@blamejs/core 0.15.13 → 0.15.15

package/lib/crypto-field.js

@@ -62,7 +62,6 @@ var vaultAad = require("./vault-aad");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
 var safeJson = require("./safe-json");
-var frameworkSchema = require("./framework-schema");
 var sql = require("./sql");
 var { defineClass } = require("./framework-error");
 var { sha3Hash, kdf, generateBytes, encryptPacked, decryptPacked, generateToken } = require("./crypto");
@@ -226,14 +225,19 @@ var PER_ROW_KEYS_TABLE = "_blamejs_per_row_keys";   // allow:hand-rolled-sql
 var PER_ROW_KEYS_COLUMN = "wrappedKey";
 var PER_ROW_KEYS_SCHEMA_VERSION = "1";
 
-// The per-row-key registry is read/written against the LOCAL db() / dbHandle
-// handle directly (not clusterStorage), so SQL composed for it uses the
-// RESOLVED name (prefix-aware via frameworkSchema.tableName) and quoteName so
-// b.sql emits the quoted identifier the single-node path expects — the same
-// shape db-query.js's _sqlOpts and db.js's own local-handle b.sql calls use.
+// The per-row-key registry ALWAYS lives in the LOCAL sqlite — reconcile creates
+// it under its RAW schema name, and per-row keys are never dispatched to an
+// external backend (see _kRowOnce's db() fallback). It is read/written against
+// the local db() / dbHandle directly, NOT through clusterStorage, so it must use
+// the RAW table name. frameworkSchema.tableName() resolves to the cluster-mode
+// EXTERNAL prefixed name (the prefix applies only to the external backend, via
+// resolveTables — local DDL stays raw); under a custom tablePrefix that names a
+// table that does not exist locally, which SILENTLY breaks crypto-shred:
+// destroyPerRowKey deletes 0 rows and sealed cells stay decryptable after
+// eraseHard. quoteName so b.sql emits the quoted identifier the local path expects.
 var _PER_ROW_SQL_OPTS = { dialect: "sqlite", quoteName: true };
 function _perRowKeysTableName() {
-  return frameworkSchema.tableName(PER_ROW_KEYS_TABLE);
+  return PER_ROW_KEYS_TABLE;
 }
 
 // Build the canonical AAD parts for a row-secret wrap in
@@ -1271,19 +1275,19 @@ function unsealRow(table, row, actor, dbHandle) {
           unsealed = out[field];
         }
       } catch (e) {
-        // A DB-write attacker who can write `vault:<crafted>` /
-        // `vault.aad:<crafted>` payloads to sealed columns can force
-        // KEM decapsulation / AEAD verify on attacker-controlled
-        // bytes via this read path. Surface the failure as a chain
-        // row so operators alert on burst patterns; null the field
-        // so downstream code sees "no value" instead of crashing the
-        // request. AAD-shape failures additionally indicate cross-
-        // row copy attempts — the audit metadata flags the shape so
-        // operators can write alert rules.
+        // A crypto-shredded (or never-materialized) per-row key is an EXPECTED
+        // absence, not a decryption-oracle attack: the wrapped secret is gone,
+        // so there is no oracle to brute-force. Reading such a row must read as
+        // "no value" WITHOUT counting against the rate cap — otherwise a bulk
+        // read over a table with many erased rows (GDPR eraseHard) trips the
+        // cap and DoS's the live rows (self-DoS, CWE-307 mis-applied). It is
+        // audited under a distinct, non-failure action so operators don't alert
+        // on routine post-erasure reads as forged-ciphertext bursts.
+        var _shredded = e && e.code === "crypto-field/row-key-unavailable";
         try {
           audit().safeEmit({
-            action:   "system.crypto.unseal_failed",
-            outcome:  "failure",
+            action:   _shredded ? "system.crypto.shredded_read" : "system.crypto.unseal_failed",
+            outcome:  _shredded ? "success" : "failure",
             metadata: {
               table:   table,
               field:   field,
@@ -1293,11 +1297,13 @@ function unsealRow(table, row, actor, dbHandle) {
             },
           });
         } catch (_e) { /* drop-silent */ }
-        // Default-on rate cap: account this failure against the (actor,
-        // table, column) tuple. When it trips the threshold, arm the
-        // cooldown + emit the distinct rate-exceeded audit once on the
-        // transition. No-op when the cap is disabled.
-        if (_rateNoteFailure(capActor, table, field)) {
+        // Default-on rate cap: account a genuine decryption / AEAD-verify /
+        // AAD-downgrade failure (a possible forged-ciphertext attack) against
+        // the (actor, table, column) tuple. A shredded-key read is exempt (see
+        // above). When the cap trips the threshold, arm the cooldown + emit the
+        // distinct rate-exceeded audit once on the transition. No-op when the
+        // cap is disabled.
+        if (!_shredded && _rateNoteFailure(capActor, table, field)) {
           _emitRateAudit({
             table: table, field: field, actor: capActor, shape: shape,
             threshold: _rateCap.threshold, windowMs: _rateCap.windowMs, cooldownMs: _rateCap.cooldownMs,
@@ -1741,9 +1747,27 @@ function assertColumnResidency(table, row, args) {
   var entry = columnResidency[table];
   if (!entry || !row || !args) return null;
   var backendTag = args.backendTag || "unrestricted";
+  // SQL unquoted identifiers are case-insensitive; a raw-SQL-parsed row keeps
+  // the column token's case, so resolve each mapped column case-insensitively
+  // (a case-sensitive `row[col]` let a differently-cased column skip the gate —
+  // CWE-178). Lazily index the row's keys by lowercase; exact match wins first.
+  var rowLcIndex = null;
+  function _rowVal(c) {
+    if (Object.prototype.hasOwnProperty.call(row, c)) return row[c];
+    if (rowLcIndex === null) {
+      rowLcIndex = {};
+      var ks = Object.keys(row);
+      for (var i = 0; i < ks.length; i++) {
+        var lk = ks[i].toLowerCase();
+        if (!Object.prototype.hasOwnProperty.call(rowLcIndex, lk)) rowLcIndex[lk] = row[ks[i]];
+      }
+    }
+    return rowLcIndex[String(c).toLowerCase()];
+  }
   for (var col in entry) {
     var want = entry[col];
-    if (row[col] === undefined || row[col] === null) continue;
+    var cellVal = _rowVal(col);
+    if (cellVal === undefined || cellVal === null) continue;
     if (want === "global" || want === "unrestricted") continue;
     if (backendTag === "unrestricted") continue;
     if (backendTag !== want) {

