@blamejs/core 0.15.12 → 0.15.14

package/lib/ai-output.js

@@ -59,14 +59,18 @@ var NEUTRALIZED_URL = "about:blank#blocked";
 // matched (we only need the URL to gate it). Reference-style definitions
 // ([id]: url) are caught by the third pattern so EchoLeak reference-link
 // payloads don't slip past.
-var MD_IMAGE_RE = /!\[[^\]]{0,2048}\]\(\s{0,256}([^)\s]+)/g;
-var MD_LINK_RE  = /(?<!!)\[[^\]]{0,2048}\]\(\s{0,256}([^)\s]+)/g;
-var MD_REF_RE   = /^[ \t]{0,3}\[[^\]]+\]:\s*(\S+)/gm;
+// The `d` (hasIndices) flag is required so _rewriteUrls can splice at the
+// captured URL's EXACT offset — when a markdown alt text equals its target URL
+// (`![u](u)`), locating the URL by m[0].indexOf would hit the alt-text copy and
+// leave the real exfiltration target intact (EchoLeak bypass).
+var MD_IMAGE_RE = /!\[[^\]]{0,2048}\]\(\s{0,256}([^)\s]+)/dg;
+var MD_LINK_RE  = /(?<!!)\[[^\]]{0,2048}\]\(\s{0,256}([^)\s]+)/dg;
+var MD_REF_RE   = /^[ \t]{0,3}\[[^\]]+\]:\s*(\S+)/dgm;
 // HTML src= / href= attribute URL extractor — the guardHtml pass already
 // strips dangerous markup, but a surviving same-origin-looking src that
 // points at an internal / metadata host must still be neutralized for
 // the auto-fetch exfiltration class.
-var HTML_URL_ATTR_RE = /\b(?:src|href)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^"'>\s]+))/gi;
+var HTML_URL_ATTR_RE = /\b(?:src|href)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^"'>\s]+))/dgi;
 
 // SQL-shaped fragment signal. Composes safe-sql's reserved-word stance:
 // a leading SQL keyword followed by a clause keyword is the executable
@@ -143,11 +147,16 @@ function _rewriteUrls(text, re, onUrl) {
   var last = 0;
   var m;
   while ((m = re.exec(text)) !== null) {
-    var url = m[1] || m[2] || m[3];
-    if (!url) continue;
+    var g = m[1] !== undefined ? 1 : (m[2] !== undefined ? 2 : (m[3] !== undefined ? 3 : 0));
+    var url = g ? m[g] : null;
+    if (!url) { if (re.lastIndex === m.index) re.lastIndex += 1; continue; }
     var replacement = onUrl(url);
     if (replacement !== null && replacement !== url) {
-      var idx = m.index + m[0].indexOf(url);
+      // Splice at the captured group's EXACT offset (hasIndices), never
+      // m[0].indexOf(url) — when a markdown alt text equals its target URL the
+      // indexOf would hit the alt copy and leave the real URL intact (EchoLeak).
+      var span = m.indices && m.indices[g];
+      var idx = span ? span[0] : (m.index + m[0].lastIndexOf(url));
       out += text.slice(last, idx) + replacement;
       last = idx + url.length;
     }

package/lib/ai-pref.js

@@ -152,13 +152,8 @@ function parseHeader(value) {
     label:      "aiPref.parseHeader",
   });
   var out = { train: null, infer: null, snippet: null, price: null };
-  var pairs = value.split(",");
-  for (var i = 0; i < pairs.length; i += 1) {
-    var p = pairs[i].trim();
-    var eq = p.indexOf("=");
-    if (eq === -1) continue;
-    var k = p.slice(0, eq).trim().toLowerCase();
-    var val = p.slice(eq + 1).trim();
+  var kvps = structuredFields.parseKeyValuePieces(value.split(","));
+  structuredFields.forEachKeyValue(kvps, function (k, val) {
     if (k === "train"      && TRAIN_VALUES.indexOf(val) !== -1)   out.train = val;
     else if (k === "infer"   && INFER_VALUES.indexOf(val) !== -1) out.infer = val;
     else if (k === "snippet" && SNIPPET_VALUES.indexOf(val) !== -1) out.snippet = val;
@@ -169,7 +164,7 @@ function parseHeader(value) {
       var pt = parseInt(val, 10);
       if (isFinite(pt) && pt > 0) out.price = Object.assign({ perTokens: pt }, out.price || {});
     }
-  }
+  });
   return out;
 }
 

