@blamejs/core 0.15.13 → 0.15.15

package/lib/restore-bundle.js

@@ -48,6 +48,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("./atomic-file");
+var C = require("./constants");
 var backupCrypto = require("./backup/crypto");
 var backupManifest = require("./backup/manifest");
 var validateOpts = require("./validate-opts");
@@ -146,13 +147,21 @@ async function extract(opts) {
   // 1. Read + parse + validate manifest
   _emit(progress, { phase: "read_manifest" });
   var manifestPath = nodePath.join(bundleDir, "manifest.json");
-  if (!nodeFs.existsSync(manifestPath)) {
-    throw new RestoreBundleError("restore-bundle/missing-manifest",
-      "extract: bundleDir has no manifest.json — bundle is incomplete or not a blamejs backup");
-  }
+  // Capped fd-bound read OUTSIDE the parse try/catch, so a missing / oversized
+  // bundle manifest surfaces the precise restore-bundle code (not a generic
+  // parse error). A backup manifest is small JSON; 4 MiB bounds a hostile one
+  // before backupManifest.parse materializes it.
+  var manifestRaw = atomicFile.fdSafeReadSync(manifestPath, {
+    maxBytes: C.BYTES.mib(4), encoding: "utf8",
+    errorFor: function (kind, detail) {
+      if (kind === "enoent") return new RestoreBundleError("restore-bundle/missing-manifest", "extract: bundleDir has no manifest.json — bundle is incomplete or not a blamejs backup");
+      if (kind === "too-large") return new RestoreBundleError("restore-bundle/bad-manifest", "extract: manifest.json exceeds " + detail.max + " bytes");
+      return new RestoreBundleError("restore-bundle/bad-manifest", "extract: manifest unreadable: " + kind);
+    },
+  });
   var manifest;
   try {
-    manifest = backupManifest.parse(nodeFs.readFileSync(manifestPath, "utf8"));
+    manifest = backupManifest.parse(manifestRaw);
   } catch (e) {
     if (e && e.isBackupManifestError) throw e;
     throw new RestoreBundleError("restore-bundle/bad-manifest",
@@ -216,12 +225,20 @@ async function extract(opts) {
       }
 
       var blobPath = nodePath.join(bundleDir, entry.encryptedPath);
-      if (!nodeFs.existsSync(blobPath)) {
-        throw new RestoreBundleError("restore-bundle/missing-blob",
-          "extract: manifest references '" + entry.encryptedPath +
-          "' but the bundle has no such file");
-      }
-      var blob = nodeFs.readFileSync(blobPath);
+      // Cap the read to the manifest's declared encryptedSize so an oversize-on-
+      // disk blob is refused BEFORE it is read into memory (was: read fully, then
+      // compare → an OOM window for a huge swapped blob). A valid blob is exactly
+      // encryptedSize; the post-read compare still catches the under-size case.
+      var blobCap = (typeof entry.encryptedSize === "number" && entry.encryptedSize > 0)
+        ? entry.encryptedSize : C.BYTES.gib(8);
+      var blob = atomicFile.fdSafeReadSync(blobPath, {
+        maxBytes: blobCap,
+        errorFor: function (kind, detail) {
+          if (kind === "enoent") return new RestoreBundleError("restore-bundle/missing-blob", "extract: manifest references '" + entry.encryptedPath + "' but the bundle has no such file");
+          if (kind === "too-large") return new RestoreBundleError("restore-bundle/size-mismatch", "extract: blob '" + entry.encryptedPath + "' has size " + detail.size + " but manifest expected " + entry.encryptedSize);
+          return new RestoreBundleError("restore-bundle/missing-blob", "extract: blob '" + entry.encryptedPath + "' unreadable: " + kind);
+        },
+      });
       if (blob.length !== entry.encryptedSize) {
         throw new RestoreBundleError("restore-bundle/size-mismatch",
           "extract: blob '" + entry.encryptedPath + "' has size " + blob.length +
@@ -235,12 +252,18 @@ async function extract(opts) {
 
