@blamejs/core 0.18.35 → 0.18.37

package/CHANGELOG.md

@@ -8,6 +8,73 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.37 (2026-08-19) — **The no-regex rule for content-safety primitives never covered lib/parsers, where 55 patterns were screening adversarial input.** SECURITY.md states that no `b.guard*` or `b.safe*` primitive contains a regular expression, so a screen costs the length of its input and the byte cap that bounds the input bounds the screen. The build gate enforcing that selected files with `lib/(safe-|guard-)[^/]+\.js` — top level only. Every nested primitive was therefore outside it, and all five of them are the ones that parse untrusted bytes: `b.parsers.yaml`, `b.parsers.toml`, `b.parsers.ini`, `b.parsers.env` and `b.parsers.xml`. Between them they carried 55 pattern literals.
+
+All 55 are gone, and the gate now covers nested paths. Nothing about the parsers' behaviour changes: each screen was differential-tested against the pattern it replaced before the call site was swapped.
+
+Upgrade if you parse YAML, TOML, INI, `.env` or XML from anything you do not control. **Changed:** *The no-regex gate asks a parser instead of walking the source itself* — Deciding whether a `/` opens a regular expression or divides means implementing the ECMAScript lexical grammar, and the previous scanner kept meeting parts of it that were not implemented yet — template substitutions nest, `of` is contextual, a labelled `break` ends at the terminator after its label, `<!--` is a comment, a shebang is not JavaScript.
+
+The check now runs as an ESLint rule, which sees the file after it has already been parsed. All of those questions are answered before the rule is asked. It needs no new dependency: ESLint already runs over the repository as the first static gate, and a flat config takes an inline rule.
+
+Suppression, if a case ever warrants it, is the standard `// eslint-disable-next-line blamejs/no-regex-in-content-safety` with the reason on the line above, replacing a bespoke marker that was never used.
+
+The hand-written scanner is gone with it — about 1,240 lines, including the fixture table that had grown to justify it. Leaving both in place would have meant a justified exception passing one gate and failing the other, since the old one honoured only its own marker.
+
+The rule reports pattern literals. `new RegExp(...)` is not yet included: three call sites use it and they are not one thing — two compile a pattern in order to validate it, which is the opposite of matching against input, while `b.guardSql` builds its detectors that way and does match input. Reporting all three today would mean either an allowlist entry for the one that should be caught, or a rushed conversion of a set of injection detectors. It is tracked instead, and the rule stays exactly as strict as the scanner it replaces. **Fixed:** *A YAML tag beginning with a digit slipped past the tag ban* — `b.parsers.yaml` refuses anchors, aliases, tags and directives. The tag check accepted `!` followed by a letter or `<`, while the comment beside it described the rule as "alphanumeric or `<`" — and the code was the weaker of the two. `a: !123` is a local tag, and it parsed as the plain string `"!123"` rather than being refused.
+
+It is now refused, along with `!!123`. A quoted `"!123"` is still an ordinary string, because a quoted scalar is not a tag. **Security:** *Every pattern literal is gone from the five parsers that consume adversarial bytes* — Fifty-five of them: `safe-yaml` 24, `safe-toml` 16, `safe-env` 8, `safe-ini` 7, `safe-xml` 1.
+
+The replacements walk characters: YAML's core-schema scalar resolution is now exact-set membership and a left-to-right digit walk; TOML's date, time and offset fields are index comparisons against fixed widths; INI's integer, float and hex classification and its `[name "subsection"]` header are single passes; `.env`'s inline-comment split, `export ` prefix and `$VAR` refusal are scans.
+
+Every replacement was compared against the pattern it replaced over exhaustive short strings and adversarial cases before the call site changed — between roughly 60,000 and 1,400,000 inputs each, all with zero divergence. Where a reported line number derives from a match position, the position was compared too, not just the verdict.
+
+One honest note on scale: these patterns were not all hanging. `.env`'s inline-comment matcher looked like catastrophic backtracking and is not — its separator and token classes are disjoint, so the partition of a line is unique, and it measures flat to 40,000 characters. The rule removes it anyway, and that is the point: the cost of a screen in this family holds by construction, rather than by someone re-deriving the ambiguity of each pattern correctly every time one is edited. **References:** [ESTree — RegExpLiteral carries the pattern and flags as parsed data](https://github.com/estree/estree/blob/master/es5.md#regexpliteral) · [OWASP — Regular expression Denial of Service (ReDoS)](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)
+
+- v0.18.36 (2026-08-18) — **Six constant-time comparisons told you which candidate matched, by how long they took.** A comparison that runs in constant time answers one question without leaking anything. A loop of them that stops at the first match answers a second question nobody asked: how far down the list the match was. Six places in the framework compared a presented value against a list of candidates and returned as soon as one matched, so the response time reported the match's position — which deny-list entry a certificate hit, which verifier's nonce a token carried, where in a key rotation the sender currently sits.
+
