@blamejs/core 0.15.13 → 0.15.14

package/lib/codepoint-class.js

@@ -356,9 +356,26 @@ function firstControlCharOffset(s, opts) {
   return -1;
 }
 
+// Decode HTML numeric character references (hex &#x..; and decimal &#..;) just
+// enough to expose a scheme hidden behind entity-encoding. The trailing
+// semicolon is OPTIONAL — a browser decodes `&#106avascript:` (no semicolon)
+// the same as `javascript:`, so a semicolon-required decoder lets the
+// no-semicolon form bypass a scheme allowlist. Shared so guard-html / guard-svg
+// / guard-markdown cannot drift on this (the bug class that shipped one buggy
+// + one correct copy).
+var NUMERIC_ENTITY_RE_G = /&#(?:x([0-9a-f]+)|(\d+));?/gi;
+function decodeNumericEntities(s) {
+  return String(s == null ? "" : s).replace(NUMERIC_ENTITY_RE_G, function (m, hex, dec) {
+    var cp = hex !== undefined ? parseInt(hex, 16) : parseInt(dec, 10);
+    if (!isFinite(cp) || cp < 0 || cp > 0x10FFFF) return m;
+    try { return String.fromCodePoint(cp); } catch (_e) { return m; }
+  });
+}
+
 module.exports = {
   isForbiddenControlChar:  isForbiddenControlChar,
   firstControlCharOffset:  firstControlCharOffset,
+  decodeNumericEntities:   decodeNumericEntities,
   isAsciiAlnum:      isAsciiAlnum,
   isUnreserved:      isUnreserved,
   hex4:              hex4,

package/lib/compliance-eaa.js

@@ -82,7 +82,7 @@ function create(opts) {
       throw new ComplianceEaaError("compliance-eaa/bad-decl",
         "compliance.eaa.declareCriterion: decl must be an object with { conformance, note? }");
     }
-    if (!VALID_CONFORMANCE[decl.conformance]) {
+    if (!Object.prototype.hasOwnProperty.call(VALID_CONFORMANCE, decl.conformance)) {
       throw new ComplianceEaaError("compliance-eaa/bad-conformance",
         "compliance.eaa.declareCriterion: conformance must be one of " + Object.keys(VALID_CONFORMANCE).join(", "));
     }

package/lib/compliance-sanctions.js

@@ -368,13 +368,14 @@ function create(opts) {
 
     for (var c = 0; c < index.length; c++) {
       var candidate = index[c];
-      // Type filter: when input.type is set, skip candidates of
-      // the wrong type unless candidate is an entity (entities can
-      // be matched regardless to catch operator-side type errors).
-      if (input.type && candidate.type !== input.type &&
-          candidate.type !== "entity") {
-        continue;
-      }
+      // A sanctions screen MUST over-match on the legally-operative NAME. The
+      // operator-asserted input.type is an unverified counterparty
+      // self-classification, NOT data-driven non-match confidence — using it to
+      // EXCLUDE a name hit inverts the screen to under-match (a false negative
+      // that processes a payment which should have been blocked). So never skip
+      // a candidate on type; the name match runs against every record and the
+      // type mismatch is surfaced as a non-dispositive `typeMatch` signal on
+      // each hit for operator triage.
 
       var bestForCandidate = { score: 0, name: "" };
       for (var qi = 0; qi < queryNames.length; qi++) {
@@ -404,6 +405,7 @@ function create(opts) {
           listed:    candidate.listedAt,
           programs:  candidate.programs,
           type:      candidate.type,
+          typeMatch: input.type ? candidate.type === input.type : null,
           country:   candidate.country,
         });
       }

package/lib/compliance.js

@@ -953,7 +953,7 @@ var REGIME_MAP = Object.freeze({
  *   b.compliance.describe("not-a-real-posture");   // → null
  */
 function describe(posture) {
-  return REGIME_MAP[posture] || null;
+  return Object.prototype.hasOwnProperty.call(REGIME_MAP, posture) ? REGIME_MAP[posture] : null;
 }
 
 // POSTURE_DEFAULTS — per-posture configuration knobs that primitives

package/lib/config-drift.js

@@ -35,7 +35,6 @@
  * @card
  *   Monitor + alert when runtime config diverges from a declared baseline.
  */
-var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var auditSign = require("./audit-sign");
 var canonicalJson = require("./canonical-json");
@@ -45,6 +44,7 @@ var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 var atomicFile = require("./atomic-file");
+var C = require("./constants");
 
 var audit = lazyRequire(function () { return require("./audit"); });
 var auditEmit = require("./audit-emit");
@@ -163,9 +163,13 @@ function create(opts) {
   var _emit = auditEmit.gatedReasonEmitter({ audit: auditOn, sink: auditInstance });
 
