteIdent(m[1] || m[2]) : null;
+  // The ^-anchored regexes scan only the statement head (constant-time). Strip
+  // leading comments first so a commented-out head can't hide the write.
+  if (typeof sql !== "string") return null;
+  var s = _stripLeadingSqlComments(sql);
+  if (_RAW_WRITE_KEYWORD_RE.test(s)) {  // allow:regex-no-length-cap
+    var m = _RAW_TABLE_RE.exec(s);  // allow:regex-no-length-cap
+    return m ? _unquoteIdent(m[1] || m[2]) : null;
+  }
+  // Writable-CTE / EXPLAIN-prefixed write: the effective write verb is hidden
+  // behind the prefix the ^-anchored test misses. If it writes a residency table,
+  // return it so the gate engages and then fails closed on the unparseable body.
+  if (/^\s*(?:WITH|EXPLAIN)\b/i.test(s)) {  // allow:regex-no-length-cap
+    return _firstResidencyWriteTarget(s);
+  }
+  return null;
 }
 
 // Cheap prepare-time pre-check so only writes to a residency table get wrapped.
@@ -1497,17 +1513,23 @@ function _assertRawWriteResidency(sql, boundParams) {
   if (!cryptoField.getPerRowResidency(table) && !cryptoField.getColumnResidency(table)) return;
   boundParams = _flattenRunParams(boundParams);
 
+  // Parse the comment-stripped head: a leading "/* x */" / "-- x" comment must
+  // not hide the INSERT/UPDATE body from the ^-anchored regexes below (that would
+  // let a residency-restricted write through the gate). The executed SQL is
+  // unchanged; this normalized copy is only for residency parsing.
+  var norm = _stripLeadingSqlComments(sql);
+
   // The INSERT/UPDATE body regexes below scan with [\s\S]+; bound the input
   // first and fail CLOSED on an over-long statement - a residency write the
   // framework cannot safely parse must be refused, never let past the gate.
-  if (sql.length > 100000) {
+  if (norm.length > 100000) {
     throw new DbQueryError("db-query/row-residency-raw-unparseable",
       "raw write to residency table '" + table + "' exceeds the parse limit (" +
-      sql.length + " chars) - use b.db.from(\"" + table + "\") so residency is validated", true);
+      norm.length + " chars) - use b.db.from(\"" + table + "\") so residency is validated", true);
   }
 
-  var mi = _RAW_INSERT_RE.exec(sql);  // allow:regex-no-length-cap — input length-capped above
-  var mu = mi ? null : _RAW_UPDATE_RE.exec(sql);  // allow:regex-no-length-cap — input length-capped above
+  var mi = _RAW_INSERT_RE.exec(norm);  // allow:regex-no-length-cap — input length-capped above
+  var mu = mi ? null : _RAW_UPDATE_RE.exec(norm);  // allow:regex-no-length-cap — input length-capped above
   if (!mi && !mu) {
     throw new DbQueryError("db-query/row-residency-raw-unparseable",
       "raw write to residency table '" + table + "' cannot be parsed to validate its " +
@@ -1543,4 +1565,8 @@ module.exports = {
   Query: Query,
   _isRawWriteToResidencyTable: _isRawWriteToResidencyTable,
   _assertRawWriteResidency:    _assertRawWriteResidency,
+  // Shared leading-comment stripper so db.js's storage-low write-gate sees the
+  // real statement head (a `/* x */ INSERT` / WITH-prefixed write must not slip
+  // the ENOSPC gate the way it slipped the residency gate).
+  _stripLeadingSqlComments:    _stripLeadingSqlComments,
 };

