@blamejs/core 0.15.13 → 0.15.14

package/lib/auth/status-list.js

@@ -78,7 +78,7 @@ var _fromB64url = bCrypto.makeBase64UrlDecoder({
 });
 
 function _validateBits(bits) {
-  if (!SUPPORTED_BIT_SIZES[bits]) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_BIT_SIZES, bits)) {
     throw new StatusListError("status-list/bad-bits",
       "statusList: bits must be 1, 2, 4, or 8 (draft §6.1.1) — got " + bits);
   }
@@ -249,7 +249,19 @@ async function fromJwt(token, opts) {
     list: {
       size:     size,
       bits:     bits,
-      get:      function (idx) { return _getAt(inflated, bits, idx); },
+      // Bounds-check the relying-party status read, mirroring create().get. An
+      // out-of-range index must FAIL CLOSED (throw): _getAt over-reads the buffer
+      // and returns 0 for an out-of-bounds index, and status 0 = VALID — so a
+      // credential whose status_list index points past the list would otherwise
+      // read as "not revoked", a revocation bypass.
+      get:      function (idx) {
+        if (typeof idx !== "number" || idx < 0 || idx >= size || (idx >> 0) !== idx) {
+          throw new StatusListError("status-list/bad-index",
+            "statusList.fromJwt get: idx out of range — got " + idx + ", size=" + size +
+            " (an out-of-range status index fails closed, never reads as status 0/valid)");
+        }
+        return _getAt(inflated, bits, idx);
+      },
       snapshot: function () { return { size: size, bits: bits, bytes: Buffer.from(inflated) }; },
     },
     claims: claims,

package/lib/auth/step-up.js

@@ -386,7 +386,15 @@ function parseChallenge(headerValue) {
     if (key === "error")              out.error     = val;
     else if (key === "scope")         out.scope     = val;
     else if (key === "acr_values")    out.acrValues = val.split(/\s+/);
-    else if (key === "max_age")       out.maxAge    = parseInt(val, 10);
+    else if (key === "max_age") {
+      // Defensive: a malformed max_age (non-numeric / negative) from the
+      // server's challenge must not land as NaN — a downstream `age > maxAge`
+      // comparison against NaN is always false and would silently mis-handle
+      // the freshness requirement. Omit it unless it parses to a non-negative
+      // integer, so callers fall back to their own default.
+      var ma = parseInt(val, 10);
+      if (isFinite(ma) && ma >= 0) out.maxAge = ma;
+    }
   });
   return out;
 }

package/lib/auth-bot-challenge.js

@@ -40,6 +40,7 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var requestHelpers = require("./request-helpers");
 var validateOpts = require("./validate-opts");
+var numericBounds = require("./numeric-bounds");
 var { AuthBotChallengeError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -67,7 +68,7 @@ function _requireFunction(name, val) {
 }
 
 function _requirePositiveInt(name, val) {
-  if (typeof val !== "number" || !isFinite(val) || val < 1 || Math.floor(val) !== val) {
+  if (!numericBounds.isPositiveFiniteInt(val)) {
     throw new AuthBotChallengeError("auth-bot-challenge/bad-opt",
       name + ": expected positive integer, got " + JSON.stringify(val));
   }
@@ -272,7 +273,25 @@ function create(opts) {
 
   // ---- Internal staircase advance ----
 
-  async function _advanceFailure(key, req) {
+  // Per-key serialization: the failure staircase is a read→increment→write on
+  // an async store, so concurrent recordFailure calls for the SAME key would
+  // both read N and both write N+1 (lost update), letting an attacker fire
+  // parallel failures to stay under the challenge / lockout thresholds. A
+  // per-key promise chain applies advances for a key sequentially. (Cross-node
+  // atomicity additionally needs an atomic store; this fixes the in-process
+  // race the gate actually depends on.)
+  var _advanceChains = new Map();
+  function _advanceFailure(key, req) {
+    var prev = _advanceChains.get(key) || Promise.resolve();
+    var run = prev.then(function () { return _doAdvanceFailure(key, req); },
+                        function () { return _doAdvanceFailure(key, req); });
+    var tail = run.then(function () {}, function () {});
+    _advanceChains.set(key, tail);
+    tail.then(function () { if (_advanceChains.get(key) === tail) _advanceChains.delete(key); });
+    return run;
+  }
+
+  async function _doAdvanceFailure(key, req) {
     var now = clock();
     var state = await _readState(key) || {
       stage: STATE_NEW, failures: 0, challengedAt: null, passedAt: null,