package/lib/ai-quota.js

@@ -318,12 +318,7 @@ function create(opts) {
     return null;
   }
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({ action: action, outcome: outcome, metadata: metadata || {} });
-    } catch (_e) { /* audit best-effort — drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced(null, { audit: auditOn });
 
   function _emitMetric(name, n) {
     try { observability().safeEvent(name, n || 1, {}); }
@@ -507,14 +502,8 @@ function _validateLimitMap(map, label) {
 }
 
 function _validateStore(store) {
-  if (!store || typeof store !== "object" ||
-      typeof store.reserve !== "function" ||
-      typeof store.add !== "function" ||
-      typeof store.get !== "function" ||
-      typeof store.reset !== "function") {
-    throw new AiQuotaError("ai-quota/bad-store",
-      "ai.quota.create: store must expose reserve / add / get / reset functions");
-  }
+  validateOpts.requireMethods(store, ["reserve", "add", "get", "reset"],
+    "ai.quota.create: store", AiQuotaError, "ai-quota/bad-store");
 }
 
 module.exports = {

package/lib/api-key.js

@@ -134,37 +134,46 @@ function _validateIdentifier(name, value) {
 }
 
 function _validateCreateOpts(opts) {
-  validateOpts.requireObject(opts, "apiKey.create", ApiKeyError);
-  _validateIdentifier("apiKey.create: namespace", opts.namespace);
-  if (opts.prefix !== undefined) _validateIdentifier("apiKey.create: prefix", opts.prefix);
-  validateOpts.optionalPositiveInt(opts.idBytes, "apiKey.create: idBytes", ApiKeyError);
-  validateOpts.optionalPositiveInt(opts.secretBytes, "apiKey.create: secretBytes", ApiKeyError);
-  validateOpts.optionalBoolean(opts.trackLastUsedAt, "apiKey.create: trackLastUsedAt", ApiKeyError);
-  validateOpts.optionalBoolean(opts.auditFailures, "apiKey.create: auditFailures", ApiKeyError);
-  validateOpts.optionalBoolean(opts.auditSuccess, "apiKey.create: auditSuccess", ApiKeyError);
-  validateOpts.optionalFiniteNonNegative(opts.purgeAfterMs, "apiKey.create: purgeAfterMs", ApiKeyError);
-  if (opts.hashAlgo !== undefined) {
-    if (typeof opts.hashAlgo !== "string" ||
-        (opts.hashAlgo !== "shake256" && opts.hashAlgo !== "argon2id")) {
-      throw _err("BAD_OPT", "apiKey.create: hashAlgo must be 'shake256' or 'argon2id', got " +
-        JSON.stringify(opts.hashAlgo));
-    }
-  }
-  validateOpts.auditShape(opts.audit, "apiKey.create", ApiKeyError);
-  validateOpts.optionalFunction(opts.clock, "apiKey.create: clock", ApiKeyError);
+  validateOpts.shape(opts, {
+    namespace:       function (v, l) { _validateIdentifier(l, v); },
+    prefix:          function (v, l) { if (v !== undefined) _validateIdentifier(l, v); },
+    idBytes:         "optional-positive-int",
+    secretBytes:     "optional-positive-int",
+    trackLastUsedAt: "optional-boolean",
+    auditFailures:   "optional-boolean",
+    auditSuccess:    "optional-boolean",
+    purgeAfterMs:    "optional-non-negative",
+    hashAlgo:        function (v) {
+      if (v !== undefined) {
+        if (typeof v !== "string" || (v !== "shake256" && v !== "argon2id")) {
+          throw _err("BAD_OPT", "apiKey.create: hashAlgo must be 'shake256' or 'argon2id', got " +
+            JSON.stringify(v));
+        }
+      }
+    },
+    audit:           function (v) { validateOpts.auditShape(v, "apiKey.create", ApiKeyError); },
+    clock:           "optional-function",
+  }, "apiKey.create", ApiKeyError);
 }
 
