@blamejs/core 0.18.48 → 0.18.50

package/CHANGELOG.md

@@ -8,6 +8,42 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.50 (2026-08-22) — **Five places let someone else choose how much CPU your server spends on one match.** A Sieve `:matches` wildcard, a JSONPath `match()` filter and a JSON Schema `pattern` each took a pattern from outside the framework and ran it on a backtracking engine. A Sieve rule with five wildcards spent 452ms on a 60-character Subject; a JSONPath filter spent 7 seconds on a 29-character value; a schema pattern spent 1.5 seconds on 28 characters and doubled with every two more. Two more were the same cost from the other direction, a fixed pattern against attacker-shaped input: a DKIM tag scan and a scanner-reply trim, both quadratic. All five now refuse the shape or match without backtracking. **Security:** *`b.mail.sieve` matches `:matches` wildcards without a regular expression* — RFC 5228 `:matches` uses `*` for any sequence and `?` for one character. Translating that into a regular expression turns each `*` into `.*`, and a backtracking engine facing several of them tries every way of dividing the subject between them. The cost is polynomial in the subject length with degree equal to the number of wildcards.
+
+Measured on the shipped path, `b.mail.sieve.runScript` with `if header :matches "Subject" ...` and a subject that never supplies the pattern's trailing literal: three wildcards grew by a factor of 7.7 for each doubling of the subject, and ten wildcards — which a script author can type without meaning anything by it — did not finish on a 64-character Subject.
+
+The `maxGas` budget did not bound it. Gas counts operations, and one match is one operation however long the engine spends inside it: five wildcards cost 452ms for three gas units.
+
+This matters because of who writes the script. Sieve is a user-level filtering language, so in most deployments the pattern comes from the mailbox owner rather than from you. The wildcard is now matched directly against the value, walking both strings with a single remembered wildcard position, so the work is bounded by their lengths rather than by how the pattern is shaped. Every pattern decides exactly as it did before, checked across 42,976 pattern/subject/case combinations against the previous implementation.
+
+One deliberate change of behaviour comes with it. `:comparator "i;ascii-casemap"` now folds US-ASCII `A-Z` only, which is what RFC 4790 §9.2 defines it as; the regular expression it replaced carried JavaScript's `i` flag and folded the whole of Unicode. The narrower fold is also the only one that preserves length: `"İ".toLowerCase()` is two UTF-16 units, so folding a subject up front shifts every position after it and leaves `?`, which matches exactly one character, facing two. A script relying on non-ASCII case folding under `i;ascii-casemap` was relying on something the comparator does not promise. · *`b.jsonPath` refuses a catastrophic `match()` or `search()` pattern* — The second argument of an RFC 9535 `match()` or `search()` filter is an I-Regexp (RFC 9485), which is a general regular-expression language: a filter can carry `(a+)+$` as easily as `a+`. `$[?match(@.name, "(a+)+$")]` against a 29-character value that fails the match took 7 seconds.
+
+The node ceilings on descendant walks and running nodelists never saw it, because the whole cost is inside one match on one node.
+
+The pattern is now screened with `b.guardRegex.assertSafe` before it can run, which is what the framework already does wherever else it compiles a caller-supplied pattern — `b.flag` targeting conditions and MCP tool schemas both go through the same screen. A refusal raises `json-path/unsafe-pattern` rather than being folded into a false test result: a malformed I-Regexp yields false per RFC 9535 §2.4.6, and a refused one must not wear those clothes, or the caller is left with a filter that silently matches nothing. · *A folded DKIM-Signature header made the submission listener spend its CPU on a trim* — `b.mail.server.submission` reads the `d=` tag out of each DKIM-Signature header, and trimmed each tag with `/^\s+|\s+$/`. That is the quadratic trim: the `\s+$` alternative is retried from every start position when the whitespace run does not reach the end of the string.
+
+The tag was believed to be bounded by the line cap. It is not, because the header is unfolded first. Every empty continuation line contributes one space to the joined value, so the lever is the number of folded lines rather than the length of any one of them, and the real bound is `maxMessageBytes` — 50 MiB by default. An authenticated client sending 40,000 empty continuation lines, a 120 KB message, produced a 40,000-character run and 446ms of backtracking on one header. Three megabytes would have bought minutes.
+
+The trim is now `String.prototype.trim`, which decides identically (the same WhiteSpace and LineTerminator set as `\s`) and does not backtrack. · *A virus-scanner reply with a long newline run cost the same shape* — The ClamAV INSTREAM reply is trimmed of trailing CR / LF / NUL before it is classified, and the trim was `/[\r\n\0]+$/`. Anchoring at `$` does not stop the engine retrying from every start position; it is what makes the scan quadratic. A reply carrying a long interior run of newlines took 1.2 seconds through the real scan path.
+
