@blamejs/core 0.15.13 → 0.15.15

package/lib/session.js

@@ -256,130 +256,48 @@ function _sealForInsert(row) {
 var DEFAULT_FINGERPRINT_FIELDS = ["clientIp", "userAgent", "acceptLanguage"];
 
 // Subnet binding: roaming carriers (T-Mobile / Verizon / etc.) flip the
-// public client IP every few requests as the device hops cells, so a
-// strict full-IP fingerprint logs out healthy mobile users. The
-// "clientIpPrefix" field hashes a /24 mask for IPv4 (256-address bucket
-// — same Class C-shaped neighborhood) and a /64 mask for IPv6 (the IPv6
-// "site" prefix the RIRs allocate to every ISP customer). Drift across
-// /24 OR /64 is meaningfully suspicious; drift within is not.
-//
-// Per the IPv6 addressing architecture (RFC 4291 §2.5.4) every customer
-// LAN is assigned at least a /64; tightening below /64 punishes IPv6
-// privacy-extension address rotation. /24 IPv4 is the original
-// IP-geolocation bucket size and matches the legacy carrier-NAT pool
-// stride. Operators with stricter needs pass a function-form
-// fingerprint field for custom mask widths.
-//
-// Protocol constants — named so the bit-arithmetic stays readable.
-var IP_BITS_PER_BYTE      = 8;                                                                  // bits per byte; protocol constant, not a byte size
-var IPV4_OCTET_COUNT      = 4;
-var IPV4_OCTET_RANGE      = 256;                                                                // 0..255 inclusive; v4 octet domain
-var IPV4_TOTAL_BITS       = 32;                                                                 // IPv4 address width in bits
-var IPV4_DEFAULT_PREFIX   = 24;                                                                 // /24 carrier-NAT pool stride
-var IPV6_GROUP_COUNT      = 8;                                                                  // 8 16-bit groups in v6
-var IPV6_BYTE_COUNT       = 16;                                                                 // 16 bytes in v6
-var IPV6_DEFAULT_PREFIX   = 64;                                                                 // /64 customer LAN per RFC 4291 §2.5.4
-var BYTE_MASK             = 0xff;
-var HEX_RADIX             = 16;                                                                 // base-16 radix
-var V4_MAPPED_V6_PREFIX   = "::ffff:";
-
-function _maskIpv4(ip, prefix) {
-  // ip = "a.b.c.d"; prefix is bits to keep (1..32).
-  var parts = String(ip).split(".");
-  if (parts.length !== IPV4_OCTET_COUNT) return null;
-  var n = 0;
-  for (var i = 0; i < IPV4_OCTET_COUNT; i++) {
-    var oct = parseInt(parts[i], 10);
-    if (!Number.isInteger(oct) || oct < 0 || oct >= IPV4_OCTET_RANGE) return null;
-    n = (n * IPV4_OCTET_RANGE) + oct;
+// public client IP every few requests as the device hops cells, so a strict
+// full-IP fingerprint logs out healthy mobile users. The "clientIpPrefix"
+// field hashes the /24 (IPv4) + /64 (IPv6) subnet bucket instead — drift
+// across the bucket is meaningfully suspicious, drift within is not. The
+// masking lives in requestHelpers.ipPrefix (the IP-utilities home, next to
+// clientIp / trustedClientIp); operators with stricter needs pass a
+// function-form fingerprint field and reuse requestHelpers.ipPrefix for a
+// custom mask width.
+
+// Resolve the per-call client-IP function for the clientIp / clientIpPrefix
+// fingerprint fields. With { trustedProxies } (an array/string of CIDRs) or a
+// custom { clientIpResolver }, the IP is peer-gated through
+// requestHelpers.trustedClientIp so a deployment behind a trusted proxy binds
+// the session to the real client and not the proxy address (which silently
+// defeats the IP component of the fingerprint). With neither, it falls back to
+// the bare-socket peer — the historical default, preserved so existing
+// fingerprints don't change and log users out. The SAME option must be passed
+// to create / verify / rotate (exactly like fingerprintFields) or the
+// fingerprint won't match across the session lifecycle. An invalid CIDR throws
+// at the call (config-time entry-point validation).
+function _clientIpResolver(opts) {
+  if (opts && (opts.trustedProxies != null || typeof opts.clientIpResolver === "function")) {
+    return requestHelpers.trustedClientIp({
+      trustedProxies:   opts.trustedProxies,
+      clientIpResolver: opts.clientIpResolver,
+    }).resolve;
   }
-  // Apply prefix mask.
-  var mask = prefix === 0 ? 0 : (-1 >>> (IPV4_TOTAL_BITS - prefix)) << (IPV4_TOTAL_BITS - prefix);
-  // Bitwise on 32-bit unsigned. JS coerces to 32-bit signed, so use
-  // unsigned right shift to recover.
-  var masked = (n & mask) >>> 0;
-  return ((masked >>> IP_BITS_PER_BYTE * 3) & BYTE_MASK) + "." +
-         ((masked >>> IP_BITS_PER_BYTE * 2) & BYTE_MASK) + "." +
-         ((masked >>> IP_BITS_PER_BYTE)     & BYTE_MASK) + "." +
-         (masked & BYTE_MASK) + "/" + prefix;
+  return requestHelpers.clientIp;
 }
 
