@blamejs/core 0.15.13 → 0.15.15

package/lib/dora.js

@@ -62,12 +62,19 @@ var SIGNIFICANT_INCIDENT_THRESHOLDS = Object.freeze({
   durationCriticalProcessMs:    C.TIME.hours(2),                                 // 2h
 });
 
-// Article 19 — initial report deadline: 24h from "first awareness".
-// Article 19(4) — intermediate update: within 72h of initial.
-// Article 19(6) — final report: within 1 month of initial.
-var INITIAL_REPORT_DEADLINE_MS      = C.TIME.hours(24);
-var INTERMEDIATE_REPORT_DEADLINE_MS = C.TIME.hours(72);
-var FINAL_REPORT_DEADLINE_MS        = C.TIME.days(30);
+// DORA major-incident reporting timeline (Art. 19 + RTS (EU) 2024/1772 Art. 5):
+//   - Initial notification: as early as possible and WITHIN 4 HOURS of
+//     classifying the incident as major (the outer bound is 24h from first
+//     awareness). classify() returns mustReportInitialByMs as a duration FROM
+//     classification, so the operative window encoded here is 4h — the
+//     24h-from-awareness outer bound is enforced separately via
+//     INITIAL_REPORT_OUTER_DEADLINE_MS below.
+//   - Intermediate update: within 72h of the INITIAL notification's submission.
+//   - Final report: within 1 month of the intermediate report's submission.
+var INITIAL_REPORT_DEADLINE_MS       = C.TIME.hours(4);
+var INITIAL_REPORT_OUTER_DEADLINE_MS = C.TIME.hours(24);
+var INTERMEDIATE_REPORT_DEADLINE_MS  = C.TIME.hours(72);
+var FINAL_REPORT_DEADLINE_MS         = C.TIME.days(30);
 
 // Adjacent-regulation incident-reporting deadlines — operators wiring
 // NIS2 / CRA / HIPAA breach notification reach for these constants
@@ -124,14 +131,26 @@ function _classifyImpl(input) {
     reasons.push("severity-high");
   }
 
-  // 2. Affected clients (absolute).
+  // 2. Affected clients — absolute count OR share of the client base. The
+  //    percentile thresholds (RTS 2024/1772 Art. 1(1)(a): >10% major, ESA-
+  //    guideline 1% significant) were declared but never evaluated, so a
+  //    large-share-but-small-absolute incident (e.g. 16% of a 50k client base)
+  //    under-classified. Operators pass clientBase (total clients) to enable
+  //    the percentage criterion; absolute-only behavior is unchanged when it
+  //    is omitted.
   if (typeof input.affectedClients === "number" && input.affectedClients > 0) {
-    if (input.affectedClients >= MAJOR_INCIDENT_THRESHOLDS.affectedClientsAbsolute) {
+    var clientBase = (typeof input.clientBase === "number" && input.clientBase > 0) ? input.clientBase : null;
+    var clientPct = clientBase ? (input.affectedClients / clientBase) : 0;
+    var majorByClients = input.affectedClients >= MAJOR_INCIDENT_THRESHOLDS.affectedClientsAbsolute ||
+      (clientBase !== null && clientPct >= MAJOR_INCIDENT_THRESHOLDS.affectedClientsPercentile);
+    var significantByClients = input.affectedClients >= SIGNIFICANT_INCIDENT_THRESHOLDS.affectedClientsAbsolute ||
+      (clientBase !== null && clientPct >= SIGNIFICANT_INCIDENT_THRESHOLDS.affectedClientsPercentile);
+    if (majorByClients) {
       hitsMajor += 1;
-      reasons.push("clients-major-absolute");
-    } else if (input.affectedClients >= SIGNIFICANT_INCIDENT_THRESHOLDS.affectedClientsAbsolute) {
+      reasons.push("clients-major");
+    } else if (significantByClients) {
       hitsSignificant += 1;
-      reasons.push("clients-significant-absolute");
+      reasons.push("clients-significant");
     }
   }
 
