@blamejs/core 0.15.12 → 0.15.14

package/lib/bounded-map.js

@@ -37,6 +37,7 @@
  */
 
 var numericBounds = require("./numeric-bounds");
+var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
 var BoundedMapError = defineClass("BoundedMapError");
@@ -99,4 +100,114 @@ function boundedMap(opts) {
   };
 }
 
-module.exports = { boundedMap: boundedMap, BoundedMapError: BoundedMapError };
+// getOrInsert(map, key, factory, opts?) — Map.prototype.getOrInsertComputed(key,
+// factory) polyfill. The native method lands in Node 26 but the framework floor
+// is 24.16, so the framework's request-keyed Maps hand-roll `var v = m.get(k);
+// if (!v) { v = ...; m.set(k, v); }` everywhere. This is the ONE place that
+// shape lives, so the floor-bump sweep swaps the body for the native method in
+// a single edit instead of N call sites. Returns the existing value; otherwise
+// computes factory(key), stores it, and returns it.
+//
+// Optional cardinality ceiling so a CAPPED caller (e.g. b.metrics' label
+// cardinality cap) composes this rather than re-rolling the get-then-set with
+// its own size guard: when `opts.maxSize` is a number and the key is absent at
+// or above that size, the value is NOT stored and `opts.onFull(key)` (or
+// undefined) is returned. Works on a plain Map or the boundedMap facade above.
+function _assertMapLike(map, fnName) {
+  validateOpts.requireMethods(map, ["has", "get", "set"],
+    fnName + ": map (Map-like)", BoundedMapError, "bounded-map/bad-map");
+}
+
+function getOrInsert(map, key, factory, opts) {
+  _assertMapLike(map, "getOrInsert");
+  if (typeof factory !== "function") {
+    throw new BoundedMapError("bounded-map/bad-factory",
+      "getOrInsert: factory must be a function, got " + (typeof factory));
+  }
+  if (map.has(key)) return map.get(key);
+  if (opts && opts.maxSize !== undefined) {
+    // A bad maxSize silently breaks the ceiling (NaN/Infinity never cap →
+    // unbounded; negative always caps → never stores) — validate via the
+    // shared numeric-bounds / validate-opts assertions, never a hand-rolled
+    // typeof check.
+    numericBounds.requirePositiveFiniteIntIfPresent(opts.maxSize,
+      "getOrInsert: opts.maxSize", BoundedMapError, "bounded-map/bad-max-size");
+    validateOpts.optionalFunction(opts.onFull,
+      "getOrInsert: opts.onFull", BoundedMapError, "bounded-map/bad-on-full");
+    if (map.size >= opts.maxSize) {
+      return opts.onFull ? opts.onFull(key) : undefined;
+    }
+  }
+  var value = factory(key);
+  map.set(key, value);
+  return value;
+}
+
+// requireAbsent / requirePresent complete the keyed-store guard family that
+// getOrInsert opened. A framework registry (topics, jobs, metrics, RoPA
+// activities, DSR tickets, …) keys a Map and guards every mutation by
+// presence: a unique INSERT throws on a duplicate key, an UPDATE/lookup throws
+// when the key is missing. That guard — `if (map.has(k)) throw <duplicate>` /
+// `if (!map.has(k)) throw <not-found>` — recurred across ~18 registries, each
+// re-rolling the check beside its own .set. Centralizing it makes the
+// uniqueness/existence check impossible to forget (the primitive IS the check)
+// while leaving the caller its own typed error and value shape.
+
+// requireAbsent(map, key, onConflict) — uniqueness guard before an insert.
+// When `key` is already present, invokes onConflict(key, existingValue)
+// (callers throw their own typed duplicate error from it) and returns its
+// result; otherwise returns undefined and the caller performs its insert.
+function requireAbsent(map, key, onConflict) {
+  _assertMapLike(map, "requireAbsent");
+  if (typeof onConflict !== "function") {
+    throw new BoundedMapError("bounded-map/bad-on-conflict",
+      "requireAbsent: onConflict must be a function, got " + (typeof onConflict));
+  }
+  if (map.has(key)) return onConflict(key, map.get(key));
+  return undefined;
+}
+
+// requirePresent(map, key, onMissing) — existence guard before an update or
+// lookup. When `key` is absent, invokes onMissing(key) (callers throw their
+// own typed not-found error) and returns its result; otherwise returns the
+// existing value, so a must-exist lookup is a single call.
+function requirePresent(map, key, onMissing) {
+  _assertMapLike(map, "requirePresent");
+  if (typeof onMissing !== "function") {
+    throw new BoundedMapError("bounded-map/bad-on-missing",
+      "requirePresent: onMissing must be a function, got " + (typeof onMissing));
+  }
+  if (!map.has(key)) return onMissing(key);
+  return map.get(key);
+}
+
+// requireAbsentMember(set, key, onConflict) — the Set sibling of requireAbsent.
+// A value-LESS membership store (a Set tracking seen keys while parsing, or
+// visited nodes during a recursive walk) rejects a re-occurrence:
+// `if (set.has(key)) throw <duplicate|cycle>` before `set.add(key)`. Unlike
+// requireAbsent (a keyed Map with values), the container has nothing to return,
+// so only `.has` is required — a Set, or any { has } membership view. When the
+// member is already present, invokes onConflict(key) (the caller throws its own
+// typed duplicate / cycle error) and returns its result; otherwise returns
+// undefined and the caller performs its `.add`.
+function requireAbsentMember(set, key, onConflict) {
+  if (!set || typeof set.has !== "function") {
+    throw new BoundedMapError("bounded-map/bad-set",
+      "requireAbsentMember: set must be a Set-like { has }");
+  }
+  if (typeof onConflict !== "function") {
+    throw new BoundedMapError("bounded-map/bad-on-conflict",
+      "requireAbsentMember: onConflict must be a function, got " + (typeof onConflict));
+  }
+  if (set.has(key)) return onConflict(key);
+  return undefined;
+}
+
+module.exports = {
+  boundedMap:          boundedMap,
+  BoundedMapError:     BoundedMapError,
+  getOrInsert:         getOrInsert,
+  requireAbsent:       requireAbsent,
+  requirePresent:      requirePresent,
+  requireAbsentMember: requireAbsentMember,
+};

