@blamejs/core 0.16.14 → 0.16.15

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.15 (2026-07-11) — **Restore break-glass certificate key escrow, hand a failed production-security assertion its real diagnostic message, and make tenant storage-byte quotas actually enforce — three defects surfaced by broadening test coverage and fixed at the root.** Three primitives had defects that only a hostile or previously-untested path reached. b.cert key escrow — the optional break-glass path that seals a renewed private key to an operator's offline recipient — never worked: writeEscrow called a b.crypto method that does not exist, so any certificate configured with keyEscrow threw the moment renewal tried to seal the key. It now seals via b.crypto.encrypt (ML-KEM-1024, plus the P-384 hybrid leg when the recipient supplies an ecPublicKey) and the operator recovers the key offline with b.crypto.decrypt; the recipient accepts an ML-KEM-1024 public-key PEM string or a { publicKey, ecPublicKey } pair from b.crypto.generateEncryptionKeyPair(). b.security.assertProduction constructed its error with the code and message transposed, so a failed production-security assertion threw with a bare token (BAD_OPT / ASSERT_FAILED) as its .message and buried the human-readable explanation in .code — operators now get the full diagnostic where they read it. And b.tenant.quota storage-byte accounting was broken several ways: the per-tenant byte sum issued a query the builder rejects, so snapshot / assert / list always threw once a storage cap was set; it read rows through the auto-unsealing ORM, so a sealed column was measured as its small decrypted plaintext rather than the larger on-disk vault envelope (letting sealed-column tenants slip under the cap); when the tenant identifier itself was a sealed column, the plaintext lookup matched no rows at all and the cap silently counted zero; and BLOB columns (handed back as Uint8Array by node:sqlite) were stringified before measuring, roughly tripling their counted size and refusing writes far below the real cap. All are fixed — the sum now filters a sealed tenant id by its derived-hash blind index, reads the raw stored rows, and measures true on-disk byte lengths — so storage quotas enforce at the configured limit. **Fixed:** *b.cert break-glass key escrow seals the renewed key instead of throwing* — A certificate configured with keyEscrow forwarded the private key to writeEscrow, which called a b.crypto.encryptEnvelope method that does not exist — so escrow threw on every renewal and the break-glass recovery path was unusable. It now seals the key to the operator's offline recipient with b.crypto.encrypt: ML-KEM-1024 always, plus a P-384 hybrid leg when the recipient carries an ecPublicKey. The recipient accepts an ML-KEM-1024 public-key PEM string or a { publicKey, ecPublicKey } pair from b.crypto.generateEncryptionKeyPair(); the sealed key is never decrypted by the framework and is recovered offline with b.crypto.decrypt and the matching private key(s). · *b.security.assertProduction throws with the diagnostic in .message* — SecurityAssertError was constructed with its code and message arguments transposed, so a failed production-security assertion surfaced a bare token (BAD_OPT / ASSERT_FAILED) as its .message while the explanatory text — including the per-assertion failure list — landed in .code. Operators catching the error now read the full diagnostic in .message and the stable token in .code, as documented. · *b.tenant.quota enforces storage-byte caps at the configured limit* — The per-tenant storage-bytes accounting had several defects. It issued a query the query builder rejects (a literal '*' column), so snapshot / assert / list threw as soon as a storage cap was configured — the storage half of tenant quotas never ran against a real database. It read rows through the ORM, which auto-unseals sealed columns, so a sealed cell was measured as its small decrypted plaintext rather than the much larger vault envelope actually on disk — a tenant whose data lives in sealed columns could sail under the cap. When the tenant identifier column itself was sealed, the plaintext lookup compared against the on-disk envelope and matched no rows, so the cap silently counted zero for those tenants. And BLOB columns, which node:sqlite returns as a Uint8Array rather than a Node Buffer, were stringified before measuring: String(uint8array) is the decimal-joined bytes, roughly a 3x overcount that refused writes well below the real cap. The sum now filters a sealed tenant identifier by its derived-hash blind index (as the query builder does), reads the raw stored rows (no unseal), and counts text as its UTF-8 byte length and typed-array views by their true byte length, so a storage cap — including data in sealed columns — enforces at the limit operators set.
+
 - v0.16.14 (2026-07-11) — **Make the object-store single-backend shorthand work for remote backends, and return a string time zone (not an array) when importing an iCalendar event — two defects found by covering previously-untested configuration and import branches.** Covering more configuration and import branches surfaced two genuine defects, now fixed at the root. The documented object-store single-backend shorthand — b.storage.init({ backend: 'sigv4' | 'gcs' | 'azure-blob' | 'http-put', ... }) — never worked for a remote backend: it forwarded the caller's options with the backend key intact, but the object-store backend builder resolves protocol, so the backend was constructed with no protocol and initialization threw a missing-protocol error. Only the local shorthand (which happens to name the key correctly) worked. The shorthand now translates backend to protocol, so all four remote backends construct as documented. And b.calendar.fromIcal mapped a DTSTART;TZID=<zone> parameter to a JSCalendar timeZone that was an array (['America/New_York']) instead of the string RFC 8984 §4.7.1 requires — it only round-tripped by accident because a single-element array coerces to a string; the parameter is now unwrapped to a scalar string. **Fixed:** *b.storage remote single-backend shorthand constructs the backend* — b.storage.init({ backend: 'sigv4' | 'gcs' | 'azure-blob' | 'http-put', ... }) forwarded the options with the backend key, but the object-store backend builder reads protocol — so the default backend had no protocol and initialization threw a missing-protocol ObjectStoreError. The remote shorthand never worked (only the { backend: 'local' } form, which names protocol correctly under the hood, did). The shorthand now maps backend to protocol and drops the backend key, so all four remote backends build as documented. · *b.calendar.fromIcal returns a string time zone for DTSTART/DUE;TZID* — An imported event's DTSTART;TZID=<zone> (or a task's DUE;TZID) mapped to a JSCalendar timeZone that was a single-element array rather than the string RFC 8984 §4.7.1 requires. It happened to round-trip back through toIcal because a one-element array coerces to a string, but consumers reading timeZone as a string saw an array. The property parameter is now unwrapped to its scalar first value.
 