@@ -188,7 +207,11 @@ function _classifyImpl(input) {
   return {
     classification:        classification,
     mustReport:            mustReport,
+    // Operative initial-notification window: 4h from this classification.
     mustReportInitialByMs: mustReport ? INITIAL_REPORT_DEADLINE_MS : null,
+    // Outer bound: no later than 24h from first awareness — surfaced so an
+    // operator scheduling from `detectedAt` can enforce min(class+4h, aware+24h).
+    mustReportInitialOuterByMs: mustReport ? INITIAL_REPORT_OUTER_DEADLINE_MS : null,
     reasons:               reasons,
   };
 }
@@ -343,10 +366,16 @@ function create(opts) {
       // Article 19 deadline — operator-side scheduler uses this.
       nextStageDueAt:    null,
     };
+    // Anchor each downstream deadline on the SUBMISSION time of the report
+    // being filed (record.reportedAt), not on detectedAt: the intermediate is
+    // due 72h after the initial is *submitted*, and the final one month after
+    // the intermediate is *submitted* (DORA RTS 2024/1772 reporting timeline).
+    // Anchoring on detectedAt understates the deadline whenever a report is
+    // filed later than detection.
     if (input.stage === "initial") {
-      record.nextStageDueAt = input.detectedAt + INTERMEDIATE_REPORT_DEADLINE_MS;
+      record.nextStageDueAt = record.reportedAt + INTERMEDIATE_REPORT_DEADLINE_MS;
     } else if (input.stage === "intermediate") {
-      record.nextStageDueAt = input.detectedAt + FINAL_REPORT_DEADLINE_MS;
+      record.nextStageDueAt = record.reportedAt + FINAL_REPORT_DEADLINE_MS;
     }
     _emit("dora.incident.reported", {
       metadata: {
@@ -396,6 +425,7 @@ module.exports = {
   MAJOR_INCIDENT_THRESHOLDS:           MAJOR_INCIDENT_THRESHOLDS,
   SIGNIFICANT_INCIDENT_THRESHOLDS:     SIGNIFICANT_INCIDENT_THRESHOLDS,
   INITIAL_REPORT_DEADLINE_MS:          INITIAL_REPORT_DEADLINE_MS,
+  INITIAL_REPORT_OUTER_DEADLINE_MS:    INITIAL_REPORT_OUTER_DEADLINE_MS,
   INTERMEDIATE_REPORT_DEADLINE_MS:     INTERMEDIATE_REPORT_DEADLINE_MS,
   FINAL_REPORT_DEADLINE_MS:            FINAL_REPORT_DEADLINE_MS,
   DEADLINES_NIS2:                      DEADLINES_NIS2,

package/lib/dr-runbook.js

@@ -275,7 +275,7 @@ async function emit(opts) {
     "drRunbook.emit: outDir", DrRunbookError, "dr-runbook/no-outdir");
   validateOpts.requireNonEmptyString(opts.posture,
     "drRunbook.emit: posture", DrRunbookError, "dr-runbook/no-posture");
-  if (!POSTURE_BLOCKS[opts.posture]) {
+  if (!Object.prototype.hasOwnProperty.call(POSTURE_BLOCKS, opts.posture)) {
     throw new DrRunbookError("dr-runbook/unknown-posture",
       "drRunbook.emit: posture '" + opts.posture + "' not in supported list (" +
       Object.keys(POSTURE_BLOCKS).join(", ") + ")");

package/lib/dsa.js

@@ -36,6 +36,7 @@
 
 var validateOpts = require("./validate-opts");
 var lazyRequire = require("./lazy-require");
+var numericBounds = require("./numeric-bounds");
 var C = require("./constants");
 var { DsaError } = require("./framework-error");
 
@@ -414,7 +415,7 @@ function transparencyReport(opts) {
   METRIC_FIELDS.forEach(function (field) {
     var v = supplied[field];
     if (v === undefined || v === null) { metrics[field] = 0; return; }
-    if (typeof v !== "number" || !isFinite(v) || v < 0 || Math.floor(v) !== v) {
+    if (!numericBounds.isNonNegativeFiniteInt(v)) {
       throw new DsaError("dsa/bad-metric-value",
         "b.dsa.transparencyReport: metrics." + field +
         " must be a non-negative integer, got " +

package/lib/dsr.js

@@ -210,7 +210,7 @@ var POSTURE_DEADLINE_MS = Object.freeze({
 // + extension). Read-only at module scope.
 function _deadlineForPosture(posture) {
   if (typeof posture !== "string") return POSTURE_DEADLINE_MS["default"];
-  return POSTURE_DEADLINE_MS[posture] || POSTURE_DEADLINE_MS["default"];
+  return Object.prototype.hasOwnProperty.call(POSTURE_DEADLINE_MS, posture) ? POSTURE_DEADLINE_MS[posture] : POSTURE_DEADLINE_MS["default"];
 }
 
