@blamejs/core 0.15.12 → 0.15.14

package/lib/mail-server-submission.js

@@ -103,7 +103,6 @@
 
 var net   = require("node:net");
 var nodeTls   = require("node:tls");
-var lazyRequire = require("./lazy-require");
 var C         = require("./constants");
 var bCrypto   = require("./crypto");
 var numericBounds = require("./numeric-bounds");
@@ -115,9 +114,10 @@ var guardSmtpCommand = require("./guard-smtp-command");
 var guardDomain = require("./guard-domain");
 var mailServerRateLimit = require("./mail-server-rate-limit");
 var mailServerTls = require("./mail-server-tls");
+var mailServerNet = require("./mail-server-net");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var MailServerSubmissionError = defineClass("MailServerSubmissionError", { alwaysPermanent: true });
 
@@ -341,14 +341,7 @@ function create(opts) {
   // Default-on per-IP rate limit (see lib/mail-server-rate-limit.js).
   // Operators pass `rateLimit: false` to disable, a rate-limit handle
   // to share across listeners, or an opts object to override defaults.
-  var rateLimit;
-  if (opts.rateLimit === false) {
-    rateLimit = mailServerRateLimit.create({ disabled: true });
-  } else if (opts.rateLimit && typeof opts.rateLimit.admitConnection === "function") {
-    rateLimit = opts.rateLimit;
-  } else {
-    rateLimit = mailServerRateLimit.create(opts.rateLimit || {});
-  }
+  var rateLimit = mailServerRateLimit.resolve(opts.rateLimit);
 
   // Default-on guardDomain hardening for HELO / MAIL FROM / RCPT TO.
   // Same posture as mail-server-mx — IDN homograph / Punycode-spoof
@@ -367,45 +360,25 @@ function create(opts) {
     });
   }
   function _validateDomainHardened(d, label) {
-    if (!guardDomainProfile) return { ok: true };
-    var verdict = guardDomain.validate(d, guardDomainProfile);
-    if (!verdict.ok) {
-      _emit("mail.server.submission.domain_refused", {
-        reason: verdict.issues && verdict.issues[0] && verdict.issues[0].kind,
-        domain: d,
-        label:  label,
-      }, "denied");
-    }
-    return verdict;
+    return mailServerNet.validateDomainHardened(d, label, {
+      guardDomainProfile: guardDomainProfile,
+      guardDomain:        guardDomain,
+      emit:               _emit,
+      refusedEvent:       "mail.server.submission.domain_refused",
+    });
   }
 
-  var tcpServer    = null;
-  var listening    = false;
   var connections  = new Set();
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emit = auditEmit.emit;
 
   function _handleConnection(rawSocket) {
-    var remoteAddress = rawSocket.remoteAddress || "0.0.0.0";
-    var admit = rateLimit.admitConnection(remoteAddress);
-    if (!admit.ok) {
-      // 421 4.7.0 — transient; sender retries elsewhere.
-      _emit("mail.server.submission.rate_limit_refused",
-        { remoteAddress: remoteAddress, reason: admit.reason }, "denied");
-      try {
-        rawSocket.write("421 4.7.0 Too many connections from your IP\r\n");
-      } catch (_e) { /* socket may already be torn down */ }
-      try { rawSocket.destroy(); } catch (_e2) { /* idempotent */ }
-      return;
-    }
+    // 421 4.7.0 — transient; sender retries elsewhere.
+    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+      refusedEvent: "mail.server.submission.rate_limit_refused",
+      refusalLine:  "421 4.7.0 Too many connections from your IP\r\n",
+    });
+    if (remoteAddress === null) return;
     rawSocket.once("close", function () { rateLimit.releaseConnection(remoteAddress); });
 
     var connectionId = "submitconn-" + bCrypto.generateToken(8);                                      // connection-id length
@@ -570,7 +543,7 @@ function create(opts) {
       }
 
       lineBuffer = lineBuffer.length === 0 ? chunk : Buffer.concat([lineBuffer, chunk]);
-      if (lineBuffer.length > maxLineBytes * 4) {
+      if (safeBuffer.byteLengthOf(lineBuffer) > maxLineBytes * 4) {
         _writeReply(socket, REPLY_500_SYNTAX,
           "5.5.6 Line too long (>" + maxLineBytes + " bytes)");
         _closeConnection(socket);
@@ -1310,37 +1283,25 @@ function create(opts) {
     }
   }
 