 - v0.16.13 (2026-07-11) — **Make SD-JWT VC verification accept a raw JWK issuer key (its own documented common path), and emit the SMTP command-smuggling audit on a NUL-byte injection — two defects found by covering previously-untested verifier and inbound-server branches.** Covering the uncovered verifier and adversarial-input branches of two more subsystems surfaced two genuine defects, now fixed at the root. b.auth.sdJwtVc.verify rejected a valid credential when the issuerKeyResolver returned a raw JWK object — the very path the code's own comment calls the common one — because the JWK was handed straight to node:crypto.verify, which cannot consume a bare JWK, so verification threw a low-level type error instead of validating; the resolver's JWK is now imported to a key object before verification, matching the holder key-binding path. And the inbound SMTP server refused a command line containing a NUL byte (correct) but never emitted the command-smuggling audit event it emits for bare-CR / bare-LF injection, because it checked for the wrong error code; the audit now fires so a NUL-injection attempt is recorded for forensic triage. A misleading comment in the permissions MFA gate that advertised a non-existent no-freshness-window escape hatch is corrected — the freshness window is always enforced by design. **Fixed:** *b.auth.sdJwtVc.verify accepts a raw JWK from issuerKeyResolver* — When the issuerKeyResolver returned a JWK object — described in the code as the common path — the JWK was passed directly to node:crypto.verify, which requires a key object, so a valid credential failed verification with a raw ERR_INVALID_ARG_TYPE rather than validating. The resolver's JWK is now imported to a public key object (with the existing algorithm/key-type cross-check preserved) before verification, mirroring the holder key-binding JWT path. Verification succeeds for EC and Ed25519 JWK resolvers. · *Corrected a misleading comment in the permissions MFA freshness gate* — A comment in the requireMfa gate described mfaWindowMs: Infinity as an operator escape hatch for a no-freshness-window pass-through. No such escape hatch exists — both the role- and route-level validators reject a non-finite mfaWindowMs, so MFA freshness is always enforced (defaulting to 15 minutes). Enabling it would let a stolen long-lived cookie with a stale mfaAt bypass the gate. The comment now states the freshness window is always enforced; behavior is unchanged. **Security:** *SMTP inbound server records a command-smuggling audit on NUL-byte injection* — The inbound MX server's command handler refused a command line containing a NUL byte with a 500, but the branch meant to emit the mail.server.mx.smtp_smuggling_detected audit checked for the error code guard-smtp-command/nul-byte while the guard actually raises guard-smtp-command/nul. As a result a NUL-injection command was rejected but not recorded, unlike bare-CR / bare-LF smuggling which was audited. The code match is corrected, so a NUL-byte command-smuggling attempt now produces the forensic audit event.