-function _maskIpv6(ip, prefix) {
-  // Expand to 8 16-bit groups. Accept :: shorthand. Reject if invalid.
-  var raw = String(ip).toLowerCase();
-  // Strip an embedded zone id (fe80::1%eth0); not part of the address.
-  var pct = raw.indexOf("%");
-  if (pct !== -1) raw = raw.substring(0, pct);
-  var doubleColonAt = raw.indexOf("::");
-  var groups;
-  if (doubleColonAt === -1) {
-    groups = raw.split(":");
-    if (groups.length !== IPV6_GROUP_COUNT) return null;
-  } else {
-    var left = raw.substring(0, doubleColonAt).split(":");
-    var right = raw.substring(doubleColonAt + 2).split(":");
-    if (left.length === 1 && left[0] === "") left = [];
-    if (right.length === 1 && right[0] === "") right = [];
-    var fillCount = IPV6_GROUP_COUNT - left.length - right.length;
-    if (fillCount < 0) return null;
-    var middle = [];
-    for (var fi = 0; fi < fillCount; fi++) middle.push("0");
-    groups = left.concat(middle).concat(right);
-  }
-  // Each group is 1–4 hex chars.
-  var bytes = [];
-  for (var gi = 0; gi < IPV6_GROUP_COUNT; gi++) {
-    var g = groups[gi];
-    if (typeof g !== "string" || g.length === 0 || g.length > 4 || /[^0-9a-f]/.test(g)) return null;
-    var v = parseInt(g, HEX_RADIX);
-    if (!Number.isInteger(v) || v < 0 || v > 0xffff) return null;
-    bytes.push((v >> IP_BITS_PER_BYTE) & BYTE_MASK);
-    bytes.push(v & BYTE_MASK);
-  }
-  // Apply prefix in bits.
-  var keepBytes = Math.floor(prefix / IP_BITS_PER_BYTE);
-  var keepBits  = prefix % IP_BITS_PER_BYTE;
-  for (var bi = 0; bi < IPV6_BYTE_COUNT; bi++) {
-    if (bi < keepBytes) continue;
-    if (bi === keepBytes && keepBits > 0) {
-      var m = (BYTE_MASK << (IP_BITS_PER_BYTE - keepBits)) & BYTE_MASK;
-      bytes[bi] = bytes[bi] & m;
-    } else {
-      bytes[bi] = 0;
-    }
-  }
-  // Re-emit as colon-hex (no compression — deterministic for hashing).
-  var out = [];
-  for (var oi = 0; oi < IPV6_BYTE_COUNT; oi += 2) {
-    out.push(((bytes[oi] << IP_BITS_PER_BYTE) | bytes[oi + 1]).toString(HEX_RADIX));
-  }
-  return out.join(":") + "/" + prefix;
-}
-
-function _ipPrefix(ip) {
-  if (typeof ip !== "string" || ip.length === 0) return "";
-  // IPv4-mapped IPv6 (::ffff:1.2.3.4) — strip the wrapper so the v4
-  // mask applies. Same bucket regardless of how the proxy reported it.
-  var lower = ip.toLowerCase();
-  if (lower.indexOf(V4_MAPPED_V6_PREFIX) === 0 && lower.indexOf(".") !== -1) {
-    return _maskIpv4(lower.substring(V4_MAPPED_V6_PREFIX.length), IPV4_DEFAULT_PREFIX) || "";
-  }
-  if (ip.indexOf(":") !== -1) return _maskIpv6(ip, IPV6_DEFAULT_PREFIX) || "";
-  if (ip.indexOf(".") !== -1) return _maskIpv4(ip, IPV4_DEFAULT_PREFIX) || "";
-  return "";
-}
-
-function _buildFingerprintInputs(req, fields) {
+function _buildFingerprintInputs(req, fields, resolveIp) {
   if (!req) return null;
+  resolveIp = resolveIp || requestHelpers.clientIp;
   var headers = req.headers || {};
   var inputs = {};
   for (var i = 0; i < fields.length; i++) {
     var f = fields[i];
     if (f === "clientIp") {
-      inputs.clientIp = requestHelpers.clientIp(req) || "";
+      inputs.clientIp = resolveIp(req) || "";
     } else if (f === "clientIpPrefix") {
-      // /24 v4 + /64 v6 — see _ipPrefix() commentary.
-      inputs.clientIpPrefix = _ipPrefix(requestHelpers.clientIp(req) || "");
+      // /24 v4 + /64 v6 — see requestHelpers.ipPrefix commentary.
+      inputs.clientIpPrefix = requestHelpers.ipPrefix(resolveIp(req) || "");
     } else if (f === "userAgent") {
       inputs.userAgent = String(headers["user-agent"] || "");
     } else if (f === "acceptLanguage") {
@@ -482,7 +400,7 @@ async function create(opts) {
