@blamejs/core 0.15.13 → 0.15.15

package/lib/network-dns.js

@@ -1,6 +1,7 @@
 "use strict";
 
 var dns = require("node:dns");
+var numericBounds = require("./numeric-bounds");
 var net = require("node:net");
 var https = require("node:https");
 var nodeTls = require("node:tls");
@@ -347,10 +348,16 @@ function _decodeDnsAnswer(buf, qtype) {
   for (var a = 0; a < ancount; a++) {
     _skipDnsName(buf, state);
     var off = state.off;
+    // Bound the RR fixed header (10 bytes: type+class+ttl+rdlen) and the rdata
+    // before indexing — ancount comes from the (untrusted upstream) header, so a
+    // truncated reply would otherwise over-read into a raw RangeError. Mirrors
+    // the hardened _decodeDnsAnswerRaw guards.
+    if (off + 10 > buf.length) throw new DnsError("dns/bad-reply", "answer record truncated");
     var rtype  = buf.readUInt16BE(off); off += 2;
     off += 2;
     off += 4;
     var rdlen  = buf.readUInt16BE(off); off += 2;
+    if (off + rdlen > buf.length) throw new DnsError("dns/bad-reply", "answer rdata truncated");
     if (rtype === qtype && qtype === 1 && rdlen === 4) {
       addrs.push(buf[off] + "." + buf[off + 1] + "." + buf[off + 2] + "." + buf[off + 3]);
     } else if (rtype === qtype && qtype === DNS_QTYPE_AAAA && rdlen === IPV6_ADDR_BYTES) {
@@ -1851,7 +1858,7 @@ var DS_DIGEST_TYPES = Object.freeze({
 });
 
 function classifyDnskeyAlgorithm(algorithm) {
-  if (typeof algorithm !== "number" || !isFinite(algorithm) || Math.floor(algorithm) !== algorithm) {
+  if (!numericBounds.isFiniteInt(algorithm)) {
     return null;
   }
   var row = DNSKEY_ALGORITHMS[algorithm];
@@ -1874,7 +1881,7 @@ function classifyDnskeyAlgorithm(algorithm) {
 }
 
 function classifyDsDigestType(digestType) {
-  if (typeof digestType !== "number" || !isFinite(digestType) || Math.floor(digestType) !== digestType) {
+  if (!numericBounds.isFiniteInt(digestType)) {
     return null;
   }
   var row = DS_DIGEST_TYPES[digestType];

package/lib/network-dnssec.js

@@ -45,6 +45,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var numericBounds = require("./numeric-bounds");
 var bCrypto = require("./crypto");
 var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
@@ -515,7 +516,7 @@ function nsec3Hash(name, opts) {
   validateOpts(opts, ["salt", "iterations"], "dnssec.nsec3Hash");
   var salt = _bytes(opts.salt, "salt");
   var iters = opts.iterations;
-  if (typeof iters !== "number" || !isFinite(iters) || iters < 0 || Math.floor(iters) !== iters) {
+  if (!numericBounds.isNonNegativeFiniteInt(iters)) {
     throw new DnssecError("dnssec/bad-iterations", "dnssec.nsec3Hash: iterations must be a non-negative integer");
   }
   return _nsec3HashWire(_canonicalName(name), salt, iters);

package/lib/network-smtp-policy.js

@@ -176,6 +176,15 @@ async function mtaStsFetch(domain, opts) {
         rejectUnauthorized: true,
       });
     } catch (_e) {
+      // RFC 8461 opportunistic fallback: a policy that can't be fetched — a
+      // network error, OR (with rejectUnauthorized:true + pinned servername
+      // above) a TLS-validation failure that signals a possible MITM of the
+      // policy endpoint — yields "no enforceable policy", so the sender
+      // proceeds without MTA-STS. This is the documented TOFU limitation for an
+      // UN-cached first fetch only: a valid cached policy is honored by the
+      // _getStsCache().wrap() wrapper and never reaches this catch, and the TLS
+      // failure itself is independently audited by httpClient's TLS layer — so
+      // this is a deliberate opportunistic fallback, not a silent swallow.
       return null;
     }
     if (res.statusCode === 404) return null;                                     // HTTP 404
@@ -403,23 +412,32 @@ function _selectorBytes(certDer, selector) {
   return null;
 }
 