package/lib/backup/bundle.js

@@ -160,14 +160,18 @@ async function create(opts) {
       },
     });
     var checksum = bCrypto.checksum(plain);
-    var encResult = await bCrypto.encryptWithFreshSalt(plain, passphrase);
+    // Bind the ciphertext to this blob's canonical relativePath as AEAD
+    // associated data. A blob copied to a different manifest entry (the
+    // restore-corruption / blob-remap attack) then fails the Poly1305 tag on
+    // restore — tamper-evident even on an unsigned bundle (manifest.aadBound).
+    var encResult = await bCrypto.encryptWithFreshSalt(plain, passphrase, entry.relativePath);
     var encPath = _encryptedPathFor(entry.relativePath);
     var destFull = nodePath.join(outDir, encPath);
     atomicFile.ensureDir(nodePath.dirname(destFull));
     atomicFile.writeSync(destFull, encResult.encrypted, { fileMode: 0o600 });
 
     var kind = entry.kind || "raw";
-    if (!backupManifest.VALID_KINDS[kind]) {
+    if (!Object.prototype.hasOwnProperty.call(backupManifest.VALID_KINDS, kind)) {
       throw new BackupBundleError("backup-bundle/bad-kind",
         "create: files[" + i + "].kind must be one of raw, vault-sealed, plaintext (got '" + kind + "')");
     }
@@ -205,6 +209,7 @@ async function create(opts) {
     vaultKeyEnc:  wrappedVk.encrypted.toString("base64"),
     files:        fileEntries,
     metadata:     opts.metadata || undefined,
+    aadBound:     true,   // every blob above was sealed with its relativePath as AEAD AAD
   });
   // Sign the manifest with the audit-sign keypair so a tampered
   // manifest fails verification on restore. The signer is best-

package/lib/backup/crypto.js

@@ -117,7 +117,21 @@ async function deriveKey(passphrase, saltHex, opts) {
   return hash;
 }
 
-async function encryptWithPassphrase(plaintext, passphrase, saltHex) {
+// Normalize optional associated-authenticated-data (AAD) into the
+// Uint8Array the AEAD expects, or undefined when none. AAD is NOT encrypted
+// but IS authenticated: ciphertext sealed under one AAD fails the Poly1305
+// tag when decrypted under a different AAD. Backup file blobs pass their
+// canonical relativePath so a blob remapped to a different manifest entry is
+// cryptographically rejected (the blob-remap / restore-corruption defense).
+function _aadBytes(aad) {
+  if (aad === undefined || aad === null) return undefined;
+  if (Buffer.isBuffer(aad)) return new Uint8Array(aad);
+  if (typeof aad === "string") return new Uint8Array(Buffer.from(aad, "utf8"));
+  throw new BackupCryptoError("backup-crypto/bad-aad",
+    "associated data must be a Buffer or string");
+}
+
+async function encryptWithPassphrase(plaintext, passphrase, saltHex, aad) {
   if (!Buffer.isBuffer(plaintext) && typeof plaintext !== "string") {
     throw new BackupCryptoError("backup-crypto/bad-plaintext",
       "encryptWithPassphrase: plaintext must be a Buffer or string");
@@ -125,11 +139,11 @@ async function encryptWithPassphrase(plaintext, passphrase, saltHex) {
   var plainBuf = Buffer.isBuffer(plaintext) ? plaintext : Buffer.from(plaintext, "utf8");
   var key = await deriveKey(passphrase, saltHex);
   var nonce = nodeCrypto.randomBytes(NONCE_BYTES);
-  var ct = xchacha20poly1305(new Uint8Array(key), nonce).encrypt(new Uint8Array(plainBuf));
+  var ct = xchacha20poly1305(new Uint8Array(key), nonce, _aadBytes(aad)).encrypt(new Uint8Array(plainBuf));
   return Buffer.concat([nonce, Buffer.from(ct)]);
 }
 
