@blamejs/core 0.17.8 → 0.17.10

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.17.x
 
+- v0.17.10 (2026-07-17) — **A CIDR-scoped SMTP relay allowlist is now actually enforced instead of relaying for the whole internet, EU AI-Act social scoring is flagged prohibited for any actor rather than only public authorities, and the X-Wing hybrid KEM stays uniform implicit-rejection on a low-order X25519 point.** The mail server's relay authorization discarded its arguments and returned allowed for every connecting peer whenever an operator configured any relayAllowedFor entry, so a per-CIDR relay allowlist -- intended to scope relay to registered sources -- turned the server into an open relay for the entire internet. The EU AI-Act prohibited-practice classifier gated social scoring on the deployer being a public authority, a limitation that was in the 2021 Commission proposal but dropped from the adopted Regulation (EU) 2024/1689, so a private-actor social-scoring system was under-classified as not-prohibited. The GDPR record-of-processing updater validated a legal-basis change with a truthiness guard, so a falsy-but-invalid value skipped the enum check and could corrupt a required Article 30 field. And the X-Wing hybrid post-quantum KEM threw a raw derivation error on a low-order X25519 point instead of the uniform implicit-rejection its contract and the draft specification require, exposing a decapsulation-oracle distinguisher and a crash for any consumer following the documented no-try/catch advice. **Security:** *SMTP relay allowlist enforces its per-entry CIDR instead of relaying for everyone* — b.mail.server.mx accepts a relayAllowedFor allowlist of { cidr, scope } entries, documented as scoping relay to registered source ranges over the default MX-only, no-relay posture. The relay-authorization check discarded both the peer address and recipient and simply returned allowed whenever the allowlist was non-empty, so an operator restricting relay to, for example, 10.0.0.0/8 actually granted relay to every peer on the internet -- an open relay, directly contradicting the module's advertised open-relay defense. The check now admits relay only when the connecting peer's source address falls inside one of the allowlisted ranges (using the same range arithmetic the HTTP network-allowlist fence uses); a peer outside every range is refused. Each relayAllowedFor entry's cidr is now validated at startup -- a mask is required so a bare IP cannot silently disable an entry, private and reserved ranges are allowed since relay allowlists legitimately name them, and a malformed entry throws at boot rather than mis-scoping relay. · *AI-Act classifier flags social scoring by any actor as prohibited* — b.compliance.aiAct's prohibited-practice classifier implements EU AI-Act Article 5. Its social-scoring gate (Art. 5(1)(c)) required both the purpose to be social scoring and the deployer to be a public authority before flagging the practice as prohibited. The "by public authorities or on their behalf" limitation existed in the 2021 Commission proposal but was removed from the adopted Regulation (EU) 2024/1689, which prohibits social scoring by any actor. A private-actor social-scoring system was therefore under-classified as not-prohibited. The classifier now flags social scoring on the purpose alone, matching the adopted text; the other Article 5 gates (predictive policing based solely on profiling, untargeted facial-recognition scraping, emotion inference in the workplace/education outside medical/safety uses) correctly retain the conjuncts that are part of their statutory definitions rather than over-broad limitations. · *GDPR record-of-processing rejects a falsy-but-invalid legal basis on update* — b.gdpr.ropa records the Article 30 register of processing activities, whose legalBasis field is constrained to the six Article 6(1) bases. register validates the basis against the allowlist, but update validated a legal-basis change with a truthiness guard, so a falsy-but-invalid value (an empty string, and similar) short-circuited past the enum check and was written into the record -- silently corrupting a required Article 30 field. The updater now validates whenever the patch touches legalBasis, keyed on the field being present rather than truthy, so an invalid value is rejected with the same rigor register applies and a genuine change to a valid basis still succeeds. · *X-Wing hybrid KEM stays uniform implicit-rejection on a low-order X25519 point* — b.crypto.xwing implements the X-Wing hybrid post-quantum KEM (ML-KEM-768 combined with X25519), whose contract and the draft-connolly-cfrg-xwing-kem specification require decapsulation to be uniform implicit-rejection: a tampered ciphertext yields a different secret, never an error, so a consumer must not branch on success. But a hostile low-order X25519 point in the ciphertext (or in the recipient's X25519 public half) drove the X25519 derivation to an all-zero shared secret, which the underlying library aborts with a raw derivation error rather than returning the value RFC 7748 X25519 (without the optional abort) yields. That exposed a decapsulation-oracle distinguisher (a low-order point throws while every other ciphertext returns a secret) and a crash for any caller following the documented advice not to wrap decapsulation in a try/catch. The shared X25519 step now translates that abort back into the all-zero shared secret, restoring uniform implicit-rejection; the combiner still binds the X25519 ciphertext and public key and the ML-KEM-768 leg still protects the result, so the hybrid's secure-if-either-holds guarantee is unchanged.
+
+- v0.17.9 (2026-07-17) — **A prototype-member regime name no longer voids a breach-notification clock into reporting a missed deadline as met, a planted plaintext file can no longer stand in for the sealed keyed-hash MAC key, and content-safety sanitization recomputes the integrity descriptor over the bytes actually delivered.