-  async function listen(listenOpts) {
-    listenOpts = listenOpts || {};
-    if (listening) {
-      throw new MailServerSubmissionError("mail-server-submission/already-listening",
-        "listen: already listening");
-    }
-    // Port 0 (ephemeral, test mode) must NOT fall back to the protocol
-    // default — the `|| <default>` short-circuit was a footgun on the
-    // test path.
-    var defaultPort = implicitTls ? 465 : 587;                                                        // RFC 8314 implicit-TLS / RFC 6409 submission ports
-    var port    = listenOpts.port    === undefined ? defaultPort : listenOpts.port;
-    var address = listenOpts.address || "0.0.0.0";
-    tcpServer = net.createServer(function (socket) { _handleConnection(socket); });
-    return new Promise(function (resolve, reject) {
-      tcpServer.once("error", reject);
-      tcpServer.listen(port, address, function () {
-        listening = true;
-        tcpServer.removeListener("error", reject);
-        _emit("mail.server.submission.listening",
-          { port: port, address: address, implicitTls: implicitTls });
-        resolve({ port: tcpServer.address().port, address: address });
-      });
-    });
-  }
+  // Port 0 (ephemeral, test mode) must NOT fall back to the protocol default —
+  // the `|| <default>` short-circuit was a footgun on the test path;
+  // createTcpListener honors an explicit 0 (only an OMITTED port defaults). The
+  // listening event reports implicitTls so an operator can confirm the wire mode.
+  var _tcpListener = mailServerNet.createTcpListener(net, {
+    defaultPort:      implicitTls ? 465 : 587,                                                        // RFC 8314 implicit-TLS / RFC 6409 submission ports
+    handleConnection: _handleConnection,
+    errorFactory:     function (code, message) { return new MailServerSubmissionError("mail-server-submission/" + code, message); },
+    emit:             _emit,
+    listeningEvent:   "mail.server.submission.listening",
+    listeningExtra:   function () { return { implicitTls: implicitTls }; },
+  });
 
   async function close(closeOpts) {
     closeOpts = closeOpts || {};
-    if (!listening) return;
+    if (!_tcpListener.isListening()) return;
     var timeoutMs = closeOpts.timeoutMs || C.TIME.seconds(30);
-    listening = false;
-    tcpServer.close();
+    _tcpListener.markClosed();
+    _tcpListener.getServer().close();
     connections.forEach(function (sock) {
       try { _writeReply(sock, REPLY_421_SERVICE_NOT_AVAIL, "4.3.0 Server shutting down"); }
       catch (_e) { /* socket already gone */ }
@@ -1359,10 +1320,10 @@ function create(opts) {
   function connectionCount() { return connections.size; }
 
   return {
-    listen:           listen,
+    listen:           _tcpListener.listen,
     close:            close,
     connectionCount:  connectionCount,
-    _portForTest:     function () { return tcpServer ? tcpServer.address().port : null; },
+    _portForTest:     function () { var s = _tcpListener.getServer(); return s ? s.address().port : null; },
   };
 }
 

package/lib/mail-server-tls.js

@@ -93,6 +93,7 @@ var nodeFs = require("node:fs");
 var nodeTls = require("node:tls");
 var lazyRequire = require("./lazy-require");
 var C = require("./constants");
+var atomicFile = require("./atomic-file");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -177,7 +178,11 @@ function context(opts) {
   var stopped = false;
 
