@blamejs/core 0.15.4 → 0.15.6

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.6 (2026-06-12) — **Closes SAML and OIDC assertion-replay windows, bounds SSE memory under a slow client, restores at-least-once delivery for a crashed outbox publisher, makes sealed-column membership queries work, ships JOSE-conformant SD-JWT signatures, and adds a URL canonicalizer for SSRF-safe comparison.** A security and correctness release. On the identity surface: a SAML Response whose Bearer (or Holder-of-Key) SubjectConfirmation omits NotOnOrAfter is now rejected instead of accepted as fresh-forever, and the OIDC ID-token verifier no longer lets a caller disable expiry validation on a normal token - the exp bypass is restricted to back-channel-logout tokens and bounded by an issued-at freshness floor. SD-JWT-VC ES256/ES384 signatures are now emitted as JOSE raw r||s, so credentials this issuer signs verify in conformant wallets and verifiers. A new b.safeUrl.canonicalize (and b.ssrfGuard.canonicalizeHost) collapses obfuscated host and IP forms to one canonical string so allowlist and SSRF comparisons can't be bypassed by encoding tricks. On the reliability side: server-sent-event channels now cap their per-connection outbound buffer and evict a stalled client instead of growing the heap without bound; the outbox reclaims a job left in-flight by a publisher that crashed mid-delivery; the background worker pool no longer drops a task queued behind one that timed out; a retention preview no longer rewrites the whole database file; an equality / membership query on an encrypted column now hashes each candidate (membership queries previously failed outright); and the on-read re-hash of a legacy lookup digest now runs on Postgres and MySQL handles, not only SQLite. **Fixed:** *SD-JWT-VC ES256 / ES384 signatures are JOSE-conformant* — `b.auth.sdJwtVc` signed and verified ES256 / ES384 credentials with node:crypto's default DER ECDSA encoding instead of the raw r||s (`ieee-p1363`) form JOSE and EUDI wallets require, so a credential this issuer signed was rejected by conformant verifiers and the library rejected conformant holders' key-binding JWTs. The issuer JWT and the holder KB-JWT now both sign and verify with `ieee-p1363`, matching the rest of the framework's JOSE signers. · *Membership queries on an encrypted column now work* — Querying an encrypted (sealed) column with `IN` / `$in` - `b.db.from(table).whereIn("email", [...])` or `b.db.collection(table).find({ email: { $in: [...] } })` - threw, because the sealed-field-to-derived-hash rewrite passed the whole candidate array to the hash lookup as a single value. Each candidate is now hashed individually and matched against both its active keyed digest and its legacy digest, so membership queries on an encrypted column return the right rows, including rows written before the lookup-hash default changed. · *A timing-out background task no longer drops the task queued behind it* — When a `b.workerPool` task timed out or its worker errored, the slot was returned to the idle pool and drained one moment before it was marked for recycling, so a task queued behind it could be dispatched to the worker about to be terminated - and came back as `workerpool/worker-exit` (or hung) instead of running. The slot is now marked recycling before the queue is drained, so the queued task waits for the replacement worker. · *The outbox recovers a job stranded by a crashed publisher* — `b.outbox` claims a row by flipping it to in-flight, but the claim scan only selected pending rows, so a publisher that crashed between claiming a row and recording delivery left that row in-flight forever - the event was silently dropped, breaking at-least-once delivery. The outbox now stamps each claim with a timestamp and, at the start of every poll, returns any in-flight row older than the claim lease (`claimReclaimMs`, default 5 minutes) to the pending pool so it is delivered. An existing outbox table gains the new column automatically. · *A retention preview no longer rewrites the whole database* — Previewing a retention rule with `b.retention` (`run(name, { dryRun: true })` or the `retention preview` command) ran a full database VACUUM for every candidate row under a regulated posture (gdpr / hipaa / and similar), because the per-row erase - which schedules the vacuum - ran before the dry-run check. A preview now computes what it would erase without touching the database; the vacuum runs only on a real erase. · *On-read lookup-digest upgrade runs on Postgres and MySQL* — When `b.cryptoField.unsealRow` re-hashed a legacy lookup digest to the current keyed form and persisted it, the UPDATE was always built for SQLite, so on a Postgres or MySQL handle the durable rewrite quoted identifiers for the wrong dialect and silently no-opped - the legacy digest stayed on disk and the migration never completed off SQLite. The rewrite now uses the handle's own dialect. **Security:** *SAML SubjectConfirmation without NotOnOrAfter is rejected* — `b.auth.saml` SP response verification treated the `NotOnOrAfter` attribute on a Bearer SubjectConfirmationData as optional: a confirmation that omitted it was accepted with no upper bound on the assertion's freshness - a captured assertion replayable indefinitely. SAML 2.0 Web Browser SSO Profile §4.1.4.2 requires Bearer confirmations to carry NotOnOrAfter. `verifyResponse` now rejects a confirmation that is missing NotOnOrAfter, has an unparseable value, or is expired; the Holder-of-Key path (Profile §3.1) is hardened the same way, including the previously-accepted unparseable-value case. · *ID-token expiry can no longer be disabled on a normal token* — `b.auth.oauth`'s `verifyIdToken` honored a `skipExpCheck` option with no constraint, so any caller could verify an expired - or replayed - ID token. That option exists only for OIDC Back-Channel Logout tokens, which carry no `exp`. It is now self-guarding: `verifyIdToken` rejects `skipExpCheck` (`auth-oauth/skip-exp-check-not-allowed`) on any token that lacks the back-channel-logout event claim, and even for a logout token it enforces an `iat` freshness floor (`auth-oauth/logout-token-stale`). The internal logout path is unaffected. · *Server-sent-event channels bound their outbound buffer* — An SSE channel wrote to the response with no regard for backpressure and no cap on buffered bytes, so a single stalled client could make the server buffer events until the heap was exhausted (a memory-exhaustion denial of service). Each channel now tracks its unflushed-byte count and, past a per-channel cap (`maxBufferedBytes`, default 1 MiB), closes the connection and throws `sse/backpressure` - evicting the slow consumer instead of buffering without limit. A client that keeps up is never affected. · *URL and host canonicalizer for SSRF-safe comparison* — New `b.safeUrl.canonicalize(url, opts?)` and `b.ssrfGuard.canonicalizeHost(host)` return the canonical, comparable form of a URL or host: scheme and host lowercased, IDN hosts emitted as their punycode A-label (a confusable / mixed-script host is rejected), every base of an IP literal (decimal, octal, hex, dotted, IPv4-mapped and zero-compressed IPv6) collapsed to one canonical address, default ports stripped, trailing-dot hosts normalized, and path percent-encoding normalized per RFC 3986. Use it to build host allowlists, deduplicate URLs, or compare a fetch target so an allowlist check can't be bypassed by encoding the same address a different way.
+
+- v0.15.5 (2026-06-12) — **Legal-hold and subject-restriction PII is sealed at rest, and a guard's compliance-posture forensic and runtime caps are applied on its default gate.** This release closes two data-protection gaps. The legal-hold registry and the subject-restriction flag stored their free-text fields - the legal basis, custodian, ticket citation, and restriction reason that link a data subject to a legal matter - in clear, because those local tables were written through a raw SQL path that bypassed the structured builder's at-rest sealing. Those columns are now sealed on write and unsealed on read, the same way the DSR ticket store already seals subject identifiers. Separately, a content guard built on the standard gate contract and gated with a compliance posture (for example b.guardCidr.gate({ compliancePosture: "hipaa" })) silently dropped that posture's forensic-snapshot cap and the profile's runtime cap, because the default gate passed the caller's raw options straight to the gate builder instead of resolving the profile and posture first - so a regulated-posture refusal carried no forensic evidence. The default gate now resolves the profile and posture before building the gate, matching the hand-written guard gates. **Security:** *Legal-hold and subject-restriction PII is sealed at rest* — `b.legalHold`'s `_blamejs_legal_hold` registry stored the hold reason, custodian, placed-by, and citation in clear, and `b.subject.restrict`'s `_blamejs_subject_restrictions` stored the restriction reason in clear - free text that ties a data subject to a litigation hold or an Art. 18 processing restriction. Those rows were written through a raw `sql.insert` + `prepare().run()` path that bypassed the structured builder's automatic field sealing (the subject-restrictions table even declared the field as sealed, but the raw write never applied it). Both now seal those columns on write and unseal on read through `cryptoField`, so the legal-basis and custodian text is encrypted at rest under the deployment's vault key. Pre-existing plaintext rows continue to read correctly (the unseal path passes through an already-plaintext value). · *A guard's default gate applies its compliance-posture forensic and runtime caps* — A guard built on `b.gateContract.defineGuard` with the standard gate (no bespoke gate) and gated with a compliance posture dropped that posture's `forensicSnippetBytes` cap and the profile's `maxRuntimeMs` cap: the default gate passed the caller's raw options straight to the gate builder, which reads those caps directly, but the values live on the resolved profile and posture, not the raw options. The effect was that a regulated-posture refusal captured no forensic snapshot (the cap defaulted to 0, i.e. disabled) and the check ran without the profile's runtime bound. The default gate now resolves the profile and posture before building the gate - matching the hand-written guard gates - so `gate({ compliancePosture: "hipaa" })` applies the posture's forensic cap and the profile's runtime cap as documented.
+
 - v0.15.4 (2026-06-12) — **Telemetry attribute values are redacted before they leave the process, per-row data residency is enforced on every write and export path, DDL routes through the single-statement gate, the DPoP middleware requires its replay store, and session rotation re-keys the device binding.** This release closes a set of egress, data-residency, and session-binding gaps. OTLP span, span-event, and resource attributes are now scrubbed through the telemetry redactor before serialization, on both the JSON and protobuf paths, matching the metric exporter - an attribute value holding a bearer token, password, or API key no longer reaches the collector verbatim. Per-row data residency, previously enforced only at the structured query builder, is now enforced on the three paths that bypassed it: raw SQL writes, read-replica fan-out, and backup export. Every CREATE TABLE / ALTER TABLE the schema reconciler and the DSR store emit now passes through the same single-statement gate the query builder uses. The DPoP middleware now requires its replay store at mount time instead of silently mounting a proof-of-possession gate that performed no replay check. And session rotation re-keys the device fingerprint to the new session id, so a rotated session stays bound to its device instead of falsely reporting drift on the next request. **Fixed:** *Session rotation re-keys the device fingerprint to the new session id* — A session's optional device fingerprint is keyed to its session id, so that a stolen database cannot replay the binding. `b.session.rotate` moved the session id but left the stored fingerprint keyed to the old id, so the next `verify` recomputed the fingerprint against the new id and mismatched - reporting a false `fingerprintDrift` (which destroys the session under strict operators, logging the user out on every rotation) or silently breaking the binding. Rotation now re-keys the fingerprint to the new session id from the live request: pass the same `{ req, fingerprintFields }` to `rotate`. A fingerprint-bound session rotated without `req` now throws, because the binding cannot otherwise follow the new id; unbound sessions are unaffected. **Security:** *OTLP exporter redacts span, event, and resource attribute values before egress* — Span, span-event, and resource attributes were serialized to the OTLP collector verbatim on both the JSON and protobuf encodings - the metric exporter scrubbed its attributes through the telemetry redactor, but the span exporter did not. An attribute value carrying a secret or PII (a bearer token in `authorization`, a `password`, an `api_key`) was therefore shipped in clear to whatever collector the deployment points at (CWE-532). Every attribute-map encoder now runs each value through `b.observability.redactAttrs` (default composes `b.redact.redact`, dropping any attribute whose redactor throws) before the wire payload, so telemetry is redacted like the log and audit egress paths. The new `b.observability.redactAttrs(attrs)` is available for operators building custom exporters. · *Per-row data residency is enforced on raw writes, read replicas, and backups* — Per-row residency was enforced only at the structured query builder. Three paths reached storage or left the deployment without it: raw SQL writes (`b.db.runSql` / `b.db.prepare().run()`, INSERT and UPDATE forms) bypassed the local residency check entirely, so a cross-border row could be written under a regulated posture with no refusal; read-replica fan-out dropped the row-residency tag, routing a regulated read with no row region identified to a residency-tagged, non-cross-border replica with no check; and `b.backup.create`'s residency check compared only the single deployment region to the destination, blind to a per-row-residency table that admits rows from several regions. Raw writes now parse the target table and residency value and apply the same gate the builder does; the replica read now fails closed when the row region is unidentified; and backup now emits a per-row cross-border advisory for any declared residency table whose admitted regions differ from the backup destination. · *Schema and DSR DDL routes through the single-statement gate* — The CREATE TABLE / ALTER TABLE statements emitted by the schema reconciler and the DSR ticket store were assembled and run without the single-statement / NUL / unterminated-quote / unbalanced-paren gate that every query the builder emits already passes. That gate is now a shared check both the builder's catalog emitter and the schema/DSR DDL path call, so a terminator, comment marker, or unbalanced quote that reached a DDL fragment is refused at emit time on every backend. · *DPoP middleware requires its replay store at mount time* — `b.middleware.dpop` documented `replayStore` as required, but the factory read it optionally and gated the jti-replay check behind its presence - omitting it mounted a proof-of-possession gate that performed no replay check, so a captured DPoP proof could be replayed indefinitely (RFC 9449 §11.1). The middleware now requires the store at config time: a missing store, or a store lacking `checkAndInsert`, throws when the middleware is created instead of failing open at request time. The low-level `b.auth.dpop.verify` primitive keeps `replayStore` optional for advanced callers that track jti themselves.
 