** The incident-report deadline clock resolved its per-regime statutory table by a plain-object lookup with no own-property check, so a regime name equal to an inherited object member (valueOf, toString, constructor) resolved to a prototype function instead of the default deadlines -- every due-by became NaN, and a notification filed long past a statutory wall was recorded on-time, reporting a missed regulatory deadline as met. The retention posture-floor lookup had the same defect. The vault's keyed-hash MAC key reader trusted the vault's documented pass-through of a non-sealed value, so a plaintext file substituted on disk was accepted as the secret MAC key without the vault passphrase. And the static file server and the upload finalizer both replaced the served/stored payload when a content-safety gate sanitized it but kept advertising the ORIGINAL bytes' ETag/SRI (static) and sha3/size descriptor (upload), so a client validating the integrity of the delivered body -- or an operator storing the reported hash as the dedup/integrity key -- got a digest that did not match what was actually delivered. **Security:** *Breach-notification and retention lookups reject a prototype-member name* — b.incident.report's deadline clock resolves the statutory deadline set for an incident's regime (GDPR 72h, NIS2 24h, DORA 4h initial, HIPAA 60 days, ...) by indexing a per-regime table with the operator-supplied regime string. The lookup used a truthiness check with no own-property guard, so a regime equal to an inherited object member -- valueOf, toString, constructor, hasOwnProperty -- resolved to the prototype function instead of falling back to the default deadlines. Every computed due-by then became NaN, and because a late comparison against NaN is never true, a notification filed long past the real statutory wall was recorded on-time (not late) and the clock's late count stayed zero -- a genuinely missed regulatory deadline reported to a regulator as met. b.retention's compliance-posture floor lookup (hipaa, pci-dss, gdpr, soc2) had the identical defect, resolving a prototype-member posture to an inherited function as the retention floor. Both now resolve the name through an own-property check, so a prototype-member name falls back to the default deadlines (incident-report) or is rejected as an unknown posture (retention); real regimes and postures are unaffected. · *Vault refuses a non-sealed file as the keyed-hash MAC key* — b.vault derives a keyed-hash MAC key (used by field-level encryption's keyed derived-hash mode to keep an attacker with disk access from correlating low-entropy plaintexts) and seals it at rest. The reader loaded the sealed file and called the vault's unseal, which by its documented idempotent-read contract returns any value lacking the vault seal prefix verbatim -- so a plaintext 32-byte value planted on disk passed straight through and was accepted as the MAC key. In wrapped-vault mode this let an attacker with disk-write access but no vault passphrase (and therefore unable to forge a genuine seal) inject a known MAC key, downgrading the keyed derived-hash to an attacker-known key. The reader now requires the on-disk value to actually be sealed (carry the vault prefix) before unsealing, refusing a substituted plaintext or otherwise-unsealed file -- the same load-bearing prefix check the database key loader and the key-rotation pipeline already apply to their sealed key material. · *Content-safety sanitization recomputes the served body's integrity descriptor* — When a content-safety gate returns a sanitize action it replaces the payload with the cleaned bytes. b.staticServe still emitted the strong ETag and subresource-integrity (SRI) header derived from the original file on disk, and b.fileUpload's finalizer still handed onFinalize (and recorded in the audit) the sha3 and size of the original assembled bytes -- so the integrity descriptor advertised for the delivered/stored bytes did not match them. A browser performing SRI verification of the sanitized static response would fail the check, a strong-validator or If-None-Match cache would be keyed to a representation the client never receives, and an operator storing the upload's reported sha3 as the integrity or dedup key of the stored (sanitized) file would record a hash that never matches it. Both now recompute the ETag/SRI (static) and the sha3/size descriptor (upload) over the bytes actually delivered whenever a gate sanitized the payload; an unsanitized response keeps the on-disk/reassembly digest, which already describes the delivered bytes.
+
 - v0.17.8 (2026-07-17) — **The AI-Act transparency HTML emitters now escape every interpolated value, closing a reflected-XSS through a banner's language attribute and a script-context breakout through the JSON-LD disclosure.** b.compliance.aiAct.transparency.htmlBanner rendered its lang value -- a free-form string that is typically a request locale, Accept-Language, or query parameter when the banner is server-rendered -- into a double-quoted HTML attribute by raw concatenation, so a lang containing a double quote broke out of the attribute and injected active content (reflected XSS). Only the element text was escaped before; the attribute values were not. And b.compliance.aiAct.transparency.jsonLdDisclosure embedded the watermark manifest (operator-supplied strings such as the model id and deployer name) inside a <script type="application/ld+json"> element with raw JSON.stringify, which does not escape </script>; the HTML parser ends a script element at the first </script> regardless of its type, so a manifest value carrying that sequence terminated the block early and injected markup. Both emitters now escape at the sink -- every attribute value through the HTML-entity escaper and the JSON-LD payload through the script-safe serializer -- so no interpolated value can break out of its context. **Security:** *AI-Act transparency banner escapes its attribute values* — b.compliance.aiAct.transparency.htmlBanner builds a status banner whose lang attribute carries a free-form language value -- in a server-rendered banner that value commonly comes from the request (a locale, an Accept-Language header, or a query parameter). The banner escaped its visible text but concatenated the lang, article, and kind values into their double-quoted HTML attributes raw, so a lang value containing a double quote closed the attribute early and let the remainder inject an element or event handler into the page (reflected cross-site scripting, CWE-79). Every attribute value is now passed through the HTML-entity escaper before interpolation, matching the escaping the banner text already had, so a hostile value is rendered as inert text inside the attribute rather than breaking out of it; the escape-at-the-sink handling also covers the article and kind values even though their range is currently constrained. · *AI-Act JSON-LD disclosure cannot break out of its script element* — b.compliance.aiAct.transparency.jsonLdDisclosure emits the watermark manifest as JSON-LD inside a <script type="application/ld+json"> element, serializing operator-supplied manifest strings (the model id, deployer name, prompt hash, and similar). It used raw JSON.stringify, which does not escape the sequence </script>; because an HTML parser terminates a script element at the first </script> regardless of the element's type, a manifest value containing </script> (or an HTML comment opener) ended the disclosure block early and injected arbitrary markup that the browser then parsed and could execute. The disclosure now serializes the manifest with the framework's script-safe serializer, which escapes <, >, & and the U+2028/U+2029 separators to their \uXXXX form so the parsed JSON is unchanged but no substring can break out of the script context.
 