   function _readSidecar() {
-    if (!nodeFs.existsSync(sidecarPath)) return null;
+    // Capped fd-bound read (no existsSync check-then-read window): the signed
+    // config-baseline sidecar is parsed + verified, so a tampered multi-GB file
+    // would OOM the reader before signature verify. refuseSymlink stays OFF: the
+    // data dir may be a symlink-mounted volume (k8s PVC). Any read failure
+    // (missing / too-large) → null, the existing "no baseline yet" behavior.
     var raw;
-    try { raw = nodeFs.readFileSync(sidecarPath, "utf8"); }
+    try { raw = atomicFile.fdSafeReadSync(sidecarPath, { maxBytes: C.BYTES.mib(1), encoding: "utf8" }); }
     catch (_e) { return null; }
     var parsed;
     try { parsed = safeJson.parse(raw); }
@@ -190,9 +194,12 @@ function create(opts) {
       publicKeyPem:     auditSign.getPublicKey(),
       snapshot:         snapshot,
     };
-    var tmp = sidecarPath + ".tmp";
-    nodeFs.writeFileSync(tmp, JSON.stringify(payload, null, 2));
-    atomicFile.renameWithRetry(tmp, sidecarPath);
+    // Atomic, symlink-refusing write. The previous hand-rolled form staged
+    // into a PREDICTABLE temp name (`sidecarPath + ".tmp"`) via a plain
+    // writeFileSync, so an attacker could pre-plant a symlink at that exact
+    // path and have the signed sidecar written through it (CWE-59 / CWE-377).
+    // writeSync uses a CSPRNG temp name opened O_EXCL | O_NOFOLLOW.
+    atomicFile.writeSync(sidecarPath, JSON.stringify(payload, null, 2), { fileMode: 0o600 });
   }
 
   function _verifySidecar(parsed) {
@@ -367,7 +374,10 @@ function verifyVendorIntegrity(opts) {
   var libVendorDir  = opts.libVendorDir  || nodePath.join(__dirname, "vendor");
   var manifestPath  = opts.manifestPath  || nodePath.join(libVendorDir, "MANIFEST.json");
   var raw;
-  try { raw = nodeFs.readFileSync(manifestPath, "utf8"); }
+  // Capped fd-bound read of the vendor MANIFEST.json (operator-bundled, install-
+  // time). refuseSymlink OFF — the vendored tree ships read-only and an install
+  // may symlink lib/. The cap precedes the alloc.
+  try { raw = atomicFile.fdSafeReadSync(manifestPath, { maxBytes: C.BYTES.mib(4), encoding: "utf8" }); }
   catch (_e) {
     throw _err("VENDOR_MANIFEST_MISSING",
       "vendor MANIFEST.json missing at " + manifestPath, true);
@@ -397,7 +407,11 @@ function verifyVendorIntegrity(opts) {
       var abs = nodePath.isAbsolute(rel) ? rel : nodePath.join(libVendorDir, relInVendor);
       var actual;
       try {
-        var bytes = nodeFs.readFileSync(abs);
+        // Capped fd-bound read (raw bytes — hashing, no encoding). Sanity ceiling
+        // so a corrupted/huge vendored file is a read-failed mismatch (caught
+        // below) rather than an OOM in the boot integrity loop. NO refuseSymlink
+        // (vendored tree ships read-only; installs may symlink lib/).
+        var bytes = atomicFile.fdSafeReadSync(abs, { maxBytes: C.BYTES.mib(64) });
         actual = "sha256:" + require("node:crypto")
           .createHash("sha256").update(bytes).digest("hex");
       } catch (_e) {

