@blamejs/core 0.15.12 → 0.15.14

package/lib/dsr.js

@@ -114,6 +114,7 @@ var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");
+var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
 var DsrError = defineClass("DsrError", { alwaysPermanent: true });
@@ -209,7 +210,7 @@ var POSTURE_DEADLINE_MS = Object.freeze({
 // + extension). Read-only at module scope.
 function _deadlineForPosture(posture) {
   if (typeof posture !== "string") return POSTURE_DEADLINE_MS["default"];
-  return POSTURE_DEADLINE_MS[posture] || POSTURE_DEADLINE_MS["default"];
+  return Object.prototype.hasOwnProperty.call(POSTURE_DEADLINE_MS, posture) ? POSTURE_DEADLINE_MS[posture] : POSTURE_DEADLINE_MS["default"];
 }
 
 function _now() { return Date.now(); }
@@ -372,10 +373,7 @@ function create(opts) {
     } catch (_e) { /* drop-silent — audit sink */ }
   }
 
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("dsr." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitMetric = observability().namespaced("dsr");
 
   function _newTicketId() {
     var ts = String(Date.now()).slice(-7);                                         // last 7 chars of unix-ms timestamp; collision-resistant when paired with the random suffix
@@ -894,10 +892,10 @@ function memoryTicketStore() {
   var byId = new Map();
   return {
     insert: async function (ticket) {
-      if (byId.has(ticket.id)) {
+      boundedMap.requireAbsent(byId, ticket.id, function () {
         throw new DsrError("dsr/duplicate-ticket-id",
           "memoryTicketStore: duplicate ticket id " + ticket.id);
-      }
+      });
       byId.set(ticket.id, Object.assign({}, ticket));
     },
     get: async function (id) {
@@ -919,10 +917,10 @@ function memoryTicketStore() {
       return out;
     },
     update: async function (id, ticket) {
-      if (!byId.has(id)) {
+      boundedMap.requirePresent(byId, id, function () {
         throw new DsrError("dsr/ticket-not-found",
           "memoryTicketStore: ticket " + id + " not found for update");
-      }
+      });
       byId.set(id, Object.assign({}, ticket));
     },
     delete: async function (id) {
@@ -1023,10 +1021,8 @@ function _ensureDsrSealTable() {
 function dbTicketStore(opts) {
   opts = opts || {};
   var db = opts.db;
-  if (!db || typeof db.runSql !== "function" || typeof db.prepare !== "function") {
-    throw new DsrError("dsr/bad-db",
-      "dbTicketStore: opts.db must be a b.db-shaped handle (with runSql + prepare)");
-  }
+  validateOpts.requireMethods(db, ["runSql", "prepare"],
+    "dbTicketStore: opts.db (b.db-shaped handle)", DsrError, "dsr/bad-db");
   var tableRaw = opts.table || "dsr_tickets";
   var qTable, qEmailIdx, qStatusIdx;
   try {
@@ -1202,12 +1198,26 @@ function dbTicketStore(opts) {
     SUBJECT_FILTER_SPEC.forEach(function (spec) {
       var supplied = filter.subject[spec.key];
       if (!supplied) return;
-      var column = vaulted ? spec.hashCol : spec.plainCol;
-      var match  = vaulted
-        ? (function () { var d = cryptoField().computeDerived(DSR_SEAL_TABLE, spec.sealField, supplied); return d ? d.value : null; })()
-        : supplied;
-      conds.push(column + " = " + spec.param);
-      params[spec.param] = match;
+      if (!vaulted) {
+        conds.push(spec.plainCol + " = " + spec.param);
+        params[spec.param] = supplied;
+        return;
+      }
+      // Vaulted: match BOTH the active keyed-MAC digest AND the legacy
+      // salted-sha3 digest via the dual-read, so a ticket written before the
+      // keyed-MAC default flip is still FOUND. A single-value equality on the
+      // keyed-MAC digest silently skips those pre-flip rows, so an Art.17
+      // erasure purge (list-by-subject → delete) would leave the subject's
+      // legacy-hashed PII-bearing tickets behind. Mirrors subject.eraseHard.
+      var cand = cryptoField().lookupHashCandidates(DSR_SEAL_TABLE, spec.sealField, supplied);
+      var values = cand && cand.values ? cand.values : [];
+      if (values.length === 0) return;
+      var placeholders = values.map(function (v, i) {
+        var p = spec.param + "_" + i;
+        params[p] = v;
+        return p;
+      });
+      conds.push(spec.hashCol + " IN (" + placeholders.join(", ") + ")");
     });
   }
 