   function _readKey() {
-    var raw = nodeFs.readFileSync(keyFile, "utf8");
+    // Cap + fd-bound TLS-private-key read. NO refuseSymlink: keyFile is commonly
+    // certbot's /etc/letsencrypt/live/<host>/privkey.pem, a symlink chain into
+    // ../../archive — refusing symlinks would break the documented Let's Encrypt
+    // layout. The cap is the OOM-before-use defense.
+    var raw = atomicFile.fdSafeReadSync(keyFile, { maxBytes: C.BYTES.kib(64), encoding: "utf8" });
     // b.vault.sealPemFile produces blobs that decrypt via vault.unseal.
     // Detect by the sealed-cell prefix the framework's vault layer
     // already documents (everything else passes through as plain PEM).
@@ -196,7 +201,9 @@ function context(opts) {
   function _build() {
     var certPem;
     try {
-      certPem = nodeFs.readFileSync(certFile, "utf8");
+      // Cap + fd-bound cert-chain read. NO refuseSymlink (certbot fullchain.pem
+      // is a symlink); the cap is the safe hardening.
+      certPem = atomicFile.fdSafeReadSync(certFile, { maxBytes: C.BYTES.mib(1), encoding: "utf8" });
     } catch (e) {
       throw new MailServerTlsError("mail-server-tls/cert-unreadable",
         "b.mail.server.tls.context: cannot read certFile " + certFile + ": " +
@@ -438,8 +445,97 @@ function upgradeSocket(opts) {
   return tlsSocket;
 }
 
+/**
+ * @primitive b.mail.server.tls.upgradeLineProtocol
+ * @signature b.mail.server.tls.upgradeLineProtocol(opts)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.mail.server.tls.upgradeSocket
+ *
+ * STARTTLS / STLS completion for the line-buffered store listeners
+ * (IMAP / POP3 / ManageSieve), layered over `upgradeSocket`. The
+ * caller has already validated protocol state and written its
+ * "begin TLS" response; this owns the steps that recur identically
+ * across the three:
+ *
+ *   1. Drop the pre-handshake `state.lineBuffer` (always) plus any
+ *      protocol-specific half-parsed command / literal / auth fields
+ *      (`clearFields`) so bytes the peer pipelined before the upgrade
+ *      cannot survive into the post-TLS session (CVE-2021-33515 /
+ *      CVE-2021-38371 STARTTLS-injection class). Centralizing the
+ *      `lineBuffer` reset makes it impossible for a listener to forget.
+ *   2. Mark `state.tls = true` on the secure event, then run the
+ *      caller's optional `onSecure` for protocol-specific work (e.g.
+ *      ManageSieve re-emitting its capability banner per RFC 5804).
+ *   3. Feed every post-handshake chunk through the caller's `drain`
+ *      via the standard `state.lineBuffer` append.
+ *
+ * The transfer listeners (MX / submission) ingest via a serialized
+ * feed pump, not the line buffer, so they call `upgradeSocket`
+ * directly.
+ *
+ * @opts
+ *   state:         object,                       // connection state ({ lineBuffer, tls, … })
+ *   socket:        net.Socket,                   // pre-upgrade plain socket
+ *   secureContext: tls.SecureContext,            // from b.mail.server.tls.context
+ *   idleTimeoutMs: number,                       // re-armed post-handshake
+ *   clearFields:   Array<string>,                // extra state fields to null pre-upgrade
+ *   drain:         function(state, tlsSocket),   // the protocol line drainer
+ *   onSecure:      function(tlsSocket),          // optional post-secure work
+ *   onError:       function(err),                // handshake / runtime error
+ *   onTimeout:     function(tlsSocket),          // optional idle-timeout handler
+ *
+ * @example
+ *   b.mail.server.tls.upgradeLineProtocol({
+ *     state: state, socket: socket, secureContext: opts.tlsContext,
+ *     idleTimeoutMs: idleTimeoutMs, clearFields: ["pendingLiteral"],
+ *     drain: _drainBuffer,
+ *     onError: function (err) { _emit("imap.tls_failed", { err: err.message }); _close(socket, state); },
+ *   });
+ */
+function upgradeLineProtocol(opts) {
+  if (!opts || typeof opts !== "object") {
+    throw new MailServerTlsError("mail-server-tls/bad-upgrade-line-opts",
+      "upgradeLineProtocol: opts required");
+  }
+  var state = opts.state;
+  if (!state || typeof state !== "object") {
+    throw new MailServerTlsError("mail-server-tls/bad-upgrade-line-state",
+      "upgradeLineProtocol: opts.state object required");
+  }
+  if (typeof opts.drain !== "function") {
+    throw new MailServerTlsError("mail-server-tls/bad-upgrade-line-drain",
+      "upgradeLineProtocol: opts.drain(state, tlsSocket) required");
+  }
+  // CVE-2021-33515 / CVE-2021-38371 injection defense: discard the
+  // pre-handshake line buffer plus every protocol-specific half-parsed
+  // field so nothing the peer pipelined pre-upgrade survives the TLS
+  // boundary.
+  state.lineBuffer = Buffer.alloc(0);
+  var clearFields = opts.clearFields;
+  if (clearFields) {
+    for (var i = 0; i < clearFields.length; i += 1) state[clearFields[i]] = null;
+  }
+  return upgradeSocket({
+    plainSocket:   opts.socket,
+    secureContext: opts.secureContext,
+    idleTimeoutMs: opts.idleTimeoutMs,
+    onSecure: function (tlsSocket) {
+      state.tls = true;
+      if (typeof opts.onSecure === "function") opts.onSecure(tlsSocket);
+    },
+    onData: function (tlsSocket, chunk) {
+      state.lineBuffer = Buffer.concat([state.lineBuffer, chunk]);
+      opts.drain(state, tlsSocket);
+    },
+    onError:   opts.onError,
+    onTimeout: opts.onTimeout,
+  });
+}
+
 module.exports = {
   context:             context,
   upgradeSocket:       upgradeSocket,
+  upgradeLineProtocol: upgradeLineProtocol,
   MailServerTlsError:  MailServerTlsError,
 };