 - v0.15.3 (2026-06-12) — **DDL hardening in b.sql, schema-confined column introspection on Postgres and MySQL, and a classical-downgrade audit on proxy-tunneled TLS.** This release hardens the data layer and closes a transport audit gap. The b.sql builder refuses an unrecognised column type that carries a statement terminator, quote, or comment marker - the one position in an otherwise quote-by-construction DDL builder where a verbatim string reached the emitted statement - and routes the finished CREATE TABLE through the same single-statement gate every other verb uses. The schema reconciler's column introspection is now confined to the schema or database the bare-named CREATE TABLE actually writes into (current_schema() on Postgres, DATABASE() on MySQL), so a same-named table in another schema no longer pollutes the column set, silently skipping an ADD COLUMN or fabricating false schema drift that refuses a regulated-posture boot. Two further builder gaps are fixed: a column-level primary key combined with a composite primaryKey now fails at build time with a clear error instead of producing invalid DDL, and a MySQL upsert read-back keyed by a cast or a server-evaluated function now renders the cast (or refuses the function) instead of binding an internal wrapper. Finally, an HTTPS request sent through a configured proxy now emits the tls.classical_downgrade audit when the handshake falls back to a classical group, the same as a direct connection. **Fixed:** *Schema reconciliation reads columns from the right schema on Postgres and MySQL* — The reconciler's column introspection queried information_schema with no schema filter, so on a Postgres instance or MySQL server hosting more than one schema/database with a same-named table, the live column set was the union across schemas. That could silently skip an ADD COLUMN the table needed, or report false drift that refuses a boot under a pinned regulated posture. Introspection is now confined to current_schema() (Postgres) / DATABASE() (MySQL) - the schema the bare-named CREATE TABLE lands in. SQLite (PRAGMA, per-file) is unchanged. · *createTable rejects a contradictory primary-key declaration at build time* — Declaring both a column-level primary key (primaryKey / autoIncrement / serial) and a composite opts.primaryKey emitted two PRIMARY KEY clauses, which every dialect rejects at the driver mid-migration. The builder now refuses the contradiction at build time with a clear error; a single column PK, or a composite primaryKey with no column-level PK, is unaffected. · *MySQL upsert read-back resolves a cast or function conflict key instead of binding a wrapper* — On MySQL, an upsert whose conflict key was a b.sql.cast(...) or b.sql.fn(...) built a read-back SELECT that bound the wrapper object, so the read-back matched no rows. A cast conflict key now renders as CAST(? AS type) binding the inner value; a server-evaluated function conflict key (which has no stable read-back identity) is refused with a clear error. Plain scalar conflict keys are unchanged. · *Proxy-tunneled TLS emits the classical-downgrade audit* — An HTTPS upstream reached through a configured proxy performed its TLS handshake without emitting the tls.classical_downgrade audit on a classical-group fallback, leaving the post-quantum-readiness inventory incomplete for proxied requests. Both the upstream handshake and the proxy-leg handshake now emit the audit on a classical fallback, matching the direct connection path. The handshake itself is unchanged (still hybrid-preferred TLSv1.3). **Security:** *b.sql refuses an injection-bearing verbatim column type and gates every CREATE TABLE* — An unrecognised column type passed to b.sql.createTable / alterTable was emitted into the DDL verbatim - the single raw-emission position in a builder that otherwise quotes every identifier and guards every constraint fragment. A type such as "text); DROP TABLE secrets; --" could therefore smuggle a stacked statement. The builder now refuses, at build time, a verbatim type carrying a statement terminator or comment marker, and routes the finished CREATE TABLE / ALTER TABLE statement through the same single-statement / NUL / unterminated-quote / unbalanced-paren gate every SELECT / INSERT / UPDATE / DELETE / UPSERT already used - so an unbalanced quote is caught there. Legitimate types are unaffected: VARCHAR(255), NUMERIC(10,2), DOUBLE PRECISION, TIMESTAMP WITH TIME ZONE, and MySQL ENUM('a','b') / SET(...) (which need balanced quotes) all still pass.

package/MIGRATING.md

@@ -14,6 +14,49 @@ The framework has no `deprecate()`-marked surface awaiting removal.
 
 Listed newest-first.
 
+### v0.15.6 — `b.auth.sdJwtVc — ES256 / ES384 signatures are now JOSE raw r||s, not DER`
+
+`b.auth.sdJwtVc` now signs and verifies ES256 / ES384 with `dsaEncoding: "ieee-p1363"` (raw r||s), the encoding JOSE / JWS and EUDI wallets require. Previously it used node:crypto's default DER ECDSA encoding, so a credential this issuer signed was rejected by conformant verifiers and the library rejected conformant holders' key-binding JWTs. The signature bytes change shape (64 bytes for ES256, 96 for ES384, no leading `0x30` SEQUENCE tag).
+
+No code change is needed — interop with conformant JOSE / wallet verifiers now works where it previously failed. Two things to re-check if you integrated with the OLD output:
+
+- A previously-issued ES256 / ES384 SD-JWT-VC signed by an earlier version is DER-encoded; re-issue it (signatures are not portable across the encodings). Tokens are short-lived, so this clears on the next issuance cycle.
+- If you pinned, cached, or asserted on the raw signature bytes of this library's ES256 / ES384 output, update the fixture — the bytes are now `ieee-p1363`. EdDSA / ML-DSA signatures are unchanged.
+
+### v0.15.6 — `b.auth.oauth verifyIdToken — skipExpCheck is restricted to logout tokens`
+
+`verifyIdToken`'s `skipExpCheck` option now throws (`auth-oauth/skip-exp-check-not-allowed`) on any token that is not an OIDC Back-Channel-Logout token (no `http://schemas.openid.net/event/backchannel-logout` event claim), and enforces an `iat` freshness floor on logout tokens (`auth-oauth/logout-token-stale`). Previously any caller could pass `skipExpCheck: true` to verify an expired — or replayed — ID token. The option was undocumented and only used internally by the back-channel-logout path, which is unaffected.
+
+No change for normal ID-token verification or for the framework's back-channel-logout handling. If you called `verifyIdToken(token, { skipExpCheck: true })` directly on a non-logout token (an undocumented use), it now throws: drop the option so expiry is validated, or verify the token through the back-channel-logout path if it really is a logout token.
+
+### v0.15.4 — `b.middleware.dpop — replayStore now required at mount`
+
+`b.middleware.dpop` now REQUIRES a `replayStore` at mount time and throws (`auth-dpop/replay-store-required`) if it is omitted or lacks `checkAndInsert`. Previously the jti-replay check was gated behind store presence, so omitting it silently mounted a DPoP gate with NO replay defense — a captured proof could be replayed indefinitely (RFC 9449 §11.1).
+
+Operators mounting `b.middleware.dpop` without a `replayStore`:
+
+```js
+b.middleware.dpop({
+  replayStore: b.nonceStore.create({ backend: "memory" }), // shared backend on multi-process
+  // ...other opts
+});
+```
+
+Use a process-shared `replayStore` backend (not `"memory"`) on a multi-process / multi-node deployment so a proof replayed against a different worker is still caught. The low-level `b.auth.dpop.verify` primitive keeps `replayStore` optional for advanced callers that track `jti` themselves.
+
+### v0.15.4 — `b.session.rotate — { req } required for a fingerprint-bound session`
+
+Rotating a session created with a device fingerprint (`{ req, fingerprintFields }`) now requires the same `{ req, fingerprintFields }` at `b.session.rotate()`; a bound session rotated without `req` throws (`ROTATE_FINGERPRINT_REQ_REQUIRED`). The fingerprint is keyed to the session id, so rotation must re-key it to the new id from the live request — previously rotation left the old-id-keyed hash in place, which made the next `verify` false-drift (logging the user out under strict operators) or silently break the binding. Unbound sessions are unaffected.
+
+Operators who rotate fingerprint-bound sessions (login / MFA / role-change transitions):
+
+```js
+// Pass the same { req, fingerprintFields } used at create():
+await b.session.rotate(oldToken, { req, fingerprintFields: ["clientIp", "userAgent"], reason: "mfa" });
+```
+
+If you rotate a bound session from a context without the request, you must supply `req` so the binding can follow to the new session id. Sessions created WITHOUT a fingerprint need no change.
+
 ### v0.9.15 — `b.middleware.idempotencyKey.dbStore — table schema`
 