   var dataObj = opts.data ? Object.assign({}, opts.data) : null;
   var fpFields = Array.isArray(opts.fingerprintFields) && opts.fingerprintFields.length > 0
     ? opts.fingerprintFields : DEFAULT_FINGERPRINT_FIELDS;
-  var fpInputs = _buildFingerprintInputs(opts.req, fpFields);
+  var fpInputs = _buildFingerprintInputs(opts.req, fpFields, _clientIpResolver(opts));
   if (fpInputs) {
     if (!dataObj) dataObj = {};
     dataObj.__bj_fingerprint = _hashFingerprint(sid, fpInputs);
@@ -660,7 +578,7 @@ async function verify(token, verifyOpts) {
   if (storedFingerprint && verifyOpts.req) {
     var fpFields = Array.isArray(verifyOpts.fingerprintFields) && verifyOpts.fingerprintFields.length > 0
       ? verifyOpts.fingerprintFields : DEFAULT_FINGERPRINT_FIELDS;
-    var currentInputs = _buildFingerprintInputs(verifyOpts.req, fpFields);
+    var currentInputs = _buildFingerprintInputs(verifyOpts.req, fpFields, _clientIpResolver(verifyOpts));
     var currentHash = _hashFingerprint(sid, currentInputs);
     if (currentHash !== storedFingerprint) {
       fingerprintDrift = true;
@@ -843,8 +761,16 @@ async function destroyAllForUser(userId) {
   // userId is sealed; look up via derived userIdHash.
   var lookup = cryptoField.lookupHash(SESSION_TABLE, "userId", userId);
   if (!lookup) {
+    // The session table's userIdHash derived-hash schema is registered during
+    // b.db.init(). A pluggable-store consumer (b.session.useStore) who never
+    // called b.db.init() lands here first — surface that, not just an opaque
+    // "framework misconfigured", since destroyAllForUser still needs b.db for
+    // the userIdHash index + the stateless valid-from boundary.
     throw _err("MISCONFIGURED",
-      "the session table schema is missing the userIdHash derived hash — framework misconfigured",
+      "session.destroyAllForUser: the session table's userIdHash derived-hash schema is " +
+      "not registered. It is registered during b.db.init() — call b.db.init() at boot even " +
+      "when session data lives in a pluggable store (b.session.useStore). If b.db is already " +
+      "initialized, the session table schema is misconfigured.",
       true);
   }
   // Dual-read across the keyed-MAC flip: a pre-v0.15.0 session row carries
@@ -860,8 +786,24 @@ async function destroyAllForUser(userId) {
   var result = await _currentStore().execute(built.sql, built.params);
   // Also raise the stateless valid-from boundary so a "logout everywhere"
   // revokes the operator's stateless tokens (sealed cookies / JWTs checked via
-  // b.session.check) too, not only the store-backed rows just deleted.
-  await bump(userId);
+  // b.session.check) too, not only the store-backed rows just deleted. This
+  // bump writes to the FRAMEWORK db (clusterStorage); a pluggable-store consumer
+  // (b.session.useStore) who never ran b.db.init() would otherwise surface the
+  // opaque "db/not-initialized" here, after the store delete already succeeded.
+  // Rethrow it as a session-specific, actionable error.
+  try {
+    await bump(userId);
+  } catch (e) {
+    if (e && e.code === "db/not-initialized") {
+      throw _err("MISCONFIGURED",
+        "session.destroyAllForUser raises the stateless valid-from boundary (so a " +
+        "logout-everywhere also revokes sealed-cookie / JWT sessions), which requires " +
+        "b.db.init() — call it at boot even when session data lives in a pluggable " +
+        "store (b.session.useStore). The store-backed rows were already deleted; rerun " +
+        "after b.db.init() to also raise the stateless boundary.", true);
+    }
+    throw e;
+  }
   return result.rowCount || 0;
 }
 