package/lib/cert.js

@@ -155,14 +155,16 @@ function _createSealedDiskStorage(opts) {
       }
     },
 
-    async writeEscrow(relPath, plaintextKeyPem, recipientPub) {
-      // Encrypt-to-recipient via b.crypto.encryptEnvelope. Recipient is
-      // an X25519 / ML-KEM hybrid pubkey held offline by the operator
-      // for break-glass key recovery.
-      var envelope = bCrypto().encryptEnvelope(Buffer.from(plaintextKeyPem), recipientPub);
+    async writeEscrow(relPath, plaintextKeyPem, recipient) {
+      // Seal the private key to the operator's offline break-glass
+      // recipient via b.crypto.encrypt (ML-KEM-1024 KEM, plus the P-384
+      // hybrid leg when the recipient supplies an ecPublicKey). The
+      // operator recovers it offline with b.crypto.decrypt and the
+      // matching private key(s) — it is never decrypted by the framework.
+      var envelope = bCrypto().encrypt(plaintextKeyPem, recipient);
       var p = nodePath.join(rootDir, relPath);
       _ensureDir(nodePath.dirname(p));
-      atomicFile.writeSync(p, JSON.stringify(envelope) + "\n", { mode: 0o600 });
+      atomicFile.writeSync(p, envelope + "\n", { mode: 0o600 });
     },
   };
 }
@@ -212,7 +214,10 @@ function _createSealedDiskStorage(opts) {
  *       cleanup:   async function (params) { ... },     // required — runs after authorization completes
  *     },
  *     keyEscrow: {                    // optional — break-glass-only key recovery
- *       recipient: Buffer | string,   // X25519 / ML-KEM hybrid public key (b.crypto.encryptEnvelope recipient)
+ *       recipient: string | { publicKey, ecPublicKey },  // ML-KEM-1024 pubkey PEM, or a
+ *                                     //   b.crypto.generateEncryptionKeyPair() hybrid pair; the
+ *                                     //   renewed key is sealed to it via b.crypto.encrypt and
+ *                                     //   recovered offline with b.crypto.decrypt
  *     },
  *   }>,
  *   renew: {
@@ -350,10 +355,23 @@ function create(opts) {
       throw new CertError("cert/bad-key-alg",
         "cert.create.certs[" + i + "].keyAlg must be ecdsa-p256 / ecdsa-p384 / rsa-2048 / rsa-3072 / rsa-4096");
     }
-    if (c.keyEscrow && (!c.keyEscrow.recipient ||
-        (typeof c.keyEscrow.recipient !== "string" && !Buffer.isBuffer(c.keyEscrow.recipient)))) {
-      throw new CertError("cert/bad-key-escrow",
-        "cert.create.certs[" + i + "].keyEscrow.recipient must be a Buffer or PEM/base64 string");
+    if (c.keyEscrow) {
+      var rec = c.keyEscrow.recipient;
+      var okStr = typeof rec === "string" && rec.length > 0;
+      // Object form: publicKey (ML-KEM PEM) is required non-empty, matching the
+      // string path; ecPublicKey (P-384 hybrid leg) is optional, but if present
+      // must itself be a non-empty string — an empty key would otherwise reach
+      // b.crypto.encrypt and either fail deeper or silently drop the hybrid leg.
+      var okObj = rec && typeof rec === "object" &&
+        typeof rec.publicKey === "string" && rec.publicKey.length > 0 &&
+        (rec.ecPublicKey == null ||
+          (typeof rec.ecPublicKey === "string" && rec.ecPublicKey.length > 0));
+      if (!okStr && !okObj) {
+        throw new CertError("cert/bad-key-escrow",
+          "cert.create.certs[" + i + "].keyEscrow.recipient must be an ML-KEM-1024 " +
+          "public-key PEM string, or a { publicKey, ecPublicKey } object from " +
+          "b.crypto.generateEncryptionKeyPair() for the P-384 hybrid path");
+      }
     }
     certsByName[c.name] = {
       name:      c.name,