-async function decryptWithPassphrase(encrypted, passphrase, saltHex) {
+async function decryptWithPassphrase(encrypted, passphrase, saltHex, aad) {
   if (!Buffer.isBuffer(encrypted)) {
     throw new BackupCryptoError("backup-crypto/bad-input",
       "decryptWithPassphrase: encrypted must be a Buffer");
@@ -143,11 +157,11 @@ async function decryptWithPassphrase(encrypted, passphrase, saltHex) {
   var ct    = encrypted.subarray(NONCE_BYTES);
   var plain;
   try {
-    plain = xchacha20poly1305(new Uint8Array(key), new Uint8Array(nonce))
+    plain = xchacha20poly1305(new Uint8Array(key), new Uint8Array(nonce), _aadBytes(aad))
       .decrypt(new Uint8Array(ct));
   } catch (e) {
     throw new BackupCryptoError("backup-crypto/decrypt-failed",
-      "XChaCha20-Poly1305 decryption failed (wrong passphrase or tampered ciphertext): " +
+      "XChaCha20-Poly1305 decryption failed (wrong passphrase, tampered ciphertext, or blob remapped to a different path): " +
       ((e && e.message) || String(e)));
   }
   return Buffer.from(plain);
@@ -155,11 +169,12 @@ async function decryptWithPassphrase(encrypted, passphrase, saltHex) {
 
 // Convenience for the common "encrypt this with a fresh salt" pattern.
 // Returns the salt as hex so callers can store it alongside the
-// ciphertext in the bundle manifest.
-async function encryptWithFreshSalt(plaintext, passphrase) {
+// ciphertext in the bundle manifest. `aad` (optional) is bound as AEAD
+// associated data (see _aadBytes).
+async function encryptWithFreshSalt(plaintext, passphrase, aad) {
   var salt = nodeCrypto.randomBytes(SALT_BYTES);
   var saltHex = salt.toString("hex");
-  var encrypted = await encryptWithPassphrase(plaintext, passphrase, saltHex);
+  var encrypted = await encryptWithPassphrase(plaintext, passphrase, saltHex, aad);
   return { encrypted: encrypted, salt: saltHex };
 }
 

