@blamejs/core 0.15.12 → 0.15.14

package/lib/importmap-integrity.js

@@ -22,6 +22,7 @@
 
 var validateOpts = require("./validate-opts");
 var bCrypto      = require("./crypto");
+var safeJson     = require("./safe-json");
 var { defineClass } = require("./framework-error");
 
 var ImportmapError = defineClass("ImportmapError", { alwaysPermanent: true });
@@ -46,7 +47,9 @@ var ImportmapError = defineClass("ImportmapError", { alwaysPermanent: true });
  *       "@org/lib": { url: "/static/lib.js", body: fileBytes },
  *     },
  *   });
- *   res.end("<script type=\"importmap\">" + JSON.stringify(im) + "</script>");
+ *   // Embed with the <script>-safe helper — NEVER raw JSON.stringify, which
+ *   // does not escape "</script>" in a module url and breaks out of the tag.
+ *   res.end(b.importmapIntegrity.scriptTag(im));
  */
 function build(opts) {
   opts = validateOpts.requireObject(opts, "importmapIntegrity.build",
@@ -84,7 +87,44 @@ function build(opts) {
   return { imports: imports, integrity: integrity };
 }
 
+/**
+ * @primitive b.importmapIntegrity.scriptTag
+ * @signature b.importmapIntegrity.scriptTag(importmap, opts?)
+ * @since     0.15.14
+ * @status    stable
+ * @related   b.importmapIntegrity.build, b.safeJson.stringifyForScript
+ *
+ * Render an import-map object (from `build`) as a ready-to-embed
+ * `<script type="importmap">…</script>` tag using the `<script>`-safe
+ * JSON serializer. Raw `JSON.stringify` does not escape `</script>` in a
+ * module url, so concatenating it into the page lets a `</script>` in a
+ * url close the element and inject markup — this escapes `< > &` (and the
+ * U+2028 / U+2029 separators) so no url can break out.
+ *
+ * @opts
+ *   nonce:  string,   // CSP nonce added as nonce="…" on the <script>
+ *
+ * @example
+ *   res.end(b.importmapIntegrity.scriptTag(im, { nonce: req.cspNonce }));
+ */
+function scriptTag(importmap, opts) {
+  opts = opts || {};
+  var nonceAttr = "";
+  if (typeof opts.nonce === "string" && opts.nonce.length > 0) {
+    // The nonce is operator-supplied (a CSP per-request token); reject any
+    // value that could itself break the attribute rather than escape it.
+    if (/[^A-Za-z0-9+/=_-]/.test(opts.nonce)) {
+      throw new ImportmapError("importmap/bad-nonce",
+        "scriptTag: opts.nonce must be a base64/token string");
+    }
+    nonceAttr = ' nonce="' + opts.nonce + '"';
+  }
+  return '<script type="importmap"' + nonceAttr + '>' +
+    safeJson.stringifyForScript(importmap) + "</script>";
+}
+
 module.exports = {
   build:           build,
+  scriptTag:       scriptTag,
   ImportmapError:  ImportmapError,
 };

package/lib/inbox.js

@@ -43,9 +43,11 @@
  */
 
 var C = require("./constants");
+var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var safeSql = require("./safe-sql");
+var safeBuffer = require("./safe-buffer");
 var sql = require("./sql");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -204,13 +206,11 @@ function create(opts) {
   }
 
   function _rejectControlChars(value, label, field) {
-    for (var i = 0; i < value.length; i += 1) {
-      var code = value.charCodeAt(i);
-      if (code === 0 || (code < 32 && code !== 9) || code === 127) {     // ASCII control codepoints (NUL + C0 + DEL); allow tab
-        throw new InboxError("inbox/bad-receive",
-          label + ": " + field + " contains control character at index " + i +
-          " (codepoint " + code + ")");
-      }
+    var _off = codepointClass.firstControlCharOffset(value);                // allow tab (RFC 5322 folding WS)
+    if (_off !== -1) {
+      throw new InboxError("inbox/bad-receive",
+        label + ": " + field + " contains control character at index " + _off +
+        " (codepoint " + value.charCodeAt(_off) + ")");
     }
   }
 