package/lib/breach-deadline.js

@@ -149,21 +149,11 @@ function forStates(states, detectedAtMs) {
 // deadline registry and tracks per-state filing status.
 function createReporter(opts) {
   opts = opts || {};
-  var auditOn = opts.audit !== false;
   var now = typeof opts.now === "function" ? opts.now : function () { return Date.now(); };
   var seq = 0;
   var breaches = new Map();
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "breach.report." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("breach.report", opts.audit);
 
   function open(spec) {
     if (!spec || typeof spec !== "object") {

package/lib/break-glass.js

@@ -120,10 +120,13 @@ function _appSqlOpts() { return { dialect: clusterStorage.dialect(), quoteName:
 // Populated on first access per-table; invalidated on policy.set/delete.
 var policyCache = new Map();    // table -> policy
 var initialized = false;
-// Framework-wide trustProxy setting (set at init). When true, the
-// break-glass primitive consults X-Forwarded-For to populate the
-// grant row's `ip` field — same trust boundary as middleware.
-var _trustProxy = false;
+// Framework-wide client-IP resolver (built at init). The grant row's `ip`
+// field is a security control — a grant is pinned to the IP that minted it
+// and re-checked on redeem. X-Forwarded-For is forgeable, so the binding is
+// meaningful only when resolution is peer-gated: operators declare their
+// reverse proxies via init({ trustedProxies }) or own resolution via
+// init({ clientIpResolver }). Default resolves the socket address only.
+var _ipResolver = requestHelpers.trustedClientIp();
 