       var plaintext;
       try {
-        plaintext = await backupCrypto.decryptWithPassphrase(blob, passphrase, entry.salt);
+        // Bundles written with manifest.aadBound sealed each blob with its
+        // relativePath as AEAD associated data — pass the SAME path so a blob
+        // remapped to a different manifest entry fails the tag here (the
+        // blob-remap / restore-corruption defense). Legacy bundles without
+        // the flag decrypt with no AAD (backward compatible).
+        var blobAad = manifest.aadBound === true ? Buffer.from(entry.relativePath, "utf8") : undefined;
+        plaintext = await backupCrypto.decryptWithPassphrase(blob, passphrase, entry.salt, blobAad);
       } catch (e) {
         if (e && e.isBackupCryptoError && e.code === "backup-crypto/decrypt-failed") {
           throw new RestoreBundleError("restore-bundle/decrypt-failed",
             "extract: blob '" + entry.encryptedPath + "' did not decrypt — " +
-            "passphrase rejected or ciphertext tampered");
+            "passphrase rejected, ciphertext tampered, or blob remapped to a different path");
         }
         throw e;
       }
@@ -326,11 +349,16 @@ function inspect(opts) {
       "inspect: opts.bundleDir is required and must exist");
   }
   var manifestPath = nodePath.join(opts.bundleDir, "manifest.json");
-  if (!nodeFs.existsSync(manifestPath)) {
-    throw new RestoreBundleError("restore-bundle/missing-manifest",
-      "inspect: bundleDir has no manifest.json");
-  }
-  return backupManifest.parse(nodeFs.readFileSync(manifestPath, "utf8"));
+  // Capped fd-bound read (no-passphrase preview path, reachable with only read
+  // access to the bundle): bound a hostile manifest before parse.
+  return backupManifest.parse(atomicFile.fdSafeReadSync(manifestPath, {
+    maxBytes: C.BYTES.mib(4), encoding: "utf8",
+    errorFor: function (kind) {
+      if (kind === "enoent") return new RestoreBundleError("restore-bundle/missing-manifest", "inspect: bundleDir has no manifest.json");
+      if (kind === "too-large") return new RestoreBundleError("restore-bundle/bad-manifest", "inspect: manifest.json too large");
+      return new RestoreBundleError("restore-bundle/missing-manifest", "inspect: manifest unreadable: " + kind);
+    },
+  }));
 }
 
 module.exports = {

package/lib/restore-rollback.js

@@ -283,10 +283,16 @@ function list(opts) {
     var p = nodePath.join(rollbackRoot, name);
     var markerPath = p + ".marker.json";
     var marker = null;
-    if (nodeFs.existsSync(markerPath)) {
-      try { marker = safeJson.parse(nodeFs.readFileSync(markerPath, "utf8"), { maxBytes: C.BYTES.kib(64) }); }
-      catch (_e) { marker = null; }
-    }
+    // Capped fd-bound read (no existsSync check-then-read window): the fs read is
+    // now bounded to 64 KiB too, so a tampered multi-GB marker.json is refused
+    // BEFORE allocation (the parse-only cap let readFileSync slurp the whole file
+    // first). refuseSymlink: the marker lives under the operator's rollbackRoot,
+    // never a secret-mount. Any failure → marker:null, the best-effort behavior.
+    try {
+      marker = safeJson.parse(
+        atomicFile.fdSafeReadSync(markerPath, { maxBytes: C.BYTES.kib(64), encoding: "utf8", refuseSymlink: true }),
+        { maxBytes: C.BYTES.kib(64) });
+    } catch (_e) { marker = null; }
     var stat;
     try { stat = nodeFs.statSync(p); } catch (_e) { continue; }
     out.push({