package/lib/content-credentials.js

@@ -31,6 +31,7 @@
 var nodeCrypto = require("node:crypto");
 var C = require("./constants");
 var bCrypto = require("./crypto");
+var x509Chain = require("./x509-chain");
 var canonicalJson = require("./canonical-json");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
@@ -1103,7 +1104,7 @@ function attachIdentityAssertion(opts) {
   validateOpts.requireObject(opts, "contentCredentials.attachIdentityAssertion", ContentCredentialsError);
   validateOpts(opts, ["binding", "subject", "referencedAssertions", "privateKeyPem", "audit"],
     "contentCredentials.attachIdentityAssertion");
-  if (typeof opts.binding !== "string" || !IDENTITY_BINDINGS[opts.binding]) {
+  if (typeof opts.binding !== "string" || !Object.prototype.hasOwnProperty.call(IDENTITY_BINDINGS, opts.binding)) {
     throw ContentCredentialsError.factory("content-credentials/bad-identity-binding",
       "attachIdentityAssertion: binding must be one of " + Object.keys(IDENTITY_BINDINGS).join(" / "));
   }
@@ -1217,7 +1218,7 @@ function verifyIdentityAssertion(assertion, publicKeyPem, opts) {
     return _fail("public-key-required");
   }
   var sp = assertion.signer_payload;
-  if (!sp || typeof sp !== "object" || typeof sp.binding !== "string" || !IDENTITY_BINDINGS[sp.binding] ||
+  if (!sp || typeof sp !== "object" || typeof sp.binding !== "string" || !Object.prototype.hasOwnProperty.call(IDENTITY_BINDINGS, sp.binding) ||
       !Array.isArray(sp.referenced_assertions)) {
     return _fail("signer-payload-shape");
   }
@@ -1334,9 +1335,10 @@ function _verifyIdentityX509Chain(certChainPem, trustAnchorsPem) {
   // only direct-root / self-signed leaves.
   for (var li = 0; li < certs.length - 1; li += 1) {
     var child = certs[li], parent = certs[li + 1];
-    var linked = false;
-    try { linked = child.checkIssued(parent) && child.verify(parent.publicKey); }
-    catch (_eLink) { linked = false; }
+    // issuerValidlyIssued enforces basicConstraints cA:TRUE on the parent in
+    // addition to the issuance + signature linkage — a non-CA cert cannot be
+    // an intermediate issuer (basicConstraints bypass, CVE-2002-0862 class).
+    var linked = x509Chain.issuerValidlyIssued(parent, child);
     if (!linked) { return { ok: false, reason: "broken-chain" }; }
   }
   // The top of the presented chain must chain to (or BE) a trust anchor.
@@ -1347,8 +1349,9 @@ function _verifyIdentityX509Chain(certChainPem, trustAnchorsPem) {
     if (top.fingerprint256 === anchor.fingerprint256) {
       chained = true;   // top of the chain IS the anchor (root-in-chain or self-signed leaf == anchor)
     } else {
-      try { chained = top.checkIssued(anchor) && top.verify(anchor.publicKey); }
-      catch (_eChk) { chained = false; }
+      // issuerValidlyIssued enforces basicConstraints cA:TRUE on the anchor
+      // in addition to issuance + signature (basicConstraints bypass class).
+      chained = x509Chain.issuerValidlyIssued(anchor, top);
     }
     if (chained) {
       if (now < anchor.validFromDate.getTime() || now > anchor.validToDate.getTime()) {
@@ -1427,7 +1430,7 @@ function cacImplicitLabel(opts) {
     throw new ContentCredentialsError("cac-implicit-label/bad-content-id",
       "cacImplicitLabel: contentId must match [A-Za-z0-9._:/-]");
   }
-  if (typeof opts.contentKind !== "string" || !CAC_KIND_ENUM[opts.contentKind]) {
+  if (typeof opts.contentKind !== "string" || !Object.prototype.hasOwnProperty.call(CAC_KIND_ENUM, opts.contentKind)) {
     throw new ContentCredentialsError("cac-implicit-label/bad-content-kind",
       "cacImplicitLabel: contentKind must be one of " +
       Object.keys(CAC_KIND_ENUM).join("/"));

package/lib/content-digest.js

@@ -99,9 +99,12 @@ function create(body, opts) {
   if (!Array.isArray(algos) || algos.length === 0) throw new ContentDigestError("content-digest/bad-arg", "contentDigest.create: opts.algorithms must be a non-empty array");
   var members = algos.map(function (a) {
     var name = String(a).toLowerCase();
-    var nodeAlg = ACTIVE[name];
+    // hasOwnProperty: the algorithm name is operator/caller input; a bracket
+    // lookup lets "constructor"/"toString" inherit a truthy value off the
+    // prototype and pass the support check (proto shadowing).
+    var nodeAlg = Object.prototype.hasOwnProperty.call(ACTIVE, name) ? ACTIVE[name] : undefined;
     if (!nodeAlg) {
-      if (DEPRECATED[name]) throw new ContentDigestError("content-digest/insecure-algorithm", "contentDigest.create: '" + name + "' is a deprecated/insecure digest algorithm (RFC 9530 §6); use sha-256 or sha-512");
+      if (Object.prototype.hasOwnProperty.call(DEPRECATED, name)) throw new ContentDigestError("content-digest/insecure-algorithm", "contentDigest.create: '" + name + "' is a deprecated/insecure digest algorithm (RFC 9530 §6); use sha-256 or sha-512");
       throw new ContentDigestError("content-digest/unsupported-algorithm", "contentDigest.create: unsupported digest algorithm '" + name + "'");
     }
     var digest = nodeCrypto.createHash(nodeAlg).update(bytes).digest("base64");
@@ -154,8 +157,12 @@ function verify(fieldValue, body, opts) {
     var kvp = structuredFields.parseKeyValuePiece(m);
     var name = kvp.key;
     var raw = kvp.value.trim();
+    // hasOwnProperty: `name` is the algorithm token from the untrusted inbound
+    // Content-Digest header; a bracket lookup lets "constructor"/"__proto__"
+    // inherit a truthy value off the prototype and reach createHash (proto
+    // shadowing).
+    if (!Object.prototype.hasOwnProperty.call(ACTIVE, name)) continue;  // ignore legacy / unknown entries
     var nodeAlg = ACTIVE[name];
-    if (!nodeAlg) continue;                                  // ignore legacy / unknown entries
     if (raw.length < 2 || raw.charAt(0) !== ":" || raw.charAt(raw.length - 1) !== ":") {
       throw new ContentDigestError("content-digest/bad-field", "contentDigest.verify: '" + name + "' value is not an RFC 8941 byte sequence (:base64:)");
     }
@@ -172,7 +179,7 @@ function verify(fieldValue, body, opts) {
     if (!Array.isArray(opts.required)) throw new ContentDigestError("content-digest/bad-arg", "contentDigest.verify: opts.required must be an array");
     for (var r = 0; r < opts.required.length; r++) {
       var req = String(opts.required[r]).toLowerCase();
-      if (!ACTIVE[req]) throw new ContentDigestError("content-digest/unsupported-algorithm", "contentDigest.verify: required algorithm '" + req + "' is not a modern digest");
+      if (!Object.prototype.hasOwnProperty.call(ACTIVE, req)) throw new ContentDigestError("content-digest/unsupported-algorithm", "contentDigest.verify: required algorithm '" + req + "' is not a modern digest");
       if (!seen[req]) throw new ContentDigestError("content-digest/missing-algorithm", "contentDigest.verify: required digest '" + req + "' is not present");
     }
   }