 function _now() { return Date.now(); }
@@ -1198,12 +1198,26 @@ function dbTicketStore(opts) {
     SUBJECT_FILTER_SPEC.forEach(function (spec) {
       var supplied = filter.subject[spec.key];
       if (!supplied) return;
-      var column = vaulted ? spec.hashCol : spec.plainCol;
-      var match  = vaulted
-        ? (function () { var d = cryptoField().computeDerived(DSR_SEAL_TABLE, spec.sealField, supplied); return d ? d.value : null; })()
-        : supplied;
-      conds.push(column + " = " + spec.param);
-      params[spec.param] = match;
+      if (!vaulted) {
+        conds.push(spec.plainCol + " = " + spec.param);
+        params[spec.param] = supplied;
+        return;
+      }
+      // Vaulted: match BOTH the active keyed-MAC digest AND the legacy
+      // salted-sha3 digest via the dual-read, so a ticket written before the
+      // keyed-MAC default flip is still FOUND. A single-value equality on the
+      // keyed-MAC digest silently skips those pre-flip rows, so an Art.17
+      // erasure purge (list-by-subject → delete) would leave the subject's
+      // legacy-hashed PII-bearing tickets behind. Mirrors subject.eraseHard.
+      var cand = cryptoField().lookupHashCandidates(DSR_SEAL_TABLE, spec.sealField, supplied);
+      var values = cand && cand.values ? cand.values : [];
+      if (values.length === 0) return;
+      var placeholders = values.map(function (v, i) {
+        var p = spec.param + "_" + i;
+        params[p] = v;
+        return p;
+      });
+      conds.push(spec.hashCol + " IN (" + placeholders.join(", ") + ")");
     });
   }
 
@@ -1455,7 +1469,7 @@ var STATE_RULES = Object.freeze({
 function stateRules(state) {
   if (typeof state !== "string" || state.length === 0) return null;
   // Direct posture-name lookup first
-  if (STATE_RULES[state]) return Object.assign({}, STATE_RULES[state]);
+  if (Object.prototype.hasOwnProperty.call(STATE_RULES, state)) return Object.assign({}, STATE_RULES[state]);
   // 2-letter state abbreviation lookup (case-insensitive)
   var u = state.toUpperCase();
   var keys = Object.keys(STATE_RULES);

package/lib/early-hints.js

@@ -170,6 +170,13 @@ function send(res, opts) {
       throw new EarlyHintsError("early-hints/bad-header-value",
         "earlyHints.send: header '" + name + "' must be a string or string[]", true);
     }
+    var vals = Array.isArray(canonical[name]) ? canonical[name] : [canonical[name]];
+    for (var vi = 0; vi < vals.length; vi += 1) {
+      if (typeof vals[vi] === "string" && _hasHeaderInjection(vals[vi])) {
+        throw new EarlyHintsError("early-hints/bad-header-value",
+          "earlyHints.send: header '" + name + "' value contains a CR/LF/NUL header-injection character", true);
+      }
+    }
     headers[name] = canonical[name];
   }
 
@@ -182,9 +189,21 @@ function send(res, opts) {
   }
 }
 
+// A header value reaching res.writeEarlyHints must carry no CR/LF/NUL — those
+// split the interim response into attacker-chosen headers. Node rejects them
+// too, but screen defensively (matching the cookies / security-headers
+// boundary) so the framework surfaces a typed error, not a raw Node throw.
+function _hasHeaderInjection(s) {
+  return s.indexOf("\r") !== -1 || s.indexOf("\n") !== -1 || s.indexOf("\0") !== -1;
+}
+
 function _validateLink(linkValue, idx) {
   validateOpts.requireNonEmptyString(linkValue, "earlyHints.send.link[" + idx + "]",
     EarlyHintsError, "early-hints/bad-link");
+  if (_hasHeaderInjection(linkValue)) {
+    throw new EarlyHintsError("early-hints/bad-link",
+      "link[" + idx + "] contains a CR/LF/NUL header-injection character");
+  }
   if (linkValue.length > LINK_MAX_BYTES) {
     throw new EarlyHintsError("early-hints/bad-link",
       "link[" + idx + "] exceeds " + LINK_MAX_BYTES + " bytes");

package/lib/eat.js

@@ -205,7 +205,11 @@ async function verify(eat, opts) {
   // Debug status — refuse a token that can't prove debug is disabled.
   if (opts.requireDebugDisabled === true) {
     var ds = raw.get(EAT.dbgstat);
-    if (typeof ds !== "number" || ds < DBGSTAT.disabled) {
+    // Accept ONLY a defined disabled enum value (1..4). `ds < disabled` alone
+    // let any out-of-range value >= 1 (5, 99, non-integers) pass as "disabled"
+    // — a fail-open on an undefined dbgstat (RFC 9711 §3.3 defines 0..4 only).
+    if (typeof ds !== "number" || !Number.isInteger(ds) ||
+        ds < DBGSTAT.disabled || ds > DBGSTAT["disabled-fully-and-permanently"]) {
       throw new EatError("eat/debug-not-disabled",
         "eat.verify: requireDebugDisabled — dbgstat is " +
         (ds === undefined ? "absent" : (DBGSTAT_BY_VALUE[ds] || ds)) + ", not a disabled state");

package/lib/external-db.js

@@ -339,6 +339,50 @@ function _classifyStatement(sql) {
   return _STATEMENT_CLASS_MAP[kw] || "OTHER";
 }
 