 // Factor lockout — wrap auth.lockout so a hostile actor brute-forcing
 // TOTP codes against break-glass gets shut out after a few failures.
@@ -457,28 +460,45 @@ async function migrate(table, opts) {
  * @related   b.breakGlass.policy.set, b.breakGlass.grant
  *
  * One-shot boot wiring. Clears the in-memory policy cache, resets the
- * factor-lockout counter, and records the framework-wide trustProxy
- * boundary so subsequent `grant()` calls populate the grant row's `ip`
- * field from `X-Forwarded-For` only when proxies are trusted. Operators
- * call this once at boot, before any policy / grant / unseal call —
- * every other primitive throws `breakglass/not-initialized` until init
- * has run.
+ * factor-lockout counter, and records how the grant row's `ip` field is
+ * resolved. That IP is a security binding — the grant pins to it at mint
+ * and re-checks it on redeem — so resolution is peer-gated: declare your
+ * reverse proxies via `trustedProxies` (CIDRs; X-Forwarded-For honored
+ * only from a trusted peer) or own resolution via `clientIpResolver`. A
+ * bare `trustProxy` is refused — a forgeable pin is no pin. Operators call
+ * this once at boot, before any policy / grant / unseal call — every other
+ * primitive throws `breakglass/not-initialized` until init has run.
  *
  * @opts
- *   trustProxy: boolean,   // honor X-Forwarded-For when populating grant.ip (default false)
+ *   trustedProxies:   string|string[],          // CIDRs of your reverse proxies — peer-gates X-Forwarded-For
+ *   clientIpResolver: function(req): string|null,  // own grant-IP resolution
  *
  * @example
- *   b.breakGlass.init({ trustProxy: true });
+ *   b.breakGlass.init({ trustedProxies: ["10.0.0.0/8"] });
  *   // → undefined  (init returns nothing; throws on bad opts)
  */
 function init(opts) {
   opts = opts || {};
-  validateOpts(opts, ["trustProxy"], "breakGlass.init");
+  validateOpts(opts, ["trustProxy", "trustedProxies", "clientIpResolver"], "breakGlass.init");
+  var resolver;
+  try {
+    resolver = requestHelpers.trustedClientIp({
+      trustedProxies:   opts.trustedProxies,
+      clientIpResolver: opts.clientIpResolver,
+    });
+  } catch (e) {
+    throw new BreakGlassError("breakglass/bad-opt", e.message);
+  }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !resolver.peerGated) {
+    throw new BreakGlassError("breakglass/bad-opt",
+      "trustProxy is spoofable — a grant pinned to a forgeable X-Forwarded-For is no " +
+      "pin at all. Declare your reverse proxies via trustedProxies: [\"10.0.0.0/8\", …] " +
+      "or supply clientIpResolver(req).");
+  }
   initialized = true;
   policyCache.clear();
   _factorLockout = null;
-  _trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
+  _ipResolver = resolver;
 }
 
 function _resetForTest() {
@@ -490,7 +510,7 @@ function _resetForTest() {
   }
   _factorLockout = null;
   _factorLockoutCache = null;
-  _trustProxy = false;
+  _ipResolver = requestHelpers.trustedClientIp();
 }
 
 function _requireInit() {
@@ -1119,11 +1139,10 @@ async function grant(opts) {
   var nowMs    = Date.now();
   var grantId  = "bg-" + generateToken(GRANT_ID_BYTES);
   var sessionId = (opts.req && opts.req.session && opts.req.session.id) || null;
-  // Honor the framework-wide trustProxy setting from init() — same
-  // boundary as middleware. Without trustProxy, X-Forwarded-For is
-  // ignored as attacker-forgeable, and the grant pins to the socket
-  // remoteAddress only.
-  var ipFromReq = requestHelpers.clientIp(opts.req, { trustProxy: _trustProxy });
+  // Peer-gated client-IP resolution from init() (trustedProxies /
+  // clientIpResolver). Without it, X-Forwarded-For is ignored as
+  // attacker-forgeable and the grant pins to the socket remoteAddress only.
+  var ipFromReq = _ipResolver.resolve(opts.req);
 
   var grantRow = {
     _id:                grantId,
@@ -1218,7 +1237,7 @@ function _enforceGrantPins(policy, grantRow, redeemReq, actorFor) {
         "captured at mint (fail-closed) — re-mint from a request whose client " +
         "IP the framework can resolve", true);
     }
-    var redeemIp = requestHelpers.clientIp(redeemReq, { trustProxy: _trustProxy });
+    var redeemIp = _ipResolver.resolve(redeemReq);
     if (redeemIp !== grantRow.ip) {
       audit.safeEmit({
         action:   "breakglass.unsealrow",

package/lib/cache.js

@@ -70,6 +70,7 @@
  *   LRU + TTL cache with operator-supplied namespacing, drop-silent key validation on hot-path observability, and pluggable backends that share semantics across single-process and clustered nodes.
  */
 