package/lib/restore.js

@@ -83,6 +83,7 @@ function create(opts) {
   validateOpts(opts, [
     "dataDir", "storage", "passphrase", "rollbackRoot", "audit",
     "maxPulledBytes", "maxPulledFiles",
+    "requireSignature", "expectedFingerprint", "verifySignature",
   ], "restore");
   validateOpts.requireNonEmptyString(opts.dataDir, "create: opts.dataDir", RestoreError, "restore/no-datadir");
   _validateStorage(opts.storage);
@@ -96,6 +97,19 @@ function create(opts) {
   var passphrase = opts.passphrase;
   var rollbackRoot = opts.rollbackRoot || (dataDir + ".rollbacks");
   var auditOn = opts.audit !== false;
+  // Manifest-signature policy. The framework signs bundles best-effort (an
+  // unsigned bundle is the documented CLI / standalone / worker case), so the
+  // non-opt-in integrity default is the per-blob AEAD path-binding below
+  // (which defeats the blob-remap attack on EVERY bundle, signed or not);
+  // requireSignature is the additional provenance policy operators under
+  // HIPAA/PCI opt into to mandate a verified signer. expectedFingerprint pins
+  // a signer; verifySignature:false allows a cold/cross-org restore. All
+  // three are threaded into restoreBundle.extract on every run — previously
+  // omitted entirely, so a present signature was never even verified and a
+  // requireSignature policy could not be enforced (CWE-347).
+  var requireSignature = opts.requireSignature === true;
+  var expectedFingerprint = opts.expectedFingerprint;
+  var verifySignature = opts.verifySignature;
 
   // Preflight footprint caps. Defended against storage that returns a
   // tampered or oversized bundle: we cap both the storage-reported size
@@ -271,6 +285,9 @@ function create(opts) {
         passphrase:       passphrase,
         filter:           runOpts.filter,
         progressCallback: runOpts.progressCallback,
+        requireSignature:    requireSignature,
+        expectedFingerprint: expectedFingerprint,
+        verifySignature:     verifySignature,
       });
     } catch (e) {
       _cleanupTmp();
@@ -283,6 +300,8 @@ function create(opts) {
       else if (code === "restore-bundle/missing-manifest")  mappedCode = "restore/missing-manifest";
       else if (code === "restore-bundle/missing-blob")      mappedCode = "restore/missing-blob";
       else if (code === "restore-bundle/size-mismatch")     mappedCode = "restore/size-mismatch";
+      else if (code === "restore-bundle/missing-signature") mappedCode = "restore/missing-signature";
+      else if (code === "restore-bundle/bad-signature")     mappedCode = "restore/bad-signature";
       _emitAudit("restore.failure",
         { bundleId: bundleId, reason: (e && e.message) || String(e) }, "failure");
       throw new RestoreError(mappedCode,

package/lib/retention.js

@@ -431,17 +431,29 @@ function create(opts) {
 
     try {
       var moreRows = true;
+      // Keyset pagination cursor. Without it the loop re-selects the SAME batch
+      // forever whenever a full batch of rows is NOT removed from the candidate
+      // set by its action — legal-hold-skipped, "warn"-stage, errored, and
+      // (critically) EVERY row under dryRun mutate nothing, so a LIMIT-from-the-
+      // top query returns the identical rows each pass and `rows.length ===
+      // batchSize` never goes false. Ordering by _id and advancing past the last
+      // row seen guarantees forward progress regardless of whether a row was
+      // actioned. (Deleted / anonymized rows are also simply skipped past.)
+      var lastId = null;
       while (moreRows) {
         var rows;
         // The candidate WHERE-clause: age + not-already-erased + not-on-legal-hold +
-        // (when soft-delete is configured) not-already-soft-deleted. Built
-        // through b.sql so the operator-supplied table / ageField / softDeleteField
-        // identifiers are quoted by construction and every value binds as a
-        // placeholder (the '' empty-string compare included — no embedded literal).
+        // (when soft-delete is configured) not-already-soft-deleted + keyset cursor.
+        // Built through b.sql so the operator-supplied table / ageField /
+        // softDeleteField identifiers are quoted by construction and every value
+        // binds as a placeholder (the '' empty-string compare included — no
+        // embedded literal).
         function _candidateBase() {
           var qb = sql.select(rule.table, SQL_OPTS)
             .where(rule.ageField, "<=", cutoff);
           if (rule.softDeleteField) qb.whereNull(rule.softDeleteField);
+          if (lastId !== null) qb.where("_id", ">", lastId);
+          qb.orderBy("_id", "asc");
           return qb;
         }
         var selStmt;
@@ -504,6 +516,10 @@ function create(opts) {
               reason: (e && e.message) || String(e) });
           }
         }
+        // Advance the keyset cursor past this batch so already-seen rows
+        // (including skipped / warned / errored / dry-run rows that stay in the
+        // candidate set) are never re-selected — the loop-termination guarantee.
+        lastId = rows[rows.length - 1]._id;
         if (rows.length < rule.batchSize) moreRows = false;
       }
     } catch (e) {