+The reply is capped, but by `maxResponseBytes`, which is 50 MiB on the strict profile and 300 MiB on permissive, so the cap was not what stood between a reply and the cost. The trim now walks backwards from the end.
+
+A local daemon is normally trusted, which makes this hardening rather than a hole — but `b.mail.scan` dials a host and a port, a scanning service can be remote, and a reply parser is the wrong place to assume the peer is well behaved. · *`b.jsonSchema` screens `pattern` and `patternProperties` when the schema compiles* — A `pattern` keyword is compiled and then run against the instance, so the schema author decides what each validation costs. `(a+)+$` against a 28-character string that fails took 1.5 seconds, doubling with every two characters added.
+
+The reasoning that left this unscreened was that a schema is operator-supplied and therefore trusted. The framework does not hold that assumption elsewhere: `b.mcp` already screens the `pattern` in a tool schema for exactly this shape before matching it against request input. A schema arrives from a registry, a tool manifest, an upload or a config file as readily as from your own source.
+
+Every pattern in a schema is now screened, and screened at `b.jsonSchema.compile` rather than on the first instance that reaches it — a bad schema should be refused while you are still looking at the schema, not on a request, through a validator you have already been handed and have no reason to doubt.
+
+The screen reads the compiled expression rather than the pattern text, which is what `b.safeJson` does with the same keyword and for the reason recorded there: the flags decide what the source means, so a text-only screen reads `(a|A)+` as two disjoint branches where the engine sees one branch twice.
+
+- v0.18.49 (2026-08-22) — **Comments in the shipped tree that answered a question you cannot ask.** A comment in `lib/` reaches anyone who opens the published package, and twenty of them were written for a reader who remembers the previous version or can look up an issue number that resolves nowhere outside this repository. They now say what the code does and why, in the present tense, keeping every reason they carried. No behaviour changes. **Changed:** *Comments that narrated a change now describe the code* — Fourteen comments across `lib/` were written against a version the reader has never seen: "this used to be opt-in", "it used to declare them in every profile anyway", "the legacy fallback was removed". Each is now a property of the design rather than a diff, and each keeps the reason it carried. The zero-width scan's comment still explains that an opt-in argument is an argument a caller can omit, and still names the six call sites that omitted it — it just no longer reads as a changelog entry pasted into the source.
+
+One of them was wrong in a way worth naming: a note in the gate-contract context builder said a guard "serves bytes it used to examine", which reads as a past version's behaviour. It means bytes the guard would otherwise examine, and now says so. · *Issue numbers that resolve nowhere are gone; the upstream ones stay* — Six comments cited a bare `issue #100` / `#330` / `#430` / `#532`. Opened from the published tarball those name nothing an operator can look up, and the explanation beside them was already doing the work. The references are gone and the explanations stay.
+
+The references that name their upstream are untouched and now read unambiguously: `cure53/DOMPurify issue #233` on the SVG `xlink:href` filtering, and CycloneDX spec issue #702 on the EU CRA property mapping, which is now attributed on both of its mentions rather than one.
+
+The boundary is what ships. `test/` carries 144 of the same kind of reference, most of them a `PR #nnn` on a regression test, and those are left alone: they resolve in the repository a contributor is already reading, and on a regression test the pull-request reference is often the most useful line in the comment. · *Three sentences in SECURITY.md* — A bot-guard rationale said an abuser "simply sends the header", which tells a reader the step is trivial and adds nothing to the argument. Two lists ended in `etc.` without saying where the rest was: the post-quantum algorithm-agility example now names HQC and FrodoKEM as the examples they are, and the session-risk scorer now says it scores whatever signal you have. The other six `etc.` in the file name their generating rule in the next clause and are unchanged.
+
 - v0.18.48 (2026-08-22) — **A guard option you set and a guard option that exists were not the same set.** Every `*Policy` option across the guard family now names the values it takes, and refuses everything else where options are resolved rather than at the first request that trips the scan. Holding the options to their vocabularies surfaced four places where what a guard advertised and what it did had come apart: an option documented under a name nothing read, a value that disabled a critical check without appearing in any opts block, two policies whose settings the gate's floor overrode anyway, and one declared in all three profiles and read nowhere. **Fixed:** *A guard policy refuses a value outside its vocabulary* — The two hundred and sixty-two `*Policy` options across the guard family each declare the values they accept, checked where options are resolved — boot, not the first hostile input — and on every entry point, including the `gate()` and `validate()` of guards that bind their own resolver.
 