 Single `v` JSON-envelope column split into discrete `fingerprint` / `status_code` / `headers` / `body` / `expires_at` columns; `headers` + `body` are sealed via `b.cryptoField.sealRow` when vault is initialized; `k` column carries the sha3-512 namespace-hash of the operator-supplied key.

package/README.md

@@ -85,10 +85,12 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
   - Pluggable storage via `b.session.useStore` + first-party `b.session.stores.localDbThin` (tmpfs-fast)
   - Opaque-userId anonymous sessions via `create({ anonymous: true })`
   - Idle / absolute timeouts, fingerprint drift detection + anomaly scoring, brute-force lockout
+  - Session-fixation rotation (`b.session.rotate`) re-keys the sid-bound device fingerprint to the new id — pass the same `{ req, fingerprintFields }` used at `create` (a fingerprint-bound session rotated without `req` is refused, so the binding can never silently break or false-drift)
 - **Authorization** — RBAC + per-role DB binding + role-spec `requireMfa` + per-route MFA freshness window + ABAC predicate registry (`b.permissions`); API keys with rotation (`b.apiKey`)
 - **Workflow gates** — break-glass column gates with second-factor + audit (`b.breakGlass`); two-person-rule m-of-n approval with cooling-off lock + cancellation (`b.dualControl`)
 - **Financial / Open Banking** — FAPI 2.0 Final composite posture (PAR + PKCE-S256 + DPoP-or-mTLS + RFC 9207); runtime enforcement helpers `b.fapi2.assertCallback` (refuses missing iss + bare-param under message-signing) and `b.fapi2.assertAuthzRequest` (refuses non-JAR); CFPB §1033 / FDX 6.0 consumer-financial-data-sharing wrapper (`b.fdx`)
-- **Data-subject coordination** — cross-table export / rectify / erase / restrict / objection (`b.subject`, `b.subject.eraseHard`); subject-level legal-hold registry consulted by erase + retention paths (FRCP Rule 26/37(e), GDPR Art 17(3)(e), SEC Rule 17a-4, HIPAA §164.530(j)(2)) (`b.legalHold`)
+- **DPoP proof-of-possession** — RFC 9449 sender-constrained tokens; `b.middleware.dpop` requires a `replayStore` (a `b.nonceStore`-shaped `{ checkAndInsert }`) at mount so single-use jti-replay defense is always enforced — mounting it without the store throws at config time rather than failing open at request time
+- **Data-subject coordination** — cross-table export / rectify / erase / restrict / objection (`b.subject`, `b.subject.eraseHard`); subject-level legal-hold registry consulted by erase + retention paths (FRCP Rule 26/37(e), GDPR Art 17(3)(e), SEC Rule 17a-4, HIPAA §164.530(j)(2)) (`b.legalHold`). The legal-hold reason / custodian / citation and the Art. 18 restriction reason — free text that ties a subject to a legal matter — are sealed at rest under the vault key, not stored in clear
 - **WORM retention** — write-once-read-many records over any backing store (`b.worm.create`): `compliance` / `governance` Object-Lock modes, extend-only `retainUntil`, legal holds, and a tamper-evident SHA3-512 digest verified on read — the store-agnostic application-level companion to `b.objectStore`'s S3 Object Lock, for sealed-DB / filesystem / non-S3 backends (SEC 17a-4(f), CFTC 1.31, FINRA 4511)
 - **Account safety** — adaptive bot-challenge staircase (`b.authBotChallenge`); session-to-device-posture binding with fail-closed verify (`b.sessionDeviceBinding`)
 - **Anonymous authorization** — Privacy Pass origin side (RFC 9577/9578 — `b.privacyPass`): issue a `WWW-Authenticate: PrivateToken` challenge and verify a presented Blind-RSA (type 0x0002) token against the issuer public key, with no issuer callback and no client identity
@@ -97,7 +99,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 
 - **At-rest envelope** — envelope-versioned PQC (ML-KEM-1024 + P-384 hybrid, XChaCha20-Poly1305, SHAKE256); vault sealing (`b.crypto`, `b.vault`)
 - **Power-on self-test** — `b.crypto.selfTest()` runs FIPS 140-3-style integrity checks: NIST FIPS 202 known-answer tests (SHA3-256/512, SHAKE256), AEAD round-trip + tamper-detect, and ML-KEM-1024 / ML-DSA-87 / SLH-DSA-SHAKE-256f pairwise-consistency + negative tests; fails closed (throws) on any mismatch
-- **Field-level + crypto-shred** — `b.cryptoField.eraseRow`; per-column and per-row data residency tagging enforced at the write boundary (cross-border DML refused under GDPR / UK-GDPR / DPDP / PIPL / LGPD / APPI / PDPA postures) + per-row keys (each row's key derives from a CSPRNG row-secret sealed under the vault root, never from an on-disk value) so destroying a row's wrapped secret leaves its WAL / replica / backup residual ciphertext undecryptable even with the vault root key (`b.cryptoField.declareColumnResidency`, `b.cryptoField.declarePerRowResidency`, `b.cryptoField.declarePerRowKey`)
+- **Field-level + crypto-shred** — `b.cryptoField.eraseRow`; per-column and per-row data residency tagging enforced at the write boundary (cross-border DML refused under GDPR / UK-GDPR / DPDP / PIPL / LGPD / APPI / PDPA postures) — on the structured builder, on raw SQL writes (`b.db.runSql` / `b.db.prepare().run()`, parsed quote-aware and failing closed when unparseable), on read-replica fan-out (a regulated read with no row region identified is refused), and surfaced by `b.backup.create` for any per-row-residency table whose admitted regions differ from the backup destination — plus per-row keys (each row's key derives from a CSPRNG row-secret sealed under the vault root, never from an on-disk value) so destroying a row's wrapped secret leaves its WAL / replica / backup residual ciphertext undecryptable even with the vault root key (`b.cryptoField.declareColumnResidency`, `b.cryptoField.declarePerRowResidency`, `b.cryptoField.listPerRowResidency`, `b.cryptoField.declarePerRowKey`)
 - **AAD-bound sealed columns** — AEAD tag tied to `(table, rowId, column, schemaVersion)`; copy-paste between rows or schema-version replay surfaces as refused decrypt (`b.vault.aad`). The database encryption key is sealed the same way — bound to its purpose, data directory, and key path — so a relocated key file fails to unseal; an older unbound key upgrades itself on first load. A vault-key rotation re-seals every AAD-bound cell, the database key, and tenant archives under the new keypair and refuses rather than silently orphaning a store it cannot reach (`b.vaultRotate`, `b.vault.aad.resealRoot`, `b.archive.rewrapTenant`)
 - **Keyed lookup hashes** — sealed-column equality-lookup hashes default to salted SHA3-512 and can opt into a keyed `hmac-shake256` MAC off a per-deployment key (`cryptoField.registerTable({ derivedHashMode })`, `b.vault.getDerivedHashMacKey`), making the lookup hash unforgeable and un-correlatable across deployments
 - **Signed webhooks + API encryption** — SLH-DSA-SHAKE-256f default; ML-DSA-65 opt-in; ECIES API encryption (`b.webhook`, `b.crypto`)
@@ -138,7 +140,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 ### Defensive parsers
 
 - **JSON / SQL / schema** — `b.safeJson` (with `maxKeys` cap defending CVE-2026-21717 V8 HashDoS), `b.safeBuffer`, `b.safeSql`, `b.safeSchema`
-- **URL + path** — `b.safeUrl` (IDN mixed-script / homograph refuse); `b.safeJsonPath` (refuses filter `?(...)`, deep-scan `$..`, script-shape `(@.x)` for safe Postgres JSONB ops)
+- **URL + path** — `b.safeUrl` (IDN mixed-script / homograph refuse; `canonicalize` collapses obfuscated host + IP forms — decimal / octal / hex / IPv4-mapped / zero-compressed IPv6, IDN → punycode, default-port, trailing-dot, percent-encoding — to one comparable string so SSRF allowlist / dedup checks can't be bypassed by re-encoding the same address, with `b.ssrfGuard.canonicalizeHost` for the host-only path); `b.safeJsonPath` (refuses filter `?(...)`, deep-scan `$..`, script-shape `(@.x)` for safe Postgres JSONB ops)
 - **Binary codec** — `b.cbor` bounded deterministic CBOR (RFC 8949 §4.2): depth/size caps, indefinite-length + reserved-info + tag + duplicate-key refusal, `requireDeterministic` canonical-form check; the in-tree substrate under COSE / CWT / SCITT / WebAuthn attestation
 - **COSE messages** — `b.cose` the full RFC 9052 message-type set over `b.cbor`: COSE_Sign1 sign/verify (attached or detached payload), COSE_Encrypt0 single-recipient AEAD, COSE_Mac0 shared-key HMAC (mac0/macVerify0), plus `importKey` (COSE_Key → KeyObject) and `exportKey` (KeyObject → COSE_Key, the inverse — ship a verification key as RFC 9052 §7 bytes). Signatures use classical ES256/384/512 + EdDSA (final COSE ids, interoperable today) plus ML-DSA-87 (PQC-forward, draft id); bounded + alg-allowlisted + crit-bypass-checked verification; AEAD ChaCha20/Poly1305 default (AES-GCM opt-in); the signed-statement substrate under SCITT / CWT / mdoc / C2PA
 - **CBOR Web Token** — `b.cwt` CWT sign/verify (RFC 8392) over `b.cose`: standard-claim mapping (iss/sub/aud/exp/nbf/iat/cti) + `exp`/`nbf` clock-skew enforcement + `iss`/`aud` matching; the CBOR-native JWT for constrained / IoT / FIDO / verifiable-credential contexts
@@ -218,7 +220,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 ### Observability
 