@@ -1459,7 +1469,7 @@ var STATE_RULES = Object.freeze({
 function stateRules(state) {
   if (typeof state !== "string" || state.length === 0) return null;
   // Direct posture-name lookup first
-  if (STATE_RULES[state]) return Object.assign({}, STATE_RULES[state]);
+  if (Object.prototype.hasOwnProperty.call(STATE_RULES, state)) return Object.assign({}, STATE_RULES[state]);
   // 2-letter state abbreviation lookup (case-insensitive)
   var u = state.toUpperCase();
   var keys = Object.keys(STATE_RULES);

package/lib/early-hints.js

@@ -170,6 +170,13 @@ function send(res, opts) {
       throw new EarlyHintsError("early-hints/bad-header-value",
         "earlyHints.send: header '" + name + "' must be a string or string[]", true);
     }
+    var vals = Array.isArray(canonical[name]) ? canonical[name] : [canonical[name]];
+    for (var vi = 0; vi < vals.length; vi += 1) {
+      if (typeof vals[vi] === "string" && _hasHeaderInjection(vals[vi])) {
+        throw new EarlyHintsError("early-hints/bad-header-value",
+          "earlyHints.send: header '" + name + "' value contains a CR/LF/NUL header-injection character", true);
+      }
+    }
     headers[name] = canonical[name];
   }
 
@@ -182,9 +189,21 @@ function send(res, opts) {
   }
 }
 
+// A header value reaching res.writeEarlyHints must carry no CR/LF/NUL — those
+// split the interim response into attacker-chosen headers. Node rejects them
+// too, but screen defensively (matching the cookies / security-headers
+// boundary) so the framework surfaces a typed error, not a raw Node throw.
+function _hasHeaderInjection(s) {
+  return s.indexOf("\r") !== -1 || s.indexOf("\n") !== -1 || s.indexOf("\0") !== -1;
+}
+
 function _validateLink(linkValue, idx) {
   validateOpts.requireNonEmptyString(linkValue, "earlyHints.send.link[" + idx + "]",
     EarlyHintsError, "early-hints/bad-link");
+  if (_hasHeaderInjection(linkValue)) {
+    throw new EarlyHintsError("early-hints/bad-link",
+      "link[" + idx + "] contains a CR/LF/NUL header-injection character");
+  }
   if (linkValue.length > LINK_MAX_BYTES) {
     throw new EarlyHintsError("early-hints/bad-link",
       "link[" + idx + "] exceeds " + LINK_MAX_BYTES + " bytes");

package/lib/eat.js

@@ -205,7 +205,11 @@ async function verify(eat, opts) {
   // Debug status — refuse a token that can't prove debug is disabled.
   if (opts.requireDebugDisabled === true) {
     var ds = raw.get(EAT.dbgstat);
-    if (typeof ds !== "number" || ds < DBGSTAT.disabled) {
+    // Accept ONLY a defined disabled enum value (1..4). `ds < disabled` alone
+    // let any out-of-range value >= 1 (5, 99, non-integers) pass as "disabled"
+    // — a fail-open on an undefined dbgstat (RFC 9711 §3.3 defines 0..4 only).
+    if (typeof ds !== "number" || !Number.isInteger(ds) ||
+        ds < DBGSTAT.disabled || ds > DBGSTAT["disabled-fully-and-permanently"]) {
       throw new EatError("eat/debug-not-disabled",
         "eat.verify: requireDebugDisabled — dbgstat is " +
         (ds === undefined ? "absent" : (DBGSTAT_BY_VALUE[ds] || ds)) + ", not a disabled state");