@@ -1034,7 +976,7 @@ async function rotate(oldToken, opts) {
           "so the device binding can be re-keyed to the new session id", true);
       }
       if (!newDataObj) newDataObj = {};
-      newDataObj.__bj_fingerprint = _hashFingerprint(newSid, _buildFingerprintInputs(opts.req, fpFields));
+      newDataObj.__bj_fingerprint = _hashFingerprint(newSid, _buildFingerprintInputs(opts.req, fpFields, _clientIpResolver(opts)));
     }
 
     var dataJson = newDataObj ? JSON.stringify(newDataObj) : null;

package/lib/sql.js

@@ -439,7 +439,7 @@ class SqlFunction {
       throw _err("b.sql.fn(name): name must be a string", "sql-builder/bad-fn");
     }
     var key = name.toUpperCase();
-    if (SQL_FUNCTIONS[key] === undefined) {
+    if (!Object.prototype.hasOwnProperty.call(SQL_FUNCTIONS, key)) {
       throw _err("b.sql.fn(name): '" + name + "' is not an allowlisted SQL function " +
         "(NOW / CURRENT_TIMESTAMP / CURRENT_DATE / CURRENT_TIME); a bound value uses a ? " +
         "placeholder, an arbitrary expression uses a guarded raw fragment", "sql-builder/bad-fn");
@@ -513,7 +513,7 @@ function _castType(type, dialect) {
     throw _err("cast type must be a non-empty string", "sql-builder/bad-cast");
   }
   var key = type.toLowerCase();
-  if (CAST_TYPES[key] === undefined) {
+  if (!Object.prototype.hasOwnProperty.call(CAST_TYPES, key)) {
     throw _err("cast type '" + type + "' is not on the allowlist (jsonb / json / " +
       "interval / uuid / text / int / bigint / timestamptz / boolean)", "sql-builder/bad-cast");
   }
@@ -798,6 +798,17 @@ class Predicate {
       return this._add(joiner, qc + " " + op + " NULL", []);
     }
 
+    // `col = NULL` / `col != NULL` is UNKNOWN in SQL — never true. Emitting it
+    // (e.g. from where({ col: null })) silently matches zero rows; worse, a null
+    // accidentally passed where a real value was expected (where({ ownerId }))
+    // would, if rewritten to `IS NULL`, return orphan rows — an authorization
+    // footgun. Refuse it and direct the caller to the explicit NULL predicates.
+    if (value === null && (op === "=" || op === "!=" || op === "<>")) {
+      throw _err("where(" + JSON.stringify(col) + ", '" + op + "', null) is never true in SQL " +
+        "(col " + op + " NULL is UNKNOWN); use whereNull(col) / whereNotNull(col) to test for NULL",
+        "sql-builder/null-equality");
+    }
+
     if ((op === "LIKE" || op === "NOT LIKE") && typeof value === "string") {
       return this._add(joiner, qc + " " + op + " ? ESCAPE '~'", [_escapeLike(value)]);
     }
@@ -948,6 +959,17 @@ class Predicate {
     if (!Array.isArray(values) || values.length === 0) {
       throw _err("whereInArray requires a non-empty array of values", "sql-builder/empty-in");
     }
+    // Validate each element is a bindable parameter. On the non-Postgres IN-list
+    // path every element is its own `?`, so the driver rejects an undefined at
+    // execute; the Postgres `= ANY(?)` path binds the WHOLE array as one param,
+    // where an undefined is silently coerced to NULL — diverging per dialect.
+    // Reject undefined here so every backend fails the same way, at build.
+    for (var vi = 0; vi < values.length; vi += 1) {
+      if (values[vi] === undefined) {
+        throw _err("whereInArray value[" + vi + "] is undefined (not a bindable parameter)",
+          "sql-builder/bad-in-value");
+      }
+    }
     this._gate(col);
     var qc = _qualifiedColumn(col, this._dialect());
     if (this._dialect() === "postgres") {
@@ -3519,7 +3541,7 @@ var catalog = Object.freeze({
  *   b.sql.pragma("journal_mode").sql;             // -> 'PRAGMA journal_mode'  (read)
  */
 function pragma(verb, arg) {
-  if (typeof verb !== "string" || CATALOG_PRAGMA_VERBS[verb] === undefined) {
+  if (typeof verb !== "string" || !Object.prototype.hasOwnProperty.call(CATALOG_PRAGMA_VERBS, verb)) {
     throw _err("pragma: verb '" + verb + "' is not on the allowlist (journal_mode / " +
       "synchronous / wal_checkpoint); a PRAGMA outside this set is refused by design",
       "sql-builder/bad-pragma");