 - **Audit chain** — tamper-evident, SLH-DSA-signed checkpoints; CADF (ISO/IEC 19395:2017) envelope export for federated SIEM (`b.audit`, `b.audit.export({ format: "cadf" })`)
-- **Metrics + tracing** — `b.metrics`, `b.tracing` (OTel pass-through); OTLP/HTTP-JSON exporter for traces + metrics (`b.otelExport`)
+- **Metrics + tracing** — `b.metrics`, `b.tracing` (OTel pass-through); OTLP/HTTP-JSON exporter for traces + metrics (`b.otelExport`). Span / metric / resource attribute **values** are scrubbed through the telemetry redactor before egress (`b.observability.redactAttrs`, default composes `b.redact.redact`) so a secret or PII in an attribute value never reaches the collector verbatim (CWE-532); operators building a custom exporter apply the same gate
 - **Log-stream sinks** — local file rotation, generic webhook, OTLP/HTTP-JSON OR OTLP/gRPC, AWS CloudWatch Logs via SigV4 with optional autoCreate, RFC 5424 syslog over UDP/TCP/TLS (`b.logStream`)
 - **PII redaction** — `b.redact`
 - **Decoy detection** — canary-credential / decoy-record framework auditing every positive lookup as `honeytoken.tripped` (`b.honeytoken`)

package/lib/auth/oauth.js

@@ -1833,10 +1833,30 @@ function create(opts) {
     var now = Math.floor(Date.now() / C.TIME.seconds(1));
     var skewSec = Math.floor(clockSkewMs / C.TIME.seconds(1));
     // OIDC Back-Channel Logout 1.0 §2.4 — logout tokens have no `exp`
-    // claim; freshness comes from `iat` + jti-replay window. Operators
-    // verifying logout tokens pass `skipExpCheck: true`. ID tokens
-    // never set this and continue to require `exp`.
-    if (!vopts.skipExpCheck) {
+    // claim; freshness comes from `iat` + jti-replay window. `skipExpCheck`
+    // bypasses the exp gate for that path ONLY. It is a public-API option,
+    // so it must be self-guarding: refuse it on any token that is not a
+    // logout token (no back-channel-logout event), or a caller could verify
+    // an expired/replayed id_token clean. Logout tokens then carry no exp,
+    // so `iat` is the only freshness bound — enforce a max-age floor.
+    if (vopts.skipExpCheck) {
+      if (!payload.events || typeof payload.events !== "object" ||
+          !payload.events["http://schemas.openid.net/event/backchannel-logout"]) {
+        throw new OAuthError("auth-oauth/skip-exp-check-not-allowed",
+          "skipExpCheck is only valid for back-channel-logout tokens " +
+          "(OIDC Back-Channel Logout 1.0 §2.4); this token carries no logout event claim");
+      }
+      // Honor the operator's configured replay window. verifyBackchannelLogoutToken
+      // exposes vopts.maxAgeSec (default 5 min) and passes it through here; a
+      // deployment that widened the window must not have this freshness floor
+      // reject a token between the default and its configured max age.
+      var logoutMaxAgeSec = (typeof vopts.maxAgeSec === "number" && isFinite(vopts.maxAgeSec) &&
+        vopts.maxAgeSec > 0) ? vopts.maxAgeSec : DEFAULT_LOGOUT_TOKEN_MAX_AGE_SEC;
+      if (typeof payload.iat !== "number" || payload.iat + logoutMaxAgeSec + skewSec < now) {
+        throw new OAuthError("auth-oauth/logout-token-stale",
+          "logout token iat is older than " + logoutMaxAgeSec + "s (no exp; iat is the freshness bound)");
+      }
+    } else {
       if (typeof payload.exp !== "number" || payload.exp + skewSec < now) {
         throw new OAuthError("auth-oauth/expired", "ID token expired (exp=" + payload.exp + ", now=" + now + ")");
       }
@@ -2212,6 +2232,10 @@ function create(opts) {
       // Logout tokens have no exp claim per OIDC Back-Channel Logout
       // §2.4 — the freshness gate is iat + jti-replay window.
       skipExpCheck:   true,
+      // Pass the operator's configured replay window through so verifyIdToken's
+      // iat freshness floor uses it, not the 5-min default (the wrapper's own
+      // maxAgeSec check below stays as a belt-and-suspenders bound).
+      maxAgeSec:      vopts.maxAgeSec,
     });
     var claims = verified.claims;
 

package/lib/auth/saml.js

@@ -684,10 +684,11 @@ function create(opts) {
         // as Bearer (Profile §3.1 incorporates §3 by reference).
         var nbHok = _attr(scdHok, "NotBefore");
         var noaHok = _attr(scdHok, "NotOnOrAfter");
+        if (!noaHok) continue;                                                                      // §3.1 (incorporates §3) — time-bound required
+        var noaHokSec = Date.parse(noaHok) / 1000;                                                  // ms→s
+        if (!isFinite(noaHokSec) || noaHokSec < nowSec - clockSkewSec) continue;                    // unparseable or expired
         if (nbHok && isFinite(Date.parse(nbHok) / 1000) &&                                          // ms→s
             Date.parse(nbHok) / 1000 > nowSec + clockSkewSec) continue;                             // ms→s
-        if (noaHok && isFinite(Date.parse(noaHok) / 1000) &&                                        // ms→s
-            Date.parse(noaHok) / 1000 < nowSec - clockSkewSec) continue;                            // ms→s
         var recipHok = _attr(scdHok, "Recipient");
         if (recipHok && recipHok !== opts.assertionConsumerServiceUrl) continue;
         hokOk = true;
@@ -697,12 +698,9 @@ function create(opts) {
       var scd = _findChild(sc, "SubjectConfirmationData", SAML_NS.assertion);
       if (!scd) continue;
       var notOnOrAfter = _attr(scd, "NotOnOrAfter");
-      if (notOnOrAfter) {
-        var t = Date.parse(notOnOrAfter) / 1000;                                                // ms→s
-        if (!isFinite(t) || t < nowSec - clockSkewSec) {
-          continue; // expired confirmation — try next
-        }
-      }
+      if (!notOnOrAfter) continue;       // §4.1.4.2 — Bearer requires NotOnOrAfter (no unbounded freshness)
+      var t = Date.parse(notOnOrAfter) / 1000;                                                  // ms→s
+      if (!isFinite(t) || t < nowSec - clockSkewSec) continue;   // unparseable or expired confirmation — try next
       var notBefore = _attr(scd, "NotBefore");
       if (notBefore) {
         var nb = Date.parse(notBefore) / 1000;                                                  // ms→s

package/lib/auth/sd-jwt-vc.js

@@ -126,12 +126,25 @@ function _hashDisclosure(disclosureStr, hashAlg) {
   return h.digest().toString("base64url");
 }
 
+// JOSE/JWS — and EUDI wallets — require ECDSA signatures as raw r||s
+// ("ieee-p1363"); node:crypto defaults to DER (ASN.1 SEQUENCE). Wrap the EC
+// key so ES256/ES384 sign + verify emit/expect the JOSE encoding. Without it
+// a token this library signs is rejected by every conformant verifier (and
+// the library rejects their raw-r||s KB-JWTs). EdDSA / ML-DSA keys pass
+// through unchanged. Mirrors oauth.js / dpop.js / jwt-external.js.
+function _ecKeyParam(algorithm, key) {
+  if (algorithm === "ES256" || algorithm === "ES384") {
+    return { key: key, dsaEncoding: "ieee-p1363" };
+  }
+  return key;
+}
+
 function _signJwt(header, payload, privateKey, algorithm) {
   var headerStr = _b64uEncode(safeJson.stringify(header));
   var payloadStr = _b64uEncode(safeJson.stringify(payload));
   var signingInput = headerStr + "." + payloadStr;
   var sigAlgo = _resolveSigAlgo(algorithm);
-  var sig = nodeCrypto.sign(sigAlgo, Buffer.from(signingInput, "ascii"), privateKey);
+  var sig = nodeCrypto.sign(sigAlgo, Buffer.from(signingInput, "ascii"), _ecKeyParam(algorithm, privateKey));
   return signingInput + "." + sig.toString("base64url");
 }
 
@@ -144,7 +157,7 @@ function _verifyJwt(token, publicKey, algorithm) {
   var signingInput = parts[0] + "." + parts[1];
   var sig = _b64uDecodeBuf(parts[2]);
   var sigAlgo = _resolveSigAlgo(algorithm);
-  var ok = nodeCrypto.verify(sigAlgo, Buffer.from(signingInput, "ascii"), publicKey, sig);
+  var ok = nodeCrypto.verify(sigAlgo, Buffer.from(signingInput, "ascii"), _ecKeyParam(algorithm, publicKey), sig);
   if (!ok) {
     throw new AuthError("auth-sd-jwt-vc/bad-signature",
       "JWT signature verification failed");

package/lib/codepoint-class.js

@@ -271,7 +271,30 @@ function escapeRegExp(s) {
 // lives once.
 var HEX_PAIR_RE = /^[0-9A-Fa-f]{2}$/;
 