package/lib/backup/index.js

@@ -53,6 +53,7 @@ var os = require("node:os");
 var nodePath = require("node:path");
 var bCrypto = require("../crypto");
 var atomicFile = require("../atomic-file");
+var C = require("../constants");
 var backupBundle = require("./bundle");
 var frameworkFiles = require("../framework-files");
 var backupManifest = require("./manifest");
@@ -721,11 +722,16 @@ function create(opts) {
         try {
           await storage.readBundle(bundleId, stagingDir);
           manifestPath = nodePath.join(stagingDir, "manifest.json");
-          if (!nodeFs.existsSync(manifestPath)) {
-            throw new BackupError("backup/test-no-manifest",
-              "manifest.json missing under restored bundle " + bundleId);
-          }
-          manifest = backupManifest.parse(nodeFs.readFileSync(manifestPath, "utf8"));
+          // Capped fd-bound read inside the scheduled restore-drill tick: an
+          // oversized manifest must not OOM the scheduler worker.
+          manifest = backupManifest.parse(atomicFile.fdSafeReadSync(manifestPath, {
+            maxBytes: C.BYTES.mib(4), encoding: "utf8",
+            errorFor: function (kind) {
+              if (kind === "enoent") return new BackupError("backup/test-no-manifest", "manifest.json missing under restored bundle " + bundleId);
+              if (kind === "too-large") return new BackupError("backup/test-bad-manifest", "manifest.json too large under restored bundle " + bundleId);
+              return new BackupError("backup/test-no-manifest", "manifest.json unreadable under restored bundle " + bundleId + ": " + kind);
+            },
+          }));
           // Verify the manifest signature so a tampered backup test
           // surfaces here, not as a regulator finding later.
           sigVerification = backupManifest.verifySignature(manifest, {
@@ -837,11 +843,17 @@ function verifyManifestSignature(target, opts) {
   var manifest;
   if (typeof target === "string") {
     var manifestPath = nodePath.join(target, "manifest.json");
-    if (!nodeFs.existsSync(manifestPath)) {
-      throw new BackupError("backup/no-manifest",
-        "verifyManifestSignature: manifest.json missing at " + manifestPath);
-    }
-    try { manifest = backupManifest.parse(nodeFs.readFileSync(manifestPath, "utf8")); }
+    // Capped fd-bound read OUTSIDE the parse try (so a missing/oversized manifest
+    // surfaces backup/no-manifest|bad-manifest, not a generic parse error).
+    var manifestRaw = atomicFile.fdSafeReadSync(manifestPath, {
+      maxBytes: C.BYTES.mib(4), encoding: "utf8",
+      errorFor: function (kind) {
+        if (kind === "enoent") return new BackupError("backup/no-manifest", "verifyManifestSignature: manifest.json missing at " + manifestPath);
+        if (kind === "too-large") return new BackupError("backup/bad-manifest", "verifyManifestSignature: manifest.json too large");
+        return new BackupError("backup/bad-manifest", "verifyManifestSignature: unreadable: " + kind);
+      },
+    });
+    try { manifest = backupManifest.parse(manifestRaw); }
     catch (e) {
       throw new BackupError("backup/bad-manifest",
         "verifyManifestSignature: parse failed: " + ((e && e.message) || String(e)));
@@ -2187,19 +2199,28 @@ bundleAdapterStorage.fsAdapter = function (fsOpts) {
       // mode 0o600 matches the v0.12.9 directory-format readback
       // discipline — backup payloads carry operator-owned bytes
       // (potentially PHI / PCI / GDPR-scoped); owner-only is the
-      // strict posture. wx is not set here because writeFile is
-      // the storage primitive (operators legitimately rewrite the
-      // same key, e.g. resuming a multipart upload); upper layers
-      // (writeBundle's `bundle-exists` check) enforce no-overwrite
-      // at the bundle level.
-      nodeFs.writeFileSync(path, bytes, { mode: 0o600 });
+      // strict posture. Overwrite of an existing key stays allowed
+      // (operators legitimately rewrite the same key, e.g. resuming a
+      // multipart upload); upper layers (writeBundle's `bundle-exists`
+      // check) enforce no-overwrite at the bundle level. writeSync's
+      // atomic rename preserves that overwrite semantic while refusing a
+      // symlink pre-planted at `path` (CWE-59) and never leaving a torn
+      // payload — a bare writeFileSync did both.
+      atomicFile.writeSync(path, bytes, { fileMode: 0o600 });
     },
     async readFile(key) {
       var path = _keyPath(key);
-      if (!nodeFs.existsSync(path)) {
-        throw new BackupError("backup/no-key", "fsAdapter: key not found: " + JSON.stringify(key));
-      }
-      return nodeFs.readFileSync(path);
+      // Capped fd-bound read (no existsSync check-then-read window): fetches a
+      // whole bundle payload, so an oversize/swapped file is an OOM lever. 8 GiB
+      // matches the writeBundle maxBundleBytes ceiling.
+      return atomicFile.fdSafeReadSync(path, {
+        maxBytes: C.BYTES.gib(8),
+        errorFor: function (kind) {
+          if (kind === "enoent") return new BackupError("backup/no-key", "fsAdapter: key not found: " + JSON.stringify(key));
+          if (kind === "too-large") return new BackupError("backup/key-too-large", "fsAdapter: payload for key " + JSON.stringify(key) + " exceeds the read cap");
+          return new BackupError("backup/no-key", "fsAdapter: key " + JSON.stringify(key) + " unreadable: " + kind);
+        },
+      });
     },
     async listKeys(prefix) {
       var out = [];

package/lib/backup/manifest.js

@@ -140,7 +140,7 @@ function _validateFileEntry(f, idx, errors) {
   if (!_isHex(f.salt, true)) {
     errors.push("files[" + idx + "].salt: required hex string");
   }
-  if (typeof f.kind !== "string" || !VALID_KINDS[f.kind]) {
+  if (typeof f.kind !== "string" || !Object.prototype.hasOwnProperty.call(VALID_KINDS, f.kind)) {
     errors.push("files[" + idx + "].kind: must be one of raw, vault-sealed, plaintext");
   }
 }
@@ -239,6 +239,11 @@ function create(opts) {
   if (opts.metadata && typeof opts.metadata === "object" && !Array.isArray(opts.metadata)) {
     manifest.metadata = Object.assign({}, opts.metadata);
   }
+  // Marks that every file blob was sealed with its relativePath as AEAD
+  // associated data (the blob-remap defense). Set on all bundles this version
+  // writes; absent on legacy bundles, which restore decrypts without AAD.
+  // Carried into the signed payload so it cannot be flipped on a signed bundle.
+  if (opts.aadBound === true) manifest.aadBound = true;
   var v = validate(manifest);
   if (!v.ok) {
     throw new BackupManifestError("backup-manifest/invalid",
@@ -271,6 +276,7 @@ function _canonical(manifest, includeSignature) {
     }),
   };
   if (manifest.metadata) canonical.metadata = manifest.metadata;
+  if (manifest.aadBound === true) canonical.aadBound = true;
   // Signature block lives alongside the rest of the manifest fields
   // and is itself stable-ordered. Sign-time canonicalization (the
   // bytes the audit-sign keypair signs) excludes the signature field