 - v0.17.7 (2026-07-17) — **A histogram exemplar's label name can no longer forge a line into the metrics scrape, the CSP report endpoint bounds how many reports one request can carry, and a cron field of the form N/step now fires on the whole repeating series instead of once.** A histogram exemplar's label VALUES were scrubbed before rendering but its label NAMES were written verbatim into the OpenMetrics exposition, and a Prometheus label name -- unlike a value -- cannot be quoted or escaped, so a name containing a newline forged an entire metric line into every /metrics scrape (the label-name sibling of the exemplar value injection already closed). The CSP report endpoint processed an unbounded number of reports per request: a single unauthenticated POST within the body-size cap could pack well over a thousand tiny reports, each driving a full audit-chain append and report hook, an amplification vector now bounded by a per-request report cap. And the shared cron parser mis-read a field of the form N/step -- e.g. 5/15 -- as the single value N instead of the standard N, N+step, ... through the field maximum, so a job scheduled that way fired once per period instead of on the intended repeating series; a recurring queue job also silently dropped its configured retry limit when it re-enqueued the next occurrence. **Fixed:** *A cron field of the form N/step fires on the full repeating series* — The shared cron parser read a field of the form N/step -- a bare number followed by a step, such as 5/15 in the minute field -- as the single value N, dropping the step entirely, instead of the standard Vixie-cron meaning N, N+step, ... up to the field maximum (5/15 in minutes is 5, 20, 35, 50, the same way */15 is 0, 15, 30, 45). A schedule written that way therefore fired once per period instead of on the intended repeating series -- and a job that runs less often than intended (a rotation, a cleanup, a scan) is a silent operational-safety gap. The parser now anchors the range at the field maximum whenever a step is present, so N/step expands to the full series; a bare number with no step is still the single value N. The cron-recurring queue backends (local and Redis) parse through this shared code and inherit the fix. · *A recurring queue job keeps its configured retry limit across occurrences* — A cron-recurring queue job re-enqueues itself for its next firing time and carried its priority, classification, and trace id forward -- but silently dropped the operator's configured maxAttempts, so every occurrence after the first reverted to the enqueue default retry budget rather than the one the operator set. Both queue backends now carry maxAttempts forward (guarded to a positive finite value, falling back to the enqueue default only when it is unset), so a recurring job's retry limit is stable across every occurrence. **Security:** *Metrics exemplar label names cannot inject a line into the scrape* — b.metrics histogram exemplars carry their own label set, stored through the same redaction step the regular labels use -- but that step scrubbed only the label VALUES (for credential shapes) and passed every label NAME through verbatim to the shared exposition renderer. A regular label name is validated against the Prometheus name grammar at registration and refused if undeclared, but the exemplar path had no equivalent gate, and because a label name cannot be quoted or escaped in the OpenMetrics wire format, an exemplar label name containing a newline (or a quote or brace) forged a complete, attacker-shaped metric line into every /metrics scrape -- reachable wherever an operator routes request-derived data into an exemplar label name (CWE-93). The exemplar redaction step now drops any label name that is not a valid Prometheus label name (length-bounded so a hostile oversized name cannot itself become a denial of service), matching the gate regular labels already get; valid names such as trace_id are unaffected. This closes the label-name sibling of the exemplar value injection fixed earlier. · *CSP report endpoint bounds the number of reports per request* — b.middleware.cspReport accepts a batch of reports in one POST (the Reporting API delivers them batched). The body-size cap bounded the request bytes but not the number of reports inside it, so a single unauthenticated request could carry well over a thousand small report objects, and the handler drove a full audit-chain append (a hash, a seal, and a serialized database insert) plus an operator report hook for every one of them -- a per-request amplification denial-of-service against an endpoint that is public by design. The endpoint now caps the batch length at a configurable maxReports (default 100, generous for a real browser batch): an over-cap batch is refused with 413 and the documented too-many-reports rejection reason, processing none of its reports, so the amplification is bounded while a normal browser report is unaffected.