package/lib/crypto.js

@@ -963,7 +963,7 @@ var SRI_ALGORITHMS = { "sha256": "sha256", "sha384": "sha384", "sha512": "sha512
 function sri(content, opts) {
   opts = opts || {};
   var algorithm = (opts.algorithm || "sha384").toLowerCase();
-  if (!SRI_ALGORITHMS[algorithm]) {
+  if (!Object.prototype.hasOwnProperty.call(SRI_ALGORITHMS, algorithm)) {
     throw new Error("crypto.sri: unsupported algorithm '" + algorithm +
       "' (W3C SRI 1.0 §3.2 supports sha256/sha384/sha512)");
   }
@@ -1356,7 +1356,21 @@ function decrypt(ciphertext, privateKeys, opts) {
     opts && opts.raw === true ? { raw: true } : undefined);
 }
 
+// Bounds-checked 2-byte length read — a bare _envU16(packed, pos) on a
+// truncated envelope throws a raw Node RangeError that escapes the documented
+// "Invalid envelope: ..." error contract (untrusted ciphertext must fail with
+// the typed envelope error, not a stack-trace-leaking RangeError).
+function _envU16(buf, at) {
+  if (at + 2 > buf.length) {
+    throw new Error("Invalid envelope: truncated (expected a 2-byte length at offset " + at + ")");
+  }
+  return buf.readUInt16BE(at);
+}
+
 function decryptEnvelope(packed, privateKeys, internalOpts) {
+  if (!Buffer.isBuffer(packed) || packed.length < 4) {
+    throw new Error("Invalid envelope: too short (need at least the 4-byte suite header)");
+  }
   var kemId = packed[1], cipherId = packed[2], kdfId = packed[3], pos = 4;
 
   // The legacy 0xE1 envelope predates the FixedInfo / suite-binding
@@ -1372,7 +1386,7 @@ function decryptEnvelope(packed, privateKeys, internalOpts) {
     throw new Error("Invalid envelope: unsupported KDF (only SHAKE256 supported)");
   }
 
-  var kemCtLen = packed.readUInt16BE(pos); pos += 2;
+  var kemCtLen = _envU16(packed, pos); pos += 2;
   var kemCt = packed.subarray(pos, pos + kemCtLen); pos += kemCtLen;
 
   var mlkemPriv = nodeCrypto.createPrivateKey(
@@ -1383,7 +1397,7 @@ function decryptEnvelope(packed, privateKeys, internalOpts) {
   var fixedInfo = omitFixedInfo ? Buffer.alloc(0) : _suiteFixedInfo(kemId, cipherId, kdfId);
 