package/lib/security-assert.js

@@ -340,14 +340,14 @@ async function assertProduction(opts) {
   if (opts.extra !== undefined) {
     if (!Array.isArray(opts.extra)) {
       throw new SecurityAssertError(
-        "security.assertProduction: opts.extra must be an array of functions, got " + typeof opts.extra,
-        "BAD_OPT", true);
+        "BAD_OPT",
+        "security.assertProduction: opts.extra must be an array of functions, got " + typeof opts.extra);
     }
     for (var ei = 0; ei < opts.extra.length; ei++) {
       if (typeof opts.extra[ei] !== "function") {
         throw new SecurityAssertError(
-          "security.assertProduction: opts.extra[" + ei + "] must be a function",
-          "BAD_OPT", true);
+          "BAD_OPT",
+          "security.assertProduction: opts.extra[" + ei + "] must be a function");
       }
       var verdict;
       try { verdict = await opts.extra[ei](); }
@@ -383,8 +383,8 @@ async function assertProduction(opts) {
   if (failures.length > 0) {
     var summary = failures.map(function (f) { return "  - " + f.code + ": " + f.message; }).join("\n");
     var err = new SecurityAssertError(
-      "production security policy failed (" + failures.length + " assertion(s)):\n" + summary,
-      "ASSERT_FAILED", true);
+      "ASSERT_FAILED",
+      "production security policy failed (" + failures.length + " assertion(s)):\n" + summary);
     err.failures = failures;
     throw err;
   }

package/lib/tenant-quota.js

@@ -55,12 +55,14 @@
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var boundedMap = require("./bounded-map");
+var sql = require("./sql");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
 var TenantQuotaError = defineClass("TenantQuotaError", { alwaysPermanent: true });
 
 var audit = lazyRequire(function () { return require("./audit"); });
+var cryptoField = lazyRequire(function () { return require("./crypto-field"); });
 var observability = lazyRequire(function () { return require("./observability"); });
 
 var DEFAULT_CACHE_TTL_MS = C.TIME.seconds(30);
@@ -115,6 +117,7 @@ function create(opts) {
   ], "tenantQuota.create");
 