+// Constant-time byte-compare for TLSA association data. The TLSA record is
+// public DNS so there is no secret to leak via timing, but the framework
+// compares all crypto material (digests, certs) in constant time so the
+// boundary stays uniform and can't regress into a leaky compare elsewhere.
+function _constEqBytes(a, b) {
+  // bCrypto.timingSafeEqual is the length-tolerant constant-time wrapper.
+  return Buffer.isBuffer(a) && Buffer.isBuffer(b) && bCrypto.timingSafeEqual(a, b);
+}
+
 function _matchTlsaAgainstCert(rec, certDer) {
   // Returns null on no-match, or { ok: true, mtypeLabel } on match.
   var bytes = _selectorBytes(certDer, rec.selector);
   if (!bytes) return null;
-  var dataHex = String(rec.dataHex || "").toLowerCase();
+  var dataHex = (typeof rec.dataHex === "string" ? rec.dataHex : "").toLowerCase();
+  var want = Buffer.from(dataHex, "hex");
   // RFC 6698 §2.1.3 matching types — Full byte match (0) or hashed
   // comparison via SHA two-family (1 short / 2 long digest).
   if (rec.mtype === 0) {
-    return bytes.toString("hex") === dataHex
-      ? { ok: true, mtype: "Full" } : null;
+    return _constEqBytes(bytes, want) ? { ok: true, mtype: "Full" } : null;
   }
   if (rec.mtype === 1) {
-    return _hashHex("sha256", bytes) === dataHex
+    return _constEqBytes(nodeCrypto.createHash("sha256").update(bytes).digest(), want)
       ? { ok: true, mtype: "SHA-256" } : null;
   }
   if (rec.mtype === 2) {
-    return _hashHex("sha512", bytes) === dataHex
+    return _constEqBytes(nodeCrypto.createHash("sha512").update(bytes).digest(), want)
       ? { ok: true, mtype: "SHA-512" } : null;
   }
   return null;

package/lib/network-tls.js

@@ -1093,6 +1093,15 @@ function _verifyOcspSignature(parsed, issuerPem) {
 // `ocsp.requireStapled` or any other source) plus the issuer cert PEM
 // and returns a structured outcome:
 //   { ok, status, certStatus, thisUpdate, nextUpdate, signatureValid, errors }
+// Normalize a certificate serial for comparison: lowercase, drop separators
+// (X509Certificate.serialNumber is uppercase, no colons here but defensive) and
+// the optional DER leading sign-zero, so a serial from node:crypto and one
+// parsed from the OCSP certID DER compare equal. Both sides go through this.
+function _normOcspSerial(s) {
+  var h = String(s || "").toLowerCase().replace(/[^0-9a-f]/g, "");
+  return h.replace(/^0+/, "") || "0";
+}
+
 function evaluateOcspResponse(ocspDer, opts) {
   opts = opts || {};
   var issuerPem = opts.issuerPem;
@@ -1120,12 +1129,21 @@ function evaluateOcspResponse(ocspDer, opts) {
     return { ok: false, status: parsed.status, signatureValid: false,
              errors: ["OCSP signature did not verify against the issuer key"] };
   }
-  // Look up the requested cert serial in the responses; "good" wins.
-  var serial = opts.serialHex || (parsed.basic.responses[0] && parsed.basic.responses[0].certIdSerialHex);
+  // Bind the response to the serial of the certificate UNDER VALIDATION. The
+  // old code defaulted an absent serialHex to responses[0]'s own serial and
+  // then matched it — so a CA-signed "good" response covering a DIFFERENT cert
+  // of the same issuer (replayed/mis-routed batch reply) was accepted. Require
+  // a bound serial and fail closed without one; compare normalized (lowercase,
+  // strip separators + DER leading sign-zero on both sides).
+  if (!opts.serialHex) {
+    return { ok: false, status: parsed.status, signatureValid: true,
+             errors: ["OCSP evaluation requires opts.serialHex (the serial of the certificate being validated) to bind the response"] };
+  }
+  var wantSerial = _normOcspSerial(opts.serialHex);
   var match = null;
   for (var i = 0; i < parsed.basic.responses.length; i += 1) {
     var r = parsed.basic.responses[i];
-    if (!serial || r.certIdSerialHex === serial) { match = r; break; }
+    if (_normOcspSerial(r.certIdSerialHex) === wantSerial) { match = r; break; }
   }
   if (!match) {
     return { ok: false, status: parsed.status, signatureValid: true,
@@ -1418,7 +1436,9 @@ async function fetchOcspResponse(opts) {
   }
   var evald = evaluateOcspResponse(res.body, {
     issuerPem:     opts.issuerPem,
-    serialHex:     opts.serialHex || null,
+    // Bind to the leaf being checked (its serial), not whatever the response
+    // happens to carry — defaults to leafX.serialNumber when not overridden.
+    serialHex:     opts.serialHex || leafX.serialNumber,
     expectedNonce: opts.nonce === false ? null : built.nonce,
   });
   if (!evald.ok) {
@@ -1458,7 +1478,9 @@ var ocsp = Object.freeze({
     }
     var evald = evaluateOcspResponse(rv.ocspBytes, {
       issuerPem: opts.issuerPem,
-      serialHex: opts.serialHex || null,
+      // Bind to the connected peer's certificate serial (not the response's own
+      // entry) — without it evaluateOcspResponse fails closed.
+      serialHex: opts.serialHex || (rv.peerCert && rv.peerCert.serialNumber) || null,
     });
     if (!evald.ok) {
       throw new TlsTrustError("tls/ocsp-not-good",