 function _validateIssueOpts(opts) {
-  validateOpts.requireObject(opts, "apiKey.issue", ApiKeyError);
-  validateOpts.requireNonEmptyString(opts.ownerId, "apiKey.issue: ownerId", ApiKeyError, "MISSING_OWNER");
-  validateOpts.optionalNonEmptyStringArray(opts.scopes, "apiKey.issue: scopes", ApiKeyError, "BAD_SCOPES");
-  validateOpts.optionalPlainObject(opts.metadata, "apiKey.issue: metadata",
-    ApiKeyError, "BAD_METADATA");
-  if (opts.expiresAt !== undefined && opts.expiresAt !== null) {
-    if (typeof opts.expiresAt !== "number" || !isFinite(opts.expiresAt) || opts.expiresAt < 0) {
-      throw _err("BAD_OPT", "apiKey.issue: expiresAt must be a non-negative finite number (unix ms) or null");
-    }
-  }
+  validateOpts.shape(opts, {
+    ownerId:   { rule: "required-string",       code: "MISSING_OWNER" },
+    scopes:    { rule: "optional-string-array", code: "BAD_SCOPES" },
+    metadata:  { rule: "optional-plain-object", code: "BAD_METADATA" },
+    expiresAt: function (v) {
+      if (v !== undefined && v !== null) {
+        if (typeof v !== "number" || !isFinite(v) || v < 0) {
+          throw _err("BAD_OPT", "apiKey.issue: expiresAt must be a non-negative finite number (unix ms) or null");
+        }
+      }
+    },
+  }, "apiKey.issue", ApiKeyError, undefined, {
+    // `req` / `context` are the audit-actor pass-through bag — forwarded
+    // verbatim to requestHelpers.resolveActorWithOverride (via _actor)
+    // to populate the issue audit's 5 W's, not validated locally.
+    allow: ["req", "context"],
+  });
 }
 
 // ---- Token format ----

package/lib/api-snapshot.js

@@ -51,6 +51,7 @@
  */
 
 var nodeFs = require("node:fs");
+var atomicFile = require("./atomic-file");
 var numericBounds = require("./numeric-bounds");
 var safeJson = require("./safe-json");
 var { FrameworkError } = require("./framework-error");
@@ -199,7 +200,9 @@ function write(snapshot, filePath) {
     createdAt:        snapshot.createdAt,
     exports:          snapshot.exports,
   };
-  nodeFs.writeFileSync(filePath, JSON.stringify(canonical, null, 2) + "\n", { mode: 0o644 });
+  // Atomic, symlink-refusing write (0o644 — the snapshot is a public,
+  // committed artifact). writeSync stages into a no-follow exclusive temp.
+  atomicFile.writeSync(filePath, JSON.stringify(canonical, null, 2) + "\n", { fileMode: 0o644 });
   return filePath;
 }
 

package/lib/app-shutdown.js

@@ -511,6 +511,7 @@ function standardPhases(components) {
 // IS the lock.
 var nodeFs   = require("node:fs");
 var nodePath = require("node:path");
+var atomicFile = require("./atomic-file");
 