package/lib/break-glass.js

@@ -120,10 +120,13 @@ function _appSqlOpts() { return { dialect: clusterStorage.dialect(), quoteName:
 // Populated on first access per-table; invalidated on policy.set/delete.
 var policyCache = new Map();    // table -> policy
 var initialized = false;
-// Framework-wide trustProxy setting (set at init). When true, the
-// break-glass primitive consults X-Forwarded-For to populate the
-// grant row's `ip` field — same trust boundary as middleware.
-var _trustProxy = false;
+// Framework-wide client-IP resolver (built at init). The grant row's `ip`
+// field is a security control — a grant is pinned to the IP that minted it
+// and re-checked on redeem. X-Forwarded-For is forgeable, so the binding is
+// meaningful only when resolution is peer-gated: operators declare their
+// reverse proxies via init({ trustedProxies }) or own resolution via
+// init({ clientIpResolver }). Default resolves the socket address only.
+var _ipResolver = requestHelpers.trustedClientIp();
 
 // Factor lockout — wrap auth.lockout so a hostile actor brute-forcing
 // TOTP codes against break-glass gets shut out after a few failures.
@@ -457,28 +460,45 @@ async function migrate(table, opts) {
  * @related   b.breakGlass.policy.set, b.breakGlass.grant
  *
  * One-shot boot wiring. Clears the in-memory policy cache, resets the
- * factor-lockout counter, and records the framework-wide trustProxy
- * boundary so subsequent `grant()` calls populate the grant row's `ip`
- * field from `X-Forwarded-For` only when proxies are trusted. Operators
- * call this once at boot, before any policy / grant / unseal call —
- * every other primitive throws `breakglass/not-initialized` until init
- * has run.
+ * factor-lockout counter, and records how the grant row's `ip` field is
+ * resolved. That IP is a security binding — the grant pins to it at mint
+ * and re-checks it on redeem — so resolution is peer-gated: declare your
+ * reverse proxies via `trustedProxies` (CIDRs; X-Forwarded-For honored
+ * only from a trusted peer) or own resolution via `clientIpResolver`. A
+ * bare `trustProxy` is refused — a forgeable pin is no pin. Operators call
+ * this once at boot, before any policy / grant / unseal call — every other
+ * primitive throws `breakglass/not-initialized` until init has run.
  *
  * @opts
- *   trustProxy: boolean,   // honor X-Forwarded-For when populating grant.ip (default false)
+ *   trustedProxies:   string|string[],          // CIDRs of your reverse proxies — peer-gates X-Forwarded-For
+ *   clientIpResolver: function(req): string|null,  // own grant-IP resolution
  *
  * @example
- *   b.breakGlass.init({ trustProxy: true });
+ *   b.breakGlass.init({ trustedProxies: ["10.0.0.0/8"] });
  *   // → undefined  (init returns nothing; throws on bad opts)
  */
 function init(opts) {
   opts = opts || {};
-  validateOpts(opts, ["trustProxy"], "breakGlass.init");
+  validateOpts(opts, ["trustProxy", "trustedProxies", "clientIpResolver"], "breakGlass.init");
+  var resolver;
+  try {
+    resolver = requestHelpers.trustedClientIp({
+      trustedProxies:   opts.trustedProxies,
+      clientIpResolver: opts.clientIpResolver,
+    });
+  } catch (e) {
+    throw new BreakGlassError("breakglass/bad-opt", e.message);
+  }
+  if ((opts.trustProxy === true || typeof opts.trustProxy === "number") && !resolver.peerGated) {
+    throw new BreakGlassError("breakglass/bad-opt",
+      "trustProxy is spoofable — a grant pinned to a forgeable X-Forwarded-For is no " +
+      "pin at all. Declare your reverse proxies via trustedProxies: [\"10.0.0.0/8\", …] " +
+      "or supply clientIpResolver(req).");
+  }
   initialized = true;
   policyCache.clear();
   _factorLockout = null;
-  _trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
-    ? opts.trustProxy : false;
+  _ipResolver = resolver;
 }
 