package/lib/network-tsig.js

@@ -61,8 +61,8 @@ var ERROR = { NOERROR: 0, BADSIG: 16, BADKEY: 17, BADTIME: 18, BADTRUNC: 22 };
 
 function _normAlg(name, allowLegacy) {
   var key = String(name || "hmac-sha256").toLowerCase().replace(/\.$/, "");
-  if (ALGORITHMS[key]) return { name: key, hash: ALGORITHMS[key] };
-  if (LEGACY_ALGORITHMS[key]) {
+  if (Object.prototype.hasOwnProperty.call(ALGORITHMS, key)) return { name: key, hash: ALGORITHMS[key] };
+  if (Object.prototype.hasOwnProperty.call(LEGACY_ALGORITHMS, key)) {
     if (!allowLegacy) throw new TsigError("tsig/legacy-algorithm", "tsig: algorithm '" + key + "' is broken; pass allowLegacy:true to permit it for legacy interop");
     return { name: key, hash: LEGACY_ALGORITHMS[key] };
   }

package/lib/nis2-report.js

@@ -54,7 +54,7 @@ function create(opts) {
   validateOpts.requireNonEmptyString(opts.entityId,
     "nis2.report.create: opts.entityId is required (NIS2 registration ID)",
     Nis2ReportError, "nis2-report/bad-entity-id");
-  if (!VALID_ENTITY_TYPES[opts.entityType]) {
+  if (!Object.prototype.hasOwnProperty.call(VALID_ENTITY_TYPES, opts.entityType)) {
     throw new Nis2ReportError("nis2-report/bad-entity-type",
       "nis2.report.create: opts.entityType must be 'essential' or 'important' (NIS2 Article 3 classification)");
   }

package/lib/nist-crosswalk.js

@@ -199,7 +199,7 @@ var CATALOGS = {
  *   // → ["b.permissions", "b.middleware.requireAuth", ...]
  */
 function controls(catalog) {
-  if (typeof catalog !== "string" || !CATALOGS[catalog]) {
+  if (typeof catalog !== "string" || !Object.prototype.hasOwnProperty.call(CATALOGS, catalog)) {
     throw new NistCrosswalkError("nist-crosswalk/unknown-catalog",
       "controls: unknown catalog '" + catalog + "'. Known: " +
       Object.keys(CATALOGS).join(", "));

package/lib/ntp-check.js

@@ -45,6 +45,8 @@
  *   Boot-time clock-drift verification against an external NTP / NTS-KE reference.
  */
 var dgram = require("node:dgram");
+var nodeCrypto = require("node:crypto");
+var bCrypto = require("./crypto");
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
@@ -200,6 +202,14 @@ function querySingle(server, opts) {
     //   LI=0 (no warning), VN=4, Mode=3 (client). Other bytes zero.
     var req = Buffer.alloc(NTP_PACKET_BYTES);
     req[0] = 0x23;
+    // RFC 5905 §8 client-cookie: put a random 64-bit nonce in the request's
+    // Transmit Timestamp (bytes 40-47). A conformant server copies it verbatim
+    // into the reply's Originate Timestamp (bytes 24-31). Verifying that echo
+    // rejects an off-path spoofed reply — without it ANY 48-byte UDP datagram
+    // reaching our ephemeral port becomes the authoritative time, letting a
+    // spoofer force a fatal-drift refuse-to-boot under BLAMEJS_NTP_STRICT.
+    var originCookie = nodeCrypto.randomBytes(8);
+    originCookie.copy(req, 40);
     var sendTimeMs = Date.now();
 