 /**
  * @primitive b.appShutdown.pidLock
@@ -552,7 +553,12 @@ function pidLock(lockPath) {
 
   function _readExisting() {
     try {
-      var raw = nodeFs.readFileSync(lockPath, "utf8");
+      // fd-safe + capped + symlink-refusing read: a PID lockfile is never a
+      // legitimate symlink (unlike a k8s/certbot secret mount), so refuseSymlink
+      // is safe here and stops a planted symlink/oversized file from redirecting
+      // or OOM-ing the read. Any throw (symlink/too-large/enoent) → null, the
+      // existing "no live lock" semantic.
+      var raw = atomicFile.fdSafeReadSync(lockPath, { maxBytes: C.BYTES.kib(1), refuseSymlink: true, encoding: "utf8" });
       var pid = parseInt(String(raw).trim(), 10);
       return isFinite(pid) && pid > 0 ? pid : null;
     } catch (_e) { return null; }

package/lib/archive-adapters.js

@@ -547,10 +547,8 @@ function http(url, opts) {
  *   for await (var e of reader.entries()) entries.push(e);
  */
 function trustedStream(readable, opts) {
-  if (!readable || typeof readable.pipe !== "function" || typeof readable.on !== "function") {
-    throw new AdapterError("adapter/bad-arg",
-      "trustedStream: arg must be a Readable (or pipe/on-compatible stream)");
-  }
+  validateOpts.requireMethods(readable, ["pipe", "on"],
+    "trustedStream: arg (Readable / pipe-on-compatible stream)", AdapterError, "adapter/bad-arg");
   if (!(readable instanceof nodeStream.Readable) && !readable.readable) {
     // Accept stream-like duck-typed objects; many libraries return
     // Readable-flavored bytes via Symbol.asyncIterator only.

package/lib/archive-entry-policy.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * lib/archive-entry-policy.js — the entry-type extraction policy shared by the
+ * ZIP (archive-read) and TAR (archive-tar-read) readers.
+ *
+ * Special archive entry types — symlinks, hardlinks, device nodes, FIFOs, and
+ * sockets — are a malicious-archive vector (symlink traversal out of the
+ * extraction root, device-node creation, etc.), so every type is DENIED by
+ * default; an operator opts a type in explicitly per archive. Both readers
+ * normalized the same default the same way, so the policy + its overlay live
+ * here once rather than drifting between the two formats.
+ */
+
+var DEFAULT_ENTRY_TYPE_POLICY = Object.freeze({
+  symlinks:  false,
+  hardlinks: false,
+  devices:   false,
+  fifos:     false,
+  sockets:   false,
+});
+
+// normalize(p) — overlay an operator policy onto the all-denied default and
+// freeze it. A falsy `p` returns the shared default object (no allocation).
+function normalize(p) {
+  if (!p) return DEFAULT_ENTRY_TYPE_POLICY;
+  return Object.freeze(Object.assign({}, DEFAULT_ENTRY_TYPE_POLICY, p));
+}
+
+module.exports = {
+  DEFAULT_ENTRY_TYPE_POLICY: DEFAULT_ENTRY_TYPE_POLICY,
+  normalize:                 normalize,
+};

package/lib/archive-gz.js

@@ -149,6 +149,15 @@ function readGz(adapter, opts) {
         throw new ArchiveGzError("archive-gz/empty-input",
           "read.gz: adapter reports empty payload");
       }
+      // Cap the raw COMPRESSED read before allocating — `adapter.range(0, size)`
+      // does Buffer.allocUnsafe(size) of an fstat/HEAD-reported length, which a
+      // hostile .gz (or an objectStore/HTTP source advertising a huge size) can
+      // drive to OOM. maxOutputBytes bounds the DECOMPRESSED output only; this
+      // bounds the compressed read too, matching archive-tar-read's _collectAdapterBytes.
+      if (typeof maxOutputBytes === "number" && size > maxOutputBytes) {
+        throw new ArchiveGzError("archive-gz/source-too-large",
+          "read.gz: random-access source size=" + size + " exceeds the read cap " + maxOutputBytes);
+      }
       return adapter.range(0, size);
     }
     if (adapter.kind === "trusted-sequential") {

package/lib/archive-read.js

@@ -54,6 +54,8 @@ var guardArchive  = lazyRequire(function () { return require("./guard-archive");
 var safeDecompress = lazyRequire(function () { return require("./safe-decompress"); });
 var safeBuffer     = lazyRequire(function () { return require("./safe-buffer"); });
 var archiveAdapters = lazyRequire(function () { return require("./archive-adapters"); });
+var archiveEntryPolicy = require("./archive-entry-policy");
+var auditEmit = require("./audit-emit");
 