   if (kemId === C.KEM_IDS.ML_KEM_1024_P384) {
-    var ecEphLen = packed.readUInt16BE(pos); pos += 2;
+    var ecEphLen = _envU16(packed, pos); pos += 2;
     var ecEphDer = packed.subarray(pos, pos + ecEphLen); pos += ecEphLen;
     var ecPrivPem = typeof privateKeys === "string" ? null : privateKeys.ecPrivateKey;
     if (!ecPrivPem) throw new Error("Hybrid KEM requires EC private key");
@@ -1400,7 +1414,7 @@ function decryptEnvelope(packed, privateKeys, internalOpts) {
     // the correct keypair via privateKeys when the envelope was sealed
     // with this algorithm. Same length-prefixed shape as the P-384
     // hybrid: 2-byte ec-eph-len + DER X25519 pubkey + nonce + ct.
-    var x25519EphLen = packed.readUInt16BE(pos); pos += 2;
+    var x25519EphLen = _envU16(packed, pos); pos += 2;
     var x25519EphDer = packed.subarray(pos, pos + x25519EphLen); pos += x25519EphLen;
     var x25519PrivPem = typeof privateKeys === "string" ? null : privateKeys.x25519PrivateKey;
     if (!x25519PrivPem) throw new Error("ML-KEM-768 + X25519 hybrid envelope requires x25519PrivateKey");

package/lib/csp.js

@@ -210,6 +210,15 @@ function build(directives, opts) {
         throw new CspError("csp/header-injection",
           "csp.build: source '" + src + "' contains CR/LF/NUL");
       }
+      // A CSP source-expression is a single non-whitespace token. The emitter
+      // space-joins sources within a directive and ';'-joins directives, so a
+      // source containing ';' or ASCII whitespace would inject a brand-new live
+      // directive (e.g. "https://x; script-src https://evil") — refuse both.
+      if (/[\s;]/.test(src)) {
+        throw new CspError("csp/bad-source",
+          "csp.build: source '" + src + "' contains whitespace or ';' — a CSP source " +
+          "must be a single token (directive-injection defense)");
+      }
       if (!acknowledgeUnsafe && SCRIPT_DIRECTIVES.indexOf(name) !== -1 &&
           UNSAFE_KEYWORDS.indexOf(src) !== -1) {
         throw new CspError("csp/unsafe-keyword",
@@ -416,6 +425,10 @@ function mergeDirectives(base, additions, opts) {
       ? directives[name].slice()
       : (directives["default-src"] ? directives["default-src"].slice() : ["'self'"]);
     var added = additions[name];
+    // A directive value of 'none' MUST stand alone (CSP3 §2.3.1) — appending a
+    // host to it emits the malformed "'none' https://x". When merging real
+    // sources in, the added sources supersede 'none', so drop it first.
+    if (added.length && existing.length === 1 && existing[0] === "'none'") existing = [];
     for (var si = 0; si < added.length; si += 1) {
       if (existing.indexOf(added[si]) === -1) existing.push(added[si]);
     }

package/lib/daemon.js

@@ -73,7 +73,10 @@ function _isLivePid(pid) {
 
 function _readPidFile(pidFile) {
   try {
-    var raw = nodeFs.readFileSync(pidFile, "utf8");
+    // Same fd-safe + capped + symlink-refusing read as app-shutdown's lockfile
+    // reader (one shape): a PID file is never a legit symlink mount, so
+    // refuseSymlink is safe; any throw → null ("nothing live there").
+    var raw = atomicFile.fdSafeReadSync(pidFile, { maxBytes: C.BYTES.kib(1), refuseSymlink: true, encoding: "utf8" });
     var pid = parseInt(String(raw).trim(), 10);
     return isFinite(pid) && pid > 0 ? pid : null;
   } catch (_e) { return null; }

package/lib/data-act.js

@@ -89,6 +89,32 @@ var DESIGNATED_GATEKEEPERS = Object.freeze([
   "booking",
 ]);
 
+// Is `recipient` a designated DMA gatekeeper? Match the gatekeeper token as a
+// DNS LABEL of the recipient's host authority — any position, including the
+// FINAL label. A substring `indexOf(g + ".")` test missed a gatekeeper that is
+// the last label (e.g. "blog.google" / "drive.google" on the real ".google"
+// TLD, or "data.amazon"), letting an Art 32 §1 third-party share through — and
+// also false-flagged a non-gatekeeper whose name merely contained the token
+// ("notgoogle.com"). Label matching closes the bypass and drops the false
+// positive. A bare name ("Google") still matches exactly. URL / userinfo / port
+// forms are normalized to the host authority first.
+function _isGatekeeperRecipient(recipient) {
+  var s = String(recipient).toLowerCase().trim();
+  var scheme = s.indexOf("://");
+  if (scheme !== -1) s = s.slice(scheme + 3);
+  s = s.split("/")[0].split("?")[0].split("#")[0];   // drop path / query / fragment
+  var at = s.lastIndexOf("@");
+  if (at !== -1) s = s.slice(at + 1);                 // drop userinfo
+  s = s.split(":")[0];                                // drop port
+  if (s.length === 0) return false;
+  var labels = s.split(".");
+  return DESIGNATED_GATEKEEPERS.some(function (g) {
+    if (s === g) return true;
+    for (var i = 0; i < labels.length; i++) { if (labels[i] === g) return true; }
+    return false;
+  });
+}
+
 /**
  * @primitive b.dataAct.declareProduct
  * @signature b.dataAct.declareProduct(opts)
@@ -229,10 +255,7 @@ function shareWithThirdParty(opts) {
     acceptGatekeeper: "optional-plain-object",
   }, "dataAct.shareWithThirdParty", DataActError, "dataact/bad-opts");
 