+Every one of them returned the correct answer. The defect is only in how long it took, which is why no test caught it and why the guard that replaces them is structural.
+
+**Upgrade if you use `b.crypto.isCertRevoked`, `b.webhookHmac.verify`, `b.standardWebhooks.verify`, `b.httpMessageSignature.verify`, `b.eat` nonce verification, or the DPoP nonce middleware.** No API changes, no configuration changes — the comparisons simply stop reporting position. **Added:** *b.crypto.timingSafeEqualAny(presented, candidates)* — Returns `true` when `presented` equals any entry of `candidates`, comparing against every entry whatever the outcome. The loop has no `break` and no `return` inside it, and folds each result into an accumulator rather than writing `matched || compare(...)` — that short-circuits the call away once something matches, which is the early exit wearing different syntax.
+
+A candidate that is neither a Buffer nor a string counts as a non-match rather than throwing, because a deny list assembled from operator configuration should not fail the request on one malformed row. The presented value and the array itself are entry-tier: passing the wrong shape is a caller bug that would otherwise answer `false` for every input. **Fixed:** *b.auth.totp gains a drift-window and replay suite* — Fixing the drift loop exposed that nothing tested it. TOTP had assertions elsewhere, but `driftSteps` and `lastUsedStep` appeared in none of them — so the window's width, which step `verify()` reports, and the replay guard were all unverified.
+
+The new suite pins them against RFC 6238's Appendix B vectors, driven through the verify-only SHA-1 path an operator migrating from a legacy authenticator actually uses. It asserts that every step in the window verifies and reports its OWN step rather than the current one — reporting the current step would quietly make `lastUsedStep` replay-tracking useless — that a step outside the window is refused and the same code is accepted once the window widens, that a replayed step is refused while the next step still works, and that a malformed token reads as no-match while a misconfigured verifier still throws. · *Four NIST SP 800-53 control mappings corrected* — `docs/cis-sqlite-equivalent.md` maps the framework's posture to Revision 5 and cited three enhancements that Revision 5 withdrew: `AU-8(1)` for time-source synchronisation, now `SC-45(1)`; `IA-2(11)` for step-up authentication, now `IA-2(6)`; and `CP-2(8)` for recovery objectives, now folded into `CP-2`.
+
+The fourth was a live enhancement claimed for a mechanism that does not meet it. `AU-9(1)` requires audit trails written to hardware-enforced write-once media; the framework's WORM tables are a database trigger refusing UPDATE and DELETE. That is software enforcement, and an assessor would reject the mapping. The row now cites `AU-9` and says what a deployment claiming the enhancement has to add underneath. **Security:** *Six multi-candidate comparisons no longer leak the matching candidate's position* — Each of these compared a presented value against a list and exited on the first hit:
+
+- `b.crypto.isCertRevoked` — which entry of the deny list the certificate's fingerprint matched. Its own docstring promised the opposite: "every comparison runs through `crypto.timingSafeEqual` so the answer doesn't leak which entry matched", above a loop that returned inside itself.
+- `b.eat` nonce verification — which verifier's nonce an attestation token carried, under a comment reading "Constant-time compare against each candidate".
+- The DPoP nonce middleware — whether a client presented the current or the previous nonce, which locates it in the rotation window. Its comment claimed the compare existed "so server-issued nonce probing can't narrow the rolling-pair bytes via response-timing".
+- `b.webhookHmac.verify` and `b.standardWebhooks.verify` — the position of the matching signature in a multi-signature header, which tracks the sender's key rotation.
+- `b.httpMessageSignature.verify` — the position of the matching member in a `Content-Digest` header.
+
+All six now compare against every candidate. A length mismatch still short-circuits a single comparison and still leaks nothing: the lengths involved are digest and fingerprint sizes fixed by an algorithm, not secrets. · *Two more, found by checking loop scope instead of matching text* — The six above were found by reading code. Replacing the text pattern that guarded them with one that actually resolves loop bodies — brace matching over comment-stripped source — turned up two the pattern could not have seen, because neither exits with the `return true` it was looking for:
+
+- `b.auth.password` breach checking returned on the first HaveIBeenPwned range line that matched, so the response time reported WHERE in the range the hit was. The range is public; the position narrows the SHA-1 suffix, which is precisely the half of the hash that k-anonymity exists to withhold. Every line is now compared before the verdict.
+- `b.totp.verify` returned on the first drift step that matched, reporting the clock offset between authenticator and server through timing. Every step in the window is now compared, and the earliest match still wins.
+
+Neither is guarded by a `matched === null` condition on the comparison itself — that short-circuits the call away once something matches, which is the same early exit in different syntax.
+