package/lib/mail-spam-score.js

@@ -71,6 +71,7 @@ var { defineClass }   = require("./framework-error");
 var lazyRequire       = require("./lazy-require");
 var validateOpts      = require("./validate-opts");
 var gateContract      = require("./gate-contract");
+var codepointClass    = require("./codepoint-class");
 
 var audit = lazyRequire(function () { return require("./audit"); });
 
@@ -131,8 +132,8 @@ function create(opts) {
     throw new MailSpamScoreError("mail-spam-score/bad-scorer",
       "mail.spamScore.create.scorer must be a function; got " + (typeof opts.scorer));
   }
-  var profile = opts.profile || (opts.posture && COMPLIANCE_POSTURES[opts.posture]) || DEFAULT_PROFILE;
-  if (!PROFILES[profile]) {
+  var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, profile)) {
     throw new MailSpamScoreError("mail-spam-score/bad-profile",
       "mail.spamScore.create.profile: unknown '" + profile +
       "' (valid: strict / balanced / permissive)");
@@ -221,9 +222,7 @@ function create(opts) {
  * @example
  *   b.mail.spamScore.compliancePosture("hipaa");   // → "strict"
  */
-function compliancePosture(posture) {
-  return COMPLIANCE_POSTURES[posture] || null;
-}
+var compliancePosture = gateContract.makePostureAccessor(COMPLIANCE_POSTURES);
 
 function _sanitizeReasons(reasons, caps) {
   if (reasons === undefined || reasons === null) return [];
@@ -250,13 +249,11 @@ function _sanitizeReasons(reasons, caps) {
     // Refuse control bytes (CR / LF / NUL / etc.) — a compromised
     // scorer could try to smuggle CRLF into an outbound X-Spam-Status
     // header.
-    for (var c = 0; c < r.length; c += 1) {
-      var cc = r.charCodeAt(c);
-      if (cc < 0x20 || cc === 0x7f) {                                                              // RFC 5234 CTL refusal range
-        throw new MailSpamScoreError("mail-spam-score/control-byte",
-          "mail.spamScore.score: reasons[" + i + "] contains control byte 0x" +
-          cc.toString(16));                                                                        // hex radix
-      }
+    var _ctlOff = codepointClass.firstControlCharOffset(r, { forbidTab: true });
+    if (_ctlOff !== -1) {
+      throw new MailSpamScoreError("mail-spam-score/control-byte",
+        "mail.spamScore.score: reasons[" + i + "] contains control byte 0x" +
+        r.charCodeAt(_ctlOff).toString(16));                                                       // hex radix
     }
     out.push(r);
   }