 function _resetForTest() {
@@ -490,7 +510,7 @@ function _resetForTest() {
   }
   _factorLockout = null;
   _factorLockoutCache = null;
-  _trustProxy = false;
+  _ipResolver = requestHelpers.trustedClientIp();
 }
 
 function _requireInit() {
@@ -1119,11 +1139,10 @@ async function grant(opts) {
   var nowMs    = Date.now();
   var grantId  = "bg-" + generateToken(GRANT_ID_BYTES);
   var sessionId = (opts.req && opts.req.session && opts.req.session.id) || null;
-  // Honor the framework-wide trustProxy setting from init() — same
-  // boundary as middleware. Without trustProxy, X-Forwarded-For is
-  // ignored as attacker-forgeable, and the grant pins to the socket
-  // remoteAddress only.
-  var ipFromReq = requestHelpers.clientIp(opts.req, { trustProxy: _trustProxy });
+  // Peer-gated client-IP resolution from init() (trustedProxies /
+  // clientIpResolver). Without it, X-Forwarded-For is ignored as
+  // attacker-forgeable and the grant pins to the socket remoteAddress only.
+  var ipFromReq = _ipResolver.resolve(opts.req);
 
   var grantRow = {
     _id:                grantId,
@@ -1218,7 +1237,7 @@ function _enforceGrantPins(policy, grantRow, redeemReq, actorFor) {
         "captured at mint (fail-closed) — re-mint from a request whose client " +
         "IP the framework can resolve", true);
     }
-    var redeemIp = requestHelpers.clientIp(redeemReq, { trustProxy: _trustProxy });
+    var redeemIp = _ipResolver.resolve(redeemReq);
     if (redeemIp !== grantRow.ip) {
       audit.safeEmit({
         action:   "breakglass.unsealrow",

package/lib/cbor.js

@@ -55,10 +55,17 @@
 
 var C = require("./constants");
 var safeBuffer = require("./safe-buffer");
+var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
 var CborError = defineClass("CborError", { alwaysPermanent: true });
 
+// Hoisted so the map-decode loop's per-key uniqueness guard doesn't allocate a
+// closure per key (the decode hot path).
+function _throwDuplicateKey() {
+  throw new CborError("cbor/duplicate-key", "cbor.decode: duplicate map key (RFC 8949 §5.6)");
+}
+
 var DEFAULT_MAX_DEPTH = 64;                                                            // nesting depth, not a size
 var ABSOLUTE_MAX_DEPTH = 256;                                                          // nesting depth ceiling, not a size
 var DEFAULT_MAX_BYTES = C.BYTES.mib(16);
@@ -127,6 +134,7 @@ function _encodeFloat(value) {
 // exponent must fit the half range and the low 13 mantissa bits must
 // be zero (half has a 10-bit mantissa vs float32's 23).
 function _doubleToHalfBits(value) {
+  if (value === 0) return Object.is(value, -0) ? 0x8000 : 0x0000;                       // ±zero → half zero (sign-preserving); -0 must not fall to the subnormal path
   var fbuf = Buffer.alloc(4);
   fbuf.writeFloatBE(value, 0);
   if (fbuf.readFloatBE(0) !== value) return -1;                                        // not exact in float32 → not in float16
@@ -177,8 +185,10 @@ function _encodeValue(value, opts) {
     // Exact integers within the safe range encode as CBOR integers;
     // an integer-VALUED number beyond 2^53 (e.g. 1e300) has lost
     // integer precision and is a float — encode it as a float (use a
-    // bigint for exact 64-bit CBOR integers).
-    if (Number.isInteger(value) && Math.abs(value) <= Number.MAX_SAFE_INTEGER) {
+    // bigint for exact 64-bit CBOR integers). NEGATIVE ZERO is excluded:
+    // CBOR integers have no -0, so encoding -0 as the uint 0 would silently
+    // drop the sign; it falls through to the float branch (float16 -0.0).
+    if (Number.isInteger(value) && !Object.is(value, -0) && Math.abs(value) <= Number.MAX_SAFE_INTEGER) {
       return value >= 0 ? _head(0, value) : _head(1, -1 - value);
     }
     if (!isFinite(value) && !opts.allowNonFinite) {
@@ -337,7 +347,11 @@ function _need(state, n) {
 