+`b.network.dns.dane.matchCertificate` also exits on its first match and is deliberately left alone: it compares a TLSA record published in DNS against a digest of the certificate presented in the handshake. Both operands are public, so the iteration count reveals nothing an observer could not compute, and reporting which record matched is the function's contract. **Detectors:** *A detector can pin the shapes it must NOT refuse* — A `codebase-patterns` entry may now carry `fixtures: { fires, quiet }`, and a check runs them: every listed shape must fire, every listed shape must stay quiet. Nothing enforced that before, so a pattern's precision lived in whatever its author happened to try by hand — which is one direction, against the code the pattern was written for.
+
+The entry added in this release got both directions wrong before the fixtures existed. It refused a single negated comparison (`if (!timingSafeEqual(a, b)) return false; return true;` — one comparison, no position to leak), and separately refused a `.find()` locating a record by type merely because a comparison appeared nearby. Neither shape was visible from the code the pattern was aimed at. · *The live-integration runner no longer counts a file that asserted nothing as a pass* — The runner decided a file had passed from its exit status, then printed whatever `OK — <n> checks passed` line the file happened to emit. Four of the fifty integration files never emitted one, so their column was blank and nobody could tell the difference between a file that ran its assertions and a file whose `run()` resolved before reaching them. Between them those four carry 111 checks.
+
+Exit status alone cannot answer the question: a file that stops asserting exits 0 exactly like a file that passed. The runner now requires the count line and requires it to be greater than zero — `OK — 0 checks passed` matches the old pattern while verifying nothing — and the four silent files report their counts.
+
+A static check covers the same ground during the fast gates, since the runner needs the live backends to say anything. It reads the source with comment lines blanked: a commented-out success print contains every token the check looks for, and that is the likeliest way a file goes silent, so reading raw source would pass on exactly the state being guarded against. The same blanking now backs the fuzz-harness entry-point check, where a commented-out `module.exports.fuzz` would otherwise read as a wired harness. · *A constant-time compare in a loop may not exit early* — Two checks, split by what each can actually decide.
+
+A pattern covers the loop-free shape: two comparisons in sequence, each guarding its own early exit — the DPoP current/previous nonce pair. That is a sequence of tokens, so a pattern decides it exactly.
+
+Loop membership is decided by matching braces over comment-stripped source instead, because whether a comparison sits inside a particular loop body is a question about scope. Successive attempts to answer it with a pattern flagged an ordinary one-pair verifier that merely followed an unrelated loop — a text pattern stops at a brace in the first column, and loop bodies close indented — while missing `for await`, `do…while`, and brace-less single-statement bodies. Resolving the body outright covers all of them and found the two additional leaks above.
+
+A `continue` is not an early exit for this purpose: it skips a candidate that was never eligible and the loop still runs to the end, which is what `timingSafeEqualAny` does. Counting it flagged the primitive written to fix the defect.
+
+An ordinary one-pair verifier stays quiet in both checks — one comparison has no position to report.
+
+This one is the primary guard rather than the usual second line, and the reason is worth stating: every affected site produced the correct output, so no assertion on a return value could observe the defect, and a wall-clock measurement cannot assert it reliably under a parallel test runner. The property is structural — the loop must have no exit to take — so the check is structural too, and the fix routes through a primitive that cannot be talked into returning early rather than asking each loop to be reviewed.
+
+Its scope is deliberately narrow, and the boundary is recorded in the entry itself. A comparison inside a `.some` or `.find` callback is the same defect, and the check does not claim it: deciding whether a call sits inside a particular callback is a parsing question, and every attempt to answer it with a pattern either refused working code or missed a real shape. What it does cover — a positive comparison guarding an early exit — is the shape all six of these took. **References:** [NIST SP 800-53 Rev. 5 SC-45(1) — Synchronization with Authoritative Time Source](https://csf.tools/reference/nist-sp-800-53/r5/sc/sc-45/sc-45-1/) · [NIST SP 800-53 Rev. 5 AU-9(1) — Hardware Write-once Media](https://csf.tools/reference/nist-sp-800-53/r5/au/au-9/au-9-1/) · [RFC 9449 — OAuth 2.0 Demonstrating Proof of Possession (DPoP), nonce handling](https://www.rfc-editor.org/rfc/rfc9449.html) · [RFC 9421 — HTTP Message Signatures, Content-Digest verification](https://www.rfc-editor.org/rfc/rfc9421.html)
+
 - v0.18.35 (2026-08-18) — **Thirteen character policies the guards declared and did not apply, and two content guards that could not perform the repair they promised.** A guard's profile names a policy per character class — `reject`, `strip`, `audit`, `allow`. Thirteen of those settings across `b.guardEmail`, `b.guardXml`, `b.guardMarkdown`, `b.guardJson` and `b.guardYaml` resolved to something other than what they named, because the code decided by the finding's SEVERITY rather than by the policy. Severity is fixed per class — a bidi control is `critical` however it is configured — so a severity-gated decision refuses what an operator asked to record and, in a guard whose findings never reach `critical`, lets through what they asked to reject. Both directions were live at once.
 