package/lib/compliance-ai-act-prohibited.js

@@ -51,7 +51,7 @@ var PROHIBITED_PRACTICES = Object.freeze([
   Object.freeze({
     id:          "social-scoring",
     article:     "Art. 5(1)(c)",
-    title:       "Social scoring by public authorities",
+    title:       "Social scoring of natural persons",
     description: "AI systems for the evaluation or classification of natural persons over a certain period of time based on their social behaviour or known, inferred or predicted personal or personality characteristics, leading to detrimental or unfavourable treatment that is unjustified or disproportionate.",
     examples:    Object.freeze([
       "General-purpose social-credit ranking by a state agency",
@@ -151,9 +151,13 @@ function classify(systemDescription) {
   if (systemDescription.targetsVulnerableGroup === true) {
     hits.push("exploit-vulnerabilities");
   }
-  // (c) social scoring
-  if (systemDescription.purpose === "social-scoring" &&
-      systemDescription.deployerType === "public-authority") {
+  // (c) social scoring — Art. 5(1)(c) of the adopted Regulation (EU)
+  // 2024/1689 prohibits social scoring by ANY actor. The "by public
+  // authorities or on their behalf" limitation from the 2021 Commission
+  // proposal was dropped in the final text, so the practice is flagged on the
+  // purpose alone, not gated on deployerType (which would under-classify a
+  // private-actor social-scoring system as minimal-risk).
+  if (systemDescription.purpose === "social-scoring") {
     hits.push("social-scoring");
   }
   // (d) predictive policing on profiling alone

package/lib/crypto-xwing.js

@@ -69,11 +69,29 @@ function _x25519Public(sk) {
   var spki = nodeCrypto.createPublicKey(key).export({ format: "der", type: "spki" });
   return spki.subarray(spki.length - X25519_LEN);
 }
+// draft-connolly-cfrg-xwing-kem uses X25519 exactly as RFC 7748 specifies it,
+// WITHOUT the optional RFC 7748 section 6.1 abort on an all-zero shared secret.
+// Decapsulation must be uniform implicit-rejection: a hostile low-order X25519
+// ephemeral in the ciphertext must NOT be able to signal validity by making
+// decapsulate throw (the documented "yields a different secret rather than an
+// error" contract, and a defense against a decapsulation oracle / crash-on-
+// crafted-input DoS). OpenSSL (the X25519 backing this seam) DOES abort that
+// derivation, so translate its error back into the all-zero shared secret RFC
+// 7748 X25519 yields for a low-order input point. The combiner still binds ctX
+// and pkX and the ML-KEM-768 leg still protects the result, so collapsing the
+// classical leg costs only the classical half of the "secure if either holds"
+// guarantee. A short/malformed key fails earlier at createPublicKey with a
+// different code and still propagates.
 function _x25519Shared(sk, pk) {
-  return nodeCrypto.diffieHellman({
-    privateKey: nodeCrypto.createPrivateKey({ key: Buffer.concat([X25519_PKCS8_PREFIX, sk]), format: "der", type: "pkcs8" }),
-    publicKey:  nodeCrypto.createPublicKey({ key: Buffer.concat([X25519_SPKI_PREFIX, pk]), format: "der", type: "spki" }),
-  });
+  try {
+    return nodeCrypto.diffieHellman({
+      privateKey: nodeCrypto.createPrivateKey({ key: Buffer.concat([X25519_PKCS8_PREFIX, sk]), format: "der", type: "pkcs8" }),
+      publicKey:  nodeCrypto.createPublicKey({ key: Buffer.concat([X25519_SPKI_PREFIX, pk]), format: "der", type: "spki" }),
+    });
+  } catch (e) {
+    if (e && e.code === "ERR_OSSL_FAILED_DURING_DERIVATION") return Buffer.alloc(X25519_LEN);
+    throw e;
+  }
 }
 
 function _shake256(buf, outLen) { return nodeCrypto.createHash("shake256", { outputLength: outLen }).update(buf).digest(); }

package/lib/file-upload.js

@@ -1191,7 +1191,11 @@ function create(opts) {
         }
       }
       // Run one gate; throws on refuse / gate-error, mutates bodyBuffer on
-      // sanitize so a later gate sees the cleaned bytes.
+      // sanitize so a later gate sees the cleaned bytes. When a gate replaces
+      // the payload, the integrity descriptor (sha3/size) handed to onFinalize
+      // and recorded in the audit must be recomputed over the DELIVERED bytes,
+      // not the pre-sanitize original — flagged here, recomputed after the loop.
+      var contentSanitized = false;
       var _runContentSafetyGate = async function (gate, gateExt) {
         var safetyDecision;
         try {
@@ -1229,6 +1233,7 @@ function create(opts) {
         if (safetyDecision.action === "sanitize" && safetyDecision.sanitized) {
           bodyBuffer = safetyDecision.sanitized;
           bodyStream = null;
+          contentSanitized = true;
         }
       };
       var ranAnyGate = false;
@@ -1271,6 +1276,19 @@ function create(opts) {
                                 verified.totalBytes);
     }
 
+    // A content-safety gate that returned "sanitize" replaced the payload, so
+    // the integrity descriptor handed to onFinalize + recorded in the audit
+    // must describe the bytes actually DELIVERED — an operator storing
+    // info.sha3 as the integrity / dedup key of the stored (sanitized) bytes
+    // would otherwise get a hash that does not match what they store. When no
+    // sanitize ran, the reassembly digest already describes the delivered bytes.
+    var deliveredSha3 = verified.totalHashHex;
+    var deliveredSize = verified.totalBytes;
+    if (contentSanitized && bodyBuffer) {
+      deliveredSha3 = require("node:crypto").createHash("sha3-512").update(bodyBuffer).digest("hex");
+      deliveredSize = bodyBuffer.length;
+    }
+
     // Hand to operator's onFinalize.
     var rv;
     try {
@@ -1279,13 +1297,13 @@ function create(opts) {
           uploadId: uploadId,
           body:     bodyBuffer,
           stream:   bodyStream,
-          sha3:     verified.totalHashHex,
-          size:     verified.totalBytes,
+          sha3:     deliveredSha3,
+          size:     deliveredSize,
           actor:    actor,
           metadata: meta.metadata,
         });
       } else {
-        rv = { ok: true, sha3: verified.totalHashHex, size: verified.totalBytes };
+        rv = { ok: true, sha3: deliveredSha3, size: deliveredSize };
       }
     } catch (e) {
       _emitObs("fileUpload.finalize_failure", 1);
@@ -1294,7 +1312,7 @@ function create(opts) {
         resource: { kind: "fileUpload", id: uploadId },
         outcome:  "failure",
         reason:   "onfinalize-threw",
-        metadata: { size: verified.totalBytes, sha3: verified.totalHashHex,
+        metadata: { size: deliveredSize, sha3: deliveredSha3,
                     error: (e && e.message) || String(e) },
       });
       throw e;
@@ -1305,12 +1323,12 @@ function create(opts) {
     catch (_e) { /* best-effort */ }
 