package/lib/external-db-migrate.js

@@ -49,6 +49,7 @@
  *   - externaldb.migrate.lock.released   { holder }
  */
 var nodePath = require("node:path");
+var moduleLoader = require("./module-loader");
 var atomicFile = require("./atomic-file");
 var canonicalJson = require("./canonical-json");
 var { sha3Hash } = require("./crypto");
@@ -379,19 +380,10 @@ function _list(dir) {
 }
 
 function _loadMigration(file, dir) {
-  var fullPath = nodePath.join(dir, file);
-  // Drop the require cache so a test/dev that edits a file picks up the
-  // new content. Matches lib/migrations.js semantics.
-  try { delete require.cache[require.resolve(fullPath)]; } catch (_e) { /* not yet cached */ }
-  var mod;
-  // Operator-supplied migration file — dynamic by design, won't survive
-  // SEA / pkg bundling. External DB migration tooling is host-CLI scope,
-  // not framework-internal scope.
-  try { mod = require(fullPath); }   // allow:dynamic-require — operator-supplied migration
-  catch (e) {
-    throw _err("externaldb-migrate/load-failed",
+  var mod = moduleLoader.requireFresh(nodePath.join(dir, file), function (e) {
+    return _err("externaldb-migrate/load-failed",
       "migration '" + file + "' failed to load: " + ((e && e.message) || String(e)));
-  }
+  });
   if (!mod || typeof mod.up !== "function") {
     throw _err("externaldb-migrate/missing-up",
       "migration '" + file + "' must export an `up(xdb, ctx)` function");
@@ -437,16 +429,23 @@ function _resolveBackendName(opts) {
 
 function create(opts) {
   opts = opts || {};
-  validateOpts(opts, [
-    "dir", "backend", "audit", "staleAfterMs",
-    "schemaIntrospect", "ranBy", "signHistory",
-  ], "b.externalDb.migrate");
-  validateOpts.requireNonEmptyString(opts.dir, "externalDb.migrate.create: opts.dir (path to migrations directory)", ExternalDbMigrateError, "externaldb-migrate/no-dir");
-  validateOpts.optionalFiniteNonNegative(opts.staleAfterMs, "externalDb.migrate: staleAfterMs", ExternalDbMigrateError, "externaldb-migrate/bad-stale");
-  validateOpts.auditShape(opts.audit, "externalDb.migrate", ExternalDbMigrateError, "externaldb-migrate/bad-audit");
-  validateOpts.optionalFunction(opts.schemaIntrospect,
-    "externalDb.migrate: schemaIntrospect", ExternalDbMigrateError,
-    "externaldb-migrate/bad-introspect");
+  validateOpts.shape(opts, {
+    dir: { rule: "required-string", code: "externaldb-migrate/no-dir",
+           label: "externalDb.migrate.create: opts.dir (path to migrations directory)" },
+    staleAfterMs: { rule: "optional-non-negative", code: "externaldb-migrate/bad-stale",
+                    label: "externalDb.migrate: staleAfterMs" },
+    audit: function (value) {
+      validateOpts.auditShape(value, "externalDb.migrate", ExternalDbMigrateError, "externaldb-migrate/bad-audit");
+    },
+    schemaIntrospect: { rule: "optional-function", code: "externaldb-migrate/bad-introspect",
+                        label: "externalDb.migrate: schemaIntrospect" },
+    backend: { rule: "optional-string", code: "externaldb-migrate/bad-backend",
+               label: "externalDb.migrate: backend (externalDb backend name)" },
+    ranBy: { rule: "optional-string", code: "externaldb-migrate/bad-ran-by",
+             label: "externalDb.migrate: ranBy (schema-history actor)" },
+    signHistory: { rule: "optional-boolean", code: "externaldb-migrate/bad-sign-history",
+                   label: "externalDb.migrate: signHistory" },
+  }, "externalDb.migrate", ExternalDbMigrateError, "externaldb-migrate/bad-opt");
   var dir = opts.dir;
   var audit = opts.audit || null;
   var schemaIntrospect = typeof opts.schemaIntrospect === "function"