package/lib/db.js

@@ -57,7 +57,7 @@ var { generateToken, generateBytes, encryptPacked, decryptPacked, sha3Hash } = r
 var cryptoField = require("./crypto-field");
 var dbDeclareRowPolicy = require("./db-declare-row-policy");
 var dbDeclareView = require("./db-declare-view");
-var { Query, _isRawWriteToResidencyTable, _assertRawWriteResidency } = require("./db-query");
+var { Query, _isRawWriteToResidencyTable, _assertRawWriteResidency, _stripLeadingSqlComments } = require("./db-query");
 var dbSchema = require("./db-schema");
 var { defineClass } = require("./framework-error");
 var frameworkFiles = require("./framework-files");
@@ -161,6 +161,14 @@ var statfsProbe   = null;      // free-space reader (fs.statfsSync; injectable f
 var _exitHandlerRegistered = false;
 var dataDir   = null;
 var initialized = false;
+// Monotonic identity of the live `database` handle. Bumped on every (re)open,
+// close, and reset so a deferred operation that captured the generation while
+// one database was live can detect — before it writes — that the handle has
+// since changed (closed / replaced). Anchors the fix for a fire-and-forget
+// audit.checkpoint() launched by close() whose deferred insert would otherwise
+// land in whatever database is live when its continuation resumes.
+var _dbGenerationCounter = 0;
+function dbGeneration() { return _dbGenerationCounter; }
 var dataResidency = null;   // operator's declared region config (validated by storage backends)
 var subjectTables = [];     // [{ name, subjectField, personalDataCategories }] — for subject.export/erase
 var tableMetadata = {};     // table name → metadata snapshot (PK/FK/sealed/derived) for getTableMetadata
@@ -193,6 +201,7 @@ var RESERVED_TABLE_NAMES = new Set([
   "_blamejs_subject_restrictions",   // allow:hand-rolled-sql — canonical reserved local table-name declaration
   "_blamejs_subject_erasures",       // allow:hand-rolled-sql — canonical reserved local table-name declaration
   "_blamejs_sessions",               // allow:hand-rolled-sql — canonical reserved local table-name declaration
+  "_blamejs_session_valid_from",     // allow:hand-rolled-sql — canonical reserved local table-name declaration
   "_blamejs_jobs",                   // allow:hand-rolled-sql — canonical reserved local table-name declaration
   "_blamejs_migrations",             // allow:hand-rolled-sql — canonical reserved local table-name declaration
   "_blamejs_counters",               // allow:hand-rolled-sql — canonical reserved local table-name declaration
@@ -480,6 +489,23 @@ var FRAMEWORK_SCHEMA = [
     sealedFields:  ["userId", "data"],
     derivedHashes: { userIdHash: { from: "userId" } },
   },
+  {
+    // _blamejs_session_valid_from — per-subject valid-from boundary for
+    // stateless-token revocation (b.session.bump / check / validFrom). Same
+    // dual-storage pattern as _blamejs_sessions: mirrors the cluster-mode DDL
+    // in framework-schema.js so cluster-storage routes to either backend.
+    // subjectHash is the PRIMARY KEY — the plaintext subject id never lands
+    // here. No sealed columns: the hash is non-reversible and the epoch is not
+    // personal data.
+    name: "_blamejs_session_valid_from",   // allow:hand-rolled-sql — canonical local-schema table-name declaration
+    columns: {
+      subjectHash:    "TEXT PRIMARY KEY",
+      validFromEpoch: "INTEGER NOT NULL",
+      updatedAt:      "INTEGER NOT NULL",
+    },
+    indexes: [],
+    sealedFields: [],
+  },
   {
     // _blamejs_api_keys — operator-facing API-key registry. Sealed
     // columns: ownerId / scopes / metadata. The secret never lands
@@ -722,7 +748,7 @@ function loadOrCreateDbKey(dataDirPath, keyPathOverride) {
   var keyPath = keyPathOverride || nodePath.join(dataDirPath, frameworkFiles.fileName("dbKeyEnc"));
   var aad = _dbKeyAad(dataDirPath, keyPath);
   if (nodeFs.existsSync(keyPath)) {
-    var sealed = atomicFile.readSync(keyPath, { encoding: "utf8" }).trim();
+    var sealed = atomicFile.readSync(keyPath, { encoding: "utf8", maxBytes: C.BYTES.kib(64) }).trim();
     var b64;
     // isAadSealed is checked FIRST and is load-bearing: AAD_PREFIX
     // ("vault.aad:") is NOT a prefix of VAULT_PREFIX ("vault:"), so a
@@ -785,7 +811,10 @@ function decryptToTmp() {
       try { nodeFs.unlinkSync(dbPath + "-shm"); } catch (_e) { /* may not exist */ }
     }
   }
-  var packed = nodeFs.readFileSync(encPath);
+  // Cap + fd-bound db.enc read at db.init. NO refuseSymlink: the data dir may be
+  // a symlink-mounted volume (k8s PVC). db.enc is AEAD-verified downstream, so
+  // the cap is the OOM-before-cap defense (was an uncapped read).
+  var packed = atomicFile.fdSafeReadSync(encPath, { maxBytes: C.BYTES.gib(2) });
   if (packed.length < 26) return; // too short to be a valid envelope
   // AAD binds the envelope to this deployment's data dir so two
   // installs sharing the same operator passphrase can't swap each
@@ -864,11 +893,27 @@ function _probeStorageHeadroom() {
 // DELETE, PRAGMA, and DDL pass through ungated. Called once in init() after
 // schema setup so init's own writes are never gated (writesRefused is false
 // until the first probe anyway).
+// A growth write for the storage-low gate: INSERT/UPDATE/REPLACE at the head
+// AFTER stripping leading comments, OR a writable-CTE / EXPLAIN-prefixed write
+// (`WITH c AS (...) INSERT INTO t ...`) whose effective verb places rows. The
+// leading-keyword-only test missed both a `/* x */ INSERT` and a WITH-prefixed
+// growth write, letting them proceed into a near-full tmpfs (the ENOSPC the gate
+// exists to prevent). Matches write SYNTAX (INTO / UPDATE..SET) so a WITH..SELECT
+// carrying the word "insert" in a value is not refused.
+function _isGrowthWrite(sql) {
+  if (typeof sql !== "string") return false;
+  var s = _stripLeadingSqlComments(sql);
+  if (/^\s*(?:INSERT|UPDATE|REPLACE)\b/i.test(s)) return true;
+  if (/^\s*(?:WITH|EXPLAIN)\b/i.test(s) &&
+      /\b(?:(?:INSERT|REPLACE|MERGE)\s+(?:OR\s+[A-Za-z]+\s+)?INTO|UPDATE\s+[\w".`]+\s+SET)\b/i.test(s)) return true;
+  return false;
+}
+
 function _installWriteGate() {
   var rawPrepare = database.prepare.bind(database);
   database.prepare = function (sql) {
     var stmt = rawPrepare(sql);
-    if (/^\s*(?:INSERT|UPDATE|REPLACE)\b/i.test(sql)) {
+    if (_isGrowthWrite(sql)) {
       var rawRun = stmt.run.bind(stmt);
       stmt.run = function () {
         if (writesRefused) {
@@ -889,7 +934,7 @@ function encryptToDisk() {
   // Force WAL checkpoint so the .db file holds all committed transactions.
   try { runSql(database, "PRAGMA wal_checkpoint(TRUNCATE)"); } catch (_e) { /* best effort */ }
   if (!nodeFs.existsSync(dbPath)) return;
-  atomicFile.writeSync(encPath, encryptPacked(nodeFs.readFileSync(dbPath), encKey, _dbEncAad(dataDir)));
+  atomicFile.writeSync(encPath, encryptPacked(atomicFile.fdSafeReadSync(dbPath, { maxBytes: C.BYTES.gib(2) }), encKey, _dbEncAad(dataDir)));
 }
 