     _emitObs("fileUpload.finalize_success", 1);
-    _emitObs("fileUpload.finalize_bytes", verified.totalBytes);
+    _emitObs("fileUpload.finalize_bytes", deliveredSize);
     _emitAudit("fileUpload.finalize", {
       actor:    requestHelpers.extractActorContext(actor),
       resource: { kind: "fileUpload", id: uploadId },
       outcome:  "success",
-      metadata: { size: verified.totalBytes, sha3: verified.totalHashHex,
+      metadata: { size: deliveredSize, sha3: deliveredSha3,
                   mode: useStream ? "stream" : "buffer" },
     });
 

package/lib/gdpr-ropa.js

@@ -129,7 +129,14 @@ function create(opts) {
       registeredAt: existing.registeredAt,
       lastUpdatedAt: now(),
     });
-    if (patch.legalBasis && !Object.prototype.hasOwnProperty.call(VALID_LEGAL_BASES, merged.legalBasis)) {
+    // Validate whenever the patch TOUCHES legalBasis — keyed on own-property
+    // presence, not truthiness. A falsy-but-invalid value ("" / 0 / false /
+    // undefined) is still an invalid legal basis and must be rejected with the
+    // same rigor register() applies; a `patch.legalBasis &&` guard would skip
+    // the enum check for those values and silently corrupt a required
+    // Article 30 field.
+    if (Object.prototype.hasOwnProperty.call(patch, "legalBasis") &&
+        !Object.prototype.hasOwnProperty.call(VALID_LEGAL_BASES, merged.legalBasis)) {
       throw new GdprRopaError("gdpr-ropa/bad-legal-basis",
         "gdpr.ropa.update: legalBasis must be one of " + Object.keys(VALID_LEGAL_BASES).join(", "));
     }

package/lib/incident-report.js

@@ -128,7 +128,14 @@ var REGIME_DEADLINES = Object.freeze({
 });
 
 function _resolveDeadlines(regime, override) {
-  var base = (regime && REGIME_DEADLINES[regime]) || DEFAULT_DEADLINES;
+  // Own-key lookup only: `regime` is operator-supplied and free-form, so a
+  // value colliding with an Object.prototype member ("valueOf", "toString",
+  // "constructor", ...) must fall back to DEFAULT_DEADLINES, not resolve to the
+  // inherited prototype function (which would make every dueBy NaN and report a
+  // missed deadline as met). Unknown-but-benign regimes fall back the same way.
+  var base = (typeof regime === "string" &&
+              Object.prototype.hasOwnProperty.call(REGIME_DEADLINES, regime))
+    ? REGIME_DEADLINES[regime] : DEFAULT_DEADLINES;
   if (!override || typeof override !== "object") return base;
   return Object.freeze({
     initial:      typeof override.initial      === "number" ? override.initial      : base.initial,

package/lib/mail-server-mx.js

@@ -150,6 +150,8 @@ var safeSmtp = require("./safe-smtp");
 var validateOpts = require("./validate-opts");
 var guardSmtpCommand = require("./guard-smtp-command");
 var guardDomain = require("./guard-domain");
+var guardCidr = require("./guard-cidr");
+var ssrfGuard = require("./ssrf-guard");
 var mailServerRateLimit = require("./mail-server-rate-limit");
 var mailServerTls = require("./mail-server-tls");
 var mailServerNet = require("./mail-server-net");
@@ -196,6 +198,42 @@ var RE_MAIL_FROM = /^MAIL\s+FROM:\s*<([^>]*)>(?:\s+(.*))?$/i;
 var RE_RCPT_TO   = /^RCPT\s+TO:\s*<([^>]+)>(?:\s+.*)?$/i;
 var RE_SIZE      = /SIZE=(\d+)/i;
 