package/lib/static.js

@@ -42,6 +42,7 @@ var nodeFs = require("node:fs");
 var fsp = require("node:fs/promises");
 var nodeCrypto = require("node:crypto");
 var nodePath = require("node:path");
+var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var gateContract = require("./gate-contract");
 var lazyRequire = require("./lazy-require");
@@ -240,10 +241,16 @@ async function _readMeta(root, candidate) {
   var sri = nodeCrypto.createHash("sha384");
   var sha3 = nodeCrypto.createHash("sha3-512");
   await new Promise(function (resolve, reject) {
-    // The path handed to createReadStream is the confined output of
-    // `_assertInsideRoot(root, candidate)` above (lexical resolve +
-    // root-prefix containment), not the request-derived candidate.
-    var s = nodeFs.createReadStream(absPath);
+    // The path is the confined output of `_assertInsideRoot(root, candidate)`
+    // above (lexical resolve + root-prefix containment). Open it O_NOFOLLOW and
+    // stream from that fd: lexical confinement still leaves a window where a
+    // symlink swapped in at the final component after the check would be
+    // followed by a plain createReadStream (CWE-22 / CWE-367); O_NOFOLLOW refuses
+    // it. The open throws synchronously on a symlink (ELOOP) / missing file —
+    // reject the hash promise so the caller falls back exactly as on a read error.
+    var s;
+    try { s = nodeFs.createReadStream(absPath, { fd: atomicFile.openNoFollowSync(absPath) }); }
+    catch (e) { reject(e); return; }
     s.on("data", function (chunk) { sri.update(chunk); sha3.update(chunk); });
     s.on("end", resolve);
     s.on("error", reject);
@@ -399,7 +406,7 @@ function _shouldForceAttachment(contentType, ext, contentSafetyMap, allowSvgRend
     return true;
   }
   if (bare.indexOf("text/") === 0) return false;
-  if (SAFE_RENDER_RASTER_MIMES[bare]) return false;
+  if (Object.prototype.hasOwnProperty.call(SAFE_RENDER_RASTER_MIMES, bare)) return false;
   if (bare === "image/svg+xml") {
     if (!allowSvgRender) return true;
     if (!contentSafetyMap || typeof contentSafetyMap !== "object") return true;
@@ -884,10 +891,21 @@ function create(opts) {
     // `_assertInsideRoot`, not the request-derived candidate.
     var confined = _assertInsideRoot(root, absPath);
     if (!confined) return { ok: false, reason: "read-failed" };
+    // Only the first 64 KiB is ever inspected, so read JUST that prefix from an
+    // O_NOFOLLOW fd: the previous fsp.readFile slurped the WHOLE file into memory
+    // just to sniff its header — a request-reachable OOM on a user-content mount
+    // — and followed a post-confinement symlink swap. A PREFIX read (not a
+    // maxBytes refusal) is required so a large but allowed file still serves.
     var sample;
-    try { sample = await fsp.readFile(confined, { flag: "r" }); }
-    catch (_e) { return { ok: false, reason: "read-failed" }; }
-    var detected = fileType.detect(sample.slice(0, C.BYTES.kib(64))) || {};
+    try {
+      var sniffFd = atomicFile.openNoFollowSync(confined);
+      try {
+        var sniffBuf = Buffer.alloc(C.BYTES.kib(64));
+        var sniffN = nodeFs.readSync(sniffFd, sniffBuf, 0, sniffBuf.length, 0);
+        sample = sniffBuf.slice(0, sniffN);
+      } finally { nodeFs.closeSync(sniffFd); }
+    } catch (_e) { return { ok: false, reason: "read-failed" }; }
+    var detected = fileType.detect(sample) || {};
     if (!detected.mime) return { ok: false, reason: "indeterminate" };
     if (allowedFileTypes.indexOf(detected.mime) === -1) {
       return { ok: false, reason: "not-allowed", detected: detected.mime };
@@ -1051,6 +1069,23 @@ function create(opts) {
           // creation can ever ride this code path.
           gateHandle = await fsp.open(gateConfined, gateOpenFlags, 0o600);
           var gateStat = await gateHandle.stat();
+          // Cap before Buffer.alloc(gateStat.size): the gate buffers the WHOLE
+          // file to inspect it, so a multi-GiB file on a user-content mount is a
+          // request-reachable OOM lever. A file too large for the gate to vet is
+          // refused (the gate's own "refuse" disposition) rather than buffered.
+          if (gateStat.size > C.BYTES.mib(16)) {
+            stats.failures += 1;
+            _emitObs("staticServe.content_safety_refused", 1, { route: urlPath });
+            try { await gateHandle.close(); } catch (_ce) { /* close best-effort */ }
+            if (auditFailures) {
+              emitAudit("staticServe.serve.failure", Object.assign({
+                outcome: "failure", reason: "content_safety_too_large",
+                resource: urlPath, ext: ext, sizeBytes: gateStat.size,
+              }, actorCtx));
+            }
+            return writeErr(res, HTTP.UNSUPPORTED_MEDIA_TYPE,
+              "content_safety_refused", "Unsupported Media Type");
+          }
           gateBuf = Buffer.alloc(gateStat.size);
           var gateRead = 0;
           while (gateRead < gateStat.size) {
@@ -1135,8 +1170,11 @@ function create(opts) {
         "precondition_failed", "Precondition Failed");
     }
 