package/lib/mail-store-fts.js

@@ -321,7 +321,7 @@ var QUERY_KEY_MAP = {
  *   // → { column: "addr_toks", field: "addr" }
  */
 function columnAndFieldFor(key) {
-  return QUERY_KEY_MAP[key] || null;
+  return Object.prototype.hasOwnProperty.call(QUERY_KEY_MAP, key) ? QUERY_KEY_MAP[key] : null;
 }
 
 // Rewrite an operator query term into a FTS5 MATCH expression. The

package/lib/mail-store.js

@@ -61,6 +61,7 @@ var C = require("./constants");
 var bCrypto = require("./crypto");
 var cryptoField = require("./crypto-field");
 var vault = require("./vault");
+var safeBuffer = require("./safe-buffer");
 var safeMime = require("./safe-mime");
 var safeSql = require("./safe-sql");
 var sql = require("./sql");
@@ -798,7 +799,7 @@ function _appendMessage(args) {
       "appendMessage: rawBytes must be Buffer or string");
   }
   var buf = Buffer.isBuffer(rawBytes) ? rawBytes : Buffer.from(rawBytes, "utf8");
-  if (buf.length > args.maxMessageBytes) {
+  if (safeBuffer.byteLengthOf(buf) > args.maxMessageBytes) {
     throw new MailStoreError("mail-store/oversize-message",
       "appendMessage: " + buf.length + " bytes exceeds maxMessageBytes=" + args.maxMessageBytes);
   }
@@ -854,7 +855,7 @@ function _appendMessage(args) {
   var bodyText = textPart ? textPart.body : "";
   var bodyHtml = htmlPart && htmlPart.contentType === "text/html" ? htmlPart.body : "";
 
-  if (bodyText.length > args.maxBodyBytes || bodyHtml.length > args.maxBodyBytes) {
+  if (safeBuffer.byteLengthOf(bodyText) > args.maxBodyBytes || safeBuffer.byteLengthOf(bodyHtml) > args.maxBodyBytes) {
     throw new MailStoreError("mail-store/oversize-body",
       "appendMessage: body exceeds maxBodyBytes=" + args.maxBodyBytes);
   }

package/lib/mail.js

@@ -57,6 +57,8 @@
  */
 var C = require("./constants");
 var bCrypto = require("./crypto");
+var codepointClass = require("./codepoint-class");
+var markupEscape = require("./markup-escape").markupEscape;
 var lazyRequire = require("./lazy-require");
 var safeBuffer = require("./safe-buffer");
 var guardDomain = require("./guard-domain");
@@ -388,11 +390,7 @@ function _renderPostalAddressHtml(addr) {
 }
 
 function _htmlEscape(s) {
-  return String(s)
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;");
+  return markupEscape(s);
 }
 
 function _hasUnsubscribe(message) {
@@ -432,6 +430,26 @@ function _validateMessage(message) {
     throw new MailError("mail/invalid-subject",
       "message.subject contains forbidden CRLF", true);
   }
+  // Reply-To and custom header KEYS go straight onto the wire in _buildRfc822;
+  // a CRLF in either smuggles arbitrary headers (Bcc / Reply-To override /
+  // Content-Type) — RFC 5322 / CWE-93 header injection. Fail closed.
+  if (message.replyTo && safeBuffer.hasCrlf(String(message.replyTo))) {
+    throw new MailError("mail/invalid-reply-to",
+      "message.replyTo contains forbidden CRLF (header injection)", true);
+  }
+  if (message.headers && typeof message.headers === "object") {
+    for (var _hk in message.headers) {
+      if (!Object.prototype.hasOwnProperty.call(message.headers, _hk)) continue;
+      if (safeBuffer.hasCrlf(_hk) || _hk.indexOf("\0") !== -1) {
+        throw new MailError("mail/invalid-header",
+          "message.headers key contains forbidden CRLF/NUL (header injection)", true);
+      }
+      if (safeBuffer.hasCrlf(String(message.headers[_hk]))) {
+        throw new MailError("mail/invalid-header",
+          "message.headers value for '" + _hk + "' contains forbidden CRLF (header injection)", true);
+      }
+    }
+  }
 