 Every declared character policy now resolves to the action it names, and a family-wide test asserts it for all five classes across every content guard.

package/README.md

@@ -346,7 +346,7 @@ Because when something breaks, `blame` should know exactly where it lives. We ow
 
 Every release passes a layered gate at `test/layer-0-primitives/codebase-patterns.test.js` that operates on lib/ source:
 
-- **Bug-class detectors** — raw byte / time literals, `JSON.parse` on operator input without size cap, numeric opts that silently accept `Infinity` / `NaN`, ReDoS-risky regex without length cap, hash / token compares without `timingSafeEqual`, raw `new URL` skipping the SSRF gate, `Math.random()` in security-sensitive paths, and a couple dozen others — each a bug class the framework already swept once and won't re-introduce.
+- **Bug-class detectors** — raw byte / time literals, `JSON.parse` on operator input without size cap, numeric opts that silently accept `Infinity` / `NaN`, ReDoS-risky regex without length cap, hash / token compares without `timingSafeEqual`, a constant-time compare in a loop that exits on the first match (which leaks the matching candidate's position however constant each comparison is), raw `new URL` skipping the SSRF gate, `Math.random()` in security-sensitive paths, and a couple dozen others — each a bug class the framework already swept once and won't re-introduce.
 - **Inline-shape catalog (n=1)** — every primitive that's been extracted (`validateOpts.requireNonEmptyString`, `safeAsync.makeScheduledFlush`, `dbSchema.runInTransaction`, etc.) registers the inline shape it replaced; new code that re-implements the shape fails the gate even if it's the only file matching.
 - **Cluster allowlist (n>=3)** — duplicate-block detection across files. Genuine new clusters get extracted; clusters that resist extraction (parser error class signature mismatches, framework-convention shapes, cross-domain coincidences) get an entry with a documented structural reason. No silent allowlisting.
 

package/lib/auth/password.js

@@ -460,6 +460,7 @@ function policy(opts) {
       var lines = bodyText.split(/\r?\n/);
       var goodLines = 0;
       var badLines = 0;
+      var breachedCount = null;
       for (var li = 0; li < lines.length; li++) {
         var line = lines[li].trim();
         if (line.length === 0) continue;
@@ -469,13 +470,21 @@ function policy(opts) {
         var count = parseInt(line.slice(colon + 1), 10);
         if (!isFinite(count)) { badLines += 1; continue; }
         goodLines += 1;
-        if (timingSafeEqual(Buffer.from(hashSuffix, "utf8"), Buffer.from(suffix, "utf8")) &&
-            count >= p.breachThreshold) {
-          return _fail("breached",
-            "plaintext appears in HaveIBeenPwned with count " + count +
-            " (threshold " + p.breachThreshold + ")");
+        // Compare against every line, then decide. Returning on the first match
+        // made the response time report WHERE in the range response the hit was,
+        // and the range is public — so that position narrows the suffix, which is
+        // the half of the password's SHA-1 that k-anonymity exists to keep back.
+        // The condition order matters too: `count >= threshold &&` first would
+        // skip the comparison on low-count lines and leak through that instead.
+        if (timingSafeEqual(Buffer.from(hashSuffix, "utf8"), Buffer.from(suffix, "utf8"))) {
+          if (count >= p.breachThreshold && breachedCount === null) breachedCount = count;
         }
       }
+      if (breachedCount !== null) {
+        return _fail("breached",
+          "plaintext appears in HaveIBeenPwned with count " + breachedCount +
+          " (threshold " + p.breachThreshold + ")");
+      }
       // If a hostile / poisoned mirror returned a response shaped like
       // HIBP but with mostly-unparseable counts, the original loop
       // skipped them silently and reported breachCheckCount=0 — i.e.

package/lib/crypto.js

@@ -570,6 +570,66 @@ function timingSafeEqual(a, b) {
   return nodeCrypto.timingSafeEqual(bufA, bufB);
 }
 