-  var recipientLower = opts.recipient.toLowerCase();
-  var isGatekeeper = DESIGNATED_GATEKEEPERS.some(function (g) {
-    return recipientLower === g || recipientLower.indexOf(g + ".") !== -1;
-  });
+  var isGatekeeper = _isGatekeeperRecipient(opts.recipient);
   if (isGatekeeper) {
     if (!opts.acceptGatekeeper || typeof opts.acceptGatekeeper !== "object" ||
         typeof opts.acceptGatekeeper.reason !== "string" ||

package/lib/db-file-lifecycle.js

@@ -172,8 +172,11 @@ function fileLifecycle(opts) {
     : nodePath.join(opts.dataDir, frameworkFiles.fileName("dbKeyEnc"));
   var flushIntervalMs = opts.flushIntervalMs || DEFAULT_FLUSH_INTERVAL_MS;
   var tmpDir = _resolveTmpDir(opts.tmpDir, opts.allowDiskFallback === true);
-  if (!nodeFs.existsSync(tmpDir)) nodeFs.mkdirSync(tmpDir, { recursive: true });
-  if (!nodeFs.existsSync(opts.dataDir)) nodeFs.mkdirSync(opts.dataDir, { recursive: true });
+  // 0o700 — these hold the DB encryption tmpfs scratch + the data dir
+  // (db.key.enc, the decrypted DB while open); a default-mode mkdir leaves
+  // them group/other-traversable.
+  if (!nodeFs.existsSync(tmpDir)) nodeFs.mkdirSync(tmpDir, { recursive: true, mode: 0o700 });
+  if (!nodeFs.existsSync(opts.dataDir)) nodeFs.mkdirSync(opts.dataDir, { recursive: true, mode: 0o700 });
 
   var dbPath = null;
   var encKey = null;
@@ -183,7 +186,9 @@ function fileLifecycle(opts) {
   function _loadOrGenerateKey() {
     if (encKey) return encKey;
     if (nodeFs.existsSync(keyPath)) {
-      var sealedKey = nodeFs.readFileSync(keyPath, "utf8");
+      // Cap + fd-bound. NO refuseSymlink: dbKeyPath may be an operator-absolute
+      // KMS-fronted volume that legitimately symlinks the sealed key.
+      var sealedKey = atomicFile.fdSafeReadSync(keyPath, { maxBytes: C.BYTES.kib(64), encoding: "utf8" });
       var keyB64;
       try { keyB64 = opts.vault.unseal(sealedKey); }
       catch (e) {
@@ -212,7 +217,10 @@ function fileLifecycle(opts) {
     dbPath = nodePath.join(tmpDir, "blamejs-fl-" + label + "-" +
       generateToken(TMP_NAME_BYTES) + ".db");
     if (nodeFs.existsSync(encPath)) {
-      var packed = nodeFs.readFileSync(encPath);
+      // Cap + fd-bound (deployment-tunable ceiling). NO refuseSymlink: the data
+      // dir may be a symlink-mounted volume (k8s PVC). db.enc is AEAD-checked
+      // downstream, so the cap is the OOM-before-cap defense.
+      var packed = atomicFile.fdSafeReadSync(encPath, { maxBytes: (opts.maxDbBytes) || C.BYTES.gib(2) });
       if (packed.length < 26) {                                                                  // minimum envelope length
         throw new DbFileLifecycleError("db-file-lifecycle/short-envelope",
           "fileLifecycle: " + encPath + " too short to be a valid envelope (" + packed.length + " bytes)");
@@ -248,7 +256,7 @@ function fileLifecycle(opts) {
       catch (_e) { /* best-effort — operators on read-only handles or pre-init still flush */ }
     }
     if (!nodeFs.existsSync(dbPath)) return null;
-    var plain = nodeFs.readFileSync(dbPath);
+    var plain = atomicFile.fdSafeReadSync(dbPath, { maxBytes: (opts.maxDbBytes) || C.BYTES.gib(2) });
     var packed = encryptPacked(plain, encKey, _aad(opts.dataDir, label));
     atomicFile.writeSync(encPath, packed);
     _emitAudit("flushed", "success", { label: label, bytes: plain.length });
@@ -269,7 +277,7 @@ function fileLifecycle(opts) {
       throw new DbFileLifecycleError("db-file-lifecycle/no-source",
         "fileLifecycle.snapshot: " + dbPath + " is missing");
     }
-    var plain = nodeFs.readFileSync(dbPath);
+    var plain = atomicFile.fdSafeReadSync(dbPath, { maxBytes: (opts.maxDbBytes) || C.BYTES.gib(2) });
     return encryptPacked(plain, encKey, _aad(opts.dataDir, label));
   }
 