package/lib/cookies.js

@@ -96,7 +96,11 @@ function _validateValue(value) {
   // Length cap before the regex test (defense in depth — the regex
   // here is a simple character class, but the same discipline that
   // bounds longer regexes elsewhere applies).
-  if (value.length > MAX_VALUE_LENGTH || FORBIDDEN_VALUE_RE.test(value)) {
+  // Byte length, not value.length (UTF-16 code units): the cap bounds the
+  // on-the-wire Set-Cookie size, and a multibyte value is 2-4x larger in bytes
+  // than chars, so a char-count check under-enforces and a 4096-char value can
+  // emit a ~12 KiB+ header.
+  if (Buffer.byteLength(value, "utf8") > MAX_VALUE_LENGTH || FORBIDDEN_VALUE_RE.test(value)) {
     throw new CookieError("cookies/invalid-value",
       "cookie value is too long or contains forbidden control character (CRLF/NUL/;/,)");
   }
@@ -108,7 +112,11 @@ function _validateValue(value) {
 // header — never trust unscrubbed values reach the wire.
 function _scrubAttr(s) {
   if (typeof s !== "string") return s;
-  return s.replace(/[\r\n\0]/g, "");                                             // allow:duplicate-regex — CR/LF/NUL header-injection rejection appears in cookies / mail / security-headers; each is the boundary primitive for its domain
+  // `;` joins Set-Cookie attributes, so an unscrubbed `;` in Path/SameSite is
+  // attribute injection (e.g. Path=/x; HttpOnly). Domain is regex-validated
+  // upstream; Path/SameSite only flow through here, so strip `;` alongside the
+  // CR/LF/NUL header-injection set.
+  return s.replace(/[\r\n\0;]/g, "");                                            // allow:duplicate-regex — CR/LF/NUL(+;) header-injection rejection appears in cookies / mail / security-headers; each is the boundary primitive for its domain
 
 }
 

package/lib/cose.js

@@ -110,6 +110,24 @@ function _algParamsFor(algId) {
   }
 }
 
+// RFC 9053 §2 binds each ECDSA alg to ONE curve. node:crypto will happily
+// verify a sha512 (ES512-shape) signature against a P-256 key as
+// self-consistent, so without this check a COSE_Sign1 declaring ES512 but
+// carrying a P-256 key passes when ES512 is allowlisted — an alg/curve
+// confusion (the COSE sibling of jwt-external._assertAlgKtyMatch). EdDSA /
+// ML-DSA carry their parameters in the KeyObject and need no binding.
+var _ES_ALG_CURVE = { ES256: "prime256v1", ES384: "secp384r1", ES512: "secp521r1" };
+function _assertEcAlgCurve(algName, key) {
+  var want = _ES_ALG_CURVE[algName];
+  if (want === undefined) return;                                                       // not an ECDSA alg — nothing to bind
+  var got = (key && key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve) || null;
+  if (key.asymmetricKeyType !== "ec" || got !== want) {
+    throw new CoseError("cose/alg-curve-mismatch",
+      "cose: alg '" + algName + "' requires an EC key on " + want +
+      ", got " + (key.asymmetricKeyType === "ec" ? got : key.asymmetricKeyType));
+  }
+}
+
 function _bstr(x) {
   return safeBuffer.toBuffer(x, {
     errorFactory: function (code, msg) { return new CoseError(code, msg); },
@@ -169,6 +187,7 @@ async function sign(payload, opts) {
   var algId = ALG_NAME_TO_ID[opts.alg];
   var params = _algParamsFor(algId);
   var key = _toKeyObject(opts.privateKey, "private");
+  _assertEcAlgCurve(opts.alg, key);                                                      // RFC 9053 alg↔curve binding — refuse e.g. ES512 over a P-256 key
 