   if (!message.text && !message.html && !message.calendar) {
     throw new MailError("mail/missing-body",
@@ -713,7 +731,7 @@ function _buildRfc822(message) {
   headers.push("From: " + message.from);
   headers.push("To: " + (Array.isArray(message.to) ? message.to.join(", ") : message.to));
   if (message.cc)      headers.push("Cc: " + (Array.isArray(message.cc) ? message.cc.join(", ") : message.cc));
-  if (message.replyTo) headers.push("Reply-To: " + message.replyTo);
+  if (message.replyTo) headers.push("Reply-To: " + safeBuffer.stripCrlf(String(message.replyTo)));
   if (message.subject) headers.push("Subject: " + message.subject);
   headers.push("MIME-Version: 1.0");
   headers.push("Date: " + new Date().toUTCString());
@@ -723,7 +741,7 @@ function _buildRfc822(message) {
         // Strip CRLF defensively even though we already validated the
         // message; custom headers go straight onto the wire.
         var v = safeBuffer.stripCrlf(String(message.headers[k]));
-        headers.push(k + ": " + v);
+        headers.push(safeBuffer.stripCrlf(String(k)) + ": " + v);
       }
     }
   }
@@ -1920,12 +1938,9 @@ function feedbackId(opts) {
     // Refuse CR/LF (header-injection) + control chars. Walk codepoints
     // manually because eslint's no-control-regex refuses control-char
     // ranges in regex literals regardless of escape form.
-    for (var ci = 0; ci < f.value.length; ci += 1) {
-      var code = f.value.charCodeAt(ci);
-      if (code < 32 || code === 127) {                                                             // C0 + DEL codepoint range
-        throw new MailError("mail/bad-feedback-id-field",
-          "feedbackId: " + f.key + " contains control characters");
-      }
+    if (codepointClass.firstControlCharOffset(f.value, { forbidTab: true }) !== -1) {              // C0 + DEL codepoint range
+      throw new MailError("mail/bad-feedback-id-field",
+        "feedbackId: " + f.key + " contains control characters");
     }
     parts.push(f.value);
   }

package/lib/markup-escape.js

@@ -0,0 +1,31 @@
+"use strict";
+
+// markup-escape — the shared XML/HTML text + attribute escaper used wherever
+// the framework SERIALIZES a value into markup (mail report / DAV / autoconfig
+// XML, the Azure blob XML API, and — once routed — the b.guardHtml / b.guardSvg
+// sanitizer output). Distinct from markup-tokenizer (which LEXES markup for the
+// sanitizers) and xml-c14n (which canonicalizes for XMLDSig with a different
+// escape set, e.g. \r\n\t and NO ">").
+//
+// markupEscape(str, opts) escapes the four always-dangerous markup
+// metacharacters — & < > " — to their entity forms, with "&" first so the
+// entities it emits are not double-escaped. The one axis that genuinely varies
+// across callers is the apostrophe, so it is a parameter:
+//   opts.apos omitted / falsy → "'" is left as-is (element content and
+//     double-quoted attributes don't require it escaped)
+//   opts.apos === "&#39;"     → HTML numeric form
+//   opts.apos === "&apos;"    → XML named form
+// Input COERCION stays with the caller (some map null/undefined or any
+// non-string to "" before serializing); markupEscape String()s defensively so
+// a stray number/boolean still escapes rather than throwing.
+function markupEscape(str, opts) {
+  var s = String(str)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+  var apos = opts && opts.apos;
+  return apos ? s.replace(/'/g, apos) : s;
+}
+
+module.exports = { markupEscape: markupEscape };