-    // Conditional: If-Modified-Since (304)
-    var ifModSince = headersIn["if-modified-since"];
+    // Conditional: If-Modified-Since (304) — RFC 7232 §6: evaluated ONLY when
+    // If-None-Match is absent. Otherwise a changed-ETag resource rewritten
+    // within the same wall-clock second (mtime compared at second granularity)
+    // would be falsely reported 304 despite the content hash differing.
+    var ifModSince = !ifNone && headersIn["if-modified-since"];
     if (ifModSince) {
       var ims = Date.parse(ifModSince);
       if (isFinite(ims) && Math.floor(meta.mtimeMs / C.TIME.seconds(1)) <= Math.floor(ims / C.TIME.seconds(1))) {
@@ -1151,8 +1189,9 @@ function create(opts) {
       }
     }
 
-    // Conditional: If-Unmodified-Since (412)
-    var ifUnmodSince = headersIn["if-unmodified-since"];
+    // Conditional: If-Unmodified-Since (412) — RFC 7232 §6: evaluated ONLY
+    // when If-Match is absent.
+    var ifUnmodSince = !ifMatch && headersIn["if-unmodified-since"];
     if (ifUnmodSince) {
       var ius = Date.parse(ifUnmodSince);
       if (isFinite(ius) && Math.floor(meta.mtimeMs / C.TIME.seconds(1)) > Math.floor(ius / C.TIME.seconds(1))) {
@@ -1348,7 +1387,20 @@ function create(opts) {
     }
 
     var streamOpts = range ? { start: range.start, end: range.end } : {};
-    var fileStream = nodeFs.createReadStream(streamTarget, streamOpts);
+    // Open streamTarget (the re-confined _assertInsideRoot output) O_NOFOLLOW and
+    // stream from that fd, so a symlink swapped in at the final component after
+    // confinement is refused (ELOOP) rather than followed (CWE-22 / CWE-367).
+    // Headers are already committed here, so a sync refusal can't re-issue a 404
+    // — abort the connection instead of serving the swapped target.
+    var fileStream;
+    try {
+      fileStream = nodeFs.createReadStream(streamTarget,
+        Object.assign({ fd: atomicFile.openNoFollowSync(streamTarget) }, streamOpts));
+    } catch (_openErr) {
+      releaseSlot();
+      try { res.destroy(); } catch (_d) { /* already torn down */ }
+      return;
+    }
 
     // Idle timeout — close the connection if the client stalls. Pattern is
     // a deadline-style debounce (clearTimeout + setTimeout) tied directly

package/lib/template.js

@@ -93,6 +93,7 @@ var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
+var markupEscape = require("./markup-escape").markupEscape;
 