+/**
+ * @primitive b.crypto.timingSafeEqualAny
+ * @signature b.crypto.timingSafeEqualAny(presented, candidates)
+ * @since     0.18.36
+ * @status    stable
+ * @related   b.crypto.timingSafeEqual, b.crypto.isCertRevoked, b.crypto.spkiPinVerifier
+ *
+ * Returns `true` when `presented` equals any entry of `candidates`, comparing
+ * against EVERY entry whatever the outcome. A per-candidate compare in a loop
+ * that stops at the first match answers a second question nobody asked — how
+ * far down the list the match was — and the caller's own timing then reports
+ * it: matching the first pinned key returns sooner than matching the last, and
+ * matching nothing runs the whole list. That is a position oracle over a secret
+ * ordering, so this loop has no `break`, no `return` inside it, and folds each
+ * result into an accumulator instead.
+ *
+ * A length mismatch short-circuits a single comparison, and that leaks nothing:
+ * the lengths compared here are digest and fingerprint sizes fixed by an
+ * algorithm, not secrets. `presented` and each candidate may be a Buffer or a
+ * string; a candidate that is neither counts as a non-match rather than
+ * throwing, because a deny list assembled from operator config should not fail
+ * the request on one malformed row.
+ *
+ * Entry-tier on `presented` and on the array itself: a caller that passes the
+ * wrong shape has a bug, and the compare would otherwise silently answer
+ * `false` for every input.
+ *
+ * @example
+ *   var ok = b.crypto.timingSafeEqualAny(presentedKey, [primary, previous]);
+ *   // → true when it matches either, in the same time either way
+ */
+function timingSafeEqualAny(presented, candidates) {
+  if (!Buffer.isBuffer(presented) && typeof presented !== "string") {
+    throw new TypeError(
+      "crypto.timingSafeEqualAny: argument 'presented' must be a Buffer or " +
+      "string, got " + (presented === null ? "null" : typeof presented)
+    );
+  }
+  if (!Array.isArray(candidates)) {
+    throw new TypeError(
+      "crypto.timingSafeEqualAny: argument 'candidates' must be an array, got " +
+      (candidates === null ? "null" : typeof candidates)
+    );
+  }
+  var presentedBuf = Buffer.isBuffer(presented)
+    ? presented : Buffer.from(presented, "utf8");
+  var matched = false;
+  for (var i = 0; i < candidates.length; i += 1) {
+    var candidate = candidates[i];
+    if (!Buffer.isBuffer(candidate) && typeof candidate !== "string") continue;
+    var candidateBuf = Buffer.isBuffer(candidate)
+      ? candidate : Buffer.from(candidate, "utf8");
+    if (candidateBuf.length !== presentedBuf.length) continue;
+    // `matched ||` would short-circuit the call away once something matched,
+    // which is the early exit wearing a different syntax.
+    if (nodeCrypto.timingSafeEqual(presentedBuf, candidateBuf)) matched = true;
+  }
+  return matched;
+}
+
 // ===========================================================
 // Public API — built on core primitives
 // ===========================================================
@@ -2088,18 +2148,23 @@ function isCertRevoked(pemOrDer, denyList) {
   var fp = hashCertFingerprint(pemOrDer);
   var fpHex = Buffer.from(fp.hex, "hex");
   var fpColon = Buffer.from(fp.colon);
+  // The docstring above promises the answer does not leak which entry matched.
+  // It did: the loop returned inside itself, so a hit on the first deny-list
+  // row answered sooner than a hit on the last, and a miss ran the whole list.
+  // Split by form and route each half through timingSafeEqualAny, which has no
+  // exit to take. The two buckets are compared independently because the
+  // colon form and the hex form are different byte lengths.
+  var colonEntries = [];
+  var hexEntries = [];
   for (var i = 0; i < denyList.length; i++) {
     var entry = denyList[i];
     if (typeof entry !== "string" || entry.length === 0) continue;
-    var normalized = entry.indexOf(":") !== -1 ? entry.toUpperCase() : entry.toLowerCase();
-    var normalizedBuf = entry.indexOf(":") !== -1 ? Buffer.from(normalized) : Buffer.from(normalized, "hex");
-    var compareBuf  = entry.indexOf(":") !== -1 ? fpColon : fpHex;
-    if (normalizedBuf.length === compareBuf.length &&
-        nodeCrypto.timingSafeEqual(normalizedBuf, compareBuf)) {
-      return true;
-    }
+    if (entry.indexOf(":") !== -1) colonEntries.push(Buffer.from(entry.toUpperCase()));
+    else hexEntries.push(Buffer.from(entry.toLowerCase(), "hex"));
   }
-  return false;
+  var hitColon = timingSafeEqualAny(fpColon, colonEntries);
+  var hitHex = timingSafeEqualAny(fpHex, hexEntries);
+  return hitColon || hitHex;
 }
 
 // ---- RFC 7469 SubjectPublicKeyInfo pinning ----
@@ -2461,6 +2526,7 @@ module.exports = {
   kdf:                         kdf,
   // Comparison
   timingSafeEqual:             timingSafeEqual,
+  timingSafeEqualAny:          timingSafeEqualAny,
   // Cert fingerprint helpers
   hashCertFingerprint:         hashCertFingerprint,
   isCertRevoked:               isCertRevoked,

package/lib/eat.js

@@ -88,13 +88,17 @@ function _nonceMatches(claimValue, expected) {
   var exp = _toBuf(expected);
   if (!exp) return false;
   // eat_nonce may be a single byte string or an array of them (one per
-  // verifier). Constant-time compare against each candidate.
+  // verifier). Compare against every candidate: the loop this replaced said
+  // "constant-time compare against each candidate" and then returned on the
+  // first hit, so the time reported WHICH verifier's nonce matched — an
+  // ordering the relying party did not agree to publish.
   var candidates = Array.isArray(claimValue) ? claimValue : [claimValue];
+  var bufs = [];
   for (var i = 0; i < candidates.length; i++) {
     var c = _toBuf(candidates[i]);
-    if (c && c.length === exp.length && bCrypto.timingSafeEqual(c, exp)) return true;
+    if (c) bufs.push(c);
   }
-  return false;
+  return bCrypto.timingSafeEqualAny(exp, bufs);
 }
 