+// True when a top-level (paren-depth 0, outside any string / comment / quoted-
+// identifier / dollar-quoted span) RETURNING keyword is present — a DML
+// statement with RETURNING yields rows to the caller. Quote-aware so the literal
+// word inside a value ('see RETURNING docs') is not mistaken for a clause, and
+// depth-aware so a RETURNING buried in a CTE / subquery paren does not count for
+// the OUTER statement. Reuses the shared opaque-span scanner; single linear pass.
+function _hasTopLevelReturning(sql) {
+  var n = sql.length, i = 0, depth = 0;
+  while (i < n) {
+    var skipped = _skipOpaqueSpan(sql, i);
+    if (skipped === -1) return false;            // unterminated span — nothing top-level beyond
+    if (skipped !== i) { i = skipped; continue; }
+    var ch = sql.charAt(i);
+    if (ch === "(") { depth += 1; i += 1; continue; }
+    if (ch === ")") { depth -= 1; i += 1; continue; }
+    if (_isIdentStart(ch)) {
+      var we = i + 1;
+      while (we < n && _isIdentChar(sql.charAt(we))) we += 1;
+      if (depth === 0 && sql.slice(i, we).toUpperCase() === "RETURNING") return true;
+      i = we;
+      continue;
+    }
+    i += 1;
+  }
+  return false;
+}
+
+// Does this statement return a row set to the caller? Distinct from the
+// residency gate's read/write split: an `EXPLAIN ANALYZE INSERT` is a WRITE for
+// the gate yet returns plan rows; a DML `... RETURNING` is a write that yields
+// rows. Consumers (e.g. cluster-storage's local exec choosing .all() vs .run())
+// must use .all() for any row-returning statement, including a WITH (CTE) read
+// that the leading keyword alone would mis-route to .run() and SILENTLY DROP.
+// Statement classes that produce a row set for the caller (SELECT and the
+// READ_INFO family — SHOW / DESCRIBE / PRAGMA). Keyed by class name, mirroring
+// _STATEMENT_CLASS_MAP / _RESIDENCY_READ_CLASS.
+var _ROW_RETURNING_CLASS = Object.freeze({ SELECT: true, READ_INFO: true });
+
+function statementReturnsRows(sql) {
+  if (typeof sql !== "string" || sql.length === 0) return false;
+  if (_ROW_RETURNING_CLASS[_classifyStatement(sql)] === true) return true;
+  return _hasTopLevelReturning(sql);
+}
+
 // Statement classes that place no rows on the backend, so the cross-
 // border residency write gate lets them pass without a row tag. Every
 // other class — DML, ROUTINE (CALL / EXECUTE / DO), a COPY ... FROM
@@ -1810,12 +1854,19 @@ async function _readQuery(sql, params, opts) {
   // was explicitly configured allowCrossBorder (which is audited).
   var _readPosture = _activePosture();
   var _tagPresent = opts.rowResidencyTag && typeof opts.rowResidencyTag === "string";
+  // A replica only carries a real residency CONSTRAINT when its tag names a
+  // specific region. "unrestricted" / "global" mean "no constraint" (the tag
+  // defaults to "unrestricted" when none is configured), so such a replica may
+  // serve any region's rows and must NOT require opts.rowResidencyTag — gating
+  // it would over-reject every regulated read to an untagged replica.
+  var _replicaConstrained = replica.residencyTag &&
+    replica.residencyTag !== "unrestricted" && replica.residencyTag !== "global";
   // Fail CLOSED when the row's region is not identified: a regulated read to a
-  // residency-tagged replica without opts.rowResidencyTag would otherwise route
-  // residency-restricted rows to an arbitrary-region replica with no check at
-  // all (symmetric with the write gate's RESIDENCY_GATE_REQUIRED).
+  // residency-CONSTRAINED replica without opts.rowResidencyTag would otherwise
+  // route residency-restricted rows to an arbitrary-region replica with no check
+  // at all (symmetric with the write gate's RESIDENCY_GATE_REQUIRED).
   if (!_tagPresent && _crossBorderRegulated(_readPosture) &&
-      replica.residencyTag && !replica.allowCrossBorder) {
+      _replicaConstrained && !replica.allowCrossBorder) {
     _emit("db.residency.replica.tag_required", "denied", {
       backend: b.name, replicaIdx: replica.index,
       replicaTag: replica.residencyTag, posture: _readPosture,
@@ -2574,6 +2625,11 @@ module.exports = {
   // lock tables live on the externalDb side. See lib/external-db-migrate.js.
   migrate:        externalDbMigrate,
   Pool:           Pool,
+  // Shared SQL statement classifier (CTE / EXPLAIN aware): does the statement
+  // return a row set? Internal — consumed by cluster-storage's local exec to
+  // choose .all() vs .run() so a WITH (CTE) read is not mis-routed and its rows
+  // lost. Underscore-prefixed: framework-internal, not an operator API surface.
+  _statementReturnsRows: statementReturnsRows,
   _resetForTest:  _resetForTest,
   _extractTargetRelation: _extractTargetRelation,
 };