 // ---- Wire-format constants ------------------------------------------------
 // Aligned with the write-side `lib/archive.js`. APPNOTE.TXT § references
@@ -120,13 +122,7 @@ var DEFAULT_BOMB_POLICY = Object.freeze({
   maxExpansionRatio:         100,                                     // compressed → decompressed ratio cap
 });
 
-var DEFAULT_ENTRY_TYPE_POLICY = Object.freeze({
-  symlinks:  false,
-  hardlinks: false,
-  devices:   false,
-  fifos:     false,
-  sockets:   false,
-});
+var DEFAULT_ENTRY_TYPE_POLICY = archiveEntryPolicy.DEFAULT_ENTRY_TYPE_POLICY;
 
 // ---- Helpers --------------------------------------------------------------
 
@@ -629,17 +625,9 @@ function _normalizeBombPolicy(p) {
   return Object.freeze(Object.assign({}, DEFAULT_BOMB_POLICY, p));
 }
 
-function _normalizeEntryTypePolicy(p) {
-  if (!p) return DEFAULT_ENTRY_TYPE_POLICY;
-  return Object.freeze(Object.assign({}, DEFAULT_ENTRY_TYPE_POLICY, p));
-}
+var _normalizeEntryTypePolicy = archiveEntryPolicy.normalize;
 
-function _emitAudit(opts, action, outcome, metadata) {
-  if (!opts || !opts.audit || typeof opts.audit.safeEmit !== "function") return;
-  try {
-    opts.audit.safeEmit({ action: action, outcome: outcome, metadata: metadata });
-  } catch (_e) { /* drop-silent — audit sinks must never crash the reader */ }
-}
+var _emitAudit = auditEmit.emitToSink;   // operator-sink audit emit (opts.audit)
 
 /**
  * @primitive b.archive.read.zip
@@ -920,13 +908,15 @@ function zip(adapter, opts) {
             "cumulative uncompressed=" + totalDecompressed +
             " exceeds maxTotalDecompressedBytes during extract");
         }
-        // Write entry to disk. Atomic rename via a tmp file so a
-        // partial write during inflate doesn't leave a half-file at
-        // the canonical name. Pre-existence check above guarantees
-        // the rename targets a non-existent path.
-        var tmpPath = resolvedPath + ".__blamejs-archive-read-tmp__";
-        nodeFs.writeFileSync(tmpPath, body);
-        atomicFile.renameWithRetry(tmpPath, resolvedPath);
+        // Write entry to disk atomically. The previous hand-rolled form
+        // staged into a PREDICTABLE temp name (resolvedPath +
+        // ".__blamejs-archive-read-tmp__") via a plain writeFileSync, so a
+        // symlink pre-planted at that exact path would be followed (CWE-59
+        // arbitrary write outside the extract dir). writeSync stages into a
+        // CSPRNG temp opened O_EXCL | O_NOFOLLOW, then renames — a partial
+        // write during inflate also never leaves a half-file at the canonical
+        // name. The pre-existence check above keeps the rename non-clobbering.
+        atomicFile.writeSync(resolvedPath, body);
         written.push({ name: entry.name, bytesWritten: body.length, path: resolvedPath });
         bytesExtracted += body.length;
       }

package/lib/archive-tar-read.js

@@ -14,7 +14,9 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var safeBuffer = require("./safe-buffer");
 var archiveTar = require("./archive-tar");
+var archiveEntryPolicy = require("./archive-entry-policy");
 var atomicFile = require("./atomic-file");
+var auditEmit = require("./audit-emit");
 
 var TarError = archiveTar.TarError;
 var _parseHeader = archiveTar._parseHeader;
@@ -45,29 +47,16 @@ var DEFAULT_BOMB_POLICY = Object.freeze({
   maxExpansionRatio:         100,                                                    // tar has no compression-ratio concept, but keep field for orchestrator policy parity
 });
 