 /**
@@ -926,7 +971,7 @@ function snapshot() {
     throw _dbErr("db/snapshot-no-source",
       "snapshot: plaintext DB at " + dbPath + " is missing — did init complete?");
   }
-  var plain = nodeFs.readFileSync(dbPath);
+  var plain = atomicFile.fdSafeReadSync(dbPath, { maxBytes: C.BYTES.gib(2) });
   if (!encPath || !encKey) {
     // atRest: 'plain' — return the raw bytes. Operators wanting an
     // encrypted snapshot under plain mode wrap with their own
@@ -1043,12 +1088,8 @@ async function init(opts) {
   // on bad shape so a typo surfaces at boot rather than as an
   // unbounded stream at first export.
   if (opts.streamLimit !== undefined) {
-    if (typeof opts.streamLimit !== "number" || !isFinite(opts.streamLimit) ||
-        opts.streamLimit <= 0 || Math.floor(opts.streamLimit) !== opts.streamLimit) {
-      throw new DbError("db/bad-init",
-        "db.init: streamLimit must be a positive finite integer; got " +
-        JSON.stringify(opts.streamLimit));
-    }
+    require("./numeric-bounds").requirePositiveFiniteIntIfPresent(opts.streamLimit,
+      "db.init: streamLimit", DbError, "db/bad-init");
     streamLimit = opts.streamLimit;
   }
   // Column-membership gate mode — throw at config-time on a typo so it
@@ -1171,6 +1212,7 @@ async function init(opts) {
       sqlLength: C.BYTES.mib(1),
     },
   });
+  _dbGenerationCounter++;   // a new live handle — see dbGeneration()
 