+// A relayAllowedFor entry's `cidr` must be an `<ip>/<prefix>` range so the
+// relay-authorization decision can match the connecting peer against it via
+// b.ssrfGuard.cidrContains (the same range arithmetic the HTTP
+// b.middleware.networkAllowlist fence uses). Shape-validated by composing
+// b.guardCidr.validate rather than a hand-rolled parse: a mask is REQUIRED
+// (a bare IP never matches in cidrContains, so it is refused at boot rather
+// than silently disabling the entry), reserved / private ranges are ALLOWED
+// (a relay allowlist legitimately names 10.0.0.0/8 and friends), and a
+// non-canonical-but-functional network address (host bits set) is audited,
+// not rejected — cidrContains masks it off at match time.
+var _RELAY_CIDR_OPTS = Object.freeze({
+  requireMaskPolicy:      "reject-bare-ip",
+  reservedRangesPolicy:   "allow",
+  ipv4MappedIpv6Policy:   "allow",
+  networkAlignmentPolicy: "audit",
+  family:                 "either",
+});
+
+// _normalizeRelayCidr — fold a DOTTED IPv4-mapped IPv6 relay CIDR
+// (::ffff:a.b.c.d/N, N in 96..128) to its plain IPv4 CIDR (a.b.c.d/(N-96)).
+// guardCidr.validate parses hex-group IPv6 but not the dotted-mapped spelling,
+// so an operator naming a mapped range that way would be refused at boot even
+// though cidrContains accepts it. Folding to plain IPv4 both validates AND
+// makes the entry match every peer form: a genuine IPv4 peer directly, and an
+// IPv4-mapped peer via the _isRelayAllowed fold. Storing the mapped CIDR as-is
+// would instead match a mapped peer but NOT a genuine IPv4 peer (the inverse
+// asymmetry). Every other spelling (plain IPv4, hex-group IPv6) is unchanged.
+function _normalizeRelayCidr(cidr) {
+  if (typeof cidr !== "string") return cidr;
+  var m = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\/(\d{1,3})$/i.exec(cidr);
+  if (!m) return cidr;
+  var prefix = parseInt(m[2], 10);
+  if (prefix < 96 || prefix > 128) return cidr;   // outside the ::ffff:0:0/96 block — a genuine IPv6 range
+  return m[1] + "/" + (prefix - 96);
+}
+
 // Map the b.mail.inbound.verify verdict to the DATA-phase gate action.
 // The sender's published DMARC policy drives it (RFC 7489 §6.3 p= /
 // §6.6.2 disposition): reject → refuse at the wire; quarantine →
@@ -319,6 +357,25 @@ function create(opts) {
     throw new MailServerMxError("mail-server-mx/bad-opts",
       "mail.server.mx.create: relayAllowedFor must be an array if provided");
   }
+  // Every relay-allowlist entry MUST carry a valid `<ip>/<prefix>` CIDR:
+  // relay is granted only to a peer whose address falls inside an allowlisted
+  // range. Refuse a malformed / mask-less entry at boot so an operator typo
+  // can't silently leave the relay decision mis-scoped (open relay is the
+  // failure this closes — pre-fix any non-empty relayAllowedFor admitted
+  // every peer regardless of source address).
+  if (Array.isArray(opts.relayAllowedFor)) {
+    for (var __ri = 0; __ri < opts.relayAllowedFor.length; __ri += 1) {
+      var __re = opts.relayAllowedFor[__ri];
+      var __reOk = __re && typeof __re === "object" && !Array.isArray(__re) &&
+        guardCidr.validate(_normalizeRelayCidr(__re.cidr), _RELAY_CIDR_OPTS).ok;
+      if (!__reOk) {
+        throw new MailServerMxError("mail-server-mx/bad-relay-cidr",
+          "mail.server.mx.create: relayAllowedFor[" + __ri + "] must be an object with a " +
+          "valid CIDR string (e.g. { cidr: \"10.0.0.0/8\", scope: \"internal\" }); relay is " +
+          "granted only to peers whose source address falls inside an allowlisted range");
+      }
+    }
+  }
 
   var greeting          = opts.greeting          || DEFAULT_GREETING;
   var maxLineBytes      = opts.maxLineBytes      || DEFAULT_MAX_LINE_BYTES;
@@ -326,7 +383,11 @@ function create(opts) {
   var maxRcptsPerMsg    = opts.maxRcptsPerMessage || DEFAULT_MAX_RCPTS_PER_MESSAGE;
   var idleTimeoutMs     = opts.idleTimeoutMs     || DEFAULT_IDLE_TIMEOUT_MS;
   var localDomains      = (opts.localDomains || []).map(function (d) { return String(d).toLowerCase(); });
-  var relayAllowedFor   = opts.relayAllowedFor || [];
+  var relayAllowedFor   = (opts.relayAllowedFor || []).map(function (__e) {
+    return (__e && typeof __e === "object" && !Array.isArray(__e))
+      ? Object.assign({}, __e, { cidr: _normalizeRelayCidr(__e.cidr) })
+      : __e;
+  });
   var profile           = opts.profile || "strict";
   // SMTPUTF8 (RFC 6531) — single switch threaded end-to-end. The MX
   // listener doesn't advertise SMTPUTF8 to the peer regardless, so
@@ -1195,12 +1256,37 @@ function create(opts) {
       return profile === "strict" || profile === "balanced";
     }
 