     socket.on("error", function (e) {
@@ -213,6 +223,24 @@ function querySingle(server, opts) {
       if (!Buffer.isBuffer(msg) || msg.length < NTP_PACKET_BYTES) {
         return done({ code: "ntp/bad-reply", message: "reply too short (" + (msg && msg.length) + " bytes)" });
       }
+      // Origin-cookie echo (RFC 5905 §8): the reply's Originate Timestamp
+      // (bytes 24-31) MUST equal the nonce we sent. An off-path spoofer can't
+      // know it, so this is the primary reply-authenticity check.
+      if (!bCrypto.timingSafeEqual(msg.subarray(24, 32), originCookie)) {
+        return done({ code: "ntp/origin-mismatch",
+          message: server + ": reply Originate Timestamp does not echo the request nonce (spoofed/stale reply)" });
+      }
+      // Reject a non-server mode, an unsynchronized/kiss-o'-death stratum
+      // (0 or >= 16), or LI=3 (alarm — clock not synchronized): such a peer
+      // cannot supply a trustworthy time and must not drive drift.
+      var mode = msg[0] & 0x07;
+      var li = (msg[0] >> 6) & 0x03;
+      var stratum = msg[1];
+      if (mode !== 4 || li === 3 || stratum === 0 || stratum >= 16) {
+        return done({ code: "ntp/unsynchronized",
+          message: server + ": reply mode=" + mode + " stratum=" + stratum + " LI=" + li +
+            " is not a synchronized server response" });
+      }
       // Bytes 40-47 = Transmit Timestamp (NTP epoch seconds.fraction)
       var ntpSeconds  = msg.readUInt32BE(40);                                    // NTP packet offset
       var ntpFraction = msg.readUInt32BE(44);                                    // NTP packet offset

package/lib/numeric-bounds.js

@@ -66,6 +66,14 @@ function isNonNegativeFiniteInt(value) {
          Number.isInteger(value) && value >= 0;
 }
 
+// Any-sign finite integer (no sign bound) — for callers that only require
+// integrality (e.g. a CloudEvents 32-bit signed-integer extension, a DNS
+// algorithm/digest-type code) and reject only non-numbers / floats / Infinity /
+// NaN. Distinct from isNonNegativeFiniteInt (which also forbids negatives).
+function isFiniteInt(value) {
+  return typeof value === "number" && Number.isFinite(value) && Number.isInteger(value);
+}
+
 // requirePositiveFiniteIntIfPresent / requireNonNegativeFiniteIntIfPresent —
 // optional-shape gates that throw via the caller's framework-error class
 // when the value is present but invalid. Replaces the per-file
@@ -150,6 +158,7 @@ module.exports = {
   shape:                                  shape,
   isPositiveFiniteInt:                    isPositiveFiniteInt,
   isNonNegativeFiniteInt:                 isNonNegativeFiniteInt,
+  isFiniteInt:                            isFiniteInt,
   requirePositiveFiniteInt:               requirePositiveFiniteInt,
   requirePositiveFiniteIntIfPresent:      requirePositiveFiniteIntIfPresent,
   requireNonNegativeFiniteIntIfPresent:   requireNonNegativeFiniteIntIfPresent,

package/lib/object-store/azure-blob.js

@@ -37,7 +37,6 @@
  */
 var nodeCrypto = require("node:crypto");
 var { URL } = require("node:url");
-var { Readable } = require("node:stream");
 var safeXml = require("../parsers/safe-xml");
 var sharedRequest = require("./http-request");
 var sigv4 = require("./sigv4");
@@ -299,7 +298,7 @@ function create(config) {
     return getResponse(key, opts).then(function (r) { return r.body; });
   }
 