   // Performance pragmas
   runSql(database, "PRAGMA journal_mode=WAL");
@@ -1813,12 +1855,8 @@ function stream(sql) {
   // typo surfaces instead of an unbounded stream.
   var perCallLimit = streamLimit;
   if (opts && opts.streamLimit !== undefined) {
-    if (typeof opts.streamLimit !== "number" || !isFinite(opts.streamLimit) ||
-        opts.streamLimit <= 0 || Math.floor(opts.streamLimit) !== opts.streamLimit) {
-      throw new DbError("db/bad-stream-limit",
-        "db.stream: opts.streamLimit must be a positive finite integer; got " +
-        JSON.stringify(opts.streamLimit));
-    }
+    require("./numeric-bounds").requirePositiveFiniteIntIfPresent(opts.streamLimit,
+      "db.stream: opts.streamLimit", DbError, "db/bad-stream-limit");
     perCallLimit = opts.streamLimit;
   }
 
@@ -2355,6 +2393,7 @@ function close() {
   // boot (integrity-probed, falling back to db.enc if it is itself corrupt).
   if (atRest === "encrypted" && encryptOk) removePlaintextFiles();
   database = null;
+  _dbGenerationCounter++;   // handle gone — invalidate any deferred op that captured the prior generation
   initialized = false;
 }
 
@@ -2591,14 +2630,12 @@ function declareRequireDualControl(args) {
   }
   var m = args.m === undefined ? 2 : args.m;
   var n = args.n === undefined ? Math.max(2, m) : args.n;
-  if (typeof m !== "number" || !isFinite(m) || m < 2 || Math.floor(m) !== m) {
-    throw new DbError("db/dual-control-bad-quorum",
-      "declareRequireDualControl: m must be an integer >= 2");
-  }
-  if (typeof n !== "number" || !isFinite(n) || n < m || Math.floor(n) !== n) {
-    throw new DbError("db/dual-control-bad-quorum",
-      "declareRequireDualControl: n must be an integer >= m");
-  }
+  // m >= 2, n >= m, both integers — via numericBounds (matches db.js's existing
+  // inline numeric-bounds usage; throws DbError("db/dual-control-bad-quorum")).
+  require("./numeric-bounds").requirePositiveFiniteInt(m,
+    "declareRequireDualControl: m", DbError, "db/dual-control-bad-quorum", { min: 2 });
+  require("./numeric-bounds").requirePositiveFiniteInt(n,
+    "declareRequireDualControl: n", DbError, "db/dual-control-bad-quorum", { min: m });
   if (args.posture !== undefined && args.posture !== null &&
       (typeof args.posture !== "string" || args.posture.length === 0)) {
     throw new DbError("db/dual-control-bad-posture",
@@ -2765,7 +2802,7 @@ function _checkRollback(dataDirPath) {
   }
   var tip;
   try {
-    tip = safeJson.parse(atomicFile.readSync(tipPath), { schema: AUDIT_TIP_SCHEMA });
+    tip = safeJson.parse(atomicFile.readSync(tipPath, { maxBytes: C.BYTES.kib(64) }), { schema: AUDIT_TIP_SCHEMA });
   } catch (e) {
     throw _dbErr("db/audit-tip-unreadable",
       "FATAL: audit.tip unreadable or schema-invalid at " + tipPath + " — " + e.message +
@@ -2879,6 +2916,7 @@ function _resetForTest() {
   try { if (database) database.close(); }
   catch (e) { log.debug("test-reset close failed", { error: e.message }); }
   database = null;
+  _dbGenerationCounter++;   // handle gone — see dbGeneration()
   dbPath = null;
   encPath = null;
   encKey = null;
@@ -3308,6 +3346,7 @@ function getActivePosture() { return _activePosture; }
 
 module.exports = {
   init:                init,
+  _dbGeneration:       dbGeneration,
   applyPosture:        applyPosture,
   getActivePosture:    getActivePosture,
   vacuumAfterErase:    vacuumAfterErase,