package/lib/fda-21cfr11.js

@@ -91,6 +91,18 @@ var DEFAULT_SIGNATURE_MEANINGS = Object.freeze([
 // must carry §11.10(e) shape. Operators add more via opts.gxpNamespaces.
 var DEFAULT_GXP_NAMESPACES = Object.freeze(["subject", "consent", "db", "breakglass"]);
 
+// Non-mutating verb segments. A GxP-namespace event whose final action segment
+// is NOT one of these is treated as a record MODIFICATION and must carry the
+// §11.10(e) before/after/reason shape (fail-closed — an unknown verb is assumed
+// to mutate). hasOwnProperty-guarded lookup (untrusted action key).
+var READ_VERBS = Object.freeze({
+  read: 1, viewed: 1, view: 1, get: 1, got: 1, list: 1, listed: 1, query: 1,
+  queried: 1, access: 1, accessed: 1, export: 1, exported: 1, history: 1,
+  isgranted: 1, check: 1, checked: 1, verify: 1, verified: 1, lookup: 1,
+  search: 1, searched: 1, fetch: 1, fetched: 1, render: 1, rendered: 1,
+  download: 1, downloaded: 1,
+});
+
 // §11.10(e) — every modification audit must carry timestamp, actor,
 // before/after pair, and a reason. The framework's audit row shape
 // already carries `recordedAt` (timestamp) + `actorUserId` + `reason`;
@@ -114,11 +126,15 @@ function _hasRequiredAuditShape(row) {
   if (!row.action || typeof row.action !== "string") {
     return { ok: false, reason: "row missing action verb (§11.10(e))" };
   }
-  // Modification-shaped events (verbs containing "update" / "modif" /
-  // "delete" / "rectif" / "erase" / "set") must carry before/after.
+  // §11.10(e) requires before/after on every record MODIFICATION. Inferring
+  // "is this a modification" from a denylist of mutating verbs silently let
+  // off-list verbs (anonymize / revoke / overwrite / replace / merge /
+  // withdraw / restrict / objection …) bypass the requirement. Fail CLOSED
+  // instead: a GxP-namespace event is treated as a modification UNLESS its
+  // final verb segment is on an explicit non-mutating READ allowlist.
   var verb = row.action.toLowerCase();
-  var modShape = /\.(update|updated|modif|modified|delete|deleted|rectif|rectified|erase|erased|set|setrole|put|patched)\b/.test(verb) ||
-    /\.(update|delete|modif|set|put|patch|rectif|erase)/.test(verb);
+  var lastSeg = verb.indexOf(".") === -1 ? verb : verb.slice(verb.lastIndexOf(".") + 1);
+  var modShape = !Object.prototype.hasOwnProperty.call(READ_VERBS, lastSeg);
   if (modShape) {
     var meta = row.metadata;
     // Audit chain stores metadata as a JSON string when read back —
@@ -263,7 +279,16 @@ function posture(opts) {
       }, "denied");
       return { ok: false, reason: "record-hash-mismatch" };
     }
-    if (verifyWith && signed.signature) {
+    if (verifyWith) {
+      // A configured verifier means a signature is REQUIRED — a null/empty
+      // signature must fail closed (recordHash alone is self-consistency, not
+      // authentication; accepting it is alg:none-style signature stripping).
+      if (!signed.signature) {
+        _emit("fda21cfr11.signature.verified", {
+          printedName: signed.printedName, ok: false, reason: "signature-required",
+        }, "denied");
+        return { ok: false, reason: "signature-required" };
+      }
       var sigBuf = Buffer.from(signed.signature, "base64");
       var payload = JSON.stringify({
         printedName:      signed.printedName,

package/lib/flag-providers.js

@@ -41,6 +41,7 @@ var validateOpts   = require("./validate-opts");
 var lazyRequire    = require("./lazy-require");
 var safeJson       = require("./safe-json");
 var C              = require("./constants");
+var atomicFile     = require("./atomic-file");
 var { defineClass } = require("./framework-error");
 var FlagError = defineClass("FlagError", { alwaysPermanent: true });
 