package/lib/markup-tokenizer.js

@@ -0,0 +1,78 @@
+"use strict";
+
+// markup-tokenizer — neutral lexing helpers shared by the markup sanitizers
+// (b.guardHtml, b.guardSvg) and the BIMI SVG Tiny PS validator (b.mail.bimi).
+// Each of those keeps its OWN tokenizer loop because their security postures
+// genuinely diverge — guard-html/guard-svg recover leniently from a truncated
+// tag (emit what was scanned, keep going), while the BIMI validator fails
+// closed (throws on any malformation), and each recognizes a different set of
+// declaration forms (`<?`, `<!ENTITY>`, balanced `<!DOCTYPE [...]>`). What they
+// share verbatim is the one quote-aware step below; centralizing it keeps the
+// attribute-quote handling — the part a bypass hides in — identical everywhere.
+
+// scanToTagEnd(s, from, len) — advance from `from` (the index just past the
+// opening "<") to the tag's closing ">", treating a ">" that appears inside a
+// single- or double-quoted attribute value as a literal, not a terminator
+// (e.g. `<a title="a>b">` ends at the SECOND ">"). Returns the index of the
+// terminating ">", or `len` if the tag is unterminated (the caller decides
+// whether that is lenient end-of-input or a hard error).
+function scanToTagEnd(s, from, len) {
+  var p = from;
+  var inQuote = "";
+  while (p < len) {
+    var ch = s.charAt(p);
+    if (inQuote) {
+      if (ch === inQuote) inQuote = "";
+    } else {
+      if (ch === '"' || ch === "'") inQuote = ch;
+      else if (ch === ">") break;
+    }
+    p += 1;
+  }
+  return p;
+}
+
+// splitTagNameAttrs(inner, tagNameRe) — given a start tag's inner text (the
+// bytes between "<" and ">", with any trailing self-closing "/" already
+// stripped by the caller), split it into the lower-cased `tagName` and the raw
+// `attrSrc` remainder. `tagNameRe` is the caller's tag-name grammar (it must
+// capture the name in group 1) — HTML allows `[A-Za-z][A-Za-z0-9:-]*`, while
+// the XML-family grammars (SVG, BIMI SVG Tiny PS) also allow `_`. A tag whose
+// start does not match the grammar yields an empty name + empty attrSrc (the
+// caller treats it as a bogus tag).
+function splitTagNameAttrs(inner, tagNameRe) {
+  var nameMatch = inner.match(tagNameRe);
+  return {
+    tagName: nameMatch ? nameMatch[1].toLowerCase() : "",
+    attrSrc: nameMatch ? inner.slice(nameMatch[0].length) : "",
+  };
+}
+
+// htmlCommentEnd(s, lt) — given that an HTML comment opens at index `lt`
+// (s.startsWith("<!--", lt)), return the index ONE PAST the comment's
+// terminator per the WHATWG HTML tokenizer, not just the legacy "-->" form.
+// A browser also closes a comment at "--!>" (comment-end-bang state) and
+// ABRUPTLY closes one that begins "<!-->" or "<!--->". A scanner that honours
+// only "-->" therefore disagrees with the browser about where the comment
+// ends, so markup AFTER an early "--!>" / abrupt close is swallowed as inert
+// comment by the sanitizer but parsed as a LIVE element by the browser (mXSS,
+// the comment-parser differential). Returns -1 if the comment is unterminated
+// so each caller keeps its own policy (lenient end-of-input vs. fail-closed
+// throw). NOTE: HTML/SVG-in-HTML only — XML comments do NOT have these forms.
+function htmlCommentEnd(s, lt) {
+  var i = lt + 4;                                  // first char after "<!--"
+  if (s.charAt(i) === ">") return i + 1;           // <!--> abrupt close
+  if (s.charAt(i) === "-" && s.charAt(i + 1) === ">") return i + 2;   // <!---> abrupt close
+  var a = s.indexOf("-->", i);
+  var b = s.indexOf("--!>", i);
+  if (a === -1 && b === -1) return -1;             // unterminated
+  if (a === -1) return b + 4;
+  if (b === -1) return a + 3;
+  return a <= b ? a + 3 : b + 4;                   // earliest terminator wins
+}
+
+module.exports = {
+  scanToTagEnd: scanToTagEnd,
+  splitTagNameAttrs: splitTagNameAttrs,
+  htmlCommentEnd: htmlCommentEnd,
+};