@@ -223,7 +223,7 @@ function create(opts) {
     var metaJson = null;
     if (receiveOpts.metadata != null) {
       var serialized = safeJson.stringify(receiveOpts.metadata);
-      if (serialized.length > maxPayloadBytes) {
+      if (safeBuffer.byteLengthOf(serialized) > maxPayloadBytes) {
         throw new InboxError("inbox/bad-receive",
           "recordReceive: metadata serialized exceeds maxPayloadBytes (" +
           maxPayloadBytes + " bytes)");

package/lib/incident-report.js

@@ -93,12 +93,15 @@ var REGIME_DEADLINES = Object.freeze({
     intermediate: C.TIME.hours(72),
     final:        C.TIME.days(30),
   }),
-  // DORA (EU Digital Operational Resilience Act) Article 19: initial
-  // within 4h of classification, intermediate within 24h, final
-  // within 1 month.
+  // DORA (EU Digital Operational Resilience Act) Art. 19 + RTS (EU)
+  // 2024/1772 Art. 5: initial within 4h of classifying the incident as
+  // major (outer bound 24h from awareness), intermediate within 72h of the
+  // initial notification, final within 1 month of the intermediate report.
+  // (intermediate was 24h here, contradicting lib/dora.js's 72h — the RTS
+  // value is 72h from the initial notification; aligned.)
   dora: Object.freeze({
     initial:      C.TIME.hours(4),
-    intermediate: C.TIME.hours(24),
+    intermediate: C.TIME.hours(72),
     final:        C.TIME.days(30),
   }),
   // CRA (EU Cyber Resilience Act) Article 14: early warning within
@@ -138,7 +141,6 @@ function create(opts) {
     "audit", "persist", "onStage", "deadlines", "now",
   ], "incident.report");
 
-  var auditOn = opts.audit !== false;
   var persist = typeof opts.persist === "function" ? opts.persist : null;
   var onStage = typeof opts.onStage === "function" ? opts.onStage : null;
   var deadlinesOverride = opts.deadlines || null;
@@ -150,20 +152,8 @@ function create(opts) {
   var incidents = new Map();
   var seq = 0;
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "incident.report." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("incident.report." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("incident.report", opts.audit);
+  var _emitMetric = observability().namespaced("incident.report");
 
   function _genIncidentId(regime, detectedAt) {
     seq += 1;
@@ -219,7 +209,7 @@ function create(opts) {
   }
 
   async function _recordStage(incidentId, stage, payload) {
-    if (!VALID_STAGES[stage]) {
+    if (!Object.prototype.hasOwnProperty.call(VALID_STAGES, stage)) {
       throw new IncidentReportError("incident-report/bad-stage",
         "incident.report._recordStage: stage must be one of " + Object.keys(VALID_STAGES).join(", "));
     }
@@ -339,12 +329,7 @@ function createDeadlineClock(opts) {
   var tracked = new Map();   // incidentId -> { detectedAt, dueBy, regime, acked, fired }
   var timer = null;
 
-  function _emit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({ action: "incident.report.clock." + action, outcome: outcome, metadata: metadata || {} });
-    } catch (_e) { /* drop-silent — by design */ }
-  }
+  var _emit = audit().namespaced("incident.report.clock", auditOn);
   function _notify(payload) {
     if (!notify) return;
     try {
@@ -376,7 +361,7 @@ function createDeadlineClock(opts) {
   function untrack(id) { return tracked.delete(id); }
 
   function acknowledgeSubmission(id, stage, info) {
-    if (!VALID_STAGES[stage]) {
+    if (!Object.prototype.hasOwnProperty.call(VALID_STAGES, stage)) {
       throw new IncidentReportError("incident-report/bad-stage",
         "createDeadlineClock.acknowledgeSubmission: stage must be one of " + Object.keys(VALID_STAGES).join(", "));
     }

package/lib/ip-utils.js

@@ -82,9 +82,9 @@ function expandIpv6Groups(ip) {
 // Loose IPv4 textual-form check — for primitives that need to
 // classify a string as "looks like dotted-quad IPv4" but don't need
 // the strict per-octet bound check (callers that DO need octet
-// bounds use the strict form in `mail-rbl.js` etc.). Shared so
-// `lib/mail.js`, `lib/mail-helo.js`, and `lib/redis-client.js`
-// don't drift on the same shape.
+// bounds use `isIPv4` below). Shared so `lib/mail.js`,
+// `lib/mail-helo.js`, and `lib/redis-client.js` don't drift on the
+// same shape.
 //
 //   isIPv4Shape("1.2.3.4")     → true
 //   isIPv4Shape("999.0.0.0")   → true (shape only; octets unbounded)
@@ -95,8 +95,51 @@ function isIPv4Shape(s) {
   return typeof s === "string" && IPV4_SHAPE_RE.test(s);
 }
 