-var DEFAULT_ENTRY_TYPE_POLICY = Object.freeze({
-  symlinks:  false,
-  hardlinks: false,
-  devices:   false,
-  fifos:     false,
-  sockets:   false,
-});
+var DEFAULT_ENTRY_TYPE_POLICY = archiveEntryPolicy.DEFAULT_ENTRY_TYPE_POLICY;
 
 function _normalizeBombPolicy(p) {
   if (!p) return DEFAULT_BOMB_POLICY;
   return Object.freeze(Object.assign({}, DEFAULT_BOMB_POLICY, p));
 }
 
-function _normalizeEntryTypePolicy(p) {
-  if (!p) return DEFAULT_ENTRY_TYPE_POLICY;
-  return Object.freeze(Object.assign({}, DEFAULT_ENTRY_TYPE_POLICY, p));
-}
+var _normalizeEntryTypePolicy = archiveEntryPolicy.normalize;
 
-function _emitAudit(opts, action, outcome, metadata) {
-  if (!opts || !opts.audit || typeof opts.audit.safeEmit !== "function") return;
-  try { opts.audit.safeEmit({ action: action, outcome: outcome, metadata: metadata }); }
-  catch (_e) { /* drop-silent */ }
-}
+var _emitAudit = auditEmit.emitToSink;   // operator-sink audit emit (opts.audit)
 
 function _isZeroBlock(buf) {
   for (var i = 0; i < BLOCK_SIZE; i += 1) {
@@ -110,13 +99,43 @@ function _parsePaxRecords(buf) {
   return out;
 }
 
-async function _collectAdapterBytes(adapter) {
+// A PAX `size` attribute is an attacker-controlled ASCII string. `parseInt` of
+// a malformed value ("", "abc", "1e9") yields NaN, which then SILENTLY bypasses
+// the entry-size bomb check (`NaN > maxEntryDecompressedBytes` is false) AND
+// desyncs the block walker (`Math.ceil(NaN / BLOCK_SIZE)` is NaN, so `pos`
+// advances by NaN). Reject anything that is not a plain non-negative integer.
+function _paxSize(raw) {
+  var s = String(raw).trim();
+  var n = parseInt(s, 10);
+  // Round-trip: a clean non-negative integer survives parseInt → String
+  // unchanged. This rejects "", "abc" (NaN), "1e9", "100abc" (parseInt stops
+  // early), negatives, leading zeros, and astronomically long strings that
+  // overflow to Infinity (String(Infinity) !== s) — every shape that would
+  // otherwise yield NaN/garbage and bypass the bomb check + desync the walker.
+  if (!Number.isFinite(n) || n < 0 || String(n) !== s) {
+    throw new TarError("archive-tar/bad-pax-size",
+      "PAX size attribute " + JSON.stringify(raw) + " is not a non-negative integer");
+  }
+  return n;
+}
+
+async function _collectAdapterBytes(adapter, maxBytes) {
   if (adapter.kind === "random-access") {
     var size = adapter.size;
     if (size == null && typeof adapter.resolveSize === "function") {
       size = await adapter.resolveSize();
     }
-    if (typeof size !== "number" || size === 0) return Buffer.alloc(0);
+    if (typeof size !== "number" || !Number.isFinite(size) || size <= 0) return Buffer.alloc(0);
+    // Cap the random-access read the same way the trusted-sequential branch
+    // caps its collector — a multi-GiB adapter.range(0, size) is an OOM lever
+    // (the size comes from the adapter, e.g. an on-disk file's stat or an
+    // operator-supplied length). The default ceiling is the bomb policy's
+    // total-decompressed cap.
+    if (typeof maxBytes === "number" && size > maxBytes) {
+      throw new TarError("archive-tar/source-too-large",
+        "read.tar: random-access source size=" + size +
+        " exceeds the read cap " + maxBytes);
+    }
     return adapter.range(0, size);
   }
   if (adapter.kind === "trusted-sequential") {
@@ -183,7 +202,7 @@ function tar(adapter, opts) {
   var entryTypePolicy = _normalizeEntryTypePolicy(opts.entryTypePolicy);
 