   var protMap = new Map();
   protMap.set(HDR_ALG, algId);
@@ -352,6 +371,7 @@ async function verify(coseSign1, opts) {
   var key = opts.publicKey
     ? _toKeyObject(opts.publicKey, "public")
     : _toKeyObject(opts.keyResolver(protMap, unprotected), "public");
+  _assertEcAlgCurve(algName, key);                                                      // RFC 9053 alg↔curve binding
 
   var externalAad = opts.externalAad == null ? Buffer.alloc(0) : _bstr(opts.externalAad);
   var toBeSigned = _toBeSigned(protectedBstr, externalAad, payload);

package/lib/crdt.js

@@ -41,6 +41,7 @@
 
 var bCrypto = require("./crypto");
 var safeJson = require("./safe-json");
+var numericBounds = require("./numeric-bounds");
 var { defineClass } = require("./framework-error");
 
 var CrdtError = defineClass("CrdtError", { alwaysPermanent: true });
@@ -52,7 +53,7 @@ function _replicaId(opts) {
   return id;
 }
 function _posInt(n, label) {
-  if (typeof n !== "number" || !isFinite(n) || n < 0 || Math.floor(n) !== n) throw new CrdtError("crdt/bad-value", "crdt: " + label + " must be a non-negative integer");
+  if (!numericBounds.isNonNegativeFiniteInt(n)) throw new CrdtError("crdt/bad-value", "crdt: " + label + " must be a non-negative integer");
   return n;
 }
 function _maxMerge(a, b) {

package/lib/crypto-field.js

@@ -62,7 +62,6 @@ var vaultAad = require("./vault-aad");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
 var safeJson = require("./safe-json");
-var frameworkSchema = require("./framework-schema");
 var sql = require("./sql");
 var { defineClass } = require("./framework-error");
 var { sha3Hash, kdf, generateBytes, encryptPacked, decryptPacked, generateToken } = require("./crypto");
@@ -226,14 +225,19 @@ var PER_ROW_KEYS_TABLE = "_blamejs_per_row_keys";   // allow:hand-rolled-sql
 var PER_ROW_KEYS_COLUMN = "wrappedKey";
 var PER_ROW_KEYS_SCHEMA_VERSION = "1";
 
-// The per-row-key registry is read/written against the LOCAL db() / dbHandle
-// handle directly (not clusterStorage), so SQL composed for it uses the
-// RESOLVED name (prefix-aware via frameworkSchema.tableName) and quoteName so
-// b.sql emits the quoted identifier the single-node path expects — the same
-// shape db-query.js's _sqlOpts and db.js's own local-handle b.sql calls use.
+// The per-row-key registry ALWAYS lives in the LOCAL sqlite — reconcile creates
+// it under its RAW schema name, and per-row keys are never dispatched to an
+// external backend (see _kRowOnce's db() fallback). It is read/written against
+// the local db() / dbHandle directly, NOT through clusterStorage, so it must use
+// the RAW table name. frameworkSchema.tableName() resolves to the cluster-mode
+// EXTERNAL prefixed name (the prefix applies only to the external backend, via
+// resolveTables — local DDL stays raw); under a custom tablePrefix that names a
+// table that does not exist locally, which SILENTLY breaks crypto-shred:
+// destroyPerRowKey deletes 0 rows and sealed cells stay decryptable after
+// eraseHard. quoteName so b.sql emits the quoted identifier the local path expects.
 var _PER_ROW_SQL_OPTS = { dialect: "sqlite", quoteName: true };
 function _perRowKeysTableName() {
-  return frameworkSchema.tableName(PER_ROW_KEYS_TABLE);
+  return PER_ROW_KEYS_TABLE;
 }
 