-    function _isRelayAllowed(_remoteAddress, _rcptTo) {
-      // Operator-supplied relayAllowedFor entries. v1 just checks
-      // presence in the array; CIDR/scope matching could be wired
-      // via b.middleware.networkAllowlist in a follow-up.
+    function _isRelayAllowed(remoteAddress, _rcptTo) {
+      // Relay is admitted ONLY when the connecting peer's source address
+      // falls inside one of the operator's allowlisted CIDR ranges — the
+      // same range arithmetic (b.ssrfGuard.cidrContains) the HTTP
+      // b.middleware.networkAllowlist fence uses. Every entry's `cidr` was
+      // shape-validated at create() time; a peer outside every range (or a
+      // non-string / empty peer address) is refused, so a misconfigured
+      // relayAllowedFor fails closed instead of turning the listener into an
+      // open relay. `scope` is an operator-facing annotation on the entry;
+      // the network boundary is the authorization control.
       if (relayAllowedFor.length === 0) return false;
-      return true;
+      if (typeof remoteAddress !== "string" || remoteAddress.length === 0) return false;
+      // Node reports an IPv4 client as an IPv4-mapped IPv6 address
+      // (::ffff:a.b.c.d) when the listener binds the IPv6 wildcard `::` (the
+      // common dual-stack deployment). cidrContains refuses a mixed-family
+      // compare, so a documented IPv4 relay CIDR (10.0.0.0/8) would deny every
+      // intended IPv4 client on that listener. Fold the mapped form to its
+      // IPv4 dotted address (ssrfGuard.canonicalizeHost, which folds only the
+      // ::ffff:0:0/96 block) and match EITHER the peer as reported OR the
+      // folded form — so an IPv4 CIDR matches a mapped peer and an IPv6 CIDR
+      // still matches a genuine IPv6 peer.
+      var canonPeer;
+      try { canonPeer = ssrfGuard.canonicalizeHost(remoteAddress); }
+      catch (_e) { canonPeer = remoteAddress; }
+      for (var i = 0; i < relayAllowedFor.length; i += 1) {
+        var entry = relayAllowedFor[i];
+        if (!entry || typeof entry !== "object") continue;
+        if (ssrfGuard.cidrContains(entry.cidr, remoteAddress)) return true;
+        if (canonPeer !== remoteAddress && ssrfGuard.cidrContains(entry.cidr, canonPeer)) return true;
+      }
+      return false;
     }
   }
 

package/lib/retention.js

@@ -641,7 +641,12 @@ function complianceFloor(posture, candidateTtlMs) {
       "complianceFloor: posture must be a string (pass one, or set the active " +
       "posture via applyPosture / b.compliance.set), got " + JSON.stringify(posture));
   }
-  var floor = COMPLIANCE_RETENTION_FLOOR_MS[posture];
+  // Own-key lookup only: `posture` is operator-supplied, so a value colliding
+  // with an Object.prototype member ("valueOf" / "toString" / "constructor" /
+  // "hasOwnProperty" / ...) must be treated as unknown and throw below — not
+  // resolve to the inherited prototype function and be returned as a "floor".
+  var floor = Object.prototype.hasOwnProperty.call(COMPLIANCE_RETENTION_FLOOR_MS, posture)
+    ? COMPLIANCE_RETENTION_FLOOR_MS[posture] : undefined;
   if (floor === undefined) {
     throw new RetentionError("retention/unknown-posture",
       "complianceFloor: unknown posture '" + posture + "'; expected one of " +
@@ -691,7 +696,10 @@ function applyPosture(posture) {
     STATE.activeFloorMs = null;
     return null;
   }
-  var floor = COMPLIANCE_RETENTION_FLOOR_MS[posture];
+  // Own-key lookup only — a proto-member posture name must not inherit a
+  // prototype function as the floor (see complianceFloor above).
+  var floor = Object.prototype.hasOwnProperty.call(COMPLIANCE_RETENTION_FLOOR_MS, posture)
+    ? COMPLIANCE_RETENTION_FLOOR_MS[posture] : undefined;
   STATE.activePosture = posture;
   STATE.activeFloorMs = (typeof floor === "number") ? floor : null;
   return { posture: posture, floorMs: STATE.activeFloorMs };

package/lib/static.js

@@ -274,6 +274,24 @@ async function _readMeta(root, candidate) {
   return entry;
 }
 
+// _integrityHeadersForBytes — recompute the strong ETag + SRI integrity for
+// an in-memory buffer, mirroring the digest shape `_readMeta` derives from a
+// file on disk (SHA3-512-truncated ETag for the PQC posture, SHA-384 SRI for
+// the W3C subresource-integrity spec). Used on the content-safety SANITIZE
+// path: the meta cache holds digests of the on-disk ORIGINAL, but the gate
+// replaces the served bytes, so the validators the response advertises must be
+// computed over the bytes actually delivered — otherwise SRI verification of
+// the served body fails and a strong-validator / If-None-Match cache is keyed
+// to a representation the client never receives.
+function _integrityHeadersForBytes(buf) {
+  var sha3Hex = nodeCrypto.createHash("sha3-512").update(buf).digest("hex");
+  var sriDigest = nodeCrypto.createHash("sha384").update(buf).digest("base64");
+  return {
+    etag:      '"' + sha3Hex.slice(0, ETAG_HEX_PREFIX) + '"',
+    integrity: "sha384-" + sriDigest,
+  };
+}
+
 function _resolveSafe(root, requestedPath) {
   if (typeof requestedPath !== "string" || requestedPath.length === 0) return null;
   if (requestedPath.indexOf("\0") !== -1) return null;
@@ -1184,15 +1202,26 @@ function create(opts) {
 
     var cacheControl = _cacheControlFor(urlPath);
 
+    // The validators the response advertises must describe the bytes ACTUALLY
+    // delivered. On the content-safety SANITIZE path the gate replaced the
+    // bytes, so the strong ETag + SRI X-Integrity are recomputed over the
+    // override buffer rather than reused from the meta cache (which hashed the
+    // on-disk original). The conditional-request checks below compare against
+    // this same effective ETag so a strong-validator / If-None-Match cache
+    // revalidates against the representation it was actually served.
+    var served = gateBytesOverride
+      ? _integrityHeadersForBytes(gateBytesOverride)
+      : { etag: meta.etag, integrity: meta.integrity };
+
     var headersIn = req.headers || {};
 