+var boundedMap = require("./bounded-map");
 var cacheRedis = require("./cache-redis");
 var redisClient = require("./redis-client");
 var clusterStorage = require("./cluster-storage");
@@ -179,16 +180,8 @@ function _defaultSizeOf(value) {
 }
 
 function _validateBackendObject(backend) {
-  var required = ["get", "set", "del", "clear", "size", "close"];
-  if (typeof backend !== "object" || backend === null) {
-    throw _err("BAD_OPT", "cache.create: custom backend must be an object");
-  }
-  for (var i = 0; i < required.length; i++) {
-    if (typeof backend[required[i]] !== "function") {
-      throw _err("BAD_OPT", "cache.create: custom backend missing method '" + required[i] +
-        "' (required: " + required.join(", ") + ")");
-    }
-  }
+  validateOpts.requireMethods(backend, ["get", "set", "del", "clear", "size", "close"],
+    "cache.create: custom backend", CacheError, "BAD_OPT");
 }
 
 function _validateCreateOpts(opts) {
@@ -338,8 +331,7 @@ function _memoryBackend(cfg) {
     totalBytes += bytes;
     if (tags && tags.length > 0) {
       for (var i = 0; i < tags.length; i++) {
-        var s = tagIndex.get(tags[i]);
-        if (!s) { s = new Set(); tagIndex.set(tags[i], s); }
+        var s = boundedMap.getOrInsert(tagIndex, tags[i], function () { return new Set(); });
         s.add(key);
       }
     }
@@ -1028,12 +1020,9 @@ function create(opts) {
   var operatorObs      = opts.observability || null;
   var clock            = opts.clock || function () { return Date.now(); };
   var invalidationPubsub = opts.invalidationPubsub || null;
-  if (invalidationPubsub && (
-        typeof invalidationPubsub.publish !== "function" ||
-        typeof invalidationPubsub.subscribe !== "function" ||
-        typeof invalidationPubsub.unsubscribe !== "function")) {
-    throw _err("BAD_OPT",
-      "cache.create: invalidationPubsub must implement { publish, subscribe, unsubscribe } (b.pubsub.create instance)");
+  if (invalidationPubsub) {
+    validateOpts.requireMethods(invalidationPubsub, ["publish", "subscribe", "unsubscribe"],
+      "cache.create: invalidationPubsub (b.pubsub.create instance)", CacheError, "BAD_OPT");
   }
   var invalidationChannel = "cache:" + namespace + ":invalidate";
   var invalidationToken = null;

package/lib/cbor.js

@@ -54,10 +54,18 @@
  */
 
 var C = require("./constants");
+var safeBuffer = require("./safe-buffer");
+var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
 var CborError = defineClass("CborError", { alwaysPermanent: true });
 
+// Hoisted so the map-decode loop's per-key uniqueness guard doesn't allocate a
+// closure per key (the decode hot path).
+function _throwDuplicateKey() {
+  throw new CborError("cbor/duplicate-key", "cbor.decode: duplicate map key (RFC 8949 §5.6)");
+}
+
 var DEFAULT_MAX_DEPTH = 64;                                                            // nesting depth, not a size
 var ABSOLUTE_MAX_DEPTH = 256;                                                          // nesting depth ceiling, not a size
 var DEFAULT_MAX_BYTES = C.BYTES.mib(16);
@@ -126,6 +134,7 @@ function _encodeFloat(value) {
 // exponent must fit the half range and the low 13 mantissa bits must
 // be zero (half has a 10-bit mantissa vs float32's 23).
 function _doubleToHalfBits(value) {
+  if (value === 0) return Object.is(value, -0) ? 0x8000 : 0x0000;                       // ±zero → half zero (sign-preserving); -0 must not fall to the subnormal path
   var fbuf = Buffer.alloc(4);
   fbuf.writeFloatBE(value, 0);
   if (fbuf.readFloatBE(0) !== value) return -1;                                        // not exact in float32 → not in float16
@@ -176,8 +185,10 @@ function _encodeValue(value, opts) {
     // Exact integers within the safe range encode as CBOR integers;
     // an integer-VALUED number beyond 2^53 (e.g. 1e300) has lost
     // integer precision and is a float — encode it as a float (use a
-    // bigint for exact 64-bit CBOR integers).
-    if (Number.isInteger(value) && Math.abs(value) <= Number.MAX_SAFE_INTEGER) {
+    // bigint for exact 64-bit CBOR integers). NEGATIVE ZERO is excluded:
+    // CBOR integers have no -0, so encoding -0 as the uint 0 would silently
+    // drop the sign; it falls through to the float branch (float16 -0.0).
+    if (Number.isInteger(value) && !Object.is(value, -0) && Math.abs(value) <= Number.MAX_SAFE_INTEGER) {
       return value >= 0 ? _head(0, value) : _head(1, -1 - value);
     }
     if (!isFinite(value) && !opts.allowNonFinite) {
@@ -300,7 +311,7 @@ function decode(buffer, opts) {
   }
   var buf = Buffer.isBuffer(buffer) ? buffer : Buffer.from(buffer);
   var maxBytes = _capInt(opts.maxBytes, DEFAULT_MAX_BYTES, ABSOLUTE_MAX_BYTES);
-  if (buf.length > maxBytes) {
+  if (safeBuffer.byteLengthOf(buf) > maxBytes) {
     throw new CborError("cbor/too-large",
       "cbor.decode: input " + buf.length + " bytes exceeds maxBytes " + maxBytes);
   }
@@ -336,7 +347,11 @@ function _need(state, n) {
 