 // Build the canonical AAD parts for a row-secret wrap in
@@ -1271,19 +1275,19 @@ function unsealRow(table, row, actor, dbHandle) {
           unsealed = out[field];
         }
       } catch (e) {
-        // A DB-write attacker who can write `vault:<crafted>` /
-        // `vault.aad:<crafted>` payloads to sealed columns can force
-        // KEM decapsulation / AEAD verify on attacker-controlled
-        // bytes via this read path. Surface the failure as a chain
-        // row so operators alert on burst patterns; null the field
-        // so downstream code sees "no value" instead of crashing the
-        // request. AAD-shape failures additionally indicate cross-
-        // row copy attempts — the audit metadata flags the shape so
-        // operators can write alert rules.
+        // A crypto-shredded (or never-materialized) per-row key is an EXPECTED
+        // absence, not a decryption-oracle attack: the wrapped secret is gone,
+        // so there is no oracle to brute-force. Reading such a row must read as
+        // "no value" WITHOUT counting against the rate cap — otherwise a bulk
+        // read over a table with many erased rows (GDPR eraseHard) trips the
+        // cap and DoS's the live rows (self-DoS, CWE-307 mis-applied). It is
+        // audited under a distinct, non-failure action so operators don't alert
+        // on routine post-erasure reads as forged-ciphertext bursts.
+        var _shredded = e && e.code === "crypto-field/row-key-unavailable";
         try {
           audit().safeEmit({
-            action:   "system.crypto.unseal_failed",
-            outcome:  "failure",
+            action:   _shredded ? "system.crypto.shredded_read" : "system.crypto.unseal_failed",
+            outcome:  _shredded ? "success" : "failure",
             metadata: {
               table:   table,
               field:   field,
@@ -1293,11 +1297,13 @@ function unsealRow(table, row, actor, dbHandle) {
             },
           });
         } catch (_e) { /* drop-silent */ }
-        // Default-on rate cap: account this failure against the (actor,
-        // table, column) tuple. When it trips the threshold, arm the
-        // cooldown + emit the distinct rate-exceeded audit once on the
-        // transition. No-op when the cap is disabled.
-        if (_rateNoteFailure(capActor, table, field)) {
+        // Default-on rate cap: account a genuine decryption / AEAD-verify /
+        // AAD-downgrade failure (a possible forged-ciphertext attack) against
+        // the (actor, table, column) tuple. A shredded-key read is exempt (see
+        // above). When the cap trips the threshold, arm the cooldown + emit the
+        // distinct rate-exceeded audit once on the transition. No-op when the
+        // cap is disabled.
+        if (!_shredded && _rateNoteFailure(capActor, table, field)) {
           _emitRateAudit({
             table: table, field: field, actor: capActor, shape: shape,
             threshold: _rateCap.threshold, windowMs: _rateCap.windowMs, cooldownMs: _rateCap.cooldownMs,

package/lib/crypto.js

@@ -963,7 +963,7 @@ var SRI_ALGORITHMS = { "sha256": "sha256", "sha384": "sha384", "sha512": "sha512
 function sri(content, opts) {
   opts = opts || {};
   var algorithm = (opts.algorithm || "sha384").toLowerCase();
-  if (!SRI_ALGORITHMS[algorithm]) {
+  if (!Object.prototype.hasOwnProperty.call(SRI_ALGORITHMS, algorithm)) {
     throw new Error("crypto.sri: unsupported algorithm '" + algorithm +
       "' (W3C SRI 1.0 §3.2 supports sha256/sha384/sha512)");
   }
@@ -1356,7 +1356,21 @@ function decrypt(ciphertext, privateKeys, opts) {
     opts && opts.raw === true ? { raw: true } : undefined);
 }
 
+// Bounds-checked 2-byte length read — a bare _envU16(packed, pos) on a
+// truncated envelope throws a raw Node RangeError that escapes the documented
+// "Invalid envelope: ..." error contract (untrusted ciphertext must fail with
+// the typed envelope error, not a stack-trace-leaking RangeError).
+function _envU16(buf, at) {
+  if (at + 2 > buf.length) {
+    throw new Error("Invalid envelope: truncated (expected a 2-byte length at offset " + at + ")");
+  }
+  return buf.readUInt16BE(at);
+}
+
 function decryptEnvelope(packed, privateKeys, internalOpts) {
+  if (!Buffer.isBuffer(packed) || packed.length < 4) {
+    throw new Error("Invalid envelope: too short (need at least the 4-byte suite header)");
+  }
   var kemId = packed[1], cipherId = packed[2], kdfId = packed[3], pos = 4;
 
   // The legacy 0xE1 envelope predates the FixedInfo / suite-binding
@@ -1372,7 +1386,7 @@ function decryptEnvelope(packed, privateKeys, internalOpts) {
     throw new Error("Invalid envelope: unsupported KDF (only SHAKE256 supported)");
   }
 