package/lib/external-db.js

@@ -36,7 +36,9 @@
  *   External-database integration for app data — Postgres / MySQL / SQLite / MongoDB connection pooling, retry, circuit breaker, classification routing, residency enforcement, and audit hooks.
  */
 var retryHelper = require("./retry");
+var safeBuffer = require("./safe-buffer");
 var bCrypto = require("./crypto");
+var numericBounds = require("./numeric-bounds");
 var C = require("./constants");
 var dbRoleContext = require("./db-role-context");
 var externalDbMigrate = require("./external-db-migrate");
@@ -45,6 +47,7 @@ var { boot } = require("./log");
 var safeAsync = require("./safe-async");
 var safeSql = require("./safe-sql");
 var validateOpts = require("./validate-opts");
+var codepointClass = require("./codepoint-class");
 var { ExternalDbError } = require("./framework-error");
 
 var log = boot("external-db");
@@ -336,6 +339,50 @@ function _classifyStatement(sql) {
   return _STATEMENT_CLASS_MAP[kw] || "OTHER";
 }
 
+// True when a top-level (paren-depth 0, outside any string / comment / quoted-
+// identifier / dollar-quoted span) RETURNING keyword is present — a DML
+// statement with RETURNING yields rows to the caller. Quote-aware so the literal
+// word inside a value ('see RETURNING docs') is not mistaken for a clause, and
+// depth-aware so a RETURNING buried in a CTE / subquery paren does not count for
+// the OUTER statement. Reuses the shared opaque-span scanner; single linear pass.
+function _hasTopLevelReturning(sql) {
+  var n = sql.length, i = 0, depth = 0;
+  while (i < n) {
+    var skipped = _skipOpaqueSpan(sql, i);
+    if (skipped === -1) return false;            // unterminated span — nothing top-level beyond
+    if (skipped !== i) { i = skipped; continue; }
+    var ch = sql.charAt(i);
+    if (ch === "(") { depth += 1; i += 1; continue; }
+    if (ch === ")") { depth -= 1; i += 1; continue; }
+    if (_isIdentStart(ch)) {
+      var we = i + 1;
+      while (we < n && _isIdentChar(sql.charAt(we))) we += 1;
+      if (depth === 0 && sql.slice(i, we).toUpperCase() === "RETURNING") return true;
+      i = we;
+      continue;
+    }
+    i += 1;
+  }
+  return false;
+}
+
+// Does this statement return a row set to the caller? Distinct from the
+// residency gate's read/write split: an `EXPLAIN ANALYZE INSERT` is a WRITE for
+// the gate yet returns plan rows; a DML `... RETURNING` is a write that yields
+// rows. Consumers (e.g. cluster-storage's local exec choosing .all() vs .run())
+// must use .all() for any row-returning statement, including a WITH (CTE) read
+// that the leading keyword alone would mis-route to .run() and SILENTLY DROP.
+// Statement classes that produce a row set for the caller (SELECT and the
+// READ_INFO family — SHOW / DESCRIBE / PRAGMA). Keyed by class name, mirroring
+// _STATEMENT_CLASS_MAP / _RESIDENCY_READ_CLASS.
+var _ROW_RETURNING_CLASS = Object.freeze({ SELECT: true, READ_INFO: true });
+
+function statementReturnsRows(sql) {
+  if (typeof sql !== "string" || sql.length === 0) return false;
+  if (_ROW_RETURNING_CLASS[_classifyStatement(sql)] === true) return true;
+  return _hasTopLevelReturning(sql);
+}
+
 // Statement classes that place no rows on the backend, so the cross-
 // border residency write gate lets them pass without a row tag. Every
 // other class — DML, ROUTINE (CALL / EXECUTE / DO), a COPY ... FROM