   async function _walk() {
-    var bytes = await _collectAdapterBytes(adapter);
+    var bytes = await _collectAdapterBytes(adapter, bombPolicy.maxTotalDecompressedBytes);
     if (bytes.length === 0) return { entries: [], bytes: bytes };
     var pos = 0;
     var entries = [];
@@ -201,6 +220,16 @@ function tar(adapter, opts) {
       zeroBlockCount = 0;
       var hdr = _parseHeader(block);
       if (hdr.typeflag === TF_PAX_EXTENDED || hdr.typeflag === TF_PAX_GLOBAL) {
+        // The per-entry bomb cap below (line ~252) is AFTER the PAX `continue`,
+        // so a PAX header body (its size is the attacker-controlled ustar octal
+        // field, up to ~8 GiB) escaped it — a multi-hundred-MiB UTF-8 string +
+        // record Object materialization above the cap operators set. Legitimate
+        // PAX/global bodies are tiny, so bound them by the same per-entry cap.
+        if (hdr.size > bombPolicy.maxEntryDecompressedBytes) {
+          throw new TarError("archive-tar/entry-too-large",
+            "pax header body size=" + hdr.size + " exceeds maxEntryDecompressedBytes=" +
+            bombPolicy.maxEntryDecompressedBytes);
+        }
         var bodyEnd = pos + Math.ceil(hdr.size / BLOCK_SIZE) * BLOCK_SIZE;
         if (bodyEnd > bytes.length) {
           throw new TarError("archive-tar/truncated-entry",
@@ -217,12 +246,12 @@ function tar(adapter, opts) {
       }
       if (globalPax) {
         if (globalPax.path) hdr.name = globalPax.path;
-        if (globalPax.size) hdr.size = parseInt(globalPax.size, 10);
+        if (globalPax.size) hdr.size = _paxSize(globalPax.size);
         if (globalPax.linkpath) hdr.linkname = globalPax.linkpath;
       }
       if (pendingPax) {
         if (pendingPax.path) hdr.name = pendingPax.path;
-        if (pendingPax.size) hdr.size = parseInt(pendingPax.size, 10);
+        if (pendingPax.size) hdr.size = _paxSize(pendingPax.size);
         if (pendingPax.linkpath) hdr.linkname = pendingPax.linkpath;
         pendingPax = null;
       }
@@ -427,9 +456,12 @@ function tar(adapter, opts) {
             "cumulative uncompressed=" + totalDecompressed +
             " exceeds maxTotalDecompressedBytes during extract");
         }
-        var tmpPath = resolvedPath + ".__blamejs-archive-tar-tmp__";
-        nodeFs.writeFileSync(tmpPath, body);
-        atomicFile.renameWithRetry(tmpPath, resolvedPath);
+        // Atomic, symlink-refusing write. The previous hand-rolled form staged
+        // into a PREDICTABLE temp name (resolvedPath +
+        // ".__blamejs-archive-tar-tmp__") via a plain writeFileSync, so a
+        // symlink pre-planted at that exact path would be followed (CWE-59).
+        // writeSync uses a CSPRNG temp opened O_EXCL | O_NOFOLLOW + rename.
+        atomicFile.writeSync(resolvedPath, body);
         written.push({ name: entry.name, bytesWritten: body.length, path: resolvedPath });
         bytesExtracted += body.length;
       }

package/lib/archive.js

@@ -52,12 +52,13 @@
  *   ZIP archive creation primitive.
  */
 var zlib = require("node:zlib");
-var nodeFs   = require("node:fs");
 var nodeCrypto = require("node:crypto");
 var nodeStream = require("node:stream");
 var streamPromises = require("node:stream/promises");
 var C = require("./constants");
 var { defineClass } = require("./framework-error");
+var auditEmit = require("./audit-emit");
+var atomicFile = require("./atomic-file");
 
 var ArchiveError = defineClass("ArchiveError", { alwaysPermanent: true });
 