 // Lazy because b.template can be loaded before b.sandbox (which pulls
 // in node:worker_threads). Operators not opting into sandboxed helpers
@@ -116,9 +117,6 @@ var DEFAULT_STRING_TEMPLATE_BYTES = require("./constants").BYTES.kib(256);
 // HTML escape (exported)
 // ============================================================
 
-var ESCAPE_MAP = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#x27;" };
-var ESCAPE_RE = /[&<>"']/g;
-
 /**
  * @primitive b.template.escapeHtml
  * @signature b.template.escapeHtml(value)
@@ -141,8 +139,12 @@ var ESCAPE_RE = /[&<>"']/g;
  */
 function escapeHtml(value) {
   if (value === null || value === undefined) return "";
-  var s = typeof value === "string" ? value : String(value);
-  return s.replace(ESCAPE_RE, function (c) { return ESCAPE_MAP[c]; });
+  // Delegate the actual escaping to the centralized markup escaper so the
+  // five-character HTML set (& < > " ') is defined in one place — a divergence
+  // between this and the shared escaper is an XSS / XML-injection surface. The
+  // apostrophe is escaped to its numeric form for safety in single-quoted
+  // attribute contexts (the historical behavior of this primitive).
+  return markupEscape(value, { apos: "&#x27;" });
 }
 
 // ============================================================

package/lib/tenant-quota.js

@@ -52,6 +52,7 @@
 
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
+var boundedMap = require("./bounded-map");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -354,18 +355,47 @@ function budget(opts) {
   }
   var auditOn = opts.audit !== false;
 
-  // tenantId → { windowStart, calls, rowsRead }
+  // TRUE sliding window (RFC-ish rolling counter, as advertised) — the prior
+  // first-call-pinned fixed window admitted ~2x the cap in a boundary burst.
+  // The window is split into BINS sub-bins; each observe lands in the current
+  // bin and the cap is enforced against the trailing-window SUM, so a burst
+  // straddling the reset can't double the rate. Mirrors network-byte-quota's
+  // _slideAndSum ring (here with two counters + a configurable bin width).
+  var BINS = 12;
+  var binMs = Math.max(1, Math.floor(windowMs / BINS));
+
+  // tenantId → { calls: number[BINS], rows: number[BINS], startBin }
   var counters = new Map();
 
-  function _slot(tenantId, now) {
-    var c = counters.get(tenantId);
-    if (!c || (now - c.windowStart) >= windowMs) {
-      c = { windowStart: now, calls: 0, rowsRead: 0 };
-      counters.set(tenantId, c);
+  // Advance the ring so its BINS bins cover the trailing [nowBin-BINS+1 .. nowBin],
+  // zeroing bins that scrolled out of the window. Returns the tenant's ring.
+  function _slide(tenantId, now) {
+    var nowBin = Math.floor(now / binMs);
+    // A freshly-created ring is anchored at the current bin, so the advance
+    // below evaluates to 0 (no-op) on the create path — get-or-insert and the
+    // slide stay one code path.
+    var c = boundedMap.getOrInsert(counters, tenantId, function () {
+      return { calls: new Array(BINS).fill(0), rows: new Array(BINS).fill(0), startBin: nowBin - (BINS - 1) };
+    });
+    var advance = nowBin - (c.startBin + (BINS - 1));
+    if (advance > 0) {
+      if (advance >= BINS) {
+        c.calls.fill(0); c.rows.fill(0);
+      } else {
+        for (var i = 0; i < BINS - advance; i++) { c.calls[i] = c.calls[i + advance]; c.rows[i] = c.rows[i + advance]; }
+        for (var k = BINS - advance; k < BINS; k++) { c.calls[k] = 0; c.rows[k] = 0; }
+      }
+      c.startBin = nowBin - (BINS - 1);
     }
     return c;
   }
 
+  function _sum(c) {
+    var calls = 0, rows = 0;
+    for (var i = 0; i < BINS; i++) { calls += c.calls[i]; rows += c.rows[i]; }
+    return { calls: calls, rowsRead: rows };
+  }
+
   var _emitAudit = audit().namespaced(null, { audit: auditOn });
 