@@ -417,11 +464,7 @@ function _otelDbAttributes(b, sql, includeStatement) {
 // legitimately-quoted relation name still surfaces in the audit row.
 var _RELATION_RE = /\b(?:FROM|INTO|UPDATE|JOIN|TABLE|COPY)\s+((?:"[^"]+"|`[^`]+`|[A-Za-z_][\w$]*)(?:\.(?:"[^"]+"|`[^`]+`|[A-Za-z_][\w$]*))?)/ig;
 function _hasControlChar(s) {
-  for (var i = 0; i < s.length; i += 1) {
-    var c = s.charCodeAt(i);
-    if (c < 0x20 || c === 0x7f) return true;
-  }
-  return false;
+  return codepointClass.firstControlCharOffset(s, { forbidTab: true }) !== -1;
 }
 function _extractTargetRelation(sql) {
   if (typeof sql !== "string" || sql.length === 0) return null;
@@ -747,7 +790,7 @@ function init(opts) {
       throw _err("INVALID_CONFIG",
         "backend '" + name + "': applicationName must not contain CR, LF, or NUL characters", true);
       }
-      if (applicationName.length > C.BYTES.bytes(63)) {
+      if (safeBuffer.byteLengthOf(applicationName) > C.BYTES.bytes(63)) {
       throw _err("INVALID_CONFIG",
         "backend '" + name + "': applicationName exceeds Postgres 63-byte limit (got " +
         applicationName.length + ")", true);
@@ -1440,7 +1483,7 @@ function _buildSessionGucsStatements(sessionGucs) {
       // that bloats query logs and consumes max_stack_depth. The cap
       // is generous for legitimate tenant identifiers but rejects
       // amplification.
-      if (value.length > C.BYTES.kib(4)) {
+      if (safeBuffer.byteLengthOf(value) > C.BYTES.kib(4)) {
         throw _err("INVALID_SESSION_GUCS",
           "sessionGucs['" + name + "']: value exceeds 4 KiB cap (got " +
           value.length + " chars)", true);
@@ -1725,11 +1768,9 @@ function _buildReplicas(backendName, cfg) {
         "backend '" + backendName + "': replicas[" + i + "].query must be a function", true);
     }
     var weight = r.weight !== undefined ? r.weight : 1;
-    if (typeof weight !== "number" || !isFinite(weight) || weight <= 0 ||
-        Math.floor(weight) !== weight) {
-      throw _err("INVALID_CONFIG",
-        "backend '" + backendName + "': replicas[" + i + "].weight must be a positive integer", true);
-    }
+    numericBounds.requirePositiveFiniteInt(weight,
+      "backend '" + backendName + "': replicas[" + i + "].weight", ExternalDbError,
+      "INVALID_CONFIG", null, { permanent: true });
     var replicaTag = r.residencyTag || "unrestricted";
     var allowCrossBorder = r.allowCrossBorder === true;
     if (!_residencyCompatible(primaryTag, replicaTag) && !allowCrossBorder) {
@@ -1813,12 +1854,19 @@ async function _readQuery(sql, params, opts) {
   // was explicitly configured allowCrossBorder (which is audited).
   var _readPosture = _activePosture();
   var _tagPresent = opts.rowResidencyTag && typeof opts.rowResidencyTag === "string";
+  // A replica only carries a real residency CONSTRAINT when its tag names a
+  // specific region. "unrestricted" / "global" mean "no constraint" (the tag
+  // defaults to "unrestricted" when none is configured), so such a replica may
+  // serve any region's rows and must NOT require opts.rowResidencyTag — gating
+  // it would over-reject every regulated read to an untagged replica.
+  var _replicaConstrained = replica.residencyTag &&
+    replica.residencyTag !== "unrestricted" && replica.residencyTag !== "global";
   // Fail CLOSED when the row's region is not identified: a regulated read to a