 function _readArgument(state, ai) {
   // ai is the low-5-bits additional info. Returns the argument as a
-  // Number (or BigInt for 8-byte values beyond Number range).
+  // Number (or BigInt for 8-byte values beyond Number range). Non-minimal
+  // (non-canonical) heads are tolerated here by design — strict canonical
+  // enforcement is the opt-in `requireDeterministic` mode (round-trip compare);
+  // duplicate keys encoded non-minimally are caught value-based in the map
+  // decoder regardless of mode (RFC 8949 §5.6).
   if (ai < CBOR_AI_1BYTE) return ai;
   if (ai === CBOR_AI_1BYTE) { _need(state, 1); var v1 = state.buf[state.pos]; state.pos += 1; return v1; }
   if (ai === 25) { _need(state, 2); var v2 = state.buf.readUInt16BE(state.pos); state.pos += 2; return v2; }
@@ -410,17 +424,26 @@ function _decodeItem(state, depth) {
     case 5: {                                                                           // map
       var mlen = _lenOf(_readArgument(state, ai));
       var m = new Map();
-      var seen = [];
+      // O(1) duplicate-key detection (RFC 8949 §5.6) keyed on the CANONICAL
+      // re-encoding of each decoded key — not its raw input bytes. A per-key
+      // Buffer.compare scan over a `seen` array is O(n²), and cbor.decode runs on
+      // raw attacker bytes BEFORE any signature check on every COSE / CWT / EAT /
+      // mdoc verify path, so a large distinct-key map is an unauthenticated
+      // algorithmic-complexity DoS (CWE-407). Keying on the canonical encoding
+      // (rather than the input bytes) also closes the bypass where the SAME key
+      // value is sent twice with different (e.g. non-minimal) encodings to dodge
+      // a byte-wise dup check and silently last-value-win — both copies
+      // re-encode identically here and the duplicate is caught regardless of the
+      // requireDeterministic mode.
+      var seen = new Set();
       for (var j = 0; j < mlen; j++) {
         var keyStart = state.pos;
         var key = _decodeItem(state, depth + 1);
-        var keyBytes = state.buf.slice(keyStart, state.pos);
-        for (var s = 0; s < seen.length; s++) {
-          if (Buffer.compare(seen[s], keyBytes) === 0) {
-            throw new CborError("cbor/duplicate-key", "cbor.decode: duplicate map key (RFC 8949 §5.6)");
-          }
-        }
-        seen.push(keyBytes);
+        var keyId;
+        try { keyId = encode(key).toString("latin1"); }
+        catch (_e) { keyId = "raw:" + state.buf.toString("latin1", keyStart, state.pos); }
+        boundedMap.requireAbsentMember(seen, keyId, _throwDuplicateKey);
+        seen.add(keyId);
         var val = _decodeItem(state, depth + 1);
         m.set(key, val);
       }

package/lib/cdn-cache-control.js

@@ -376,9 +376,13 @@ function parse(headerValue) {
         }
         continue;
       }
-      var n = Number(val);
-      if (isFinite(n) && n >= 0) {
-        out[_camel(key)] = Math.floor(n);
+      // RFC 9111 delta-seconds is 1*DIGIT — Number() would also accept hex
+      // ("0x10"), exponential ("1e3"), and surrounding whitespace, which are
+      // not valid cache-directive values. Round-trip parseInt to require pure
+      // decimal digits.
+      var n = parseInt(val, 10);
+      if (Number.isFinite(n) && n >= 0 && String(n) === val) {
+        out[_camel(key)] = n;
       }
       continue;
     }

package/lib/cert.js

@@ -125,7 +125,9 @@ function _createSealedDiskStorage(opts) {
     async readSealed(relPath) {
       var p = nodePath.join(rootDir, relPath + ".sealed");
       if (!nodeFs.existsSync(p)) return null;
-      var sealed = nodeFs.readFileSync(p);
+      // Cap + fd-bound (sealed cert/key envelope is well under 256 KiB). NO
+      // refuseSymlink: the sealed store may be operator-mounted.
+      var sealed = atomicFile.fdSafeReadSync(p, { maxBytes: C.BYTES.kib(256) });
       var plain = vaultStore.unseal(sealed);
       return Buffer.isBuffer(plain) ? plain : Buffer.from(plain);
     },
@@ -139,7 +141,7 @@ function _createSealedDiskStorage(opts) {
     async readMeta(certName) {
       var p = nodePath.join(_certDir(certName), "meta.json");
       if (!nodeFs.existsSync(p)) return null;
-      try { return safeJson.parse(nodeFs.readFileSync(p, "utf8"), { maxBytes: C.BYTES.kib(16) }); }
+      try { return safeJson.parse(atomicFile.fdSafeReadSync(p, { maxBytes: C.BYTES.kib(16), encoding: "utf8" }), { maxBytes: C.BYTES.kib(16) }); }
       catch (e) {
         // meta.json is a derived index (expiry + fingerprint), not a
         // source of truth — the sealed cert is. A corrupt meta must not
@@ -429,7 +431,7 @@ function create(opts) {
   function _loadOrGenerateAccountKey() {
     // Read sealed account JWK; generate + persist if absent.
     var sealedBuf = nodeFs.existsSync(nodePath.join(storage.rootDir, "account/jwk.json.sealed"))
-      ? nodeFs.readFileSync(nodePath.join(storage.rootDir, "account/jwk.json.sealed"))
+      ? atomicFile.fdSafeReadSync(nodePath.join(storage.rootDir, "account/jwk.json.sealed"), { maxBytes: C.BYTES.kib(64) })
       : null;
     if (sealedBuf) {
       var jwk;