package/lib/db-query.js

@@ -89,6 +89,19 @@ function _postureState() {
 //
 // Unregulated postures audit (drop-silent) and pass; tables with no
 // declaration are untouched.
+// Resolve a column in a raw-SQL-parsed row case-insensitively (SQL unquoted
+// identifiers fold case; the parser preserves the token). Exact match wins
+// first so a structured-builder row (keys already canonical) is unaffected.
+function _ciColumn(row, col) {
+  if (Object.prototype.hasOwnProperty.call(row, col)) return { present: true, value: row[col] };
+  var lc = String(col).toLowerCase();
+  var keys = Object.keys(row);
+  for (var i = 0; i < keys.length; i++) {
+    if (keys[i].toLowerCase() === lc) return { present: true, value: row[keys[i]] };
+  }
+  return { present: false, value: undefined };
+}
+
 function _assertLocalResidency(table, plaintextRow, op) {
   var spec = cryptoField.getPerRowResidency(table);
   var colMap = cryptoField.getColumnResidency(table);
@@ -106,9 +119,16 @@ function _assertLocalResidency(table, plaintextRow, op) {
   var regulated = state.regulated;
 
   if (spec) {
-    var tag = plaintextRow[spec.residencyColumn];
+    // SQL unquoted identifiers are case-insensitive, and the raw-SQL parser
+    // preserves the column token's case — so resolve the residency column
+    // case-insensitively. A case-sensitive lookup let `UPDATE t SET REGION=...`
+    // miss a `residencyColumn: "region"` declaration, skipping the gate and
+    // admitting a cross-border write (CWE-178 / CWE-863). Fail-safe: any
+    // spelling that could be the residency column engages the gate.
+    var resolved = _ciColumn(plaintextRow, spec.residencyColumn);
+    var tag = resolved.value;
     var tagPresent = tag !== undefined && tag !== null;
-    var colInChangeSet = Object.prototype.hasOwnProperty.call(plaintextRow, spec.residencyColumn);
+    var colInChangeSet = resolved.present;
     if (op === "insert" && !tagPresent) {
       throw new DbQueryError("db-query/row-residency-tag-missing",
         op + ": table '" + table + "' declares per-row residency on column '" +
@@ -368,6 +388,17 @@ class Query {
     return this.where(field, "IN", values);
   }
 
+  // whereNull / whereNotNull — explicit NULL predicates (IS NULL / IS NOT
+  // NULL). `where({ field: null })` / `where(field, "=", null)` is refused
+  // because `col = NULL` is UNKNOWN in SQL (never true); these are the
+  // intended way to test a column for NULL.
+  whereNull(field) {
+    return this.where(field, "IS", null);
+  }
+  whereNotNull(field) {
+    return this.where(field, "IS NOT", null);
+  }
+
   // Resolve a (field, op, value) predicate through the framework gates
   // (JSONB value guard, sealed-field → derived-hash rewrite, column
   // membership) and return the post-rewrite { field, op, value } that
@@ -1378,12 +1409,62 @@ function _unquoteIdent(s) {
   return s;
 }
 