 /**

package/lib/http-message-signature.js

@@ -703,19 +703,23 @@ function verify(msg, opts) {
     // buried inside another member's value or parameters. Peer-supplied
     // sha-512 / sha-256 identifiers stay the operator's responsibility.
     var expectedDigest = contentDigest(m.body);           // "sha3-512=:<b64>:"
-    var matchedDigest  = false;
     var digestMembers  = structuredFields.splitTopLevel(presented, ",");
+    var offeredDigests = [];
     for (var di = 0; di < digestMembers.length; di++) {
       var member = digestMembers[di].trim();
       var deq = member.indexOf("=");
       if (deq < 1) continue;
       var dkv = structuredFields.parseKeyValuePiece(member);
       if (dkv.key !== "sha3-512") continue;
-      var memberCanonical = "sha3-512=" + dkv.value.trim();
-      // crypto.timingSafeEqual is the length-tolerant constant-time wrapper
-      // (returns false for unequal lengths without leaking via a length branch).
-      if (bCrypto.timingSafeEqual(memberCanonical, expectedDigest)) { matchedDigest = true; break; }
+      offeredDigests.push("sha3-512=" + dkv.value.trim());
     }
+    // Every offered member is compared. The `break` this replaced stopped at
+    // the first match, so a Content-Digest header whose first sha3-512 member
+    // matched answered sooner than one whose last did — the position of the
+    // matching member, reported by timing. timingSafeEqualAny is the
+    // length-tolerant constant-time compare (an unequal length is a non-match
+    // without a branch that leaks anything: digest lengths are fixed).
+    var matchedDigest = bCrypto.timingSafeEqualAny(expectedDigest, offeredDigests);
     if (!matchedDigest) {
       return { valid: false, reason: "content-digest-mismatch" };
     }

package/lib/middleware/dpop.js

@@ -114,12 +114,16 @@ function _nonceManager(rotateSec) {
       if (shutdown) return false;
       _maybeRotate();
       if (typeof n !== "string" || n.length === 0) return false;
-      // Constant-time compare so server-issued nonce probing can't
-      // narrow the rolling-pair bytes via response-timing — matches
-      // the timingSafeEqual discipline on the DPoP-proof nonce.
-      if (current && bCrypto.timingSafeEqual(n, current.nonce)) return true;
-      if (previous && bCrypto.timingSafeEqual(n, previous.nonce)) return true;
-      return false;
+      // Constant-time compare so server-issued nonce probing can't narrow the
+      // rolling-pair bytes via response-timing. Both halves of the pair are
+      // compared every time: returning on `current` answered a client holding
+      // the current nonce sooner than one holding the previous one, which
+      // reports where in the rotation window the caller sits — the property
+      // the comment above already claimed this had.
+      var accepted = [];
+      if (current) accepted.push(current.nonce);
+      if (previous) accepted.push(previous.nonce);
+      return bCrypto.timingSafeEqualAny(n, accepted);
     },
     // Hot-reload coexistence. Operators redeploying without
     // a clean process restart need a way to drain in-flight clients

package/lib/parsers/safe-env.js

@@ -64,6 +64,7 @@ var lazyRequire = require("../lazy-require");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var safeJson = require("../safe-json");
+var codepointClass = require("../codepoint-class");
 var { FrameworkError } = require("../framework-error");
 var { boot } = require("../log");
 