-  function getStream(key, opts) { return Readable.from(get(key, opts)); }
+  function getStream(key, opts) { return sharedRequest.promiseToStream(get(key, opts)); }
 
   function getResponse(key, opts) {
     opts = opts || {};

package/lib/object-store/gcs-bucket-ops.js

@@ -23,13 +23,13 @@
  * Auth: same service-account JSON / RSA-SHA256-signed JWT exchanged
  * for an OAuth2 access token as `lib/object-store/gcs.js`.
  */
-var nodeFs = require("node:fs");
 var gcs = require("./gcs");
 var authHeader = require("../auth-header");
 var httpClient = require("../http-client");
 var safeJson = require("../safe-json");
 var safeUrl = require("../safe-url");
 var C = require("../constants");
+var atomicFile = require("../atomic-file");
 var requestHelpers = require("../request-helpers");
 var { ObjectStoreError } = require("../framework-error");
 
@@ -139,7 +139,9 @@ function create(config) {
   var serviceAccount = config.serviceAccount;
   if (!serviceAccount && config.serviceAccountFile) {
     try {
-      serviceAccount = safeJson.parse(nodeFs.readFileSync(config.serviceAccountFile));
+      // Cap + fd-bound read of the GCS service-account JSON (private_key). NO
+      // refuseSymlink: commonly a k8s projected-secret mount (symlink).
+      serviceAccount = safeJson.parse(atomicFile.fdSafeReadSync(config.serviceAccountFile, { maxBytes: C.BYTES.kib(64), encoding: "utf8" }));
     } catch (e) {
       throw _err("BAD_OPT", "gcs bucketOps: failed to read serviceAccountFile '" +
         config.serviceAccountFile + "': " + ((e && e.message) || String(e)), true);

package/lib/object-store/gcs.js

@@ -22,12 +22,11 @@
  *   https://cloud.google.com/storage/docs/json_api/v1
  *   https://developers.google.com/identity/protocols/oauth2/service-account
  */
-var nodeFs = require("node:fs");
 var nodeCrypto = require("node:crypto");
-var { Readable } = require("node:stream");
 var bCrypto = require("../crypto");
 var safeJson = require("../safe-json");
 var C = require("../constants");
+var atomicFile = require("../atomic-file");
 var requestHelpers = require("../request-helpers");
 var { ObjectStoreError } = require("../framework-error");
 var safeUrl = require("../safe-url");
@@ -115,7 +114,10 @@ function create(config) {
   var serviceAccount = config.serviceAccount;
   if (!serviceAccount && config.serviceAccountFile) {
     try {
-      serviceAccount = safeJson.parse(nodeFs.readFileSync(config.serviceAccountFile), { schema: SERVICE_ACCOUNT_SCHEMA });
+      // Cap + fd-bound read of the GCS service-account JSON (contains the
+      // private_key). NO refuseSymlink: the SA file is commonly a k8s
+      // projected-secret mount (symlink). 64 KiB bounds the uncapped read.
+      serviceAccount = safeJson.parse(atomicFile.fdSafeReadSync(config.serviceAccountFile, { maxBytes: C.BYTES.kib(64), encoding: "utf8" }), { schema: SERVICE_ACCOUNT_SCHEMA });
     } catch (e) {
       throw new Error("gcs: failed to read serviceAccountFile '" + config.serviceAccountFile + "': " + e.message);
     }
@@ -224,7 +226,7 @@ function create(config) {
   }
 
   function getStream(key, opts) {
-    return Readable.from(get(key, opts));
+    return sharedRequest.promiseToStream(get(key, opts));
   }
 
   async function getResponse(key, opts) {

package/lib/object-store/http-put.js

@@ -16,7 +16,6 @@
  * Errors are surfaced as object-store errors with statusCode set so the
  * retry layer can classify retryable vs permanent.
  */
-var { Readable } = require("node:stream");
 var { ObjectStoreError } = require("../framework-error");
 var safeUrl = require("../safe-url");
 var sharedRequest = require("./http-request");
@@ -96,7 +95,7 @@ function create(config) {
     // https that doesn't buffer; return a Readable wrapping the buffered
     // body. Backends that support chunked transfer (e.g. SigV4) implement
     // a real streaming getStream in their own adapter.
-    return Readable.from(get(key));
+    return sharedRequest.promiseToStream(get(key));
   }
 