 function _readArgument(state, ai) {
   // ai is the low-5-bits additional info. Returns the argument as a
-  // Number (or BigInt for 8-byte values beyond Number range).
+  // Number (or BigInt for 8-byte values beyond Number range). Non-minimal
+  // (non-canonical) heads are tolerated here by design — strict canonical
+  // enforcement is the opt-in `requireDeterministic` mode (round-trip compare);
+  // duplicate keys encoded non-minimally are caught value-based in the map
+  // decoder regardless of mode (RFC 8949 §5.6).
   if (ai < CBOR_AI_1BYTE) return ai;
   if (ai === CBOR_AI_1BYTE) { _need(state, 1); var v1 = state.buf[state.pos]; state.pos += 1; return v1; }
   if (ai === 25) { _need(state, 2); var v2 = state.buf.readUInt16BE(state.pos); state.pos += 2; return v2; }
@@ -409,17 +424,26 @@ function _decodeItem(state, depth) {
     case 5: {                                                                           // map
       var mlen = _lenOf(_readArgument(state, ai));
       var m = new Map();
-      var seen = [];
+      // O(1) duplicate-key detection (RFC 8949 §5.6) keyed on the CANONICAL
+      // re-encoding of each decoded key — not its raw input bytes. A per-key
+      // Buffer.compare scan over a `seen` array is O(n²), and cbor.decode runs on
+      // raw attacker bytes BEFORE any signature check on every COSE / CWT / EAT /
+      // mdoc verify path, so a large distinct-key map is an unauthenticated
+      // algorithmic-complexity DoS (CWE-407). Keying on the canonical encoding
+      // (rather than the input bytes) also closes the bypass where the SAME key
+      // value is sent twice with different (e.g. non-minimal) encodings to dodge
+      // a byte-wise dup check and silently last-value-win — both copies
+      // re-encode identically here and the duplicate is caught regardless of the
+      // requireDeterministic mode.
+      var seen = new Set();
       for (var j = 0; j < mlen; j++) {
         var keyStart = state.pos;
         var key = _decodeItem(state, depth + 1);
-        var keyBytes = state.buf.slice(keyStart, state.pos);
-        for (var s = 0; s < seen.length; s++) {
-          if (Buffer.compare(seen[s], keyBytes) === 0) {
-            throw new CborError("cbor/duplicate-key", "cbor.decode: duplicate map key (RFC 8949 §5.6)");
-          }
-        }
-        seen.push(keyBytes);
+        var keyId;
+        try { keyId = encode(key).toString("latin1"); }
+        catch (_e) { keyId = "raw:" + state.buf.toString("latin1", keyStart, state.pos); }
+        boundedMap.requireAbsentMember(seen, keyId, _throwDuplicateKey);
+        seen.add(keyId);
         var val = _decodeItem(state, depth + 1);
         m.set(key, val);
       }

package/lib/cdn-cache-control.js

@@ -336,20 +336,19 @@ function parse(headerValue) {
   if (trimmed.length === 0) return null;
 