     // Conditional: If-None-Match (304)
     var ifNone = headersIn["if-none-match"];
-    if (ifNone && ifNone === meta.etag) {
+    if (ifNone && ifNone === served.etag) {
       stats.etagHits += 1;
       _emitObs("staticServe.etag_hits", 1, { route: urlPath });
       res.writeHead(HTTP.NOT_MODIFIED, {
-        "ETag":          meta.etag,
+        "ETag":          served.etag,
         "Cache-Control": cacheControl,
         "Last-Modified": meta.lastModified,
       });
@@ -1201,7 +1230,7 @@ function create(opts) {
 
     // Conditional: If-Match (412 if no match — strong validator only)
     var ifMatch = headersIn["if-match"];
-    if (ifMatch && ifMatch !== "*" && ifMatch !== meta.etag) {
+    if (ifMatch && ifMatch !== "*" && ifMatch !== served.etag) {
       stats.failures += 1;
       _emitObs("staticServe.precondition_failed", 1, { route: urlPath, header: "if-match" });
       return writeErr(res, HTTP.PRECONDITION_FAILED || 412,
@@ -1219,7 +1248,7 @@ function create(opts) {
         stats.etagHits += 1;
         _emitObs("staticServe.if_modified_since_hits", 1, { route: urlPath });
         res.writeHead(HTTP.NOT_MODIFIED, {
-          "ETag":          meta.etag,
+          "ETag":          served.etag,
           "Cache-Control": cacheControl,
           "Last-Modified": meta.lastModified,
         });
@@ -1309,10 +1338,10 @@ function create(opts) {
     var headers = {
       "Content-Type":   _contentTypeFor(absPath, contentTypes),
       "Content-Length": sendBytes,
-      "ETag":           meta.etag,
+      "ETag":           served.etag,
       "Cache-Control":  cacheControl,
       "Last-Modified":  meta.lastModified,
-      "X-Integrity":    meta.integrity,
+      "X-Integrity":    served.integrity,
     };
     // Drive-by-execution defense — when safeAttachmentForRiskyMimes is
     // on, force Content-Disposition: attachment for HTML / JS / SVG /
@@ -1362,6 +1391,15 @@ function create(opts) {
     }
 
     if (req.method === "HEAD") {
+      // A sanitized resource is delivered as the override buffer on GET, so a
+      // HEAD must advertise that same length (and drop Content-Range) — the
+      // meta-cache size describes the on-disk original the client never gets.
+      var headSize = gateBytesOverride ? gateBytesOverride.length : meta.size;
+      if (gateBytesOverride) {
+        headers = Object.assign({}, headers, { "Content-Length": headSize });
+        delete headers["Content-Range"];
+        status = HTTP.OK;
+      }
       res.writeHead(status, headers);
       res.end();
       stats.requestsServed += 1;
@@ -1369,7 +1407,7 @@ function create(opts) {
       if (auditSuccess) {
         emitAudit("staticServe.serve.success", Object.assign({
           outcome: "success", resource: urlPath, method: "HEAD",
-          size: meta.size, contentType: headers["Content-Type"],
+          size: headSize, contentType: headers["Content-Type"],
         }, actorCtx));
       }
       return;

package/lib/vault/index.js

@@ -193,6 +193,19 @@ function _readOrCreateDerivedHashMacKey() {
   }
   if (nodeFs.existsSync(paths.derivedHashMacKey)) {
     var sealed = atomicFile.readSync(paths.derivedHashMacKey, { encoding: "utf8" }).trim();
+    // A genuine MAC key file is a vault-sealed value (seal() always emits
+    // the VAULT_PREFIX). unseal() returns a NON-prefixed value VERBATIM
+    // (idempotent read passthrough), so without this load-bearing prefix
+    // check a plaintext (or otherwise-unsealed) file substituted on disk
+    // would be accepted as the secret MAC key — defeating the sealed-at-
+    // rest guarantee a disk-write-only attacker (no vault passphrase, so
+    // unable to forge a genuine seal) otherwise cannot bypass (CWE-345).
+    // Same load-bearing prefix check db.js applies to db.key.enc.
+    if (sealed.indexOf(VAULT_PREFIX) !== 0) {
+      throw new VaultError("vault/derived-hash-mac-key-corrupted",
+        "vault.derived-hash-mac.sealed is not a sealed value (missing '" +
+        VAULT_PREFIX + "' prefix) — refusing to accept it as the MAC key");
+    }
     var b64 = unseal(sealed);
     var key = Buffer.from(b64, "base64");
     if (key.length !== 32) {                                                        // 32-byte (256-bit) MAC key

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.17.8",
+  "version": "0.17.10",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:628c839a-3725-4405-b9d5-cd446477675a",
+  "serialNumber": "urn:uuid:f1f0285b-f0c7-4750-93f1-1e0098be1f94",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-17T19:11:48.442Z",
+    "timestamp": "2026-07-18T00:02:49.577Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.17.8",
+      "bom-ref": "@blamejs/core@0.17.10",
       "type": "application",
       "name": "blamejs",
-      "version": "0.17.8",
+      "version": "0.17.10",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.17.8",
+      "purl": "pkg:npm/%40blamejs/core@0.17.10",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.17.8",
+      "ref": "@blamejs/core@0.17.10",
       "dependsOn": []
     }
   ]