   function head(key) {

package/lib/object-store/http-request.js

@@ -16,6 +16,7 @@
  * different class pass `errorClass: SomeError` in opts.
  */
 
+var { Readable } = require("node:stream");
 var httpClient = require("../http-client");
 var C = require("../constants");
 var numericBounds = require("../numeric-bounds");
@@ -109,7 +110,22 @@ function resolvePresignUploadMinBytes(opts) {
 // parameter; the rest is identical.
 function applyConditionalGetHeaders(target, opts, rangeHeaderName) {
   if (opts.range) {
-    target[rangeHeaderName] = "bytes=" + opts.range.start + "-" + opts.range.end;
+    // The documented + shipped contract is an array [start, end] (see
+    // b.archive.adapters.objectStore and b.backup). Reading .start/.end off an
+    // array yields undefined → "bytes=undefined-undefined", which every store
+    // IGNORES — silently returning the FULL object instead of the byte range
+    // (over-fetch + wrong data for a partial read). Accept the array form (and
+    // {start,end} for compatibility) and validate, so a malformed range fails
+    // loudly rather than emitting a garbage header.
+    var r = opts.range;
+    var start = Array.isArray(r) ? r[0] : r.start;
+    var end   = Array.isArray(r) ? r[1] : r.end;
+    if (!Number.isInteger(start) || !Number.isInteger(end) || start < 0 || end < start) {
+      throw _err("INVALID_RANGE",
+        "range must be [start, end] (or { start, end }) with 0 <= start <= end, got " +
+        JSON.stringify(r), true);
+    }
+    target[rangeHeaderName] = "bytes=" + start + "-" + end;
   }
   if (opts.ifNoneMatch)       target["If-None-Match"]       = opts.ifNoneMatch;
   if (opts.ifMatch)           target["If-Match"]            = opts.ifMatch;
@@ -153,8 +169,21 @@ function notModifiedGetResult() {
   };
 }
 
+// Wrap a Promise<Buffer|string> as a Readable WITHOUT awaiting it first, so a
+// backend's getStream() stays synchronous (the dispatcher hands the returned
+// Readable straight to the consumer). A bare `Readable.from(promise)` throws
+// ERR_INVALID_ARG_TYPE — Readable.from needs an (async-)iterable, not a Promise
+// — which broke getStream on every remote backend. The async generator defers
+// the await to the first read; a rejection surfaces as the stream's 'error'
+// event, matching the dispatcher's "the Readable surfaces its own errors"
+// contract.
+function promiseToStream(promise) {
+  return Readable.from((async function* () { yield await promise; })());
+}
+
 module.exports = request;
 module.exports.applyConditionalGetHeaders = applyConditionalGetHeaders;
+module.exports.promiseToStream = promiseToStream;
 module.exports.mapGetResponse = mapGetResponse;
 module.exports.mapHeadResponse = mapHeadResponse;
 module.exports.notModifiedGetResult = notModifiedGetResult;

package/lib/object-store/local.js

@@ -14,6 +14,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("../atomic-file");
+var C = require("../constants");
 var cluster = require("../cluster");
 var { ObjectStoreError } = require("../framework-error");
 
@@ -54,16 +55,14 @@ function create(config) {
       return Promise.resolve({ size: body.length });
     }
     if (body && typeof body.pipe === "function") {
-      // Streaming put — pipe directly to disk
-      return new Promise(function (resolve, reject) {
-        var ws = nodeFs.createWriteStream(full);
-        var bytes = 0;
-        body.on("data", function (chunk) { bytes += chunk.length; });
-        body.pipe(ws);
-        ws.on("finish", function () { resolve({ size: bytes }); });
-        ws.on("error", reject);
-        body.on("error", reject);
-      });
+      // Streaming put — stage into a no-follow exclusive temp + atomic rename
+      // (a bare createWriteStream(full) follows a symlink planted at `full` and
+      // leaves a half-written object there if the source aborts). maxBytes is
+      // raised to the object-store ceiling; default 64 MiB is too small here.
+      return atomicFile.writeStream(full, body, {
+        fileMode: 0o600,
+        maxBytes: C.BYTES.gib(64),
+      }).then(function (r) { return { size: r.bytesWritten }; });
     }
     if (typeof body === "string") {
       var buf = Buffer.from(body, "utf8");
@@ -75,18 +74,39 @@ function create(config) {
 