+// Strip LEADING SQL comments + whitespace so the ^-anchored write-detection
+// regexes see the real statement head. Without this, a residency write smuggled
+// behind a leading "/* x */" or "-- x\n" comment is NOT recognized as a write →
+// the residency gate is skipped entirely (a cross-border-write BYPASS). The
+// executed SQL is unchanged; this normalized copy is only for the gate's parse.
+// Each replace is ^-anchored single-pass; the loop terminates when nothing more
+// is stripped (an unterminated /* leaves the head intact → write still detected
+// or fails closed downstream).
+function _stripLeadingSqlComments(sql) {
+  var s = String(sql), prev;
+  do {
+    prev = s;
+    s = s.replace(/^\s+/, "");                 // allow:regex-no-length-cap — anchored, single leading run
+    s = s.replace(/^--[^\n]*\r?\n?/, "");      // allow:regex-no-length-cap — anchored leading line comment
+    s = s.replace(/^\/\*[\s\S]*?\*\//, "");    // allow:regex-no-length-cap — anchored leading block comment (lazy, single scan)
+  } while (s !== prev);
+  return s;
+}
+
+// Non-anchored write-target scan for the writable-CTE / EXPLAIN-prefixed case.
+// A SQLite `WITH c AS (...) INSERT INTO residents ...` / `WITH ... UPDATE residents
+// SET ...` is a real write, but its effective verb is hidden behind the prefix so
+// the ^-anchored _RAW_WRITE_KEYWORD_RE misses it. This matches every INSERT/REPLACE
+// INTO, MERGE INTO, and UPDATE ... SET target token anywhere in the statement and
+// returns the first that names a residency table — so such a write still ENGAGES
+// the residency gate (_assertRawWriteResidency then fails CLOSED: the ^-anchored
+// body parsers can't read a CTE body, so it throws row-residency-raw-unparseable
+// directing the operator to b.db.from().insertOne/.updateOne). DELETE moves no
+// residency value across a border, so it is not a residency write. Linear scan.
+var _CTE_WRITE_TARGET_RE = /(?:\b(?:INSERT|REPLACE)\s+(?:OR\s+[A-Za-z]+\s+)?INTO|\bMERGE\s+INTO)\s+(?:[\x22\x27\x60]?[A-Za-z_]\w*[\x22\x27\x60]?\s*\.\s*){0,3}[\x22\x27\x60]?([A-Za-z_]\w*)[\x22\x27\x60]?|\bUPDATE\s+(?:[\x22\x27\x60]?[A-Za-z_]\w*[\x22\x27\x60]?\s*\.\s*){0,3}[\x22\x27\x60]?([A-Za-z_]\w*)[\x22\x27\x60]?\s+SET\b/ig;  // allow:regex-no-length-cap — alternation, no nested quantifiers; linear
+function _firstResidencyWriteTarget(s) {
+  _CTE_WRITE_TARGET_RE.lastIndex = 0;
+  var m;
+  while ((m = _CTE_WRITE_TARGET_RE.exec(s)) !== null) {  // allow:regex-no-length-cap
+    var t = _unquoteIdent(m[1] || m[2]);
+    if (t && (cryptoField.getPerRowResidency(t) || cryptoField.getColumnResidency(t))) return t;
+  }
+  return null;
+}
+
 function _rawWriteTable(sql) {
-  // Both regexes are ^-anchored (leading write keyword + table head): they scan
-  // only the statement head, so they are constant-time regardless of SQL length.
-  if (typeof sql !== "string" || !_RAW_WRITE_KEYWORD_RE.test(sql)) return null;  // allow:regex-no-length-cap
-  var m = _RAW_TABLE_RE.exec(sql);  // allow:regex-no-length-cap
-  return m ? _unquoteIdent(m[1] || m[2]) : null;
+  // The ^-anchored regexes scan only the statement head (constant-time). Strip
+  // leading comments first so a commented-out head can't hide the write.
+  if (typeof sql !== "string") return null;
+  var s = _stripLeadingSqlComments(sql);
+  if (_RAW_WRITE_KEYWORD_RE.test(s)) {  // allow:regex-no-length-cap
+    var m = _RAW_TABLE_RE.exec(s);  // allow:regex-no-length-cap
+    return m ? _unquoteIdent(m[1] || m[2]) : null;
+  }
+  // Writable-CTE / EXPLAIN-prefixed write: the effective write verb is hidden
+  // behind the prefix the ^-anchored test misses. If it writes a residency table,
+  // return it so the gate engages and then fails closed on the unparseable body.
+  if (/^\s*(?:WITH|EXPLAIN)\b/i.test(s)) {  // allow:regex-no-length-cap
+    return _firstResidencyWriteTarget(s);
+  }
+  return null;
 }
 
 // Cheap prepare-time pre-check so only writes to a residency table get wrapped.
@@ -1463,17 +1544,23 @@ function _assertRawWriteResidency(sql, boundParams) {
   if (!cryptoField.getPerRowResidency(table) && !cryptoField.getColumnResidency(table)) return;
   boundParams = _flattenRunParams(boundParams);
 