+// isAsciiAlnum — codepoint is an ASCII letter or digit (A-Z / a-z / 0-9).
+// The ASCII-alphanumeric range test recurs across every byte-class parser
+// (URL unreserved, XML name chars, header tokens); centralized so the three
+// range literals live once rather than as a re-rolled `cc>=0x41&&...` chain.
+function isAsciiAlnum(cc) {
+  return (cc >= 0x41 && cc <= 0x5a) ||   // A-Z
+         (cc >= 0x61 && cc <= 0x7a) ||   // a-z
+         (cc >= 0x30 && cc <= 0x39);     // 0-9
+}
+
+// isUnreserved — codepoint is in the RFC 3986 §2.3 unreserved set:
+// ALPHA / DIGIT / "-" / "." / "_" / "~". A percent-escape of an unreserved
+// character is over-encoding the URI spec says SHOULD be decoded (§6.2.2.3).
+function isUnreserved(cc) {
+  return isAsciiAlnum(cc) ||
+         cc === 0x2d ||   // -
+         cc === 0x2e ||   // .
+         cc === 0x5f ||   // _
+         cc === 0x7e;     // ~
+}
+
 module.exports = {
+  isAsciiAlnum:      isAsciiAlnum,
+  isUnreserved:      isUnreserved,
   hex4:              hex4,
   charClass:         charClass,
   fromCp:            fromCp,

package/lib/crypto-field.js

@@ -1348,7 +1348,16 @@ function _upgradeDerivedHashesOnRead(s, table, out, dbHandle) {
     : _resolveLocalDbHandle();
   if (!handle) return;
   try {
-    var updBuilt = sql.update(table, { dialect: "sqlite", quoteName: true })
+    // The rewrite runs on whatever handle resolved the read. The local b.db is
+    // node:sqlite; a caller-supplied external handle declares its dialect on
+    // handle.dialect ("postgres" | "mysql"), so the UPDATE must quote
+    // identifiers for THAT dialect — a sqlite-quoted UPDATE ("users") is parsed
+    // as a string literal by MySQL (which expects `users`) and the durable
+    // re-hash silently no-ops. Resolve the dialect the way db-query._dialect()
+    // does (validated set, sqlite default).
+    var handleDialect = (handle.dialect === "postgres" || handle.dialect === "mysql" ||
+      handle.dialect === "sqlite") ? handle.dialect : "sqlite";
+    var updBuilt = sql.update(table, { dialect: handleDialect, quoteName: true })
       .set(upgrades)
       .where("_id", rowId)
       .toSql();

package/lib/db-query.js

@@ -421,26 +421,51 @@ class Query {
     }
     // Sealed-field translation: rewrite predicate to use derived hash if available
     if (this._isSealedField(field)) {
-      var lookup = cryptoField.lookupHash(this._cryptoFieldKey(), field, value);
-      if (!lookup) {
-        throw new Error(
-          "cannot query sealed column '" + this._cryptoFieldKey() + "." + field +
-          "' without a derived hash. Declare derivedHashes: { <name>: { from: '" + field + "' } } " +
-          "in the table's schema config."
-        );
-      }
-      field = lookup.field;
-      if (op === "=" && lookup.legacyValue != null && lookup.legacyValue !== lookup.value) {
-        // Dual-read across the v0.15.0 keyed-MAC default flip: a row written
-        // before the flip carries the legacy salted-sha3 digest, so an
-        // equality lookup on a sealed field must match BOTH the active
-        // keyed-MAC digest and the legacy one — otherwise the flip silently
-        // drops every un-migrated row from the result. b.sql expands the
-        // IN-list to (?, ?) and binds each digest.
-        op = "IN";
-        value = [lookup.value, lookup.legacyValue];
+      var missingHashMsg =
+        "cannot query sealed column '" + this._cryptoFieldKey() + "." + field +
+        "' without a derived hash. Declare derivedHashes: { <name>: { from: '" + field + "' } } " +
+        "in the table's schema config.";
+      if (op === "IN") {
+        // Membership query on a sealed column: each candidate plaintext maps
+        // to its own derived hash. Hashing the whole array as one value (the
+        // scalar path below) never matches — whereIn/$in on a sealed column
+        // would throw or silently miss. Expand to the per-element hash set,
+        // and for each element ALSO include the legacy salted-sha3 digest so
+        // membership dual-reads across the v0.15.0 keyed-MAC flip exactly as
+        // the "=" path does (un-migrated rows must still be found).
+        if (!Array.isArray(value) || value.length === 0) {
+          throw new Error("where IN on sealed column '" + this._cryptoFieldKey() +
+            "." + field + "' requires a non-empty array of values");
+        }
+        var sealedField = null;
+        var hashedValues = [];
+        for (var inI = 0; inI < value.length; inI++) {
+          var elemLookup = cryptoField.lookupHash(this._cryptoFieldKey(), field, value[inI]);
+          if (!elemLookup) throw new Error(missingHashMsg);
+          sealedField = elemLookup.field;
+          hashedValues.push(elemLookup.value);
+          if (elemLookup.legacyValue != null && elemLookup.legacyValue !== elemLookup.value) {
+            hashedValues.push(elemLookup.legacyValue);
+          }
+        }
+        field = sealedField;
+        value = hashedValues;
       } else {
-        value = lookup.value;
+        var lookup = cryptoField.lookupHash(this._cryptoFieldKey(), field, value);
+        if (!lookup) throw new Error(missingHashMsg);
+        field = lookup.field;
+        if (op === "=" && lookup.legacyValue != null && lookup.legacyValue !== lookup.value) {
+          // Dual-read across the v0.15.0 keyed-MAC default flip: a row written
+          // before the flip carries the legacy salted-sha3 digest, so an
+          // equality lookup on a sealed field must match BOTH the active
+          // keyed-MAC digest and the legacy one — otherwise the flip silently
+          // drops every un-migrated row from the result. b.sql expands the
+          // IN-list to (?, ?) and binds each digest.
+          op = "IN";
+          value = [lookup.value, lookup.legacyValue];
+        } else {
+          value = lookup.value;
+        }
       }
     }
     _validateField(field);

package/lib/db.js

@@ -304,6 +304,10 @@ var FRAMEWORK_SCHEMA = [
       citation:      "TEXT",
       retainUntil:   "INTEGER",
     },
+    // The legal-basis / custodian / ticket-citation free text links a data
+    // subject to a legal matter — PII at rest. Sealed like the DSR ticket store
+    // (b.legalHold seals on write + unseals on read through cryptoField).
+    sealedFields: ["reason", "placedBy", "custodian", "citation"],
     indexes: ["placedAt"],
   },
   {

package/lib/gate-contract.js

@@ -1992,12 +1992,22 @@ function defineGuard(spec) {
   // to the right ctx field by KIND (or spec.ctxFields). Guards with a bespoke
   // gate pass spec.gate; guards whose gate is the standard chain take this
   // default.
-  // Raw opts pass straight through to spec.validate and buildGuardGate —
-  // matching the hand-written gates, whose validate resolves profile/posture
-  // internally (validate calls its own _resolveOpts). Pre-resolving here
-  // would double-resolve.
-  function defaultGate(opts) {
-    opts = opts || {};
+  // Resolve the profile + posture BEFORE buildGuardGate reads its runtime /
+  // forensic caps: forensicSnippetBytes lives on the posture and maxRuntimeMs
+  // on the profile, NOT on the raw caller opts. Passing raw opts through dropped
+  // a regulated posture's forensic cap to 0 (no forensic snapshot on a refusal)
+  // and the profile's runtime cap to uncapped — the hand-written gates resolve
+  // in their own gate(), and the default gate must match. resolveProfileAndPosture
+  // is idempotent over an already-resolved opts, so spec.validate's internal
+  // resolution stays correct.
+  function defaultGate(rawOpts) {
+    var opts = resolveProfileAndPosture(rawOpts || {}, {
+      profiles:           profiles,
+      compliancePostures: postures,
+      defaults:           defaults,
+      errorClass:         ErrorClass,
+      errCodePrefix:      prefix,
+    });
     var perCtx = spec.defaultGateCheck || function (ctx) {
       var value = _ctxValueForKind(spec.kind, ctx, ctxFields);
       if (!value) return { ok: true, action: "serve" };

package/lib/legal-hold.js

@@ -64,6 +64,7 @@ var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var sql = require("./sql");
+var cryptoField = require("./crypto-field");
 var { defineClass } = require("./framework-error");
 
 // Local-SQLite framework table names. These run against the b.db() handle
@@ -185,6 +186,16 @@ function create(opts) {
       ], SQL_OPTS);
       fn(ddl.sql);
     }
+    // Register the table's PII columns for at-rest sealing. The framework
+    // SQLite path also registers this via db.init() FRAMEWORK_SCHEMA, but the
+    // external-db / cluster path and a post-_resetForTest registry need this
+    // idempotent guard so sealRow/unsealRow below are never no-ops (which would
+    // store the legal-basis / custodian / citation free text in clear).
+    if (!cryptoField.getSchema(HOLD_TABLE)) {
+      cryptoField.registerTable(HOLD_TABLE, {
+        sealedFields: ["reason", "placedBy", "custodian", "citation"],
+      });
+    }
   }
 
   function place(subjectId, args) {
@@ -222,7 +233,7 @@ function create(opts) {
     }
     var nowMs = Date.now();
     var placeInsBuilt = sql.insert(HOLD_TABLE, SQL_OPTS)
-      .values({
+      .values(cryptoField.sealRow(HOLD_TABLE, {
         subjectIdHash: hash,
         placedAt:      nowMs,
         placedBy:      args.placedBy || null,
@@ -230,7 +241,7 @@ function create(opts) {
         custodian:     args.custodian || null,
         citation:      args.citation || null,
         retainUntil:   args.retainUntil || null,
-      })
+      }))
       .toSql();
     var placeInsStmt = db.prepare(placeInsBuilt.sql);
     placeInsStmt.run.apply(placeInsStmt, placeInsBuilt.params);
@@ -268,6 +279,7 @@ function create(opts) {
         "denied");
       return { error: "not-held" };
     }
+    existing = cryptoField.unsealRow(HOLD_TABLE, existing);
     var relDelBuilt = sql.delete(HOLD_TABLE, SQL_OPTS)
       .where("subjectIdHash", hash)
       .toSql();
@@ -312,6 +324,7 @@ function create(opts) {
     var getStmt = db.prepare(getBuilt.sql);
     var row = getStmt.get.apply(getStmt, getBuilt.params);
     if (!row) return null;
+    row = cryptoField.unsealRow(HOLD_TABLE, row);
     return {
       subjectId:   sid,
       placedAt:    row.placedAt,
@@ -334,6 +347,7 @@ function create(opts) {
     var rows = listStmt.all.apply(listStmt, listBuilt.params);
     var nowMs = Date.now();
     return rows.map(function (r) {
+      r = cryptoField.unsealRow(HOLD_TABLE, r);
       return {
         subjectIdHash: r.subjectIdHash,
         placedAt:      r.placedAt,