@@ -90,10 +91,117 @@ class SafeEnvError extends FrameworkError {
   }
 }
 
+// Split an unquoted value at an inline `# comment`, returning the text BEFORE
+// the comment, or null when there is no comment to strip. Replaces
+// `/^([^\s#]*(?:[ \t]+[^#\s]+)*)\s+#.*$/`.
+//
+// That pattern was NOT catastrophic, and it is worth saying so rather than
+// implying the family rule only ever removes live bugs. `[ \t]+` and `[^#\s]+`
+// are disjoint, so the partition of a line into separators and tokens is unique
+// and there is nothing for the engine to backtrack through — measured flat to
+// 40k characters across every shape that defeats the match. It goes because the
+// rule is uniform: a screen in this family costs the length of its input, and
+// that holds by construction instead of by someone re-deriving the ambiguity of
+// each pattern correctly, every time one is edited. The neighbouring
+// trailing-whitespace strip is already a walk, for a reason that WAS measured —
+// `.replace(/[ \t]+$/)` is quadratic in V8 and the parser caps total bytes, not
+// bytes per line.
+//
+// Reading the pattern back gives a rule with no search in it. Group 1 admits no
+// `#` at all, so the `#` the pattern finds is always the FIRST one; it must be
+// preceded by whitespace; and everything before that whitespace run may only be
+// separated by spaces and tabs (a `\v`, `\f` or U+00A0 is whitespace to `\s` but
+// not to `[ \t]`, so the pattern would not match and neither does this).
+function _splitInlineComment(rest) {
+  var hash = rest.indexOf("#");
+  if (hash <= 0) return null;                       // absent, or nothing before it
+  if (!codepointClass.inRanges(rest.charCodeAt(hash - 1), codepointClass.WHITESPACE_RANGES)) {
+    return null;                                    // `color#red` keeps its `#`
+  }
+  // Walk back over the whitespace run that `\s+` consumed.
+  var end = hash - 1;
+  while (end >= 0 && codepointClass.inRanges(rest.charCodeAt(end), codepointClass.WHITESPACE_RANGES)) {
+    end -= 1;
+  }
+  var head = rest.slice(0, end + 1);
+  // The separators inside group 1 are `[ \t]` only.
+  for (var i = 0; i < head.length; i += 1) {
+    var cc = head.charCodeAt(i);
+    if (!codepointClass.inRanges(cc, codepointClass.WHITESPACE_RANGES)) continue;
+    if (cc !== 0x20 && cc !== 0x09) return null;
+  }
+  // `#.*$` cannot cross a line terminator, and `$` without `m` is end-of-string.
+  // Lines arrive split on LF and CR already, but U+2028 and U+2029 survive that
+  // and are terminators to the grammar, so a comment containing one meant the
+  // pattern did not match and the whole value was kept.
+  for (var t = hash; t < rest.length; t += 1) {
+    var tc = rest.charCodeAt(t);
+    if (tc === 0x0A || tc === 0x0D || tc === 0x2028 || tc === 0x2029) return null;
+  }
+  return head;
+}
+
+// `export FOO=bar` — the POSIX shell convention. Replaces a `/^export\s+/` test
+// paired with an identical `.replace`, which walked the prefix twice.
+// The default key shape, `^[A-Z_][A-Z0-9_]*$`, as a walk. The label is what the
+// refusal message quotes, so an operator still sees the shape they violated
+// rather than the word "function".
+var _ASCII_UPPER      = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+var _KEY_HEAD_CHARS   = _ASCII_UPPER + "_";
+var _KEY_TAIL_CHARS   = _ASCII_UPPER + codepointClass.ASCII_DIGITS + "_";
+var DEFAULT_KEY_SHAPE = "^[A-Z_][A-Z0-9_]*$";
+
+function _matchesDefaultKeyShape(key) {
+  if (typeof key !== "string" || key.length === 0) return false;
+  if (_KEY_HEAD_CHARS.indexOf(key.charAt(0)) === -1) return false;
+  if (key.length === 1) return true;                 // isRunOf("") is false
+  return codepointClass.isRunOf(key.slice(1), _KEY_TAIL_CHARS);
+}
+
+var _EXPORT = "export";
+
+function _stripExportPrefix(line) {
+  if (line.slice(0, _EXPORT.length) !== _EXPORT) return line;
+  var i = _EXPORT.length;
+  var afterWord = i;
+  while (i < line.length &&
+         codepointClass.inRanges(line.charCodeAt(i), codepointClass.WHITESPACE_RANGES)) i += 1;
+  if (i === afterWord) return line;              // `exported=1` is a key, not a prefix
+  return line.slice(i);
+}
+
+// `$VAR` and `${VAR}` references, which this parser refuses rather than expands.
+// Replaces `/\$(\{[A-Za-z_]|[A-Za-z_])/` — a `$` followed either by a brace and
+// an identifier head, or by an identifier head directly. A trailing `$`, `$1` or
+// `$ ` is a literal dollar and stays one.
+function _isIdentifierHead(ch) {
+  // The length guard is load-bearing: `charAt` past the end returns "", and
+  // `indexOf("")` is 0 on every string, so without it a trailing `$` reads as a
+  // reference and a literal dollar at end-of-value is refused.
+  if (ch.length !== 1) return false;
+  return ch === "_" || codepointClass.ASCII_ALPHA.indexOf(ch) !== -1;
+}
+
+function _hasVariableReference(text) {
+  for (var i = 0; i < text.length; i += 1) {
+    if (text.charAt(i) !== "$") continue;
+    var next = text.charAt(i + 1);
+    if (next === "{") {
+      if (_isIdentifierHead(text.charAt(i + 2))) return true;
+      continue;
+    }
+    if (_isIdentifierHead(next)) return true;
+  }
+  return false;
+}
+
 var DEFAULTS = {
   maxBytes:       C.BYTES.kib(64),
   maxKeys:        1_000,
-  keyShape:       /^[A-Z_][A-Z0-9_]*$/,
+  // The DEFAULT shape is a walk, not a pattern. An operator may still pass a
+  // RegExp — there the pattern is the INPUT, which is the one case this family
+  // allows — and that override is honoured unchanged below.
+  keyShape:       null,
   applyToProcess: false,
   allowOverwrite: false,
   rejectUnknown:  false,
@@ -120,7 +228,11 @@ function parse(input, opts) {
     ? Math.min(opts.maxBytes, C.BYTES.mib(1)) : DEFAULTS.maxBytes;
   var maxKeys = opts.maxKeys !== undefined
     ? Math.min(opts.maxKeys, 100_000) : DEFAULTS.maxKeys;
-  var keyShape = opts.keyShape instanceof RegExp ? opts.keyShape : DEFAULTS.keyShape;
+  var operatorKeyShape = opts.keyShape instanceof RegExp ? opts.keyShape : null;
+  var keyShapeLabel = operatorKeyShape ? String(operatorKeyShape) : DEFAULT_KEY_SHAPE;
+  function keyShapeAccepts(key) {
+    return operatorKeyShape ? operatorKeyShape.test(key) : _matchesDefaultKeyShape(key);
+  }
 