package/lib/router.js

@@ -36,6 +36,7 @@ var http  = require("node:http");
 var http2 = require("node:http2");
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
+var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var requestHelpers = require("./request-helpers");
 var lazyRequire = require("./lazy-require");
@@ -147,7 +148,11 @@ function _makeSchemaValidator(spec) {
       if (!qq.ok) return _writeValidationError(req, res, "query", qq.errors);
       req.query = qq.value;
     }
-    if (spec.body && req.body !== undefined) {
+    if (spec.body) {
+      // Validate even when req.body is undefined (no body parsed / empty POST):
+      // a required body schema must report the violation, not be silently
+      // skipped. safeParse(undefined) fails a non-optional schema and passes an
+      // optional()/default() one. Mirrors the always-run params/query checks.
       var bb = spec.body.safeParse(req.body);
       if (!bb.ok) return _writeValidationError(req, res, "body", bb.errors);
       req.body = bb.value;
@@ -1425,11 +1430,19 @@ function serveStatic(dir) {
     // that shares the root's name as a prefix — e.g. root `/srv/public`
     // vs `/srv/public-evil` — cannot satisfy the containment check.
     if (filePath !== root && !filePath.startsWith(root + nodePath.sep)) return next();
-    if (!nodeFs.existsSync(filePath) || nodeFs.statSync(filePath).isDirectory()) return next();
+    // Open the (lexically-confined) path ONCE with O_NOFOLLOW and bind existence,
+    // stat, and streaming to that single fd. The previous existsSync → statSync →
+    // statSync → createReadStream sequence was a triple check-then-read TOCTOU
+    // (CWE-367) on a request-derived pathname, and the plain createReadStream
+    // would follow a symlink swapped in after the lexical check (CWE-22).
+    // Opening before writeHead lets a refusal still fall through to next().
+    var fd;
+    try { fd = atomicFile.openNoFollowSync(filePath); } catch (_e) { return next(); }
+    var stat = nodeFs.fstatSync(fd);
+    if (stat.isDirectory()) { nodeFs.closeSync(fd); return next(); }
 
     var ext = nodePath.extname(filePath).toLowerCase();
     var mime = MIME_TYPES[ext] || "application/octet-stream";
-    var stat = nodeFs.statSync(filePath);
     var hasVersion = req.url && req.url.includes("?v=");
     var cacheControl = hasVersion
       ? "public, max-age=31536000, immutable"
@@ -1439,7 +1452,7 @@ function serveStatic(dir) {
       "Content-Length": stat.size,
       "Cache-Control":  cacheControl,
     });
-    nodeFs.createReadStream(filePath).pipe(res);
+    nodeFs.createReadStream(filePath, { fd: fd }).pipe(res);
   };
 }
 