package/lib/dbsc.js

@@ -198,12 +198,11 @@ function verifyBindingAssertion(assertion, opts) {
   // import boundary (alg-confusion defense — JWT_KEY_CONFUSION-class
   // attacks pass an HS256 jwk for an ES256-claimed token).
   jwtExternal._assertAlgKtyMatch(headerJson.alg, headerJson.jwk);
-  var pubKey;
-  try { pubKey = nodeCrypto.createPublicKey({ key: headerJson.jwk, format: "jwk" }); }
-  catch (e) {
-    throw new DbscError("dbsc/bad-jwk",
-      "verifyBindingAssertion: jwk could not be imported: " + ((e && e.message) || String(e)));
-  }
+  var pubKey = bCrypto.importPublicJwk(headerJson.jwk, {
+    errorClass:    DbscError,
+    code:          "dbsc/bad-jwk",
+    messagePrefix: "verifyBindingAssertion: jwk could not be imported: ",
+  });
   var signingInput = parts[0] + "." + parts[1];
   var sigBytes = Buffer.from(parts[2], "base64url");
   var ok;

package/lib/ddl-change-control.js

@@ -207,20 +207,24 @@ function _memoryStore() {
  */
 function create(opts) {
   opts = opts || {};
-  validateOpts(opts, [
-    "audit", "approvers", "windowSpec", "posture", "signWith",
-    "verifyWith", "store", "now", "selfApproval",
-  ], "ddlChangeControl.create");
-  validateOpts.auditShape(opts.audit, "ddlChangeControl",
-    DdlChangeControlError, "ddl-change-control/bad-audit");
-  validateOpts.optionalFunction(opts.signWith,
-    "ddlChangeControl: signWith", DdlChangeControlError, "ddl-change-control/bad-signer");
-  validateOpts.optionalFunction(opts.verifyWith,
-    "ddlChangeControl: verifyWith", DdlChangeControlError, "ddl-change-control/bad-verifier");
-  validateOpts.optionalFunction(opts.now,
-    "ddlChangeControl: now", DdlChangeControlError, "ddl-change-control/bad-now");
-  validateOpts.optionalNonEmptyString(opts.posture,
-    "ddlChangeControl: posture", DdlChangeControlError, "ddl-change-control/bad-posture");
+  validateOpts.shape(opts, {
+    audit: function (value) {
+      validateOpts.auditShape(value, "ddlChangeControl",
+        DdlChangeControlError, "ddl-change-control/bad-audit");
+    },
+    signWith:   { rule: "optional-function", code: "ddl-change-control/bad-signer" },
+    verifyWith: { rule: "optional-function", code: "ddl-change-control/bad-verifier" },
+    now:        { rule: "optional-function", code: "ddl-change-control/bad-now" },
+    posture:    { rule: "optional-string",   code: "ddl-change-control/bad-posture" },
+    // approvers / windowSpec / store keep their own bespoke validation in
+    // the factory body (distinct error codes, floor semantics, the window
+    // grammar parser, the silent in-memory fallback) — declared here so the
+    // exhaustive contract accepts them while the body remains authoritative.
+    approvers:    function () {},
+    windowSpec:   function () {},
+    store:        function () {},
+    selfApproval: { rule: "optional-boolean", code: "ddl-change-control/bad-self-approval" },
+  }, "ddlChangeControl", DdlChangeControlError, "ddl-change-control/bad-posture");
 
   var approvers = 2;
   if (opts.approvers !== undefined) {

package/lib/deprecate.js

@@ -48,6 +48,7 @@
 
 var safeEnv = require("./parsers/safe-env");
 var validateOpts = require("./validate-opts");
+var boundedMap = require("./bounded-map");
 var { FrameworkError } = require("./framework-error");
 
 class DeprecateError extends FrameworkError {
@@ -131,9 +132,8 @@ function warn(name, opts) {
   _validateOpts(opts, "warn");
 
   var key = name + ":" + opts.since;
-  var entry = _seen.get(key);
-  if (!entry) {
-    entry = {
+  var entry = boundedMap.getOrInsert(_seen, key, function () {
+    return {
       name:      name,
       since:     opts.since,
       removeIn:  opts.removeIn,
@@ -142,8 +142,7 @@ function warn(name, opts) {
       callCount: 0,
       firstSeen: new Date().toISOString(),
     };
-    _seen.set(key, entry);
-  }
+  });
   entry.callCount++;
 
   var mode = _modeFromEnv();

package/lib/did.js

@@ -46,6 +46,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var bCrypto = require("./crypto");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -380,8 +381,11 @@ function _jwkToKey(jwk) {
     throw new DidError("did/unsupported-key",
       "did: verificationMethod publicKeyJwk has unsupported kty/crv (" + jwk.kty + "/" + jwk.crv + ")");
   }
-  try { return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }
-  catch (e) { throw new DidError("did/bad-key", "did: verificationMethod publicKeyJwk is invalid: " + ((e && e.message) || e)); }
+  return bCrypto.importPublicJwk(jwk, {
+    errorClass:    DidError,
+    code:          "did/bad-key",
+    messagePrefix: "did: verificationMethod publicKeyJwk is invalid: ",
+  });
 }
 