+// Strict RFC 791 dotted-quad IPv4: four 0-255 octets separated by `.`.
+// The single source for textual IPv4 validation across the framework
+// — `b.mail.greylist` / `b.mail.rbl` CIDR fingerprinting, `b.mail.helo`
+// RFC 5321 §4.1.3 address-literals, `b.guardDomain` IPv4-as-domain
+// detection, and `b.safeSchema` `.ip()`. Hand-rolling the per-octet
+// alternation had drifted into several spellings; this is canonical.
+//
+//   isIPv4("203.0.113.42")  → true
+//   isIPv4("256.0.0.1")     → false (octet > 255)
+//   isIPv4("1.2.3")         → false (three octets)
+var IPV4_RE = /^(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;       // allow:regex-no-length-cap — anchored + per-octet repeat-cap
+function isIPv4(s) {
+  return typeof s === "string" && IPV4_RE.test(s);
+}
+
+// RFC 5321 §4.1.3 IPv4 address-literal `[1.2.3.4]`. Capture group 1 is
+// the inner dotted-quad; `b.mail.helo` matches a claimed literal
+// against the connection IP. Same per-octet bound as `IPV4_RE`.
+var IPV4_ADDR_LITERAL_RE = /^\[((?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})\]$/;  // allow:regex-no-length-cap — anchored + per-octet repeat-cap
+
+// Loose IPv6 textual pre-filter: hex digits + colons only, bounded to
+// the RFC 4291 §2.2 max no-IPv4-tail textual length (8 groups × 4 hex
+// + 7 colons = 39). A cheap fail-fast before the full `expandIpv6Hex`
+// parse — NOT a complete validator; callers follow with
+// `expandIpv6Hex`. A hex-colon string longer than 39 chars is never a
+// valid IPv6 textual form, so the bound only rejects garbage.
+//
+//   looksLikeIPv6Hex("2001:db8::1")  → true
+//   looksLikeIPv6Hex("::1")          → true
+//   looksLikeIPv6Hex("::ffff:1.2.3.4")→ false (dotted tail — use expandIpv6Hex)
+//   looksLikeIPv6Hex("nothex")       → false
+var IPV6_TEXT_MAX_LEN = 39;                                                                              // RFC 4291 §2.2 max no-IPv4-tail textual length
+var IPV6_HEX_RE = /^[0-9a-fA-F:]+$/;                                                                     // allow:regex-no-length-cap — length-bounded by IPV6_TEXT_MAX_LEN in looksLikeIPv6Hex
+function looksLikeIPv6Hex(s) {
+  return typeof s === "string" && s.length <= IPV6_TEXT_MAX_LEN && IPV6_HEX_RE.test(s);
+}
+
 module.exports = {
-  expandIpv6Hex:    expandIpv6Hex,
-  expandIpv6Groups: expandIpv6Groups,
-  isIPv4Shape:      isIPv4Shape,
+  expandIpv6Hex:        expandIpv6Hex,
+  expandIpv6Groups:     expandIpv6Groups,
+  isIPv4Shape:          isIPv4Shape,
+  isIPv4:               isIPv4,
+  IPV4_RE:              IPV4_RE,
+  IPV4_ADDR_LITERAL_RE: IPV4_ADDR_LITERAL_RE,
+  looksLikeIPv6Hex:     looksLikeIPv6Hex,
+  IPV6_HEX_RE:          IPV6_HEX_RE,
+  IPV6_TEXT_MAX_LEN:    IPV6_TEXT_MAX_LEN,
 };

package/lib/jobs.js

@@ -77,6 +77,7 @@ var { boot } = require("./log");
 var queue = require("./queue");
 var validateOpts = require("./validate-opts");
 var { JobsError } = require("./framework-error");
+var boundedMap = require("./bounded-map");
 
 var log = boot("jobs");
 