package/lib/safe-ical.js

@@ -444,7 +444,7 @@ function _parseComponent(lines, startIdx, ctx, depth) {
       "safeIcal.parse: expected BEGIN, got '" + begin.name + "'");
   }
   var compName = begin.value.toUpperCase();
-  if (!KNOWN_COMPONENTS[compName] && !ctx.extraComps[compName] &&
+  if (!Object.prototype.hasOwnProperty.call(KNOWN_COMPONENTS, compName) && !ctx.extraComps[compName] &&
       compName.indexOf("X-") !== 0) {
     throw new SafeIcalError("safe-ical/unknown-component",
       "safeIcal.parse: unknown component '" + compName +
@@ -475,7 +475,7 @@ function _parseComponent(lines, startIdx, ctx, depth) {
     }
     // Validate property name.
     var pn = ln.name;
-    if (!KNOWN_PROPERTIES[pn] && !ctx.extraProps[pn] && pn.indexOf("X-") !== 0) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_PROPERTIES, pn) && !ctx.extraProps[pn] && pn.indexOf("X-") !== 0) {
       throw new SafeIcalError("safe-ical/unknown-property",
         "safeIcal.parse: unknown property '" + pn +
         "' (extend via opts.extraProperties or use X- prefix)");

package/lib/safe-icap.js

@@ -426,7 +426,7 @@ function _parseEncapsulated(value) {
     }
     var part = token.slice(0, eq);
     var offStr = token.slice(eq + 1);
-    if (!ENCAPSULATED_PARTS[part]) {
+    if (!Object.prototype.hasOwnProperty.call(ENCAPSULATED_PARTS, part)) {
       throw new SafeIcapError("safe-icap/bad-encapsulated",
         "safeIcap.parse: Encapsulated part '" + part + "' is not one of " +
         Object.keys(ENCAPSULATED_PARTS).join(", "));

package/lib/safe-json.js

@@ -354,6 +354,49 @@ function stringify(value, opts) {
   }
 }
 
+/**
+ * @primitive b.safeJson.stringifyForScript
+ * @signature b.safeJson.stringifyForScript(value, opts?)
+ * @since     0.15.14
+ * @status    stable
+ * @related   b.safeJson.stringify
+ *
+ * Like `b.safeJson.stringify` but safe to embed verbatim inside an
+ * inline `<script>` element. Raw `JSON.stringify` does not escape `<`,
+ * `>`, or `&`, so a string value containing `</script>` (or `<!--`)
+ * closes the surrounding script element and injects markup; the
+ * Unicode line/paragraph separators U+2028 / U+2029 are also illegal
+ * unescaped in a script context on older parsers. This escapes all of
+ * them to their equivalent `\uXXXX` JSON escapes — the parsed value is
+ * byte-identical, but no substring can break out of a `<script>` block.
+ *
+ * @opts
+ *   indent:    number | string,   // forwarded to b.safeJson.stringify
+ *   allowProto:boolean,           // forwarded
+ *
+ * @example
+ *   var json = b.safeJson.stringifyForScript({ url: "/a</script>x" });
+ *   res.end('<script type="importmap">' + json + '</script>');
+ *   // → the "</script>" inside the value is emitted as "</script>"
+ */
+function stringifyForScript(value, opts) {
+  var json = stringify(value, opts);
+  // BS is a single backslash built at runtime so this source carries no
+  // escape literals (they round-trip badly through tooling). Escape < > &
+  // so the JSON cannot close / comment-open the surrounding inline
+  // <script>; escape U+2028 / U+2029 (illegal unescaped in a script on
+  // older parsers). The parsed value is unchanged.
+  var BS = String.fromCharCode(92);
+  json = json.replace(/[<>&]/g, function (c) {
+    if (c === "<") return BS + "u003c";
+    if (c === ">") return BS + "u003e";
+    return BS + "u0026";
+  });
+  json = json.split(String.fromCharCode(0x2028)).join(BS + "u2028");
+  json = json.split(String.fromCharCode(0x2029)).join(BS + "u2029");
+  return json;
+}
+
 // Walk the value, substituting any references that would create a cycle
 // with `replacement`. Uses an active-stack Set so SHARED non-circular
 // subtrees are preserved (only true cycles are replaced).
@@ -926,10 +969,37 @@ function _capInt(value, defaultValue, ceiling) {
  *   });
  */
 