-  // residency-tagged replica without opts.rowResidencyTag would otherwise route
-  // residency-restricted rows to an arbitrary-region replica with no check at
-  // all (symmetric with the write gate's RESIDENCY_GATE_REQUIRED).
+  // residency-CONSTRAINED replica without opts.rowResidencyTag would otherwise
+  // route residency-restricted rows to an arbitrary-region replica with no check
+  // at all (symmetric with the write gate's RESIDENCY_GATE_REQUIRED).
   if (!_tagPresent && _crossBorderRegulated(_readPosture) &&
-      replica.residencyTag && !replica.allowCrossBorder) {
+      _replicaConstrained && !replica.allowCrossBorder) {
     _emit("db.residency.replica.tag_required", "denied", {
       backend: b.name, replicaIdx: replica.index,
       replicaTag: replica.residencyTag, posture: _readPosture,
@@ -2066,15 +2114,9 @@ function configurePool(backendName, opts) {
         "configurePool: unknown option '" + k + "'. Allowed: " + allowed.join(", "), true);
     }
   }
-  function _requirePosInt(name, value) {
-    if (typeof value !== "number" || !isFinite(value) || value <= 0 || Math.floor(value) !== value) {
-      throw _err("INVALID_CONFIG",
-        "configurePool: " + name + " must be a positive integer, got " + JSON.stringify(value), true);
-    }
-  }
-  if (opts.min           !== undefined) _requirePosInt("min", opts.min);
-  if (opts.max           !== undefined) _requirePosInt("max", opts.max);
-  if (opts.idleTimeoutMs !== undefined) _requirePosInt("idleTimeoutMs", opts.idleTimeoutMs);
+  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
+    ["min", "max", "idleTimeoutMs"], "configurePool", ExternalDbError,
+    "INVALID_CONFIG", { permanent: true });
   if (opts.min !== undefined && opts.max !== undefined && opts.min > opts.max) {
     throw _err("INVALID_CONFIG", "configurePool: min must be <= max", true);
   }
@@ -2146,11 +2188,8 @@ function _connectAs(rawConnect, query, opts) {
     throw _err("INVALID_CONFIG", "connectAs: applicationName must be a string", true);
   }
   if (opts.statementTimeoutMs !== undefined) {
-    if (typeof opts.statementTimeoutMs !== "number" || !isFinite(opts.statementTimeoutMs) ||
-        opts.statementTimeoutMs <= 0 || Math.floor(opts.statementTimeoutMs) !== opts.statementTimeoutMs) {
-      throw _err("INVALID_CONFIG",
-        "connectAs: statementTimeoutMs must be a positive integer", true);
-    }
+    numericBounds.requirePositiveFiniteIntIfPresent(opts.statementTimeoutMs,
+      "connectAs: statementTimeoutMs", ExternalDbError, "INVALID_CONFIG", { permanent: true });
   }
   if (opts.gucs !== undefined && (typeof opts.gucs !== "object" || opts.gucs === null)) {
     throw _err("INVALID_CONFIG", "connectAs: gucs must be an object", true);
@@ -2586,6 +2625,11 @@ module.exports = {
   // lock tables live on the externalDb side. See lib/external-db-migrate.js.
   migrate:        externalDbMigrate,
   Pool:           Pool,
+  // Shared SQL statement classifier (CTE / EXPLAIN aware): does the statement
+  // return a row set? Internal — consumed by cluster-storage's local exec to
+  // choose .all() vs .run() so a WITH (CTE) read is not mis-routed and its rows
+  // lost. Underscore-prefixed: framework-internal, not an operator API surface.
+  _statementReturnsRows: statementReturnsRows,
   _resetForTest:  _resetForTest,
   _extractTargetRelation: _extractTargetRelation,
 };