package/lib/mcp-tool-registry.js

@@ -65,8 +65,8 @@ var validateOpts  = require("./validate-opts");
 var { McpError }  = require("./framework-error");
 
 var bCrypto = lazyRequire(function () { return require("./crypto"); });
-var audit  = lazyRequire(function () { return require("./audit"); });
-var C      = require("./constants");
+var auditEmit = require("./audit-emit");
+var C = require("./constants");
 
 // Shared name-shape regex across mcp.js / mcp-tool-registry.js / a2a-tasks.js
 // — every agent-protocol identifier follows the same RFC-3986-unreserved
@@ -80,15 +80,7 @@ var ALLOWED_ALGS = Object.freeze([
   "slh-dsa-shake-256f",
 ]);
 
-function _emitAudit(action, metadata, outcome) {
-  try {
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome || "success",
-      metadata: metadata,
-    });
-  } catch (_e) { /* best-effort */ }
-}
+var _emitAudit = auditEmit.emit;
 
 function _validateAlg(alg, label) {
   if (alg === undefined || alg === null) return "ml-dsa-87";
@@ -175,20 +167,31 @@ function create(opts) {
     throw new McpError("mcp/bad-registry-opts",
       "toolRegistry.create: opts required (tools + signingKey)", true);
   }
-  if (!Array.isArray(opts.tools)) {
-    throw new McpError("mcp/bad-registry-opts",
-      "toolRegistry.create: opts.tools must be an array", true);
-  }
-  validateOpts.requireNonEmptyString(
-    opts.signingKey, "toolRegistry.create.signingKey", McpError, "mcp/bad-signing-key");
-  validateOpts.optionalNonEmptyString(
-    opts.verifyingKey, "toolRegistry.create.verifyingKey", McpError, "mcp/bad-verifying-key");
+  validateOpts.shape(opts, {
+    tools: function (value) {
+      if (!Array.isArray(value)) {
+        throw new McpError("mcp/bad-registry-opts",
+          "toolRegistry.create: opts.tools must be an array", true);
+      }
+    },
+    signingKey:   { rule: "required-string", code: "mcp/bad-signing-key",   label: "toolRegistry.create.signingKey" },
+    verifyingKey: { rule: "optional-string", code: "mcp/bad-verifying-key", label: "toolRegistry.create.verifyingKey" },
+    alg: function (value) {
+      // undefined → default applied below; any present value is registry-checked.
+      _validateAlg(value, "toolRegistry.create.alg");
+    },
+    ttlMs: function (value) {
+      // undefined → registry default applied below; any present value must be a
+      // finite millisecond count at or above the 1-second floor.
+      if (value === undefined) return;
+      if (typeof value !== "number" || !isFinite(value) || value < 1000) {                         // minimum-ttl threshold (1 second), not bytes
+        throw new McpError("mcp/bad-ttl",
+          "toolRegistry.create.ttlMs must be >= 1000 ms", true);
+      }
+    },
+  }, "toolRegistry.create", McpError, "mcp/bad-registry-opts");
   var alg = _validateAlg(opts.alg, "toolRegistry.create.alg");
   var defaultTtlMs = opts.ttlMs !== undefined ? opts.ttlMs : C.TIME.minutes(5);
-  if (typeof defaultTtlMs !== "number" || !isFinite(defaultTtlMs) || defaultTtlMs < 1000) {        // minimum-ttl threshold (1 second), not bytes
-    throw new McpError("mcp/bad-ttl",
-      "toolRegistry.create.ttlMs must be >= 1000 ms", true);
-  }
 
   var signingKey = opts.signingKey;
   var verifyingKey = opts.verifyingKey || null;