   input = safeBuffer.normalizeText(input, {
     maxBytes:   maxBytes,
@@ -129,7 +241,9 @@ function parse(input, opts) {
     sizeCode:   "env/too-large",
   });
 
-  var rawLines = input.split(/\r\n|\r|\n/);
+  // splitLinesAny breaks on LF, CR and CRLF-as-one — the same three the
+  // `/\r\n|\r|\n/` alternation covered, in the same order of preference.
+  var rawLines = codepointClass.splitLinesAny(input);
   var values = Object.create(null);
   var seen = new Set();
 
@@ -137,14 +251,12 @@ function parse(input, opts) {
     var line = rawLines[i];
     var lineNumber = i + 1;
     // Trim leading whitespace (operators sometimes indent for readability)
-    var trimmed = line.replace(/^[ \t]+/, "");
+    var trimmed = codepointClass.trimChars(line, " \t", { trailing: false });
     if (trimmed.length === 0) continue;
     if (trimmed.charAt(0) === "#") continue;
 
     // Optional `export ` prefix (POSIX shell convention)
-    if (/^export\s+/.test(trimmed)) {
-      trimmed = trimmed.replace(/^export\s+/, "");
-    }
+    trimmed = _stripExportPrefix(trimmed);
 
     var eqIdx = trimmed.indexOf("=");
     if (eqIdx < 0) {
@@ -159,9 +271,9 @@ function parse(input, opts) {
     if (pick.isPoisonedKey(key)) {
       throw new SafeEnvError("forbidden key '" + key + "'", "env/poisoned-key", lineNumber);
     }
-    if (!keyShape.test(key)) {
+    if (!keyShapeAccepts(key)) {
       throw new SafeEnvError(
-        "key '" + key + "' does not match keyShape " + keyShape,
+        "key '" + key + "' does not match keyShape " + keyShapeLabel,
         "env/bad-key-shape", lineNumber
       );
     }
@@ -188,18 +300,14 @@ function parse(input, opts) {
       // Unquoted value: strip trailing whitespace + inline `# comment`.
       // The comment marker MUST be preceded by whitespace to count
       // (so a value like `KEY=color#red` keeps the literal `#`).
-      var commentMatch = rest.match(/^([^\s#]*(?:[ \t]+[^#\s]+)*)\s+#.*$/);
+      var beforeComment = _splitInlineComment(rest);
       // stripTrailingHspace is a linear char-scan; .replace(/[ \t]+$/) is O(n^2)
       // in V8 and the env parser only caps TOTAL bytes, not per-line, so a
       // single huge-whitespace value line would otherwise hang the parser.
-      if (commentMatch) {
-        value = safeBuffer.stripTrailingHspace(commentMatch[1]);
-      } else {
-        value = safeBuffer.stripTrailingHspace(rest);
-      }
+      value = safeBuffer.stripTrailingHspace(beforeComment === null ? rest : beforeComment);
       // Reject `$VAR` style references — explicit error so operators
       // see the policy rather than silently getting unexpanded text.
-      if (/\$(\{[A-Za-z_]|[A-Za-z_])/.test(value)) {
+      if (_hasVariableReference(value)) {
         throw new SafeEnvError(
           "$VAR / ${VAR} expansion not supported (escape with \\$ if literal, or quote and expand yourself)",
           "env/expansion-banned", lineNumber
@@ -254,7 +362,8 @@ function _decodeDoubleQuoted(rest, lineNumber) {
       // Optional inline comment after closing quote — ignore.
       return out;
     }
-    if (ch === "$" && /^[{A-Za-z_]/.test(rest.charAt(i + 1) || "")) {
+    var afterDollar = rest.charAt(i + 1);
+    if (ch === "$" && (afterDollar === "{" || _isIdentifierHead(afterDollar))) {
       throw new SafeEnvError(
         "$VAR / ${VAR} expansion not supported in double-quoted value (use \\$ for literal $)",
         "env/expansion-banned", lineNumber