@@ -102,10 +103,10 @@ function create(opts) {
     if (typeof handler !== "function") {
       throw _err("INVALID_HANDLER", "jobs.define: handler must be a function", true);
     }
-    if (registry.has(name)) {
+    boundedMap.requireAbsent(registry, name, function () {
       throw _err("DUPLICATE_NAME",
         "jobs.define: '" + name + "' is already defined", true);
-    }
+    });
     if (started) {
       // Defining after start would mean the new handler doesn't run
       // until the next start cycle. Reject loudly so operators don't

package/lib/json-patch.js

@@ -157,7 +157,7 @@ function apply(doc, operations) {
   var work = structuredClone(doc);
   for (var i = 0; i < operations.length; i += 1) {
     var op = operations[i];
-    if (!op || typeof op !== "object" || typeof op.op !== "string" || !OPS[op.op]) {
+    if (!op || typeof op !== "object" || typeof op.op !== "string" || !Object.prototype.hasOwnProperty.call(OPS, op.op)) {
       throw new JsonPatchError("json-patch/bad-op", "jsonPatch.apply: operations[" + i + "] has an invalid 'op'");
     }
     if (typeof op.path !== "string") throw new JsonPatchError("json-patch/bad-op", "jsonPatch.apply: operations[" + i + "] is missing 'path'");

package/lib/json-path.js

@@ -35,6 +35,7 @@ var { defineClass } = require("./framework-error");
 var JsonPathError = defineClass("JsonPathError", { alwaysPermanent: true });
 
 var MAX_DESCEND_NODES = 1000000;                             // DoS ceiling on nodes visited by a descendant walk
+var MAX_TOTAL_NODES = 1000000;                              // DoS ceiling on the running nodelist across ALL segments (chained wildcard/slice/filter cross-product)
 
 // ---------------------------------------------------------------------------
 // Parser — recursive descent over the RFC 9535 ABNF.
@@ -46,7 +47,20 @@ function _isDigit(c) { return c >= "0" && c <= "9"; }
 function _isNameFirst(c) { var cc = c.charCodeAt(0); return (c >= "A" && c <= "Z") || (c >= "a" && c <= "z") || c === "_" || cc >= 0x80; }
 function _isNameChar(c) { return _isNameFirst(c) || _isDigit(c); }
 
-function _Parser(s) { this.s = s; this.i = 0; }
+function _Parser(s) { this.s = s; this.i = 0; this._depth = 0; }
+
+// Nesting-depth cap for the filter-expression recursion (parens + `!`). Without
+// it, a deeply-nested filter like `?(((((...)))))` recurses until V8 throws a
+// raw RangeError ("Maximum call stack size exceeded") that escapes JsonPathError
+// handling — a DoS / unhandled-crash lever on attacker-supplied JSONPath.
+var MAX_FILTER_DEPTH = 200;
+_Parser.prototype._descend = function () {
+  if (++this._depth > MAX_FILTER_DEPTH) {
+    throw new JsonPathError("json-path/filter-too-deep",
+      "jsonPath: filter expression nesting exceeds " + MAX_FILTER_DEPTH);
+  }
+};
+_Parser.prototype._ascend = function () { this._depth -= 1; };
 _Parser.prototype.err = function (msg) { throw new JsonPathError("json-path/invalid", "jsonPath: " + msg + " at index " + this.i); };
 _Parser.prototype.peek = function () { return this.i < this.s.length ? this.s.charAt(this.i) : ""; };
 _Parser.prototype.eat = function (c) { if (this.peek() !== c) this.err("expected '" + c + "'"); this.i += 1; };
@@ -226,9 +240,9 @@ _Parser.prototype.parseLogicalAnd = function () {
 };
 _Parser.prototype.parseBasic = function () {
   this.skipBlank();
-  if (this.peek() === "!") { this.i += 1; this.skipBlank(); var inner = this.parseBasic(); this._requireTestable(inner); return { type: "not", e: inner, vtype: "logical" }; }
+  if (this.peek() === "!") { this.i += 1; this.skipBlank(); this._descend(); var inner = this.parseBasic(); this._ascend(); this._requireTestable(inner); return { type: "not", e: inner, vtype: "logical" }; }
   if (this.peek() === "(") {
-    this.i += 1; this.skipBlank(); var e = this.parseLogicalOr(); this.skipBlank(); this.eat(")");
+    this.i += 1; this.skipBlank(); this._descend(); var e = this.parseLogicalOr(); this._ascend(); this.skipBlank(); this.eat(")");
     return e;
   }
   // comparison or test
@@ -436,6 +450,13 @@ function _evalSegments(segments, root) {
       base = acc;
     }
     base.forEach(function (nd) { seg.selectors.forEach(function (sel) { _applySelector(sel, nd, root, next); }); });
+    // Cap the running nodelist across the WHOLE query, not just per descendant
+    // walk: chained wildcard/slice/filter selectors multiply the nodelist each
+    // segment ([*][*][*]…), an OOM lever the per-`_descend` budget never sees.
+    if (next.length > MAX_TOTAL_NODES) {
+      throw new JsonPathError("json-path/too-large",
+        "jsonPath: nodelist exceeded " + MAX_TOTAL_NODES + " nodes (chained selector cross-product)");
+    }
     nodes = next;
   }
   return nodes;