   function _emitMetric(name, n) {
@@ -378,16 +408,19 @@ function budget(opts) {
       "tenantQuota.budget.observe: tenantId", TenantQuotaError, "tenant-quota/bad-tenant");
     info = info || {};
     var rowsRead = (typeof info.rowsRead === "number" && info.rowsRead >= 0) ? info.rowsRead : 0;
-    var now = Date.now();
-    var c = _slot(tenantId, now);
-    c.calls += 1;
-    c.rowsRead += rowsRead;
+    // info.now lets a caller / test supply a deterministic clock (idiomatic —
+    // mirrors auth verifiers' opts.now); defaults to wall-clock.
+    var now = (typeof info.now === "number") ? info.now : Date.now();
+    var c = _slide(tenantId, now);
+    c.calls[BINS - 1] += 1;
+    c.rows[BINS - 1] += rowsRead;
+    var tot = _sum(c);
     var maxCalls = Math.max(1, Math.floor(qpsCap * (windowMs / C.TIME.seconds(1))));
-    if (c.calls > maxCalls || c.rowsRead > rowsCap) {
+    if (tot.calls > maxCalls || tot.rowsRead > rowsCap) {
       _emitAudit("tenant.budget.exceeded", "denied", {
         tenantId: tenantId,
-        calls:    c.calls,
-        rowsRead: c.rowsRead,
+        calls:    tot.calls,
+        rowsRead: tot.rowsRead,
         qpsCap:   qpsCap,
         rowsCap:  rowsCap,
         windowMs: windowMs,
@@ -395,19 +428,19 @@ function budget(opts) {
       _emitMetric("tenant.budget.exceeded", 1);
       throw new TenantQuotaError("tenant-quota/budget-exceeded",
         "tenantQuota.budget: tenant '" + tenantId + "' exceeded budget " +
-        "(calls=" + c.calls + "/" + maxCalls + ", rowsRead=" + c.rowsRead +
+        "(calls=" + tot.calls + "/" + maxCalls + ", rowsRead=" + tot.rowsRead +
         "/" + rowsCap + ", windowMs=" + windowMs + ")");
     }
-    return { calls: c.calls, rowsRead: c.rowsRead, windowMs: windowMs };
+    return { calls: tot.calls, rowsRead: tot.rowsRead, windowMs: windowMs };
   }
 
   function snapshot(tenantId) {
-    var now = Date.now();
-    var c = counters.get(tenantId);
-    if (!c || (now - c.windowStart) >= windowMs) {
+    if (!counters.has(tenantId)) {
       return { tenantId: tenantId, calls: 0, rowsRead: 0, windowMs: windowMs };
     }
-    return { tenantId: tenantId, calls: c.calls, rowsRead: c.rowsRead, windowMs: windowMs };
+    var c = _slide(tenantId, Date.now());
+    var tot = _sum(c);
+    return { tenantId: tenantId, calls: tot.calls, rowsRead: tot.rowsRead, windowMs: windowMs };
   }
 
   function reset(tenantId) {

package/lib/tsa.js

@@ -56,6 +56,7 @@ var bCrypto = require("./crypto");
 var safeBuffer = require("./safe-buffer");
 var asn1 = require("./asn1-der");
 var cms = require("./cms-codec");
+var x509Chain = require("./x509-chain");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -539,8 +540,10 @@ function _verifyChain(signerCertDer, tokenCerts, trustAnchorsPem, at) {
   throw new TsaError("tsa/chain-loop", "tsa.verifyToken: certificate chain did not terminate");
 }
 function _issued(issuer, subject) {
-  try { return subject.checkIssued(issuer) && subject.verify(issuer.publicKey); }
-  catch (_e) { return false; }
+  // Enforces basicConstraints cA:TRUE on the issuer in addition to the
+  // checkIssued + signature linkage — a non-CA cert can never be a chain
+  // issuer (basicConstraints bypass, CVE-2002-0862 class).
+  return x509Chain.issuerValidlyIssued(issuer, subject);
 }
 function _assertValidAt(cert, atMs) {
   if (atMs < cert.validFromDate.getTime() || atMs > cert.validToDate.getTime()) {

package/lib/vault/index.js

@@ -681,6 +681,11 @@ module.exports = {
   init:                  init,
   seal:                  seal,
   unseal:                unseal,
+  // The default sealed-storage Store: a { seal, unseal } pair backed by the
+  // in-process vault key. b.cert.create (and other sealed-disk consumers)
+  // resolve `opts.vault || getDefaultStore()`; documented in their @opts.
+  getDefaultStore:       function () { return { seal: seal, unseal: unseal }; },
+  Store:                 { seal: seal, unseal: unseal },
   getDerivedHashSalt:    getDerivedHashSalt,
   getDerivedHashMacKey:  getDerivedHashMacKey,
   _zeroizeAndReplace:    _zeroizeAndReplace,