   function get(key) {
     var full = _resolveSafe(rootDir, key);
-    if (!nodeFs.existsSync(full)) {
-      return Promise.reject(_err("NOT_FOUND", "key not found: " + key, true));
-    }
-    return Promise.resolve(nodeFs.readFileSync(full));
+    // One capped fd-bound read (no existsSync check-then-read TOCTOU): get()
+    // buffers the whole object, so an uncapped read of a multi-GiB object is an
+    // OOM lever — cap it (large reads should use getStream). refuseSymlink stays
+    // OFF: operators may legitimately symlink into the store, and _resolveSafe
+    // already confines the key to rootDir.
+    try {
+      return Promise.resolve(atomicFile.fdSafeReadSync(full, {
+        maxBytes: C.BYTES.mib(64),
+        errorFor: function (kind, detail) {
+          if (kind === "enoent") return _err("NOT_FOUND", "key not found: " + key, true);
+          if (kind === "too-large") {
+            return _err("OBJECT_TOO_LARGE", "object " + key + " exceeds the buffered-get read cap (" +
+              detail.size + " > " + detail.max + " bytes) — use getStream()", true);
+          }
+          return _err("READ_FAILED", "failed to read " + key, true);
+        },
+      }));
+    } catch (e) { return Promise.reject(e); }
   }
 
   function getStream(key) {
     var full = _resolveSafe(rootDir, key);
-    if (!nodeFs.existsSync(full)) {
-      throw _err("NOT_FOUND", "key not found: " + key, true);
+    // Open once and stream from that fd, mapping ENOENT to NOT_FOUND, so the
+    // existsSync→createReadStream check-then-read window is collapsed. Plain
+    // O_RDONLY (follows symlinks): operators may symlink into the store, and the
+    // key is already confined by _resolveSafe.
+    var fd;
+    try { fd = nodeFs.openSync(full, "r"); }
+    catch (e) {
+      if (e && e.code === "ENOENT") throw _err("NOT_FOUND", "key not found: " + key, true);
+      throw e;
     }
-    return nodeFs.createReadStream(full);
+    return nodeFs.createReadStream(full, { fd: fd });
   }
 
   function head(key) {

package/lib/object-store/sigv4.js

@@ -25,7 +25,6 @@
  */
 var nodeCrypto = require("node:crypto");
 var { URL } = require("node:url");
-var { Readable } = require("node:stream");
 var safeXml = require("../parsers/safe-xml");
 var sharedRequest = require("./http-request");
 var C = require("../constants");
@@ -633,7 +632,7 @@ function create(config) {
   }
 
   function getStream(key, opts) {
-    return Readable.from(get(key, opts));
+    return sharedRequest.promiseToStream(get(key, opts));
   }
 
   // getResponse(key, opts?) — full-fidelity GET. Returns

package/lib/observability-otlp-exporter.js

@@ -133,12 +133,27 @@ function _valueToOtlp(v) {
   return { stringValue: String(v) };
 }
 