package/lib/outbox.js

@@ -85,6 +85,12 @@ var DEFAULT_MAX_ATTEMPTS    = 10;
 var DEFAULT_BACKOFF_INITIAL = C.TIME.seconds(1);
 var DEFAULT_BACKOFF_MAX     = C.TIME.minutes(5);
 var DEFAULT_BACKOFF_FACTOR  = 2;                                                   // multiplier, not bytes
+// Lease after which an in-flight row is treated as stranded by a crashed
+// publisher and reclaimed to 'pending'. Must exceed the longest expected
+// publish so a slow-but-live publish isn't reclaimed mid-flight (a reclaim
+// then re-publish is a duplicate, which at-least-once tolerates, but a tight
+// lease makes duplicates routine). Default 5 min, matching backoff.maxMs.
+var DEFAULT_CLAIM_RECLAIM_MS = C.TIME.minutes(5);
 var TOPIC_MAX_LEN           = C.BYTES.bytes(255);
 var KEY_MAX_LEN             = C.BYTES.bytes(255);
 
@@ -197,7 +203,7 @@ function create(opts) {
   validateOpts.requireObject(opts, "outbox", OutboxError);
   validateOpts(opts, [
     "externalDb", "table", "publisher",
-    "pollIntervalMs", "batchSize", "maxAttempts",
+    "pollIntervalMs", "batchSize", "maxAttempts", "claimReclaimMs",
     "retryBackoff", "audit", "name",
     "envelope", "connectorName", "connectorVersion", "dbName",
   ], "outbox.create");
@@ -223,10 +229,13 @@ function create(opts) {
     "outbox.create: batchSize", OutboxError, "outbox/bad-opts");
   validateOpts.optionalPositiveFinite(opts.maxAttempts,
     "outbox.create: maxAttempts", OutboxError, "outbox/bad-opts");
+  validateOpts.optionalPositiveFinite(opts.claimReclaimMs,
+    "outbox.create: claimReclaimMs", OutboxError, "outbox/bad-opts");
 
   var pollIntervalMs = opts.pollIntervalMs || DEFAULT_POLL_MS;
   var batchSize      = opts.batchSize      || DEFAULT_BATCH_SIZE;
   var maxAttempts    = opts.maxAttempts    || DEFAULT_MAX_ATTEMPTS;
+  var claimReclaimMs = opts.claimReclaimMs || DEFAULT_CLAIM_RECLAIM_MS;
   var name           = opts.name           || "outbox";
 
   var backoff = opts.retryBackoff || {};
@@ -355,6 +364,7 @@ function create(opts) {
       { name: "enqueued_at",     type: tsType,         notNull: true },
       { name: "next_attempt_at", type: tsType,         notNull: true },
       { name: "published_at",    type: tsType },
+      { name: "claimed_at",      type: tsType },
       { name: "attempts",        type: "INTEGER",      notNull: true, default: 0 },
       { name: "last_error",      type: "TEXT" },
       { name: "status",          type: "VARCHAR(16)",  notNull: true, default: "pending" },
@@ -366,6 +376,17 @@ function create(opts) {
       ["next_attempt_at"], { dialect: dialect, where: "status = 'pending'" }), dialect);
     await target.query(ddl.sql, ddl.params);
     await target.query(idx.sql, idx.params);
+    // Back-compat: an outbox table created before the claimed_at column
+    // existed predates the stale-in-flight reaper. CREATE TABLE above is
+    // IF NOT EXISTS, so it won't add the column to an existing table — add it
+    // idempotently here (every dialect errors if the column already exists,
+    // which a fresh table from the CREATE will; swallow that). Without
+    // claimed_at the reaper can't tell a stranded claim from a live one.
+    try {
+      var alter = sql.toExternalSql(sql.alterTable(opts.table,
+        { addColumn: { name: "claimed_at", type: tsType } }, { dialect: dialect }), dialect);
+      await target.query(alter.sql, alter.params);
+    } catch (_e) { /* column already present — idempotent add */ }
   }
 
   // ---- Publisher worker ----
@@ -428,7 +449,7 @@ function create(opts) {
         // on postgres (the whole id set as one bound array) / expanded
         // `IN (?, ?, ...)` on mysql.
         var claimUpdate = sql.update(opts.table, { dialect: dialect })
-          .set({ status: "in-flight" })
+          .set({ status: "in-flight", claimed_at: _utcNowExpr(externalDb) })
           .whereInArray("id", ids)
           .toExternalSql(dialect);
         await xdb.query(claimUpdate.sql, claimUpdate.params);
@@ -440,7 +461,7 @@ function create(opts) {
         // another publisher beat us to are skipped. whereInArray expands
         // to an `IN (?, ?, ...)` placeholder list on sqlite.
         var markUpdate = sql.update(opts.table, { dialect: dialect })
-          .set({ status: "in-flight" })
+          .set({ status: "in-flight", claimed_at: _utcNowExpr(externalDb) })
           .whereRaw("status = 'pending'", [], { allowLiterals: true })
           .whereInArray("id", ids)
           .toExternalSql(dialect);
@@ -466,6 +487,28 @@ function create(opts) {
     });
   }
 
+  // Reclaim rows stranded in 'in-flight' by a crashed publisher. A claim
+  // flips status pending → in-flight and stamps claimed_at; if the process
+  // dies before the row is marked published / retry / dead, it sits in-flight
+  // forever, because the claim path only selects status='pending'. That
+  // silently drops the event and violates the at-least-once guarantee. Reset
+  // any in-flight row whose claim is older than the lease — or that predates
+  // the claimed_at column (NULL) — back to 'pending' so the next poll
+  // re-publishes it. The lease bounds how long a legitimately slow publish is
+  // protected from reclaim; a reclaim+re-publish is a duplicate, which
+  // at-least-once tolerates. Best-effort: a failed sweep retries next poll.
+  async function _reapStaleInflight() {
+    var dialect = _sqlDialect(externalDb);
+    var cutoff = new Date(Date.now() - claimReclaimMs);
+    var stmt = sql.update(opts.table, { dialect: dialect })
+      .set({ status: "pending", claimed_at: null })
+      .whereRaw("status = 'in-flight'", [], { allowLiterals: true })
+      .whereRaw("(claimed_at IS NULL OR claimed_at <= ?)", [cutoff])
+      .toExternalSql(dialect);
+    var res = await externalDb.query(stmt.sql, stmt.params);
+    return res;
+  }
+
   async function _markPublished(id) {
     var dialect = _sqlDialect(externalDb);
     var stmt = sql.update(opts.table, { dialect: dialect })
@@ -506,6 +549,10 @@ function create(opts) {
   }
 
   async function _processOnce() {
+    // Reclaim crashed-publisher rows before claiming new work, so a stranded
+    // in-flight row re-enters the pending pool and is published this cycle.
+    try { await _reapStaleInflight(); }
+    catch (_e) { /* drop-silent — reaper retries next poll */ }
     var batch = await _claimBatch();
     if (batch.length === 0) return 0;
     for (var i = 0; i < batch.length; i++) {

package/lib/retention.js

@@ -282,7 +282,6 @@ function create(opts) {
   }
 
   function _erase(table, row, dryRun) {
-    var erased = cryptoField.eraseRow(table, row);
     var sealedFields = cryptoField.getSealedFields(table) || [];
     var hashFields = [];
     var schema = cryptoField.getSchema(table);
@@ -294,6 +293,15 @@ function create(opts) {
       return _hardDelete(table, row._id, dryRun);
     }
     if (dryRun) return { wouldErase: 1, sealedFieldCount: sealedFields.length };
+    // eraseRow produces the in-memory tombstone AND drives the posture-gated
+    // side effects: under a regime whose POSTURE_DEFAULTS sets
+    // requireVacuumAfterErase it schedules db.vacuumAfterErase({ mode: "full" })
+    // and emits cryptofield.erase.row. Both belong only to the COMMITTING path
+    // — running them above the dry-run gate made a preview VACUUM the whole
+    // database file per candidate row (#120). Its return value is unused (the
+    // UPDATE below NULLs the columns directly); we keep the call for the
+    // tombstone bucketing + posture vacuum on the real path.
+    var erased = cryptoField.eraseRow(table, row);
     // NULL every sealed column + its derived-hash sibling. b.sql binds each
     // null as a placeholder (the set map preserves the column ordering).
     var eraseSet = {};

package/lib/safe-url.js

@@ -53,6 +53,11 @@ var nodeUrl = require("node:url");
 var { URL } = require("node:url");
 
 var audit = lazyRequire(function () { return require("./audit"); });
+// ssrf-guard requires safe-url at top of file (the SSRF gate parses through
+// the framework's defensive URL parser); lazyRequire breaks that cycle so the
+// canonicalizer can reuse ssrf-guard's IP-literal canonicalization without an
+// at-load circular require.
+var ssrfGuard = lazyRequire(function () { return require("./ssrf-guard"); });
 
 /**
  * @primitive b.safeUrl.ALLOW_HTTP_TLS
@@ -168,9 +173,9 @@ var ALLOW_ANY      = Object.freeze(["http:", "https:", "ws:", "wss:"]);
  * Extends `FrameworkError`. Carries a stable `.code`:
  * `safe-url/missing` / `safe-url/too-long` / `safe-url/malformed` /
  * `safe-url/protocol-disallowed` / `safe-url/userinfo-disallowed` /
- * `safe-url/idn-homograph` / `safe-url/bad-opt`. HTTP middleware
- * inspects `.code` to translate the throw into a 400 without
- * leaking parser internals.
+ * `safe-url/idn-homograph` / `safe-url/uncanonicalizable` /
+ * `safe-url/bad-opt`. HTTP middleware inspects `.code` to translate
+ * the throw into a 400 without leaking parser internals.
  *
  * @example
  *   var b = require("blamejs");
@@ -205,6 +210,38 @@ function _makeError(errorClass, code, message) {
 // payloads) override via opts.maxUrlLength.
 var DEFAULT_MAX_URL_LENGTH = C.BYTES.kib(8);
 