+  // Parse the comment-stripped head: a leading "/* x */" / "-- x" comment must
+  // not hide the INSERT/UPDATE body from the ^-anchored regexes below (that would
+  // let a residency-restricted write through the gate). The executed SQL is
+  // unchanged; this normalized copy is only for residency parsing.
+  var norm = _stripLeadingSqlComments(sql);
+
   // The INSERT/UPDATE body regexes below scan with [\s\S]+; bound the input
   // first and fail CLOSED on an over-long statement - a residency write the
   // framework cannot safely parse must be refused, never let past the gate.
-  if (sql.length > 100000) {
+  if (norm.length > 100000) {
     throw new DbQueryError("db-query/row-residency-raw-unparseable",
       "raw write to residency table '" + table + "' exceeds the parse limit (" +
-      sql.length + " chars) - use b.db.from(\"" + table + "\") so residency is validated", true);
+      norm.length + " chars) - use b.db.from(\"" + table + "\") so residency is validated", true);
   }
 
-  var mi = _RAW_INSERT_RE.exec(sql);  // allow:regex-no-length-cap — input length-capped above
-  var mu = mi ? null : _RAW_UPDATE_RE.exec(sql);  // allow:regex-no-length-cap — input length-capped above
+  var mi = _RAW_INSERT_RE.exec(norm);  // allow:regex-no-length-cap — input length-capped above
+  var mu = mi ? null : _RAW_UPDATE_RE.exec(norm);  // allow:regex-no-length-cap — input length-capped above
   if (!mi && !mu) {
     throw new DbQueryError("db-query/row-residency-raw-unparseable",
       "raw write to residency table '" + table + "' cannot be parsed to validate its " +
@@ -1509,4 +1596,8 @@ module.exports = {
   Query: Query,
   _isRawWriteToResidencyTable: _isRawWriteToResidencyTable,
   _assertRawWriteResidency:    _assertRawWriteResidency,
+  // Shared leading-comment stripper so db.js's storage-low write-gate sees the
+  // real statement head (a `/* x */ INSERT` / WITH-prefixed write must not slip
+  // the ENOSPC gate the way it slipped the residency gate).
+  _stripLeadingSqlComments:    _stripLeadingSqlComments,
 };

package/lib/db.js

@@ -57,7 +57,7 @@ var { generateToken, generateBytes, encryptPacked, decryptPacked, sha3Hash } = r
 var cryptoField = require("./crypto-field");
 var dbDeclareRowPolicy = require("./db-declare-row-policy");
 var dbDeclareView = require("./db-declare-view");
-var { Query, _isRawWriteToResidencyTable, _assertRawWriteResidency } = require("./db-query");
+var { Query, _isRawWriteToResidencyTable, _assertRawWriteResidency, _stripLeadingSqlComments } = require("./db-query");
 var dbSchema = require("./db-schema");
 var { defineClass } = require("./framework-error");
 var frameworkFiles = require("./framework-files");
@@ -748,7 +748,7 @@ function loadOrCreateDbKey(dataDirPath, keyPathOverride) {
   var keyPath = keyPathOverride || nodePath.join(dataDirPath, frameworkFiles.fileName("dbKeyEnc"));
   var aad = _dbKeyAad(dataDirPath, keyPath);
   if (nodeFs.existsSync(keyPath)) {
-    var sealed = atomicFile.readSync(keyPath, { encoding: "utf8" }).trim();
+    var sealed = atomicFile.readSync(keyPath, { encoding: "utf8", maxBytes: C.BYTES.kib(64) }).trim();
     var b64;
     // isAadSealed is checked FIRST and is load-bearing: AAD_PREFIX
     // ("vault.aad:") is NOT a prefix of VAULT_PREFIX ("vault:"), so a
@@ -811,7 +811,10 @@ function decryptToTmp() {
       try { nodeFs.unlinkSync(dbPath + "-shm"); } catch (_e) { /* may not exist */ }
     }
   }
-  var packed = nodeFs.readFileSync(encPath);
+  // Cap + fd-bound db.enc read at db.init. NO refuseSymlink: the data dir may be
+  // a symlink-mounted volume (k8s PVC). db.enc is AEAD-verified downstream, so
+  // the cap is the OOM-before-cap defense (was an uncapped read).
+  var packed = atomicFile.fdSafeReadSync(encPath, { maxBytes: C.BYTES.gib(2) });
   if (packed.length < 26) return; // too short to be a valid envelope
   // AAD binds the envelope to this deployment's data dir so two
   // installs sharing the same operator passphrase can't swap each
@@ -890,11 +893,27 @@ function _probeStorageHeadroom() {
 // DELETE, PRAGMA, and DDL pass through ungated. Called once in init() after
 // schema setup so init's own writes are never gated (writesRefused is false
 // until the first probe anyway).
+// A growth write for the storage-low gate: INSERT/UPDATE/REPLACE at the head
+// AFTER stripping leading comments, OR a writable-CTE / EXPLAIN-prefixed write
+// (`WITH c AS (...) INSERT INTO t ...`) whose effective verb places rows. The
+// leading-keyword-only test missed both a `/* x */ INSERT` and a WITH-prefixed
+// growth write, letting them proceed into a near-full tmpfs (the ENOSPC the gate
+// exists to prevent). Matches write SYNTAX (INTO / UPDATE..SET) so a WITH..SELECT
+// carrying the word "insert" in a value is not refused.
+function _isGrowthWrite(sql) {
+  if (typeof sql !== "string") return false;
+  var s = _stripLeadingSqlComments(sql);
+  if (/^\s*(?:INSERT|UPDATE|REPLACE)\b/i.test(s)) return true;
+  if (/^\s*(?:WITH|EXPLAIN)\b/i.test(s) &&
+      /\b(?:(?:INSERT|REPLACE|MERGE)\s+(?:OR\s+[A-Za-z]+\s+)?INTO|UPDATE\s+[\w".`]+\s+SET)\b/i.test(s)) return true;
+  return false;
+}
+
 function _installWriteGate() {
   var rawPrepare = database.prepare.bind(database);
   database.prepare = function (sql) {
     var stmt = rawPrepare(sql);
-    if (/^\s*(?:INSERT|UPDATE|REPLACE)\b/i.test(sql)) {
+    if (_isGrowthWrite(sql)) {
       var rawRun = stmt.run.bind(stmt);
       stmt.run = function () {
         if (writesRefused) {
@@ -915,7 +934,7 @@ function encryptToDisk() {
   // Force WAL checkpoint so the .db file holds all committed transactions.
   try { runSql(database, "PRAGMA wal_checkpoint(TRUNCATE)"); } catch (_e) { /* best effort */ }
   if (!nodeFs.existsSync(dbPath)) return;
-  atomicFile.writeSync(encPath, encryptPacked(nodeFs.readFileSync(dbPath), encKey, _dbEncAad(dataDir)));
+  atomicFile.writeSync(encPath, encryptPacked(atomicFile.fdSafeReadSync(dbPath, { maxBytes: C.BYTES.gib(2) }), encKey, _dbEncAad(dataDir)));
 }
 