-  var kemCtLen = packed.readUInt16BE(pos); pos += 2;
+  var kemCtLen = _envU16(packed, pos); pos += 2;
   var kemCt = packed.subarray(pos, pos + kemCtLen); pos += kemCtLen;
 
   var mlkemPriv = nodeCrypto.createPrivateKey(
@@ -1383,7 +1397,7 @@ function decryptEnvelope(packed, privateKeys, internalOpts) {
   var fixedInfo = omitFixedInfo ? Buffer.alloc(0) : _suiteFixedInfo(kemId, cipherId, kdfId);
 
   if (kemId === C.KEM_IDS.ML_KEM_1024_P384) {
-    var ecEphLen = packed.readUInt16BE(pos); pos += 2;
+    var ecEphLen = _envU16(packed, pos); pos += 2;
     var ecEphDer = packed.subarray(pos, pos + ecEphLen); pos += ecEphLen;
     var ecPrivPem = typeof privateKeys === "string" ? null : privateKeys.ecPrivateKey;
     if (!ecPrivPem) throw new Error("Hybrid KEM requires EC private key");
@@ -1400,7 +1414,7 @@ function decryptEnvelope(packed, privateKeys, internalOpts) {
     // the correct keypair via privateKeys when the envelope was sealed
     // with this algorithm. Same length-prefixed shape as the P-384
     // hybrid: 2-byte ec-eph-len + DER X25519 pubkey + nonce + ct.
-    var x25519EphLen = packed.readUInt16BE(pos); pos += 2;
+    var x25519EphLen = _envU16(packed, pos); pos += 2;
     var x25519EphDer = packed.subarray(pos, pos + x25519EphLen); pos += x25519EphLen;
     var x25519PrivPem = typeof privateKeys === "string" ? null : privateKeys.x25519PrivateKey;
     if (!x25519PrivPem) throw new Error("ML-KEM-768 + X25519 hybrid envelope requires x25519PrivateKey");

package/lib/csp.js

@@ -416,6 +416,10 @@ function mergeDirectives(base, additions, opts) {
       ? directives[name].slice()
       : (directives["default-src"] ? directives["default-src"].slice() : ["'self'"]);
     var added = additions[name];
+    // A directive value of 'none' MUST stand alone (CSP3 §2.3.1) — appending a
+    // host to it emits the malformed "'none' https://x". When merging real
+    // sources in, the added sources supersede 'none', so drop it first.
+    if (added.length && existing.length === 1 && existing[0] === "'none'") existing = [];
     for (var si = 0; si < added.length; si += 1) {
       if (existing.indexOf(added[si]) === -1) existing.push(added[si]);
     }

package/lib/daemon.js

@@ -73,7 +73,10 @@ function _isLivePid(pid) {
 
 function _readPidFile(pidFile) {
   try {
-    var raw = nodeFs.readFileSync(pidFile, "utf8");
+    // Same fd-safe + capped + symlink-refusing read as app-shutdown's lockfile
+    // reader (one shape): a PID file is never a legit symlink mount, so
+    // refuseSymlink is safe; any throw → null ("nothing live there").
+    var raw = atomicFile.fdSafeReadSync(pidFile, { maxBytes: C.BYTES.kib(1), refuseSymlink: true, encoding: "utf8" });
     var pid = parseInt(String(raw).trim(), 10);
     return isFinite(pid) && pid > 0 ? pid : null;
   } catch (_e) { return null; }

package/lib/data-act.js

@@ -89,6 +89,32 @@ var DESIGNATED_GATEKEEPERS = Object.freeze([
   "booking",
 ]);
 
+// Is `recipient` a designated DMA gatekeeper? Match the gatekeeper token as a
+// DNS LABEL of the recipient's host authority — any position, including the
+// FINAL label. A substring `indexOf(g + ".")` test missed a gatekeeper that is
+// the last label (e.g. "blog.google" / "drive.google" on the real ".google"
+// TLD, or "data.amazon"), letting an Art 32 §1 third-party share through — and
+// also false-flagged a non-gatekeeper whose name merely contained the token
+// ("notgoogle.com"). Label matching closes the bypass and drops the false
+// positive. A bare name ("Google") still matches exactly. URL / userinfo / port
+// forms are normalized to the host authority first.
+function _isGatekeeperRecipient(recipient) {
+  var s = String(recipient).toLowerCase().trim();
+  var scheme = s.indexOf("://");
+  if (scheme !== -1) s = s.slice(scheme + 3);
+  s = s.split("/")[0].split("?")[0].split("#")[0];   // drop path / query / fragment
+  var at = s.lastIndexOf("@");
+  if (at !== -1) s = s.slice(at + 1);                 // drop userinfo
+  s = s.split(":")[0];                                // drop port
+  if (s.length === 0) return false;
+  var labels = s.split(".");
+  return DESIGNATED_GATEKEEPERS.some(function (g) {
+    if (s === g) return true;
+    for (var i = 0; i < labels.length; i++) { if (labels[i] === g) return true; }
+    return false;
+  });
+}
+
 /**
  * @primitive b.dataAct.declareProduct
  * @signature b.dataAct.declareProduct(opts)
@@ -229,10 +255,7 @@ function shareWithThirdParty(opts) {
     acceptGatekeeper: "optional-plain-object",
   }, "dataAct.shareWithThirdParty", DataActError, "dataact/bad-opts");
 