 // Extract verification methods from a DID document → KeyObjects.

package/lib/dora.js

@@ -62,12 +62,19 @@ var SIGNIFICANT_INCIDENT_THRESHOLDS = Object.freeze({
   durationCriticalProcessMs:    C.TIME.hours(2),                                 // 2h
 });
 
-// Article 19 — initial report deadline: 24h from "first awareness".
-// Article 19(4) — intermediate update: within 72h of initial.
-// Article 19(6) — final report: within 1 month of initial.
-var INITIAL_REPORT_DEADLINE_MS      = C.TIME.hours(24);
-var INTERMEDIATE_REPORT_DEADLINE_MS = C.TIME.hours(72);
-var FINAL_REPORT_DEADLINE_MS        = C.TIME.days(30);
+// DORA major-incident reporting timeline (Art. 19 + RTS (EU) 2024/1772 Art. 5):
+//   - Initial notification: as early as possible and WITHIN 4 HOURS of
+//     classifying the incident as major (the outer bound is 24h from first
+//     awareness). classify() returns mustReportInitialByMs as a duration FROM
+//     classification, so the operative window encoded here is 4h — the
+//     24h-from-awareness outer bound is enforced separately via
+//     INITIAL_REPORT_OUTER_DEADLINE_MS below.
+//   - Intermediate update: within 72h of the INITIAL notification's submission.
+//   - Final report: within 1 month of the intermediate report's submission.
+var INITIAL_REPORT_DEADLINE_MS       = C.TIME.hours(4);
+var INITIAL_REPORT_OUTER_DEADLINE_MS = C.TIME.hours(24);
+var INTERMEDIATE_REPORT_DEADLINE_MS  = C.TIME.hours(72);
+var FINAL_REPORT_DEADLINE_MS         = C.TIME.days(30);
 
 // Adjacent-regulation incident-reporting deadlines — operators wiring
 // NIS2 / CRA / HIPAA breach notification reach for these constants
@@ -124,14 +131,26 @@ function _classifyImpl(input) {
     reasons.push("severity-high");
   }
 
-  // 2. Affected clients (absolute).
+  // 2. Affected clients — absolute count OR share of the client base. The
+  //    percentile thresholds (RTS 2024/1772 Art. 1(1)(a): >10% major, ESA-
+  //    guideline 1% significant) were declared but never evaluated, so a
+  //    large-share-but-small-absolute incident (e.g. 16% of a 50k client base)
+  //    under-classified. Operators pass clientBase (total clients) to enable
+  //    the percentage criterion; absolute-only behavior is unchanged when it
+  //    is omitted.
   if (typeof input.affectedClients === "number" && input.affectedClients > 0) {
-    if (input.affectedClients >= MAJOR_INCIDENT_THRESHOLDS.affectedClientsAbsolute) {
+    var clientBase = (typeof input.clientBase === "number" && input.clientBase > 0) ? input.clientBase : null;
+    var clientPct = clientBase ? (input.affectedClients / clientBase) : 0;
+    var majorByClients = input.affectedClients >= MAJOR_INCIDENT_THRESHOLDS.affectedClientsAbsolute ||
+      (clientBase !== null && clientPct >= MAJOR_INCIDENT_THRESHOLDS.affectedClientsPercentile);
+    var significantByClients = input.affectedClients >= SIGNIFICANT_INCIDENT_THRESHOLDS.affectedClientsAbsolute ||
+      (clientBase !== null && clientPct >= SIGNIFICANT_INCIDENT_THRESHOLDS.affectedClientsPercentile);
+    if (majorByClients) {
       hitsMajor += 1;
-      reasons.push("clients-major-absolute");
-    } else if (input.affectedClients >= SIGNIFICANT_INCIDENT_THRESHOLDS.affectedClientsAbsolute) {
+      reasons.push("clients-major");
+    } else if (significantByClients) {
       hitsSignificant += 1;
-      reasons.push("clients-significant-absolute");
+      reasons.push("clients-significant");
     }
   }
 