package/lib/jtd.js

@@ -58,7 +58,7 @@ function _checkSchema(schema, root, isRoot) {
   if (!_isPlainObject(schema)) throw new JtdError("jtd/bad-schema", "jtd: schema must be an object");
   if (!isRoot && Object.prototype.hasOwnProperty.call(schema, "definitions")) throw new JtdError("jtd/bad-schema", "jtd: 'definitions' is allowed only at the root");
   Object.keys(schema).forEach(function (k) {
-    if (FORM_KEYWORDS.indexOf(k) === -1 && !SHARED_KEYWORDS[k] && k !== "additionalProperties" && k !== "mapping") throw new JtdError("jtd/bad-schema", "jtd: unknown keyword '" + k + "'");
+    if (FORM_KEYWORDS.indexOf(k) === -1 && !Object.prototype.hasOwnProperty.call(SHARED_KEYWORDS, k) && k !== "additionalProperties" && k !== "mapping") throw new JtdError("jtd/bad-schema", "jtd: unknown keyword '" + k + "'");
   });
   if (Object.prototype.hasOwnProperty.call(schema, "nullable") && typeof schema.nullable !== "boolean") throw new JtdError("jtd/bad-schema", "jtd: 'nullable' must be a boolean");
   if (Object.prototype.hasOwnProperty.call(schema, "metadata") && !_isPlainObject(schema.metadata)) throw new JtdError("jtd/bad-schema", "jtd: 'metadata' must be an object");
@@ -75,7 +75,7 @@ function _checkSchema(schema, root, isRoot) {
   if ("ref" in schema) {
     if (typeof schema.ref !== "string" || !root.definitions || !Object.prototype.hasOwnProperty.call(root.definitions, schema.ref)) throw new JtdError("jtd/bad-schema", "jtd: 'ref' must name a key in the root definitions");
   }
-  if ("type" in schema && !TYPES[schema.type]) throw new JtdError("jtd/bad-schema", "jtd: unknown type '" + schema.type + "'");
+  if ("type" in schema && !Object.prototype.hasOwnProperty.call(TYPES, schema.type)) throw new JtdError("jtd/bad-schema", "jtd: unknown type '" + schema.type + "'");
   if ("enum" in schema) {
     if (!Array.isArray(schema.enum) || schema.enum.length === 0) throw new JtdError("jtd/bad-schema", "jtd: 'enum' must be a non-empty array");
     var seen = Object.create(null);

package/lib/keychain.js

@@ -242,24 +242,12 @@ async function _writeFile(fallbackFile, doc, passphrase) {
 // Drain a stream into a Buffer, honoring an upper byte cap so a
 // runaway tool can't OOM the framework.
 function _drain(stream, capBytes) {
-  return new Promise(function (resolve, reject) {
-    if (!stream) { resolve(Buffer.alloc(0)); return; }
-    var collector = safeBuffer.boundedChunkCollector({
-      maxBytes:    capBytes,
-      errorClass:  KeychainError,
-      sizeCode:    "keychain/native-output-too-large",
-      sizeMessage: "native tool output exceeded " + capBytes + " bytes",
-    });
-    stream.on("data", function (chunk) {
-      try {
-        collector.push(chunk);
-      } catch (e) {
-        try { stream.destroy(); } catch (_e) { /* destroy best-effort */ }
-        reject(e);
-      }
-    });
-    stream.on("end",   function () { resolve(collector.result()); });
-    stream.on("error", function (e) { reject(e); });
+  if (!stream) return Promise.resolve(Buffer.alloc(0));
+  return safeBuffer.collectStream(stream, {
+    maxBytes:    capBytes,
+    errorClass:  KeychainError,
+    sizeCode:    "keychain/native-output-too-large",
+    sizeMessage: "native tool output exceeded " + capBytes + " bytes",
   });
 }
 