-  var recipientLower = opts.recipient.toLowerCase();
-  var isGatekeeper = DESIGNATED_GATEKEEPERS.some(function (g) {
-    return recipientLower === g || recipientLower.indexOf(g + ".") !== -1;
-  });
+  var isGatekeeper = _isGatekeeperRecipient(opts.recipient);
   if (isGatekeeper) {
     if (!opts.acceptGatekeeper || typeof opts.acceptGatekeeper !== "object" ||
         typeof opts.acceptGatekeeper.reason !== "string" ||

package/lib/db-file-lifecycle.js

@@ -172,8 +172,11 @@ function fileLifecycle(opts) {
     : nodePath.join(opts.dataDir, frameworkFiles.fileName("dbKeyEnc"));
   var flushIntervalMs = opts.flushIntervalMs || DEFAULT_FLUSH_INTERVAL_MS;
   var tmpDir = _resolveTmpDir(opts.tmpDir, opts.allowDiskFallback === true);
-  if (!nodeFs.existsSync(tmpDir)) nodeFs.mkdirSync(tmpDir, { recursive: true });
-  if (!nodeFs.existsSync(opts.dataDir)) nodeFs.mkdirSync(opts.dataDir, { recursive: true });
+  // 0o700 — these hold the DB encryption tmpfs scratch + the data dir
+  // (db.key.enc, the decrypted DB while open); a default-mode mkdir leaves
+  // them group/other-traversable.
+  if (!nodeFs.existsSync(tmpDir)) nodeFs.mkdirSync(tmpDir, { recursive: true, mode: 0o700 });
+  if (!nodeFs.existsSync(opts.dataDir)) nodeFs.mkdirSync(opts.dataDir, { recursive: true, mode: 0o700 });
 
   var dbPath = null;
   var encKey = null;
@@ -183,7 +186,9 @@ function fileLifecycle(opts) {
   function _loadOrGenerateKey() {
     if (encKey) return encKey;
     if (nodeFs.existsSync(keyPath)) {
-      var sealedKey = nodeFs.readFileSync(keyPath, "utf8");
+      // Cap + fd-bound. NO refuseSymlink: dbKeyPath may be an operator-absolute
+      // KMS-fronted volume that legitimately symlinks the sealed key.
+      var sealedKey = atomicFile.fdSafeReadSync(keyPath, { maxBytes: C.BYTES.kib(64), encoding: "utf8" });
       var keyB64;
       try { keyB64 = opts.vault.unseal(sealedKey); }
       catch (e) {
@@ -212,7 +217,10 @@ function fileLifecycle(opts) {
     dbPath = nodePath.join(tmpDir, "blamejs-fl-" + label + "-" +
       generateToken(TMP_NAME_BYTES) + ".db");
     if (nodeFs.existsSync(encPath)) {
-      var packed = nodeFs.readFileSync(encPath);
+      // Cap + fd-bound (deployment-tunable ceiling). NO refuseSymlink: the data
+      // dir may be a symlink-mounted volume (k8s PVC). db.enc is AEAD-checked
+      // downstream, so the cap is the OOM-before-cap defense.
+      var packed = atomicFile.fdSafeReadSync(encPath, { maxBytes: (opts.maxDbBytes) || C.BYTES.gib(2) });
       if (packed.length < 26) {                                                                  // minimum envelope length
         throw new DbFileLifecycleError("db-file-lifecycle/short-envelope",
           "fileLifecycle: " + encPath + " too short to be a valid envelope (" + packed.length + " bytes)");
@@ -248,7 +256,7 @@ function fileLifecycle(opts) {
       catch (_e) { /* best-effort — operators on read-only handles or pre-init still flush */ }
     }
     if (!nodeFs.existsSync(dbPath)) return null;
-    var plain = nodeFs.readFileSync(dbPath);
+    var plain = atomicFile.fdSafeReadSync(dbPath, { maxBytes: (opts.maxDbBytes) || C.BYTES.gib(2) });
     var packed = encryptPacked(plain, encKey, _aad(opts.dataDir, label));
     atomicFile.writeSync(encPath, packed);
     _emitAudit("flushed", "success", { label: label, bytes: plain.length });
@@ -269,7 +277,7 @@ function fileLifecycle(opts) {
       throw new DbFileLifecycleError("db-file-lifecycle/no-source",
         "fileLifecycle.snapshot: " + dbPath + " is missing");
     }
-    var plain = nodeFs.readFileSync(dbPath);
+    var plain = atomicFile.fdSafeReadSync(dbPath, { maxBytes: (opts.maxDbBytes) || C.BYTES.gib(2) });
     return encryptPacked(plain, encKey, _aad(opts.dataDir, label));
   }