+/**
+ * @primitive b.safeJson.isJsonObject
+ * @signature b.safeJson.isJsonObject(value)
+ * @since     0.15.14
+ * @status    stable
+ * @related   b.safeJson.parse
+ *
+ * True iff <code>value</code> is a plain JSON object — not <code>null</code>,
+ * not an array, not a scalar. <code>safeJson.parse</code> accepts the literal
+ * <code>null</code> and scalars / arrays (all valid JSON documents), so a
+ * parsed JWS header, claims set, or document must be re-checked before its
+ * fields are dereferenced. This is that check, shared so the
+ * <code>!x || typeof x !== "object" || Array.isArray(x)</code> idiom isn't
+ * re-rolled (and silently varied) at every call site.
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   b.safeJson.isJsonObject(b.safeJson.parse('{"a":1}'));   // → true
+ *   b.safeJson.isJsonObject(b.safeJson.parse("null"));      // → false
+ *   b.safeJson.isJsonObject(b.safeJson.parse("[1,2]"));     // → false
+ */
+function isJsonObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
 module.exports = {
   parse:          parse,
   parseOrDefault: parseOrDefault,
+  isJsonObject:   isJsonObject,
   stringify:      stringify,
+  stringifyForScript: stringifyForScript,
   canonical:      canonical,
   validate:       validate,
   registerFormat: registerFormat,

package/lib/safe-sieve.js

@@ -133,7 +133,7 @@ function _resolveProfile(opts) {
   if (!opts) return "strict";
   if (typeof opts.profile === "string") return opts.profile;
   if (typeof opts.compliancePosture === "string") {
-    return COMPLIANCE_POSTURES[opts.compliancePosture] || "strict";
+    return (Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.compliancePosture) && COMPLIANCE_POSTURES[opts.compliancePosture]) || "strict";
   }
   return "strict";
 }

package/lib/safe-vcard.js

@@ -361,7 +361,7 @@ function _parseVcard(lines, startIdx, caps, extraProps) {
         "safeVcard.parse: nested BEGIN inside VCARD (vCard does not support sub-components)");
     }
     var pn = ln.name;
-    if (!KNOWN_PROPERTIES[pn] && !extraProps[pn] && pn.indexOf("X-") !== 0) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_PROPERTIES, pn) && !extraProps[pn] && pn.indexOf("X-") !== 0) {
       throw new SafeVcardError("safe-vcard/unknown-property",
         "safeVcard.parse: unknown property '" + pn +
         "' (extend via opts.extraProperties or use X- prefix)");

package/lib/sandbox-worker.js

@@ -63,6 +63,12 @@ var workerThreads = require("node:worker_threads");
     "setInterval", "clearInterval",
     "queueMicrotask",
     "global",
+    // WebAssembly linear memory is allocated OUTSIDE the V8 heap, so the
+    // worker's maxOldGenerationSizeMb cap (derived from opts.maxBytes) does
+    // NOT bound `new WebAssembly.Memory(...).grow(N)` — operator source could
+    // commit multi-GiB of off-heap RAM under a tiny maxBytes (CWE-770). It is
+    // not in KNOWN_SAFE_BUILTINS so no `allowed` opt can re-expose it.
+    "WebAssembly",
   ];
   for (var k = 0; k < NODE_BUILTINS.length; k += 1) {
     var nm = NODE_BUILTINS[k];

package/lib/sandbox.js

@@ -133,7 +133,7 @@ function _validateAllowed(allowed) {
       throw new SandboxError("sandbox/bad-allowed",
         "sandbox.run: opts.allowed[" + i + "] must be a non-empty identifier string");
     }
-    if (!KNOWN_SAFE_BUILTINS[name]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_SAFE_BUILTINS, name)) {
       throw new SandboxError("sandbox/bad-allowed",
         "sandbox.run: opts.allowed[" + i + "] = " + JSON.stringify(name) +
         " is not in the sandbox built-in allowlist " +