@@ -128,7 +129,10 @@ function localFile(opts) {
   validateOpts.requireNonEmptyString(opts.path,
     "providers.localFile: path", FlagError, "flag/bad-provider");
   var raw;
-  try { raw = nodeFs.readFileSync(opts.path, "utf8"); }
+  // Capped fd-bound read; the cap precedes the alloc so an oversized flag file
+  // can't OOM boot. refuseSymlink stays OFF: a flag file is commonly a k8s
+  // ConfigMap mount, which is a symlink chain — refusing it would break that.
+  try { raw = atomicFile.fdSafeReadSync(opts.path, { maxBytes: C.BYTES.mib(1), encoding: "utf8" }); }
   catch (e) {
     throw new FlagError("flag/bad-provider",
       "providers.localFile: cannot read file " + JSON.stringify(opts.path) +
@@ -154,7 +158,7 @@ function localFile(opts) {
     try {
       nodeFs.watch(opts.path, { persistent: false }, function () {
         try {
-          var nextRaw = nodeFs.readFileSync(opts.path, "utf8");
+          var nextRaw = atomicFile.fdSafeReadSync(opts.path, { maxBytes: C.BYTES.mib(1), encoding: "utf8" });
           var nextParsed = safeJson.parse(nextRaw, { maxBytes: C.BYTES.mib(1) });
           if (nextParsed && nextParsed.flags) {
             for (var k in nextParsed.flags) {

package/lib/forms.js

@@ -252,7 +252,7 @@ function _renderField(field) {
   var control;
   if (type === "textarea") control = _renderTextarea(field);
   else if (type === "select") control = _renderSelect(field);
-  else if (INPUT_TYPES[type])  control = _renderInput(field);
+  else if (Object.prototype.hasOwnProperty.call(INPUT_TYPES, type))  control = _renderInput(field);
   else throw new Error("forms.render: unsupported field type: " + type);
 
   // Hidden + submit fields don't need a label wrapper

package/lib/gate-contract.js

@@ -1095,13 +1095,49 @@ function makeProfileBuilder(profiles) {
  *   posture.piiPolicy;                                   // → "redact"
  */
 function lookupCompliancePosture(name, postures, errorFactory, codePrefix) {
-  if (!postures || !postures[name]) {
+  // hasOwnProperty: `name` is caller input; a bracket lookup would let a
+  // prototype key like "constructor" pass the presence check and reach
+  // Object.assign (proto shadowing).
+  if (!postures || !Object.prototype.hasOwnProperty.call(postures, name)) {
     throw errorFactory(codePrefix + ".bad-posture",
       "unknown compliancePosture " + JSON.stringify(name));
   }
   return Object.assign({}, postures[name]);
 }
 
+/**
+ * @primitive  b.gateContract.makePostureAccessor
+ * @signature  b.gateContract.makePostureAccessor(postures, opts?)
+ * @since      0.15.14
+ * @status     stable
+ * @related    b.gateContract.lookupCompliancePosture, b.gateContract.resolveProfileName
+ *
+ * Build the public `compliancePosture(name)` accessor a guard exposes — maps a
+ * compliance-posture name through the guard's own `postures` table to the
+ * profile it selects, returning `opts.fallback` (default `null`) for an
+ * unknown name. Folds the one-line lookup the mail-scanner / content-detect
+ * factories each redefined verbatim (`return POSTURES[name] || null`) into one
+ * proto-shadow-safe helper: the membership test is `hasOwnProperty.call` so a
+ * prototype key (constructor / __proto__ / toString) resolves to the fallback
+ * rather than an inherited Function. Unlike `lookupCompliancePosture` it does
+ * NOT throw and returns the raw mapped value (a profile name string), not an
+ * object copy.
+ *
+ * @opts
+ *   fallback: any,   // value returned for an unknown / proto-key name (default null)
+ *
+ * @example
+ *   var compliancePosture = b.gateContract.makePostureAccessor(COMPLIANCE_POSTURES);
+ *   compliancePosture("hipaa");        // → "strict"
+ *   compliancePosture("constructor");  // → null  (proto key, not an own posture)
+ */
+function makePostureAccessor(postures, opts) {
+  var fallback = (opts && Object.prototype.hasOwnProperty.call(opts, "fallback")) ? opts.fallback : null;
+  return function (name) {
+    return Object.prototype.hasOwnProperty.call(postures, name) ? postures[name] : fallback;
+  };
+}
+
 // "GuardCidrError" -> "guardCidr" — the guard's audit/message identity, derived
 // once from its error class name. Used for the default gate's audit/metric
 // prefix AND the profile resolver's error message, so neither re-cases the name.
@@ -1199,9 +1235,13 @@ function makeProfileResolver(cfg) {
  */
 function resolveProfileName(opts, postures, defaultProfile) {
   opts = opts || {};
-  return opts.profile ||
-    (opts.posture && postures && postures[opts.posture]) ||
-    defaultProfile;
+  // hasOwnProperty: opts.posture is caller/operator input; a bracket lookup
+  // would let a prototype key like "constructor" resolve to an inherited
+  // truthy value and become the profile name (proto shadowing).
+  var postureProfile = (opts.posture && postures &&
+    Object.prototype.hasOwnProperty.call(postures, opts.posture))
+    ? postures[opts.posture] : null;
+  return opts.profile || postureProfile || defaultProfile;
 }
 