package/lib/legal-hold.js

@@ -60,7 +60,6 @@
  * on policy denials (already-held / not-held / invalid-citation).
  */
 var bCrypto = require("./crypto");
-var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var sql = require("./sql");
@@ -77,7 +76,7 @@ var { defineClass } = require("./framework-error");
 var HOLD_TABLE = "_blamejs_legal_hold";   // allow:hand-rolled-sql — canonical local table-name; passed to b.sql with quoteName
 var AUDIT_TABLE = "audit_log";
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var LegalHoldError = defineClass("LegalHoldError", { alwaysPermanent: true });
 var _err = LegalHoldError.factory;
@@ -151,19 +150,11 @@ function create(opts) {
   validateOpts.optionalObjectWithMethod(opts.signWith, "sign",
     "create: opts.signWith", LegalHoldError, "BAD_OPT", "b.auditSign-shaped object");
 
-  function _emit(action, info, outcome) {
-    if (!auditOn) return;
-    var sink = auditInstance || audit();
-    try {
-      sink.safeEmit({
-        action:   action,
-        outcome:  outcome,
-        resource: { kind: "legal-hold", id: info && info.subjectId },
-        reason:   (info && info.reason) || null,
-        metadata: info || {},
-      });
-    } catch (_e) { /* best-effort */ }
-  }
+  var _emit = auditEmit.gatedReasonEmitter({
+    audit: auditOn,
+    sink:  auditInstance,
+    extra: function (info) { return { resource: { kind: "legal-hold", id: info && info.subjectId } }; },
+  });
 
   function _ensureSchema() {
     // Idempotent migration. The framework SQLite path installs the
@@ -219,19 +210,34 @@ function create(opts) {
     _ensureSchema();
     var hash = _hashSubject(sid);
     var placeSelBuilt = sql.select(HOLD_TABLE, SQL_OPTS)
-      .columns(["placedAt"])
+      .columns(["placedAt", "retainUntil"])
       .where("subjectIdHash", hash)
       .toSql();
     var placeSelStmt = db.prepare(placeSelBuilt.sql);
     var existing = placeSelStmt.get.apply(placeSelStmt, placeSelBuilt.params);
+    var nowMs = Date.now();
+    var renewedFromLapsed = false;
     if (existing) {
-      _emit("legalhold.place_rejected",
-        { subjectId: sid, reason: "already-held",
-          existingSince: existing.placedAt },
-        "denied");
-      return { error: "already-held", placedAt: existing.placedAt };
+      // A LAPSED hold (retainUntil sunset already passed → isHeld() is already
+      // false) must not block a fresh placement: otherwise a subject whose hold
+      // expired cannot be re-held when new litigation arises, leaving the data
+      // both unprotected (isHeld false) and erasable by retention. Replace the
+      // lapsed row with the new hold. An ACTIVE hold still rejects as before.
+      var existingLapsed = existing.retainUntil && existing.retainUntil < nowMs;
+      if (!existingLapsed) {
+        _emit("legalhold.place_rejected",
+          { subjectId: sid, reason: "already-held",
+            existingSince: existing.placedAt },
+          "denied");
+        return { error: "already-held", placedAt: existing.placedAt };
+      }
+      renewedFromLapsed = true;
+      var lapseDelBuilt = sql.delete(HOLD_TABLE, SQL_OPTS)
+        .where("subjectIdHash", hash)
+        .toSql();
+      var lapseDelStmt = db.prepare(lapseDelBuilt.sql);
+      lapseDelStmt.run.apply(lapseDelStmt, lapseDelBuilt.params);
     }
-    var nowMs = Date.now();
     var placeInsBuilt = sql.insert(HOLD_TABLE, SQL_OPTS)
       .values(cryptoField.sealRow(HOLD_TABLE, {
         subjectIdHash: hash,
@@ -251,9 +257,10 @@ function create(opts) {
         citation:  args.citation  || null,
         retainUntil: args.retainUntil || null,
         placedBy: args.placedBy || null,
+        renewedFromLapsed: renewedFromLapsed,
         knownCitation: args.citation && KNOWN_CITATIONS.indexOf(args.citation) !== -1 },
       "success");
-    return { placed: true, placedAt: nowMs };
+    return { placed: true, placedAt: nowMs, renewedFromLapsed: renewedFromLapsed };
   }
 
   function release(subjectId, args) {