 The failure it ends is quiet, because policies are read leniently. `duplicateKeyPolicy: "rejct"` is not `allow`, so the check still runs; it is not `reject` either, so the finding drops from critical to a warning. The operator asked to refuse a duplicate key and silently got an audit line. Nothing was let through that a stricter reading would have caught, so this was never a hole — but a setting that means something other than what it says is worth a restart to learn about.

package/lib/ai-model-manifest.js

@@ -178,8 +178,8 @@ function build(opts) {
     }
   }
 
-  // Hyperparameters → CycloneDX properties[] kv pairs per spec
-  // issue #702 EU CRA alignment.
+  // Hyperparameters → CycloneDX properties[] kv pairs, per CycloneDX spec
+  // issue #702 (EU CRA alignment).
   var properties = [];
   if (opts.hyperparameters && typeof opts.hyperparameters === "object") {
     var keys = Object.keys(opts.hyperparameters);

package/lib/audit-sign.js

@@ -85,8 +85,8 @@ var _err = AuditSignError.factory;
 // via opts.algorithm — e.g. `auditSigning: { algorithm: "ml-dsa-87" }`
 // for throughput-sensitive deployments. Every key file MUST carry the
 // `algorithm` field on disk — the framework refuses to load a key file
-// that lacks it. The legacy implicit-default-to-ml-dsa-87 fallback was
-// removed as part of the pre-v1 compat-shim sweep.
+// that lacks it. There is no implicit default: a key file whose algorithm has
+// to be guessed is a key file whose signatures cannot be attributed.
 var DEFAULT_SIGNING_ALG = "slh-dsa-shake-256f";
 // ml-dsa-65 (FIPS 204 Category 3, ~192-bit symmetric security) is opt-
 // in alongside ml-dsa-87 — same code path (both auto-detected by
@@ -102,7 +102,7 @@ var SIGNING_KEY_SCHEMA = {
   properties: {
     publicKey:  { type: "string" },
     privateKey: { type: "string" },
-    algorithm:  { type: "string" },     // load-time-required — _initPlaintext + _initWrapped both throw KEY_FILE_MISSING_ALG / UNWRAPPED_MISSING_ALG when the field is absent (legacy implicit-default-to-ml-dsa-87 was removed in the pre-v1 compat-shim sweep). Schema's `required` keeps publicKey + privateKey only so the runtime checks fire with the precise error codes operators have wired alerting on.
+    algorithm:  { type: "string" },     // load-time-required — _initPlaintext + _initWrapped both throw KEY_FILE_MISSING_ALG / UNWRAPPED_MISSING_ALG when the field is absent, rather than defaulting to an algorithm the file never named. Schema's `required` keeps publicKey + privateKey only so the runtime checks fire with the precise error codes operators have wired alerting on.
   },
 };
 

package/lib/auth/passkey.js

@@ -986,7 +986,7 @@ function _requireCredentialIdMatches(response, authoritativeId, why) {
   // _credentialDescriptors deliberately supports -- while the browser returns
   // the unpadded spelling. Two spellings of ONE credential must not read as
   // two credentials, or the compatibility this binding sits next to would
-  // lock out exactly the deployments it was added for.
+  // lock out exactly the deployments it exists for.
   var expected = _canonicalBase64Url(authoritativeId);
   var fields = ["id", "rawId"];
   var stated = 0;