package/lib/fda-21cfr11.js

@@ -91,6 +91,18 @@ var DEFAULT_SIGNATURE_MEANINGS = Object.freeze([
 // must carry §11.10(e) shape. Operators add more via opts.gxpNamespaces.
 var DEFAULT_GXP_NAMESPACES = Object.freeze(["subject", "consent", "db", "breakglass"]);
 
+// Non-mutating verb segments. A GxP-namespace event whose final action segment
+// is NOT one of these is treated as a record MODIFICATION and must carry the
+// §11.10(e) before/after/reason shape (fail-closed — an unknown verb is assumed
+// to mutate). hasOwnProperty-guarded lookup (untrusted action key).
+var READ_VERBS = Object.freeze({
+  read: 1, viewed: 1, view: 1, get: 1, got: 1, list: 1, listed: 1, query: 1,
+  queried: 1, access: 1, accessed: 1, export: 1, exported: 1, history: 1,
+  isgranted: 1, check: 1, checked: 1, verify: 1, verified: 1, lookup: 1,
+  search: 1, searched: 1, fetch: 1, fetched: 1, render: 1, rendered: 1,
+  download: 1, downloaded: 1,
+});
+
 // §11.10(e) — every modification audit must carry timestamp, actor,
 // before/after pair, and a reason. The framework's audit row shape
 // already carries `recordedAt` (timestamp) + `actorUserId` + `reason`;
@@ -114,11 +126,15 @@ function _hasRequiredAuditShape(row) {
   if (!row.action || typeof row.action !== "string") {
     return { ok: false, reason: "row missing action verb (§11.10(e))" };
   }
-  // Modification-shaped events (verbs containing "update" / "modif" /
-  // "delete" / "rectif" / "erase" / "set") must carry before/after.
+  // §11.10(e) requires before/after on every record MODIFICATION. Inferring
+  // "is this a modification" from a denylist of mutating verbs silently let
+  // off-list verbs (anonymize / revoke / overwrite / replace / merge /
+  // withdraw / restrict / objection …) bypass the requirement. Fail CLOSED
+  // instead: a GxP-namespace event is treated as a modification UNLESS its
+  // final verb segment is on an explicit non-mutating READ allowlist.
   var verb = row.action.toLowerCase();
-  var modShape = /\.(update|updated|modif|modified|delete|deleted|rectif|rectified|erase|erased|set|setrole|put|patched)\b/.test(verb) ||
-    /\.(update|delete|modif|set|put|patch|rectif|erase)/.test(verb);
+  var lastSeg = verb.indexOf(".") === -1 ? verb : verb.slice(verb.lastIndexOf(".") + 1);
+  var modShape = !Object.prototype.hasOwnProperty.call(READ_VERBS, lastSeg);
   if (modShape) {
     var meta = row.metadata;
     // Audit chain stores metadata as a JSON string when read back —
@@ -181,14 +197,18 @@ function posture(opts) {
     "audit", "signWith", "verifyWith", "meanings", "gxpNamespaces",
     "interceptAudit", "now",
   ], "fda21cfr11.posture");
-  validateOpts.auditShape(opts.audit, "fda21cfr11.posture",
-    Fda21Cfr11Error, "fda21cfr11/bad-audit");
-  validateOpts.optionalFunction(opts.signWith,
-    "fda21cfr11.posture: signWith", Fda21Cfr11Error, "fda21cfr11/bad-signer");
-  validateOpts.optionalFunction(opts.verifyWith,
-    "fda21cfr11.posture: verifyWith", Fda21Cfr11Error, "fda21cfr11/bad-verifier");
-  validateOpts.optionalFunction(opts.now,
-    "fda21cfr11.posture: now", Fda21Cfr11Error, "fda21cfr11/bad-now");
+  validateOpts.shape(opts, {
+    audit: function (value) {
+      validateOpts.auditShape(value, "fda21cfr11.posture",
+        Fda21Cfr11Error, "fda21cfr11/bad-audit");
+    },
+    signWith:       { rule: "optional-function", code: "fda21cfr11/bad-signer" },
+    verifyWith:     { rule: "optional-function", code: "fda21cfr11/bad-verifier" },
+    now:            { rule: "optional-function", code: "fda21cfr11/bad-now" },
+    meanings:       { rule: "optional-string-array", code: "fda21cfr11/bad-meanings" },
+    gxpNamespaces:  { rule: "optional-string-array", code: "fda21cfr11/bad-gxp-namespaces" },
+    interceptAudit: { rule: "optional-boolean", code: "fda21cfr11/bad-intercept-audit" },
+  }, "fda21cfr11.posture", Fda21Cfr11Error, "fda21cfr11/bad-opts");
 