   if (!opts.db || typeof opts.db.from !== "function" ||
+      typeof opts.db.prepare !== "function" ||
       typeof opts.db.getTableMetadata !== "function") {
     throw new TenantQuotaError("tenant-quota/bad-db",
       "tenantQuota.create: opts.db must be the framework's b.db namespace");
@@ -197,25 +200,61 @@ function create(opts) {
     var tables = _resolveTables();
     var total = 0;
     for (var i = 0; i < tables.length; i++) {
-      // SUM(LENGTH(...)) across every column wins over a per-row
-      // serializer — SQLite computes it in one scan and the framework's
-      // sealed-column ciphertext is already on disk under this length.
-      // We sum the textual length of every column to approximate row
-      // bytes; a small under-count for INTEGER columns is acceptable
-      // when the cap is a soft limit operators raise long before
-      // hitting hard storage.
-      var rows = db.from(tables[i])
-        .where(tenantField, "=", tenantId)
-        .select(["*"])
-        .all();
+      var table = tables[i];
+      // Resolve the tenant predicate. When tenantField is itself a SEALED
+      // column, the plaintext tenantId never equals the on-disk vault
+      // envelope, so the framework filters it by its derived-hash blind index.
+      // Reuse cryptoField.lookupHash — the same rewrite db.from().where()
+      // applies — so a sealed tenantField resolves correctly (including the
+      // legacy dual-read across the keyed-MAC flip). A plaintext tenantField
+      // compares directly. Without this, a schema that seals the tenant id
+      // matches zero rows and the cap silently never fires.
+      var whereField = tenantField;
+      var whereVals = [tenantId];
+      var sealed = cryptoField().getSealedFields(table) || [];
+      if (sealed.indexOf(tenantField) !== -1) {
+        var lk = cryptoField().lookupHash(table, tenantField, tenantId);
+        if (!lk) {
+          throw new TenantQuotaError("tenant-quota/sealed-tenant-no-hash",
+            "tenantQuota: tenantField '" + tenantField + "' on table '" + table +
+            "' is a sealed column without a derived hash; declare " +
+            "derivedHashes: { <name>: { from: '" + tenantField + "' } } so it can be queried");
+        }
+        whereField = lk.field;
+        whereVals = (lk.legacyValue != null && lk.legacyValue !== lk.value)
+          ? [lk.value, lk.legacyValue]
+          : [lk.value];
+      }
+      // Build the read with b.sql — the same builder db.from() uses — so the
+      // table and column identifiers get identical handling (schema-qualified
+      // "schema.table" names, reserved-word names, dialect quoting) without
+      // re-implementing any of it here. Run it raw via db.prepare and, unlike
+      // db.from().all(), do NOT route rows through cryptoField.unsealRow: a
+      // storage cap must count what is actually on disk — the (much larger)
+      // vault envelope of a sealed column, not the plaintext it unseals to —
+      // or a tenant whose data lives in sealed columns sails under the cap.
+      // The tenant value(s) are bound parameters.
+      var built = sql.select(table, { dialect: "sqlite", quoteName: true })
+        .whereIn(whereField, whereVals)
+        .toSql();
+      var stmt = db.prepare(built.sql);
+      var rows = stmt.all.apply(stmt, built.params);
       for (var r = 0; r < rows.length; r++) {
         var row = rows[r];
         var keys = Object.keys(row);
         for (var k = 0; k < keys.length; k++) {
           var v = row[keys[k]];
           if (v == null) continue;
-          if (Buffer.isBuffer(v)) total += v.length;
-          else total += String(v).length;
+          // BLOB columns round-trip as a typed-array view (node:sqlite hands
+          // them back as Uint8Array, not a Node Buffer), so count the true
+          // byte length off any ArrayBuffer view rather than stringifying it
+          // — String(Uint8Array) is the decimal-joined bytes, a ~3x overcount
+          // that would refuse inserts well below the real storage cap. Text
+          // (including a sealed column's "vault:" envelope) is counted as its
+          // UTF-8 byte length, not the JS string .length — a multi-byte
+          // character occupies more than one byte on disk.
+          if (ArrayBuffer.isView(v)) total += v.byteLength;
+          else total += Buffer.byteLength(String(v), "utf8");
         }
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.14",
+  "version": "0.16.15",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:bdc2a663-f665-4018-9260-017bb1ddc890",
+  "serialNumber": "urn:uuid:1618a7b7-f477-422c-99bb-f941a8827acf",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-11T16:22:28.907Z",
+    "timestamp": "2026-07-12T01:36:29.373Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.14",
+      "bom-ref": "@blamejs/core@0.16.15",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.14",
+      "version": "0.16.15",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.14",
+      "purl": "pkg:npm/%40blamejs/core@0.16.15",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.14",
+      "ref": "@blamejs/core@0.16.15",
       "dependsOn": []
     }
   ]