package/lib/backup/index.js

@@ -1697,8 +1697,8 @@ function bundleAdapterStorage(opts) {
       // "unknown" rather than risk a full payload load. For
       // rewrap, we already have to load the payload (to unwrap),
       // so fall back to a sniffEnvelope on the loaded sealed
-      // bytes — fixes the regression where adapters satisfying
-      // the minimum contract couldn't use rewrapBundle.
+      // bytes, which keeps rewrapBundle reachable for an adapter
+      // that satisfies only the minimum contract.
       if (envelopeKind === "unknown") {
         envelopeKind = archiveLazy().sniffEnvelope(sealed);
       }

package/lib/client-hints.js

@@ -136,8 +136,7 @@ function _parseSfBrandList(s) {
   // sf-list members don't allow parenthesized inner-list values in
   // the Sec-CH-UA grammar (only sf-string + parameters), so the
   // simple top-level comma split suffices — no `depth` tracking
-  // needed (the earlier inline shape carried defensive paren
-  // tracking left over from a generic sf-list walker prototype).
+  // needed.
   var pieces = structuredFields.splitTopLevel(t, ",");
   var out = [];
   for (var i = 0; i < pieces.length; i += 1) {

package/lib/codepoint-class.js

@@ -860,11 +860,12 @@ function detectCharThreats(text, opts, codePrefix) {
   // zero-width-only input under `strip` reaches the sanitizer instead of being
   // served unchanged.
   //
-  // This used to be OPT-IN via a `zeroWidthSeverity` argument, which meant a
-  // caller that forgot it disabled the scan no matter what the operator's
-  // policy said — and six did, including the shared gate path, so seven guards
-  // declared `zeroWidthPolicy: "reject"` and never applied it. Six more passed
-  // a hardcoded "warn", which dispositions to serve, so they reported the
+  // Not opt-in, and deliberately: an argument the caller has to pass in order
+  // for the scan to run is an argument a caller can omit, and omitting it
+  // disables the scan no matter what the operator's policy says. Six call
+  // sites omitted it, the shared gate path among them, so seven guards declared
+  // `zeroWidthPolicy: "reject"` and never applied it. Six more passed a
+  // hardcoded "warn", which dispositions to serve, so they reported the
   // character and shipped it anyway.
   //
   // Severity follows the resolved POLICY, not a per-caller constant — the same

package/lib/gate-contract.js

@@ -305,7 +305,7 @@ function validateGateShape(gate, label, errorClass) {
 //   - `Object.assign({}, base, ...)` copies OWN enumerable properties, so a
 //     class instance whose fields come from prototype getters arrives with them
 //     missing. A guard reading an absent subject as nothing-to-inspect then
-//     serves bytes it used to examine.
+//     serves bytes it would otherwise examine.
 //   - `Object.create(base)` fixes that but makes inherited getters run with the
 //     DERIVED object as `this`, so a getter returning a private field throws
 //     and a valid context is refused.

package/lib/guard-archive.js

@@ -115,11 +115,12 @@ var MAGIC_SIGNATURES = Object.freeze([
 
 // Character-class policy for an entry NAME comes from `filenameProfile`, which
 // routes the name through b.guardFilename — this guard never reads a
-// bidi/control/null/zero-width policy of its own. It used to declare them in
-// every profile anyway, so an operator passing `zeroWidthPolicy` here was
-// configuring nothing and had no way to find that out. The declarations are
-// gone rather than wired, because `filenameProfile` is already the one place
-// that decides it and two spellings of the same setting is how they disagree.
+// bidi/control/null/zero-width policy of its own, and does not declare them in
+// its profiles either. Declaring an option nothing reads leaves an operator
+// setting `zeroWidthPolicy` here configuring nothing, with no way to find that
+// out. Wiring them instead would give the same setting two spellings, which is
+// how the two come to disagree, and `filenameProfile` is already the one place
+// that decides it.
 var PROFILES = Object.freeze({
   "strict": {
     traversalPolicy:           "reject",