 /**
@@ -2072,7 +2112,7 @@ Object.freeze(INPUT_CONTRACTS);
 
 function resolveInputContract(contract) {
   if (typeof contract === "function") return contract;
-  return INPUT_CONTRACTS[contract] || INPUT_CONTRACTS.text;
+  return Object.prototype.hasOwnProperty.call(INPUT_CONTRACTS, contract) ? INPUT_CONTRACTS[contract] : INPUT_CONTRACTS.text;
 }
 
 /**
@@ -3125,6 +3165,7 @@ module.exports = {
   charThreatDisposition: charThreatDisposition,
   extractBytesAsText: extractBytesAsText,
   lookupCompliancePosture: lookupCompliancePosture,
+  makePostureAccessor: makePostureAccessor,
   ALL_STRICT_POSTURES: ALL_STRICT_POSTURES,
   CHAR_THREATS_REJECT_ALL: CHAR_THREATS_REJECT_ALL,
   DANGEROUS_URL_SCHEMES: DANGEROUS_URL_SCHEMES,

package/lib/gdpr-ropa.js

@@ -91,7 +91,7 @@ function create(opts) {
       throw new GdprRopaError("gdpr-ropa/bad-id",
         "gdpr.ropa." + op + ": activity.id must be a non-empty string");
     }
-    if (!VALID_LEGAL_BASES[activity.legalBasis]) {
+    if (!Object.prototype.hasOwnProperty.call(VALID_LEGAL_BASES, activity.legalBasis)) {
       throw new GdprRopaError("gdpr-ropa/bad-legal-basis",
         "gdpr.ropa." + op + ": activity.legalBasis must be one of " + Object.keys(VALID_LEGAL_BASES).join(", "));
     }
@@ -127,7 +127,7 @@ function create(opts) {
       registeredAt: existing.registeredAt,
       lastUpdatedAt: now(),
     });
-    if (patch.legalBasis && !VALID_LEGAL_BASES[merged.legalBasis]) {
+    if (patch.legalBasis && !Object.prototype.hasOwnProperty.call(VALID_LEGAL_BASES, merged.legalBasis)) {
       throw new GdprRopaError("gdpr-ropa/bad-legal-basis",
         "gdpr.ropa.update: legalBasis must be one of " + Object.keys(VALID_LEGAL_BASES).join(", "));
     }
@@ -173,6 +173,21 @@ function create(opts) {
       activities:           list(),
     };
   }
+  // Quote a CSV cell AND neutralize spreadsheet formula injection (CWE-1236):
+  // a value beginning with = + - @ TAB or CR is evaluated as a formula by
+  // Excel / Google Sheets when the export is opened, so a RoPA field like
+  // "=HYPERLINK(...)" or "=cmd|..." would execute. Prefix such a value with a
+  // single quote so the spreadsheet renders it as literal text; then RFC-4180
+  // quote (double internal quotes).
+  function _csvCell(v) {
+    var s = (v === undefined || v === null) ? ""
+      : (Array.isArray(v) ? JSON.stringify(v) : String(v));
+    var c0 = s.charCodeAt(0);
+    if (c0 === 0x3d || c0 === 0x2b || c0 === 0x2d || c0 === 0x40 || c0 === 0x09 || c0 === 0x0d) {
+      s = "'" + s;
+    }
+    return '"' + s.replace(/"/g, '""') + '"';
+  }
   function _exportCsv() {
     var headers = [
       "id", "name", "purposes", "legalBasis", "dataCategories",
@@ -183,13 +198,7 @@ function create(opts) {
     var entries = list();
     for (var i = 0; i < entries.length; i++) {
       var e = entries[i];
-      var row = headers.map(function (h) {
-        var v = e[h];
-        if (v === undefined || v === null) return "";
-        if (Array.isArray(v)) return JSON.stringify(v).replace(/"/g, "\"\"");
-        return String(v).replace(/"/g, "\"\"");
-      });
-      rows.push(row.map(function (c) { return '"' + c + '"'; }).join(","));
+      rows.push(headers.map(function (h) { return _csvCell(e[h]); }).join(","));
     }
     return rows.join("\n");
   }