@@ -477,20 +478,13 @@ function zip() {
 
   function writeTo(filepath) {
     var buf = toBuffer();
-    nodeFs.writeFileSync(filepath, buf);
+    // Atomic, symlink-refusing write (a bare writeFileSync follows a symlink
+    // planted at filepath and can leave a torn archive on a crash).
+    atomicFile.writeSync(filepath, buf, { fileMode: 0o600 });
     return buf.length;
   }
 
-  function _emitAudit(opts, action, outcome, metadata) {
-    if (!opts || !opts.audit || typeof opts.audit.safeEmit !== "function") return;
-    try {
-      opts.audit.safeEmit({
-        action:   action,
-        outcome:  outcome,
-        metadata: metadata,
-      });
-    } catch (_e) { /* drop-silent — audit sinks must never crash the producer */ }
-  }
+  var _emitAudit = auditEmit.emitToSink;   // operator-sink audit emit (opts.audit)
 
   function _writeChunk(writable, chunk) {
     return new Promise(function (resolve, reject) {

package/lib/arg-parser.js

@@ -36,6 +36,7 @@
  */
 
 var { defineClass } = require("./framework-error");
+var pick = require("./pick");
 
 var ArgParserError = defineClass("ArgParserError", { alwaysPermanent: true });
 
@@ -44,8 +45,8 @@ var SUPPORTED_TYPES = ["string", "number", "boolean", "list"];
 // Names operators can never use for a flag. Prototype-pollution defense:
 // even though the parser internally uses Object.create(null), downstream
 // callers spreading parsed.flags into a normal object would otherwise
-// overwrite the prototype.
-var FORBIDDEN_NAMES = ["__proto__", "constructor", "prototype"];
+// overwrite the prototype. The forbidden-name set is the framework's one
+// prototype-pollution key guard — pick.isPoisonedKey.
 
 function _isPlainNonEmpty(s) {
   return typeof s === "string" && s.length > 0;
@@ -56,7 +57,7 @@ function _validateFlagName(name) {
     throw new ArgParserError("arg-parser/flag-name-invalid",
       "flag name must be a non-empty string");
   }
-  if (FORBIDDEN_NAMES.indexOf(name) !== -1) {
+  if (pick.isPoisonedKey(name)) {
     throw new ArgParserError("arg-parser/flag-name-forbidden",
       "flag name '" + name + "' is reserved");
   }
@@ -298,7 +299,7 @@ function _consumeFlags(index, tokens) {
 
     if (tok.indexOf("--") === 0) {
       var rest = tok.slice(2);
-      if (FORBIDDEN_NAMES.indexOf(rest.split("=")[0]) !== -1) {
+      if (pick.isPoisonedKey(rest.split("=")[0])) {
         throw new ArgParserError("arg-parser/argv-forbidden-name",
           "flag '--" + rest.split("=")[0] + "' is reserved");
       }
@@ -672,14 +673,14 @@ function parseRaw(argv) {
       } else {
         val = true;
       }
-      if (FORBIDDEN_NAMES.indexOf(name) !== -1) {
+      if (pick.isPoisonedKey(name)) {
         throw new ArgParserError("arg-parser/argv-forbidden-name",
           "flag '--" + name + "' is reserved");
       }
       flags[name] = val;
     } else if (tok.indexOf("-") === 0 && tok.length === 2) {
       var s = tok.slice(1);
-      if (FORBIDDEN_NAMES.indexOf(s) !== -1) {
+      if (pick.isPoisonedKey(s)) {
         throw new ArgParserError("arg-parser/argv-forbidden-name",
           "flag '-" + s + "' is reserved");
       }