package/lib/guard-regex.js

@@ -201,14 +201,15 @@ function _classUsesSetSyntax(text, from) {
 // ---- pattern parsing ------------------------------------------------------
 //
 // Every analysis below reads a parse tree. None of them reads the pattern
-// source. Reading source with regexes is what this module used to do, and each
-// reader drew the token boundaries a little differently: one could not see
-// past a nested group, one decided whether a `?` was a quantifier by looking at
-// the previous CHARACTER (so the `?` in `\*?` read as a lazy marker and the
-// length variation it contributes was lost), one capped the digits inside
-// `{n,m}` (so a longer bound read as no quantifier at all). Each disagreement
-// was a way to write a catastrophic pattern that one reader found and another
-// waved through, and patching them one at a time only moved the edge.
+// source. Reading source with regexes puts a separate reader behind each
+// analysis, and separate readers draw the token boundaries differently: one
+// cannot see past a nested group, one decides whether a `?` is a quantifier by
+// looking at the previous CHARACTER (so the `?` in `\*?` reads as a lazy marker
+// and the length variation it contributes is lost), one caps the digits inside
+// `{n,m}` (so a longer bound reads as no quantifier at all). Every such
+// disagreement is a way to write a catastrophic pattern that one reader finds
+// and another waves through, and patching them one at a time moves the edge
+// rather than closing it.
 //
 // So: one tokenizer, one tree, and anything it cannot represent becomes an
 // OPAQUE node — which every analysis treats as "cannot prove", never as
@@ -754,9 +755,9 @@ function _codePointAt(src, at, flags) {
 // `k`, but `k` uppercases to `K` and never back to the Kelvin sign, so a pass
 // starting at `K` never reaches it and two branches that both match it were
 // proven disjoint. Which characters an engine treats as equal under `i` is a
-// rule the language states, so the rule is applied — it used to be discovered
-// by building a RegExp per pair of characters and seeing which ones matched,
-// which is the screen reaching for the construct it exists to screen.
+// rule the language states, so the rule is applied rather than discovered by
+// building a RegExp per pair of characters and seeing which ones match, which
+// would be the screen reaching for the construct it exists to screen.
 //
 // Only characters PRESENT in the pattern can create an overlap between two of
 // its sets, so the comparison is made over that alphabet alone. Pairs whose
@@ -796,9 +797,9 @@ function _foldGroups(src, flags) {
       var x = alphabet[a], y = alphabet[b];
       if (_linkedByCase(x, y)) continue;                    // already found by folding
       // Which characters an engine treats as the same under `i` is a rule, not
-      // something to be discovered by asking. This used to build a RegExp per
-      // pair and see whether one matched the other — the screen reaching for
-      // the very construct it screens, and a pattern's worth of them per call.
+      // something to be discovered by asking. Building a RegExp per pair and
+      // seeing whether one matches the other is the screen reaching for the very
+      // construct it screens, and a pattern's worth of them per call.
       // The rule itself is exact and costs a comparison.
       if (_canonical(x, unicodeMode) !== _canonical(y, unicodeMode)) continue;
       _linkFold(groups, x, y);

package/lib/json-path.js

@@ -33,6 +33,11 @@
  */
 
 var { defineClass } = require("./framework-error");
+var lazyRequire = require("./lazy-require");
+// Lazy: guard-regex composes the parser in this file's sibling modules, and the
+// screen is only reached by a filter that calls match() or search().
+var guardRegex = lazyRequire(function () { return require("./guard-regex"); });
+var boundedMap = require("./bounded-map");
 
 var JsonPathError = defineClass("JsonPathError", { alwaysPermanent: true });
 
@@ -573,7 +578,25 @@ function _evalFunctionValue(node, current, root) {
   return NOTHING;
 }
 