@@ -188,7 +207,11 @@ function _classifyImpl(input) {
   return {
     classification:        classification,
     mustReport:            mustReport,
+    // Operative initial-notification window: 4h from this classification.
     mustReportInitialByMs: mustReport ? INITIAL_REPORT_DEADLINE_MS : null,
+    // Outer bound: no later than 24h from first awareness — surfaced so an
+    // operator scheduling from `detectedAt` can enforce min(class+4h, aware+24h).
+    mustReportInitialOuterByMs: mustReport ? INITIAL_REPORT_OUTER_DEADLINE_MS : null,
     reasons:               reasons,
   };
 }
@@ -343,10 +366,16 @@ function create(opts) {
       // Article 19 deadline — operator-side scheduler uses this.
       nextStageDueAt:    null,
     };
+    // Anchor each downstream deadline on the SUBMISSION time of the report
+    // being filed (record.reportedAt), not on detectedAt: the intermediate is
+    // due 72h after the initial is *submitted*, and the final one month after
+    // the intermediate is *submitted* (DORA RTS 2024/1772 reporting timeline).
+    // Anchoring on detectedAt understates the deadline whenever a report is
+    // filed later than detection.
     if (input.stage === "initial") {
-      record.nextStageDueAt = input.detectedAt + INTERMEDIATE_REPORT_DEADLINE_MS;
+      record.nextStageDueAt = record.reportedAt + INTERMEDIATE_REPORT_DEADLINE_MS;
     } else if (input.stage === "intermediate") {
-      record.nextStageDueAt = input.detectedAt + FINAL_REPORT_DEADLINE_MS;
+      record.nextStageDueAt = record.reportedAt + FINAL_REPORT_DEADLINE_MS;
     }
     _emit("dora.incident.reported", {
       metadata: {
@@ -396,6 +425,7 @@ module.exports = {
   MAJOR_INCIDENT_THRESHOLDS:           MAJOR_INCIDENT_THRESHOLDS,
   SIGNIFICANT_INCIDENT_THRESHOLDS:     SIGNIFICANT_INCIDENT_THRESHOLDS,
   INITIAL_REPORT_DEADLINE_MS:          INITIAL_REPORT_DEADLINE_MS,
+  INITIAL_REPORT_OUTER_DEADLINE_MS:    INITIAL_REPORT_OUTER_DEADLINE_MS,
   INTERMEDIATE_REPORT_DEADLINE_MS:     INTERMEDIATE_REPORT_DEADLINE_MS,
   FINAL_REPORT_DEADLINE_MS:            FINAL_REPORT_DEADLINE_MS,
   DEADLINES_NIS2:                      DEADLINES_NIS2,

package/lib/dr-runbook.js

@@ -275,7 +275,7 @@ async function emit(opts) {
     "drRunbook.emit: outDir", DrRunbookError, "dr-runbook/no-outdir");
   validateOpts.requireNonEmptyString(opts.posture,
     "drRunbook.emit: posture", DrRunbookError, "dr-runbook/no-posture");
-  if (!POSTURE_BLOCKS[opts.posture]) {
+  if (!Object.prototype.hasOwnProperty.call(POSTURE_BLOCKS, opts.posture)) {
     throw new DrRunbookError("dr-runbook/unknown-posture",
       "drRunbook.emit: posture '" + opts.posture + "' not in supported list (" +
       Object.keys(POSTURE_BLOCKS).join(", ") + ")");

package/lib/dsa.js

@@ -36,6 +36,7 @@
 
 var validateOpts = require("./validate-opts");
 var lazyRequire = require("./lazy-require");
+var numericBounds = require("./numeric-bounds");
 var C = require("./constants");
 var { DsaError } = require("./framework-error");
 
@@ -414,7 +415,7 @@ function transparencyReport(opts) {
   METRIC_FIELDS.forEach(function (field) {
     var v = supplied[field];
     if (v === undefined || v === null) { metrics[field] = 0; return; }
-    if (typeof v !== "number" || !isFinite(v) || v < 0 || Math.floor(v) !== v) {
+    if (!numericBounds.isNonNegativeFiniteInt(v)) {
       throw new DsaError("dsa/bad-metric-value",
         "b.dsa.transparencyReport: metrics." + field +
         " must be a non-negative integer, got " +