package/lib/scheduler.js

@@ -177,7 +177,7 @@ function parseCron(expr) {
       "cron expression must be a non-empty string", true);
   }
   var trimmed = expr.trim();
-  if (CRON_SHORTHANDS[trimmed.toLowerCase()]) {
+  if (Object.prototype.hasOwnProperty.call(CRON_SHORTHANDS, trimmed.toLowerCase())) {
     trimmed = CRON_SHORTHANDS[trimmed.toLowerCase()];
   }
   var fields = trimmed.split(/\s+/);
@@ -711,8 +711,24 @@ function create(opts) {
     });
   }
 
+  // Node coerces a setTimeout delay greater than the 32-bit signed max
+  // (2147483647 ms ≈ 24.8 days) to 1 ms — so a far-future task would fire
+  // immediately, and an interval longer than the max would tight-loop. Wait
+  // the max chunk, then re-arm for the remainder WITHOUT firing.
+  var TIMEOUT_MAX_MS = 2147483647;
+
   function _arm(task) {
     var delay = Math.max(0, task.nextRun - Date.now());
+    if (delay > TIMEOUT_MAX_MS) {
+      var tc = setTimeout(function () {
+        timers.delete(tc);
+        if (!started) return;
+        _arm(task);                                // re-arm for the remaining delay; do NOT fire yet
+      }, TIMEOUT_MAX_MS);
+      if (typeof tc.unref === "function") tc.unref();
+      timers.add(tc);
+      return;
+    }
     var t = setTimeout(function () {
       timers.delete(t);
       if (!started) return;

package/lib/self-update-standalone-verifier.js

@@ -181,6 +181,14 @@ function verify(assetPath, signaturePath, pubkeyPem) {
   var signature;
   try {
     var sigStat = nodeFs.fstatSync(sigFd);
+    // Bound the alloc: the largest supported signature (ML-DSA-87) is ~4.6 KB;
+    // 64 KiB is far above any legitimate sig and stops Buffer.allocUnsafe(stat.size)
+    // from OOM-ing if signaturePath is pointed at a giant file. Zero-dep by
+    // contract — inline literal, cannot import C.BYTES.
+    if (sigStat.size > 64 * 1024) {   // allow:raw-byte-literal — zero-dep module
+      throw new Error("standalone-verifier.verify: signature file implausibly large (" +
+                      sigStat.size + " bytes)");
+    }
     signature = Buffer.allocUnsafe(sigStat.size);
     if (sigStat.size > 0) nodeFs.readSync(sigFd, signature, 0, sigStat.size, 0);
   } finally {
@@ -219,6 +227,14 @@ function verify(assetPath, signaturePath, pubkeyPem) {
   // to come from the same {0..assetStat.size} range fixed at open
   // time.
   var assetStat = nodeFs.fstatSync(assetFd);
+  // Bound the asset alloc before Buffer.allocUnsafe(assetStat.size): a self-update
+  // bundle (SEA) is intentionally large, so the ceiling is generous (2 GiB), but
+  // it stops a signaturePath/assetPath pointed at an unbounded file from OOM-ing
+  // the verifier before any byte is hashed. Zero-dep by contract — inline literal.
+  if (assetStat.size > 2 * 1024 * 1024 * 1024) {   // allow:raw-byte-literal — zero-dep module, 2 GiB asset ceiling
+    throw new Error("standalone-verifier.verify: asset implausibly large (" +
+                    assetStat.size + " bytes) — exceeds the 2 GiB self-update ceiling");
+  }
   var sha256 = nodeCrypto.createHash("sha256");
   var sha3   = nodeCrypto.createHash("sha3-512");
   var verifier = (alg === "ecdsa-p384") ? nodeCrypto.createVerify("sha3-512") : null;