   var auditMod = opts.audit && typeof opts.audit.safeEmit === "function" ? opts.audit : null;
   var signWith = typeof opts.signWith === "function" ? opts.signWith : null;
@@ -259,7 +279,16 @@ function posture(opts) {
       }, "denied");
       return { ok: false, reason: "record-hash-mismatch" };
     }
-    if (verifyWith && signed.signature) {
+    if (verifyWith) {
+      // A configured verifier means a signature is REQUIRED — a null/empty
+      // signature must fail closed (recordHash alone is self-consistency, not
+      // authentication; accepting it is alg:none-style signature stripping).
+      if (!signed.signature) {
+        _emit("fda21cfr11.signature.verified", {
+          printedName: signed.printedName, ok: false, reason: "signature-required",
+        }, "denied");
+        return { ok: false, reason: "signature-required" };
+      }
       var sigBuf = Buffer.from(signed.signature, "base64");
       var payload = JSON.stringify({
         printedName:      signed.printedName,

package/lib/fdx.js

@@ -168,10 +168,13 @@ function bind(opts) {
     throw FdxError.factory("fdx/bad-auth-server",
       "fdx.bind: authServer object required");
   }
-  validateOpts.requireNonEmptyString(opts.authServer.issuer,
-    "fdx.bind: authServer.issuer", FdxError, "BAD_ISSUER");
-  validateOpts.requireNonEmptyString(opts.authServer.jwksUri,
-    "fdx.bind: authServer.jwksUri", FdxError, "BAD_JWKS_URI");
+  validateOpts.shape(opts.authServer, {
+    issuer:  { rule: "required-string", code: "BAD_ISSUER",   label: "fdx.bind: authServer.issuer" },
+    jwksUri: { rule: "required-string", code: "BAD_JWKS_URI", label: "fdx.bind: authServer.jwksUri" },
+  }, "fdx.bind: authServer", FdxError, "fdx/bad-auth-server",
+    // fapi2 is forwarded verbatim to fapi2.assertOAuthConfig, which owns
+    // its shape ({ pkce, dpop?, mtls?, par }) — validated there, not here.
+    { allow: ["fapi2"] });
 
   if (!Array.isArray(opts.resources) || opts.resources.length === 0) {
     throw FdxError.factory("fdx/bad-resources",
@@ -315,20 +318,21 @@ function consentReceipt(opts) {
   if (!opts || typeof opts !== "object") {
     throw FdxError.factory("fdx/bad-opts", "fdx.consentReceipt: opts required");
   }
-  validateOpts.requireNonEmptyString(opts.dataProvider,
-    "fdx.consentReceipt: dataProvider", FdxError, "BAD_DATA_PROVIDER");
-  validateOpts.requireNonEmptyString(opts.consumerRef,
-    "fdx.consentReceipt: consumerRef", FdxError, "BAD_CONSUMER_REF");
-  validateOpts.requireNonEmptyString(opts.thirdParty,
-    "fdx.consentReceipt: thirdParty", FdxError, "BAD_THIRD_PARTY");
-  validateOpts.requireNonEmptyString(opts.revocationUrl,
-    "fdx.consentReceipt: revocationUrl", FdxError, "BAD_REVOCATION_URL");
-  if (!Array.isArray(opts.scopes) || opts.scopes.length === 0) {
-    throw FdxError.factory("fdx/bad-scopes",
-      "fdx.consentReceipt: scopes must be a non-empty array");
-  }
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.durationMs,
-    "fdx.consentReceipt: durationMs", FdxError, "BAD_DURATION");
+  validateOpts.shape(opts, {
+    dataProvider:  { rule: "required-string", code: "BAD_DATA_PROVIDER" },
+    consumerRef:   { rule: "required-string", code: "BAD_CONSUMER_REF" },
+    thirdParty:    { rule: "required-string", code: "BAD_THIRD_PARTY" },
+    revocationUrl: { rule: "required-string", code: "BAD_REVOCATION_URL" },
+    scopes: function (value) {
+      if (!Array.isArray(value) || value.length === 0) {
+        throw FdxError.factory("fdx/bad-scopes",
+          "fdx.consentReceipt: scopes must be a non-empty array");
+      }
+    },
+    durationMs: function (value, label) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value, label, FdxError, "BAD_DURATION");
+    },
+  }, "fdx.consentReceipt", FdxError, "fdx/bad-opts");
 
   var issuedAt = Date.now();
   var expiresAt = issuedAt + (opts.durationMs || C.TIME.weeks(52));