   var out = { directives: {} };
-  var pieces = structuredFields.splitTopLevel(trimmed, ",");
-  for (var p = 0; p < pieces.length; p += 1) {
-    var raw = pieces[p].trim();
-    if (raw.length === 0) continue;
-    var eq = raw.indexOf("=");
+  var kvps = structuredFields.parseKeyValuePieces(
+    structuredFields.splitTopLevel(trimmed, ","));
+  for (var p = 0; p < kvps.length; p += 1) {
+    var kvp = kvps[p];
     var key, val, bare;
-    if (eq === -1) {
-      key = raw.toLowerCase();
+    if (kvp.value === null) {
+      key = kvp.key;
       val = "";
       bare = true;
     }
     else {
-      key = raw.slice(0, eq).trim().toLowerCase();
-      val = raw.slice(eq + 1).trim();
+      key = kvp.key;
+      val = kvp.value.trim();
       bare = false;
       // Unquote sf-string per RFC 8941 §3.3.3 (defensive — operators
       // routinely emit `s-maxage="3600"` even though the directive is
@@ -377,9 +376,13 @@ function parse(headerValue) {
         }
         continue;
       }
-      var n = Number(val);
-      if (isFinite(n) && n >= 0) {
-        out[_camel(key)] = Math.floor(n);
+      // RFC 9111 delta-seconds is 1*DIGIT — Number() would also accept hex
+      // ("0x10"), exponential ("1e3"), and surrounding whitespace, which are
+      // not valid cache-directive values. Round-trip parseInt to require pure
+      // decimal digits.
+      var n = parseInt(val, 10);
+      if (Number.isFinite(n) && n >= 0 && String(n) === val) {
+        out[_camel(key)] = n;
       }
       continue;
     }

package/lib/cert.js

@@ -100,10 +100,8 @@ function _createSealedDiskStorage(opts) {
     CertError, "cert/bad-storage-root");
   var rootDir = nodePath.resolve(opts.rootDir);
   var vaultStore = opts.vault || vault().getDefaultStore();
-  if (!vaultStore || typeof vaultStore.seal !== "function" || typeof vaultStore.unseal !== "function") {
-    throw new CertError("cert/bad-storage-vault",
-      "cert.storage: vault must expose seal(buf) + unseal(buf) — typically b.vault.getDefaultStore()");
-  }
+  validateOpts.requireMethods(vaultStore, ["seal", "unseal"],
+    "cert.storage: vault (typically b.vault.getDefaultStore())", CertError, "cert/bad-storage-vault");
 
   function _ensureDir(dir) { atomicFile.ensureDir(dir); }
   function _certDir(name)  { return nodePath.join(rootDir, name); }
@@ -127,7 +125,9 @@ function _createSealedDiskStorage(opts) {
     async readSealed(relPath) {
       var p = nodePath.join(rootDir, relPath + ".sealed");
       if (!nodeFs.existsSync(p)) return null;
-      var sealed = nodeFs.readFileSync(p);
+      // Cap + fd-bound (sealed cert/key envelope is well under 256 KiB). NO
+      // refuseSymlink: the sealed store may be operator-mounted.
+      var sealed = atomicFile.fdSafeReadSync(p, { maxBytes: C.BYTES.kib(256) });
       var plain = vaultStore.unseal(sealed);
       return Buffer.isBuffer(plain) ? plain : Buffer.from(plain);
     },
@@ -141,7 +141,7 @@ function _createSealedDiskStorage(opts) {
     async readMeta(certName) {
       var p = nodePath.join(_certDir(certName), "meta.json");
       if (!nodeFs.existsSync(p)) return null;
-      try { return safeJson.parse(nodeFs.readFileSync(p, "utf8"), { maxBytes: C.BYTES.kib(16) }); }
+      try { return safeJson.parse(atomicFile.fdSafeReadSync(p, { maxBytes: C.BYTES.kib(16), encoding: "utf8" }), { maxBytes: C.BYTES.kib(16) }); }
       catch (e) {
         // meta.json is a derived index (expiry + fingerprint), not a
         // source of truth — the sealed cert is. A corrupt meta must not
@@ -411,12 +411,7 @@ function create(opts) {
   var ocspTimer = null;
   var stopped = false;
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditEnabled) return;
-    try {
-      audit().safeEmit({ action: action, outcome: outcome, metadata: metadata || {} });
-    } catch (_e) { /* drop-silent — audit emission is hot-path */ }
-  }
+  var _emitAudit = audit().namespaced(null, { audit: auditEnabled });
 
   function _bootAcme() {
     if (acmeClient) return acmeClient;
@@ -436,7 +431,7 @@ function create(opts) {
   function _loadOrGenerateAccountKey() {
     // Read sealed account JWK; generate + persist if absent.
     var sealedBuf = nodeFs.existsSync(nodePath.join(storage.rootDir, "account/jwk.json.sealed"))
-      ? nodeFs.readFileSync(nodePath.join(storage.rootDir, "account/jwk.json.sealed"))
+      ? atomicFile.fdSafeReadSync(nodePath.join(storage.rootDir, "account/jwk.json.sealed"), { maxBytes: C.BYTES.kib(64) })
       : null;
     if (sealedBuf) {
       var jwk;