package/lib/graphql-federation.js

@@ -35,7 +35,13 @@ var ROUTER_TOKEN_MIN_LEN = 32;
 var NONCE_MIN_LEN = 16;                                                                     // string-length floor for nonce entropy, not bytes
 var NONCE_MAX_LEN = 256;                                                                    // string-length cap, not bytes
 var NONCE_PREVIEW_LEN = 8;                                                                  // log-preview slice length, not bytes
-var SDL_PROBE_RE = /(^|[\s,{])_service\b|_entities\b/;
+// Word-boundary anchored on BOTH probes. A prefix char-class ([\s,{]) on
+// `_service` was bypassable by an alias with no leading space — `query{x:_service{sdl}}`
+// has `:` before `_service`, which is not in the class, so the SDL trust gate
+// was skipped and the subgraph leaked its full SDL. `\b` already prevents
+// matching substrings like `my_service` (no boundary between `y` and `_`), so
+// the prefix class only added the bypass.
+var SDL_PROBE_RE = /\b_service\b|\b_entities\b/;
 
 /**
  * @primitive b.graphqlFederation.queryProbesSdl
@@ -173,14 +179,21 @@ function guardSdl(opts) {
   return function graphqlFedGuard(req, res, next) {
     Promise.resolve().then(function () {
       return _readBody(req, errorClass).then(function (rawBody) {
-        var query = null;
+        var probesSdl = false;
         try {
           var parsed = typeof rawBody === "string" ? safeJson.parse(rawBody, { maxBytes: C.BYTES.mib(1) }) : rawBody;             // routed via safeJson.parse
-          query = parsed && typeof parsed === "object" ? parsed.query : null;
+          // A GraphQL HTTP batch is a JSON ARRAY of operations; probe EVERY
+          // element's query, not just `parsed.query` (which is undefined for an
+          // array → the SDL gate was skipped and a batched `_service{sdl}`
+          // operation leaked the SDL on batching-enabled subgraphs).
+          var candidates = Array.isArray(parsed)
+            ? parsed.map(function (o) { return o && typeof o === "object" ? o.query : null; })
+            : [parsed && typeof parsed === "object" ? parsed.query : null];
+          probesSdl = candidates.some(queryProbesSdl);
         } catch (_e) { /* not JSON; pass through */ }
         if (req.body === undefined) req.body = rawBody;
 
-        if (!queryProbesSdl(query)) {
+        if (!probesSdl) {
           if (typeof next === "function") next();
           return;
         }

package/lib/guard-all.js

@@ -128,12 +128,12 @@ function _verifyParity() {
       failures.push(g.NAME + ": missing gate(opts) function");
     }
     SHARED_PROFILES.forEach(function (p) {
-      if (!g.PROFILES || !g.PROFILES[p]) {
+      if (!g.PROFILES || !Object.prototype.hasOwnProperty.call(g.PROFILES, p)) {
         failures.push(g.NAME + ": does not declare shared profile " + JSON.stringify(p));
       }
     });
     SHARED_POSTURES.forEach(function (p) {
-      if (!g.COMPLIANCE_POSTURES || !g.COMPLIANCE_POSTURES[p]) {
+      if (!g.COMPLIANCE_POSTURES || !Object.prototype.hasOwnProperty.call(g.COMPLIANCE_POSTURES, p)) {
         failures.push(g.NAME + ": does not declare shared compliance posture " + JSON.stringify(p));
       }
     });

package/lib/guard-dsn.js

@@ -210,7 +210,7 @@ function parse(deliveryStatusBody, opts) {
         "parse: per-recipient block missing Action (RFC 3464 §2.3.3)");
     }
     var action = fields["action"].toLowerCase();
-    if (!KNOWN_ACTIONS[action]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_ACTIONS, action)) {
       throw new GuardDsnError("guard-dsn/bad-action",
         "parse: Action '" + action + "' not in RFC 3464 §2.3.3 vocabulary");
     }

package/lib/guard-envelope.js

@@ -148,7 +148,7 @@ var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
 function check(ctx, opts) {
   opts = opts || {};
   var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
-  if (!PROFILES[profile]) {
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, profile)) {
     throw new GuardEnvelopeError("guard-envelope/bad-profile",
       "check: unknown profile '" + profile + "'");
   }