+// RFC 3986 §6.2.2 percent-encoding normalization applied CONSERVATIVELY to a
+// path segment string: uppercase the two hex digits of every valid escape
+// (§6.2.2.2) and decode an escape of an unreserved character to its literal
+// (§6.2.2.3). A malformed escape (`%`, `%g`, `%4`) is passed through verbatim
+// so no information is invented. Query and fragment are NOT touched —
+// reordering / re-decoding there can change application semantics (a `%26`
+// inside a value is NOT the same as a literal `&`).
+function _normalizePctPath(path) {
+  if (typeof path !== "string" || path.indexOf("%") === -1) return path;
+  var out = "";
+  for (var i = 0; i < path.length; i += 1) {
+    var ch = path.charAt(i);
+    if (ch === "%") {
+      // The escape's two hex digits — sliced to a fixed two-char window so
+      // the regex test runs on a length-bounded string (no ReDoS surface).
+      var pair = path.slice(i + 1, i + 3);
+      if (pair.length === 2 && codepointClass.HEX_PAIR_RE.test(pair)) {
+        var cc = parseInt(pair, 16);
+        if (codepointClass.isUnreserved(cc)) {
+          out += String.fromCharCode(cc);
+        } else {
+          out += "%" + pair.toUpperCase();
+        }
+        i += 2;
+        continue;
+      }
+    }
+    out += ch;
+  }
+  return out;
+}
+
 /**
  * @primitive b.safeUrl.parse
  * @signature b.safeUrl.parse(url, opts?)
@@ -416,9 +453,139 @@ function format(url) {
   }
 }
 
+/**
+ * @primitive b.safeUrl.canonicalize
+ * @signature b.safeUrl.canonicalize(input, opts?)
+ * @since     0.15.6
+ * @status    stable
+ * @related   b.safeUrl.parse, b.ssrfGuard.canonicalizeHost, b.ssrfGuard.checkUrl
+ *
+ * Return the single canonical, comparable form of a URL so two
+ * spellings of the same destination compare equal as strings. The use
+ * cases are host allowlists, dedup / cache keys, and SSRF pre-checks —
+ * exactly the places an attacker reaches for an obfuscated host
+ * (`http://0177.0.0.1/`, `http://2130706433/`, `http://[::ffff:7f00:1]/`,
+ * an IDN homograph, a trailing-dot or default-port variation) to slip
+ * past a naive `===` allowlist. Routing every comparison through one
+ * audited canonicalizer closes that class instead of leaving each
+ * caller to re-derive normalization (which is how the bypasses happen).
+ *
+ * The canonical form is built from `parse`'s defensive gates plus the
+ * security-relevant normalization set:
+ *
+ *   - Scheme and host lowercased (the WHATWG URL parser does this).
+ *   - Host IDN labels emitted as their punycode `xn--` A-label; a
+ *     mixed-script / confusable host label THROWS exactly as
+ *     `parse` does (a homograph is never silently passed) unless the
+ *     caller opts in via `allowMixedScript` / `allowedScripts`.
+ *   - A trailing dot on the host is removed (`example.com.` →
+ *     `example.com`) — DNS-equivalent but breaks string comparison.
+ *   - An IP-literal host in ANY notation collapses to one canonical
+ *     string via `b.ssrfGuard.canonicalizeHost` (the SAME byte parser
+ *     the SSRF classifier matches on): IPv4 decimal / octal / hex /
+ *     shorthand → dotted-quad; IPv6 (incl. IPv4-mapped + any
+ *     zero-compression) → RFC 5952 lower-hex, bracketed.
+ *   - The default port for the scheme is stripped (`:80` http/ws,
+ *     `:443` https/wss — the parser does this).
+ *   - Path `.` / `..` segments resolved (WHATWG), then RFC 3986 §6.2.2
+ *     percent-normalization applied to the path: hex digits uppercased,
+ *     escapes of unreserved characters decoded. Query and fragment are
+ *     left BYTE-FOR-BYTE as parsed — reordering or re-decoding there can
+ *     change application semantics.
+ *
+ * Throws `SafeUrlError` (or `opts.errorClass`): the `parse` codes for a
+ * missing / too-long / malformed / disallowed-scheme / userinfo /
+ * homograph input, plus `safe-url/uncanonicalizable` when a parsed URL
+ * cannot be reduced to a safe canonical form. This is a config /
+ * entry-point validator — it THROWS on bad input, it does NOT return a
+ * best-effort string.
+ *
+ * @opts
+ *   allowedSchemes:   string[],   // default ALLOW_ANY (http/https/ws/wss); canonicalize is a compare tool, not a fetch gate
+ *   allowUserinfo:    boolean,    // default false; opt-in to keep user:pass@ (still discouraged)
+ *   allowMixedScript: boolean,    // default false; opt-in to mixed-script host labels
+ *   allowedScripts:   string[],   // narrow mixed-script allowlist (e.g. ["latin","cyrillic"])
+ *   maxUrlLength:     number,     // default 8192 (RFC 7230 §3.1.1)
+ *   errorClass:       Function,   // throw this instead of SafeUrlError
+ *
+ * @example
+ *   var b = require("blamejs");
+ *
+ *   // Every obfuscated loopback spelling collapses to one string.
+ *   b.safeUrl.canonicalize("http://0177.0.0.1/");      // → "http://127.0.0.1/"
+ *   b.safeUrl.canonicalize("http://2130706433/");      // → "http://127.0.0.1/"
+ *   b.safeUrl.canonicalize("http://127.1/");           // → "http://127.0.0.1/"
+ *
+ *   // Case, default port, trailing dot, and `..` all normalize.
+ *   b.safeUrl.canonicalize("https://Example.COM:443/a/../b");
+ *   // → "https://example.com/b"
+ *
+ *   // A disallowed scheme throws SafeUrlError.
+ *   try { b.safeUrl.canonicalize("ftp://example.com/"); }
+ *   catch (e) { e.code; }   // → "safe-url/protocol-disallowed"
+ */
+function canonicalize(input, opts) {
+  opts = opts || {};
+  var allowedSchemes = Array.isArray(opts.allowedSchemes) && opts.allowedSchemes.length > 0
+    ? opts.allowedSchemes
+    : ALLOW_ANY;
+
+  // Route through parse — it owns the length cap, the scheme allowlist,
+  // userinfo refusal, and the IDN-homograph defense. A parse throw (with
+  // its stable .code) propagates unchanged so callers branch on the same
+  // codes parse documents.
+  var parsed = parse(input, {
+    allowedProtocols: allowedSchemes,
+    maxUrlLength:     opts.maxUrlLength,
+    allowUserinfo:    opts.allowUserinfo,
+    allowMixedScript: opts.allowMixedScript,
+    allowedScripts:   opts.allowedScripts,
+    errorClass:       opts.errorClass,
+  });
+
+  try {
+    // The parser already lowercased the scheme + host, stripped the
+    // default port, emitted IDN as punycode, and resolved `.`/`..`. The
+    // canonicalizer adds: IP-literal collapse (shared with the SSRF
+    // classifier), trailing-dot removal, and path percent-normalization.
+    var scheme = parsed.protocol;                 // e.g. "https:"
+    var rawHost = parsed.hostname;                // already lowercase / punycode / default-port-free
+    var canonHost = ssrfGuard().canonicalizeHost(rawHost);
+    // canonicalizeHost returns IPv6 UNbracketed; a URL authority needs the
+    // brackets back. net.isIP via the colon is a sufficient discriminator
+    // (a DNS label can't contain a colon).
+    var host = canonHost.indexOf(":") !== -1 ? "[" + canonHost + "]" : canonHost;
+
+    // Userinfo (`user:pass@`) is deliberately DROPPED from the canonical form.
+    // The canonical string is built to be compared, used as a dedup / cache
+    // key, or logged; carrying a credential into any of those leaks it, and
+    // the username/password are not part of the resource's target identity for
+    // an allowlist / SSRF decision. parse() already refuses userinfo unless
+    // allowUserinfo:true; even then, the canonical output omits it (never reads
+    // parsed.password), so two URLs that differ only in credentials canonicalize
+    // equal.
+
+    var port = parsed.port !== "" ? ":" + parsed.port : "";
+    var path = _normalizePctPath(parsed.pathname);
+    // Query + fragment: byte-for-byte as the parser emitted them. Reordering
+    // a query or re-decoding a value changes semantics — out of scope for a
+    // safe canonicalizer.
+    var query = parsed.search;
+    var fragment = parsed.hash;
+
+    return scheme + "//" + host + port + path + query + fragment;
+  } catch (e) {
+    if (e && e.isSafeUrlError) throw e;
+    throw _makeError(opts.errorClass, "safe-url/uncanonicalizable",
+      "safeUrl.canonicalize could not reduce the URL to a canonical form: " +
+        ((e && e.message) || String(e)));
+  }
+}
+
 module.exports = {
   parse:           parse,
   format:          format,
+  canonicalize:    canonicalize,
   SafeUrlError:    SafeUrlError,
   ALLOW_HTTP_TLS:  ALLOW_HTTP_TLS,
   ALLOW_HTTP_ALL:  ALLOW_HTTP_ALL,

package/lib/sse.js

@@ -247,6 +247,21 @@ function create(req, res, opts) {
   // proxyBuffer: false to suppress the nginx-specific header.
   var proxyBuffer = opts.proxyBuffer !== false;
 