+// Run a single wire STRING (span name / status message) through the telemetry
+// redactor. These reach the collector exactly like attribute values, so a
+// connection string / token / PII in an error message (the tracer's canonical
+// `setStatus("error", e.message)`) must be scrubbed too (CWE-532). Routes
+// through redactAttrs (the same chokepoint attributes use); fails toward an
+// empty string on a redactor throw, matching redactAttrs' drop-on-error.
+function _redactWireString(key, value) {
+  if (typeof value !== "string" || value.length === 0) return value || "";
+  try {
+    var holder = {};
+    holder[key] = value;
+    return observability().redactAttrs(holder)[key];
+  } catch (_e) { return ""; }
+}
+
 function _spanToOtlp(span) {
   return {
     traceId:           span.traceId,
     spanId:            span.spanId,
     parentSpanId:      span.parentSpanId || "",
-    name:              span.name,
+    name:              _redactWireString("otel.span.name", span.name),
     kind:              KIND_TO_OTLP[span.kind] || KIND_TO_OTLP.internal,
     startTimeUnixNano: span.startTimeUnixNano,
     endTimeUnixNano:   span.endTimeUnixNano || span.startTimeUnixNano,
@@ -155,7 +170,7 @@ function _spanToOtlp(span) {
     droppedEventsCount: span.droppedEventsCount || 0,
     status: {
       code:    STATUS_CODE_TO_OTLP[span.status && span.status.code] || 0,
-      message: (span.status && span.status.message) || "",
+      message: _redactWireString("exception.message", (span.status && span.status.message) || ""),
     },
   };
 }
@@ -336,7 +351,7 @@ function _attrsToProto(attrs) {
 function _spanToProto(span) {
   // Status code: 0=Unset, 1=Ok, 2=Error. Status field 1 is reserved.
   var statusBody = Buffer.concat([
-    pb.string(2, (span.status && span.status.message) || ""),
+    pb.string(2, _redactWireString("exception.message", (span.status && span.status.message) || "")),
     pb.uint32(3, STATUS_CODE_TO_OTLP[span.status && span.status.code] || 0),
   ]);
   var eventsRepeated = pb.repeatedMessage(11, span.events || [], function (e) {
@@ -352,7 +367,7 @@ function _spanToProto(span) {
     pb.bytes(2,   _hexToBytes(span.spanId)),
     pb.string(3,  ""),                                                          // trace_state (not yet propagated by the framework)
     pb.bytes(4,   _hexToBytes(span.parentSpanId || "")),
-    pb.string(5,  span.name || ""),
+    pb.string(5,  _redactWireString("otel.span.name", span.name || "")),
     pb.uint32(6,  KIND_TEXT_TO_ENUM[span.kind] != null ? KIND_TEXT_TO_ENUM[span.kind] : KIND_TEXT_TO_ENUM.internal),
     pb.fixed64(7, span.startTimeUnixNano || 0),
     pb.fixed64(8, span.endTimeUnixNano || span.startTimeUnixNano || 0),         // proto field number 8, not bytes
@@ -648,6 +663,7 @@ module.exports = {
   OtlpExporterError:       OtlpExporterError,
   // Exported for tests
   _spanToOtlp:             _spanToOtlp,
+  _spanToProto:            _spanToProto,
   _bundleSpans:            _bundleSpans,
   _attrToOtlp:             _attrToOtlp,
   _BASE64URL_RE_REF:       safeBuffer.BASE64URL_RE,                                // not used; reserved for OTLP/protobuf shape upgrade

package/lib/outbox.js

@@ -375,11 +375,18 @@ function create(opts) {
       { name: "last_error",      type: "TEXT" },
       { name: "status",          type: "VARCHAR(16)",  notNull: true, default: "pending" },
     ], { dialect: dialect }), dialect);
-    // Partial index on the pending pool (the publisher's claim path scans
-    // status='pending' ORDER BY next_attempt_at). The 'pending' literal is
-    // a builder-emitted static predicate, opted in via allowLiterals.
+    // Index for the publisher's claim path (scans status='pending' ORDER BY
+    // next_attempt_at). sqlite/postgres support a partial index (WHERE on
+    // CREATE INDEX) on next_attempt_at; MySQL does NOT — a WHERE there is a
+    // syntax error that made declareSchema() throw on MySQL — so fall back to a
+    // composite (status, next_attempt_at) index, which serves the same
+    // equality+range scan. The 'pending' literal is a builder-emitted static
+    // predicate, opted in via allowLiterals.
+    var idxCols = dialect === "mysql" ? ["status", "next_attempt_at"] : ["next_attempt_at"];
+    var idxOpts = { dialect: dialect };
+    if (dialect !== "mysql") idxOpts.where = "status = 'pending'";
     var idx = sql.toExternalSql(sql.createIndex(opts.table + "_pending_idx", opts.table,
-      ["next_attempt_at"], { dialect: dialect, where: "status = 'pending'" }), dialect);
+      idxCols, idxOpts), dialect);
     await target.query(ddl.sql, ddl.params);
     await target.query(idx.sql, idx.params);
     // Back-compat: an outbox table created before the claimed_at column

package/lib/parsers/safe-xml.js

@@ -174,7 +174,7 @@ function parse(input, opts) {
         }
         out += String.fromCodePoint(code);
         i = end + 1;
-      } else if (BUILT_IN_ENTITIES[name] !== undefined) {
+      } else if (Object.prototype.hasOwnProperty.call(BUILT_IN_ENTITIES, name)) {
         out += BUILT_IN_ENTITIES[name];
         i = end + 1;
       } else {