 /**
@@ -952,7 +971,7 @@ function snapshot() {
     throw _dbErr("db/snapshot-no-source",
       "snapshot: plaintext DB at " + dbPath + " is missing — did init complete?");
   }
-  var plain = nodeFs.readFileSync(dbPath);
+  var plain = atomicFile.fdSafeReadSync(dbPath, { maxBytes: C.BYTES.gib(2) });
   if (!encPath || !encKey) {
     // atRest: 'plain' — return the raw bytes. Operators wanting an
     // encrypted snapshot under plain mode wrap with their own
@@ -2611,14 +2630,12 @@ function declareRequireDualControl(args) {
   }
   var m = args.m === undefined ? 2 : args.m;
   var n = args.n === undefined ? Math.max(2, m) : args.n;
-  if (typeof m !== "number" || !isFinite(m) || m < 2 || Math.floor(m) !== m) {
-    throw new DbError("db/dual-control-bad-quorum",
-      "declareRequireDualControl: m must be an integer >= 2");
-  }
-  if (typeof n !== "number" || !isFinite(n) || n < m || Math.floor(n) !== n) {
-    throw new DbError("db/dual-control-bad-quorum",
-      "declareRequireDualControl: n must be an integer >= m");
-  }
+  // m >= 2, n >= m, both integers — via numericBounds (matches db.js's existing
+  // inline numeric-bounds usage; throws DbError("db/dual-control-bad-quorum")).
+  require("./numeric-bounds").requirePositiveFiniteInt(m,
+    "declareRequireDualControl: m", DbError, "db/dual-control-bad-quorum", { min: 2 });
+  require("./numeric-bounds").requirePositiveFiniteInt(n,
+    "declareRequireDualControl: n", DbError, "db/dual-control-bad-quorum", { min: m });
   if (args.posture !== undefined && args.posture !== null &&
       (typeof args.posture !== "string" || args.posture.length === 0)) {
     throw new DbError("db/dual-control-bad-posture",
@@ -2785,7 +2802,7 @@ function _checkRollback(dataDirPath) {
   }
   var tip;
   try {
-    tip = safeJson.parse(atomicFile.readSync(tipPath), { schema: AUDIT_TIP_SCHEMA });
+    tip = safeJson.parse(atomicFile.readSync(tipPath, { maxBytes: C.BYTES.kib(64) }), { schema: AUDIT_TIP_SCHEMA });
   } catch (e) {
     throw _dbErr("db/audit-tip-unreadable",
       "FATAL: audit.tip unreadable or schema-invalid at " + tipPath + " — " + e.message +