+  // Slow-consumer bound. SSE is server-push: when a client stalls, res.write()
+  // returns false but the app keeps pushing, so Node buffers the unsent bytes
+  // in res.writableLength without limit — one stuck connection grows the heap
+  // until exhaustion (memory-exhaustion DoS). Cap the per-channel buffer and
+  // evict the slow consumer past it. A healthy client (writableLength ~0) is
+  // never affected. Config-time input → throw on a bad value.
+  var maxBufferedBytes = opts.maxBufferedBytes;
+  if (maxBufferedBytes === undefined) maxBufferedBytes = C.BYTES.mib(1);
+  if (typeof maxBufferedBytes !== "number" || !isFinite(maxBufferedBytes) ||
+      maxBufferedBytes <= 0 || Math.floor(maxBufferedBytes) !== maxBufferedBytes) {
+    throw errorClass.factory("sse/bad-opts",
+      "sse.create: maxBufferedBytes must be a positive integer byte count (got " +
+      JSON.stringify(maxBufferedBytes) + ")");
+  }
+
   var lastEventId = _readLastEventId(req);
 
   // Headers. text/event-stream is the contract; Cache-Control: no-cache
@@ -275,6 +290,17 @@ function create(req, res, opts) {
         "sse.send: channel closed");
     }
     res.write(s);
+    // res.writableLength is the count of bytes Node has buffered but not yet
+    // flushed to the socket. A healthy client drains it (≈0); a stalled one
+    // lets it climb. Past the per-channel cap, evict the slow consumer rather
+    // than buffer without bound. h2 streams + h1 responses both expose it.
+    var buffered = (typeof res.writableLength === "number") ? res.writableLength : 0;
+    if (buffered > maxBufferedBytes) {
+      close({ reason: "backpressure-exceeded" });
+      throw errorClass.factory("sse/backpressure",
+        "sse.send: client too slow — buffered " + buffered +
+        " bytes exceeds maxBufferedBytes " + maxBufferedBytes + "; channel closed");
+    }
   }
 
   function send(eventOpts) {

package/lib/ssrf-guard.js

@@ -247,6 +247,105 @@ function _expandIpv6(ip) {
   return left.concat(fill).concat(right);
 }
 
+function _ipv6BytesToString(bytes) {
+  // RFC 5952 §4 canonical textual form from 16 canonical bytes: lower-hex,
+  // no leading zeros per group, the LONGEST run of two-or-more zero groups
+  // compressed to "::" (leftmost run on a length tie — §4.2.3), and the
+  // shortened-but-not-IPv4-dotted form (the framework keeps IPv4-mapped as
+  // pure hex so every mapped spelling collapses to one string). Driven off
+  // the same 16-byte buffer classify() matches on, so the emitted string and
+  // the security verdict can never disagree about which address this is.
+  var groups = [];
+  for (var i = 0; i < IPV6_GROUPS; i++) {
+    groups.push(((bytes[i * 2] << 8) | bytes[i * 2 + 1]) & 0xffff);
+  }
+  var bestStart = -1, bestLen = 0, curStart = -1, curLen = 0;
+  for (var g = 0; g < IPV6_GROUPS; g++) {
+    if (groups[g] === 0) {
+      if (curStart === -1) { curStart = g; curLen = 1; } else { curLen += 1; }
+      if (curLen > bestLen) { bestLen = curLen; bestStart = curStart; }
+    } else {
+      curStart = -1;
+      curLen = 0;
+    }
+  }
+  // A single zero group is NOT compressed (RFC 5952 §4.2.2).
+  if (bestLen < 2) bestStart = -1;
+  var parts = [];
+  for (var k = 0; k < IPV6_GROUPS; k++) {
+    if (bestStart !== -1 && k === bestStart) {
+      parts.push("");
+      k += bestLen - 1;
+      // A run reaching the final group needs a trailing empty part so the
+      // join yields the "::"-terminated form (e.g. fe80:: not fe80:).
+      if (k === IPV6_GROUPS - 1) parts.push("");
+      continue;
+    }
+    parts.push(groups[k].toString(HEX_RADIX));
+  }
+  var out = parts.join(":");
+  // A run starting at group 0 needs a leading empty part ("::1", "::").
+  if (bestStart === 0) out = ":" + out;
+  return out;
+}
+
+/**
+ * @primitive b.ssrfGuard.canonicalizeHost
+ * @signature b.ssrfGuard.canonicalizeHost(host)
+ * @since     0.15.6
+ * @status    stable
+ * @related   b.ssrfGuard.classify, b.safeUrl.canonicalize
+ *
+ * Canonicalize a bare host string to its single comparable form for
+ * host allowlists, dedup keys, and SSRF pre-checks. A `net.isIP`-valid
+ * IP literal collapses to one canonical string: a dotted-quad IPv4
+ * stays dotted-quad; IPv6 in any zero-compression / mixed-case /
+ * IPv4-mapped spelling (`[0:0:0:0:0:ffff:7f00:1]`, `::FFFF:7F00:1`)
+ * becomes the RFC 5952 lower-hex compressed form. The IP bytes are
+ * parsed by the SAME routines `classify` matches on, so the canonical
+ * string and the SSRF verdict can never disagree about which address a
+ * host is.
+ *
+ * The numeric-base IPv4 decode (octal `0177.0.0.1`, hex `0x7f000001`,
+ * single-integer `2130706433`, shorthand `127.1`) is the WHATWG URL
+ * parser's job — `b.safeUrl.canonicalize` runs that FIRST and hands this
+ * primitive the already-decoded dotted-quad. This is the IP-byte + case
+ * layer, not the base decoder.
+ *
+ * A DNS name (not an IP literal) is lowercased and any trailing dot is
+ * stripped — `Example.COM.` → `example.com`. IDN A-label / U-label
+ * normalization is NOT done here (the WHATWG URL parser owns that via
+ * `b.safeUrl.canonicalize`).
+ * `[...]`-bracketed IPv6 input is accepted (brackets stripped); the
+ * returned IPv6 string is UNbracketed (the URL layer re-adds brackets).
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   b.ssrfGuard.canonicalizeHost("[0:0:0:0:0:0:0:1]");    // → "::1"
+ *   b.ssrfGuard.canonicalizeHost("::FFFF:7F00:1");        // → "::ffff:7f00:1"
+ *   b.ssrfGuard.canonicalizeHost("Example.COM.");         // → "example.com"
+ */
+function canonicalizeHost(host) {
+  if (typeof host !== "string" || host.length === 0) return host;
+  var bare = host.replace(/^\[|\]$/g, "");
+  var family = net.isIP(bare);
+  if (family === 4) {
+    var v4 = _ipv4ToBytes(bare);
+    if (v4) return v4[0] + "." + v4[1] + "." + v4[2] + "." + v4[3];
+    return bare.toLowerCase();
+  }
+  if (family === 6) {
+    return _ipv6BytesToString(_ipv6ToBytes(bare));
+  }
+  // Not an IP literal — DNS name. Lowercase + strip a single trailing dot
+  // (the root-label dot is DNS-equivalent but breaks string comparison).
+  var name = bare.toLowerCase();
+  if (name.length > 1 && name.charAt(name.length - 1) === ".") {
+    name = name.slice(0, name.length - 1);
+  }
+  return name;
+}
+
 function _cidrIpv4Match(cidr, ip) {
   var slash = cidr.indexOf("/");
   if (slash === -1) return false;
@@ -826,6 +925,7 @@ function checkUrlTextual(url, opts) {
 
 module.exports = {
   classify:         classify,
+  canonicalizeHost: canonicalizeHost,
   cidrContains:     cidrContains,
   checkUrl:         checkUrl,
   checkUrlTextual:  checkUrlTextual,

package/lib/subject.js

@@ -561,12 +561,19 @@ function restrict(subjectId, opts) {
 
   if (opts.on) {
     if (!existing) {
+      // The restriction `reason` is a ticket reference / legal basis — PII at
+      // rest. db.js declares sealedFields:["reason"] on this table, but the raw
+      // write path bypasses the structured builder's auto-seal, so seal here
+      // explicitly (idempotent registration guard covers a reset registry).
+      if (!cryptoField.getSchema(RESTRICTIONS_TABLE)) {
+        cryptoField.registerTable(RESTRICTIONS_TABLE, { sealedFields: ["reason"] });
+      }
       var restrictInsBuilt = sql.insert(RESTRICTIONS_TABLE, { dialect: "sqlite", quoteName: true })
-        .values({
+        .values(cryptoField.sealRow(RESTRICTIONS_TABLE, {
           subjectIdHash: _subjectHash(subjectId),
           since:         Date.now(),
           reason:        opts.reason || null,
-        })
+        }))
         .toSql();
       var restrictInsStmt = db().prepare(restrictInsBuilt.sql);
       restrictInsStmt.run.apply(restrictInsStmt, restrictInsBuilt.params);

package/lib/worker-pool.js

@@ -287,6 +287,11 @@ function create(scriptPath, opts) {
       reason:   "workerpool/worker-error",
       message:  (err && err.message) || String(err),
     });
+    // Mark the slot dying BEFORE _finishTask. _finishTask sets slot.busy =
+    // false and drains the queue, so an unmarked slot would be handed a
+    // freshly-queued task that then dies with this same worker. _recycleWorker
+    // re-asserts the flag idempotently.
+    slot.recycling = true;
     if (failingTask) {
       _finishTask(slot, true,
         new WorkerPoolError("workerpool/worker-error",
@@ -331,6 +336,12 @@ function create(scriptPath, opts) {
       workerId: slot.id, taskId: taskId, taskTimeoutMs: taskTimeoutMs,
     });
     var failingTask = slot.currentTask;
+    // Mark the slot dying BEFORE _finishTask drains the queue, so the drain
+    // skips this about-to-be-terminated slot instead of dispatching a queued
+    // task onto it (which would die with the worker on terminate, surfacing as
+    // workerpool/worker-exit on a task that never ran). _recycleWorker
+    // re-asserts the flag idempotently.
+    slot.recycling = true;
     if (failingTask) {
       _finishTask(slot, true,
         new WorkerPoolError("workerpool/timeout",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.4",
+  "version": "0.15.6",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:58fea242-8071-4e16-965b-d1ea85e285ba",
+  "serialNumber": "urn:uuid:05cef77c-2364-4c63-8af3-3dd59f5dd56f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-13T02:42:24.654Z",
+    "timestamp": "2026-06-13T09:12:01.883Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.4",
+      "bom-ref": "@blamejs/core@0.15.6",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.4",
+      "version": "0.15.6",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.4",
+      "purl": "pkg:npm/%40blamejs/core@0.15.6",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.4",
+      "ref": "@blamejs/core@0.15.6",
       "dependsOn": []
     }
   ]