package/lib/cli.js

@@ -39,6 +39,7 @@ var os = require("node:os");
 var nodePath = require("node:path");
 var apiSnapshot = require("./api-snapshot");
 var argParser = require("./arg-parser");
+var atomicFile = require("./atomic-file");
 var auditChain = require("./audit-chain");
 var auditTools = require("./audit-tools");
 var backup = require("./backup");
@@ -1484,7 +1485,10 @@ async function _runMtls(args, ctx) {
           validityDays: daysP,
         });
         if (outPath) {
-          nodeFs.writeFileSync(outPath, p12.p12, { mode: 0o600 });
+          // Atomic, symlink-refusing write — a bare writeFileSync follows a
+          // symlink an attacker pre-planted at the operator-supplied --out
+          // path (CWE-59) and could expose the client key bundle through it.
+          atomicFile.writeSync(outPath, p12.p12, { fileMode: 0o600 });
           report.write("p12 written: " + outPath);
         } else {
           // No --out: stream the bytes to stdout for piping. Operators

package/lib/cloud-events.js

@@ -35,6 +35,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var rfc3339 = require("./rfc3339");
 var safeJson = require("./safe-json");
@@ -265,7 +266,7 @@ function parse(envelope) {
   for (var j = 0; j < keys.length; j += 1) {
     var key = keys[j];
     if (REQUIRED_ATTRS.indexOf(key) !== -1) continue;
-    if (KNOWN_OPTIONAL_ATTRS[key]) continue;
+    if (Object.prototype.hasOwnProperty.call(KNOWN_OPTIONAL_ATTRS, key)) continue;
     extensions[key] = envelope[key];
   }
 
@@ -309,7 +310,7 @@ function _extIssue(name, v) {
   if (v === null) return null;
   if (typeof v === "string" || typeof v === "boolean") return null;
   if (typeof v === "number") {
-    if (!isFinite(v) || Math.floor(v) !== v) return "extension '" + name + "' must be an integer (CloudEvents has no float type)";
+    if (!numericBounds.isFiniteInt(v)) return "extension '" + name + "' must be an integer (CloudEvents has no float type)";
     if (v < INT_MIN || v > INT_MAX) return "extension '" + name + "' integer out of 32-bit range";
     return null;
   }

package/lib/cluster-storage.js

@@ -327,9 +327,13 @@ var _activeTx = null;
 // synchronous this runs atomically to completion with no interleaving.
 function _localExec(sql, params) {
   var stmt = _localDb().prepare(sql);
-  // Heuristic: if the statement returns rows (SELECT or has RETURNING),
-  // use .all(); otherwise .run() and report changes as rowCount.
-  if (/^\s*SELECT\b/i.test(sql) || /\bRETURNING\b/i.test(sql)) {
+  // Choose .all() vs .run() by whether the statement returns rows. A leading-
+  // keyword check (`^\s*SELECT`) mis-routes a WITH (CTE) read — "WITH c AS (...)
+  // SELECT ..." does not start with SELECT — to .run(), which on node:sqlite
+  // silently returns only a changes count and DROPS the rows. The shared
+  // CTE/EXPLAIN-aware classifier resolves the effective verb (and a top-level
+  // RETURNING) so every row-returning statement reaches the caller via .all().
+  if (externalDb._statementReturnsRows(sql)) {
     var rows = stmt.all.apply(stmt, params || []);
     return { rows: rows, rowCount: rows.length };
   }