+// A filter runs once per candidate node, and the pattern is almost always the
+// same literal throughout a query, so translating and screening it per node
+// would put the cost of the analysis on the nodelist length. Screened once per
+// distinct (pattern, anchored) pair instead.
+//
+// Bounded, because the key comes from the query: an unbounded map keyed by
+// caller-supplied text is a slower way to spend the same memory. The framework's
+// own ceiling primitive owns the eviction, so the oldest entry goes rather than
+// the whole cache.
+var _filterRegexCache = boundedMap.boundedMap({ maxEntries: 256 });
+
+// Only an accepted pattern is stored: a refusal throws out of `query()` on the
+// first candidate node, so there is no second node to re-decide it for.
 function _iRegexpToJs(pattern, anchored) {
+  return boundedMap.getOrInsert(_filterRegexCache, (anchored ? "1" : "0") + pattern,
+    function () { return _buildFilterRegex(pattern, anchored); });
+}
+
+function _buildFilterRegex(pattern, anchored) {
   // I-Regexp (RFC 9485) is close to a JS regex subset. Translate the one
   // systematic difference — "." must not match line separators — and
   // (for match) anchor the whole input.
@@ -582,16 +605,43 @@ function _iRegexpToJs(pattern, anchored) {
     if (cls) return cls;
     return "[^\\n\\r]";
   });
-  // The pattern is the I-Regexp argument of an RFC 9535 match()/search()
-  // filter — translated (not raw) and used only as a boolean test.
-  return new RegExp(anchored ? "^(?:" + translated + ")$" : translated, "su");   // allow:dynamic-regex — translated I-Regexp from a match()/search() filter argument
+  var source = anchored ? "^(?:" + translated + ")$" : translated;
+  // I-Regexp is a general regular-expression language, so the argument of a
+  // match() or search() filter can be `(a+)+$` as easily as `a+`, and a
+  // backtracking engine will spend the caller's chosen amount of CPU deciding
+  // it. Being a boolean test is no protection: `.test()` is exactly where the
+  // backtracking happens, and the node caps above never see it because the
+  // whole blow-up is inside one call on one node. Measured before this screen:
+  // 7 seconds on a 29-character subject, doubling per added character.
+  //
+  // Screened with the same primitive the framework already uses wherever it
+  // compiles a caller-supplied pattern — b.flag targeting conditions and MCP
+  // tool schemas both go through it.
+  //
+  // Compiled first and screened on the COMPILED form, matching b.safeJson: the
+  // flags decide what the source means, so a source-only screen reads `(a|A)+`
+  // as two disjoint branches where the engine sees one branch twice. Compiling
+  // is safe on its own; the cost is in matching, which has not happened yet.
+  var re = new RegExp(source, "su");   // allow:dynamic-regex — translated I-Regexp, ReDoS-screened via guardRegex.assertSafe below, before it is returned to the caller that will run it
+  guardRegex().assertSafe(re, "jsonPath.filter.pattern",
+    JsonPathError, "json-path/unsafe-pattern");
+  return re;
 }
 function _evalFunctionLogical(node, current, root) {
   var input = _funcArgValue(node.args[0], current, root);
   var pat = _funcArgValue(node.args[1], current, root);
   if (typeof input !== "string" || typeof pat !== "string") return false;
   var re;
-  try { re = _iRegexpToJs(pat, node.name === "match"); } catch (_e) { return false; }
+  try { re = _iRegexpToJs(pat, node.name === "match"); }
+  catch (e) {
+    // A malformed I-Regexp yields Nothing, which RFC 9535 §2.4.6 renders as a
+    // false test result. A pattern REFUSED as catastrophic is a different
+    // answer and must not wear the same clothes: swallowing it would leave the
+    // caller with a filter that silently matches nothing and no way to tell
+    // that from a filter that matched nothing.
+    if (e && e.code === "json-path/unsafe-pattern") throw e;
+    return false;
+  }
   return re.test(input);
 }
 

package/lib/json-schema.js

@@ -52,6 +52,10 @@
 var numericBounds = require("./numeric-bounds");
 var rfc3339 = require("./rfc3339");
 var { defineClass } = require("./framework-error");
+var lazyRequire = require("./lazy-require");
+// Lazy: the screen is only reached by a schema that carries a `pattern`.
+var guardRegex = lazyRequire(function () { return require("./guard-regex"); });
+var boundedMap = require("./bounded-map");
 
 var JsonSchemaError = defineClass("JsonSchemaError", { alwaysPermanent: true });
 
@@ -288,6 +292,51 @@ function _buildModule() {
  *     properties: { n: { type: "integer" } }, required: ["n"] });
  *   v.validate({ n: 1 }).valid;   // → true
  */
+// Where a subschema can appear. Named rather than inferred, because a schema
+// also carries DATA — `const`, `enum`, `default` and `examples` hold instance
+// values — and a walk that recursed into everything would read a `pattern` key
+// inside a `const` value as a schema keyword and refuse a legal schema for the
+// shape of its example data.
+//
+// Missing a position here is safe in the direction that matters: the screen in
+// _compileRegex still runs on whatever is actually compiled, so a subschema
+// this walk does not reach is refused when it is used rather than never. The
+// walk buys an earlier refusal, not the refusal itself.
+// `additionalItems` and `contentSchema` are deliberately absent: this validator
+// does not evaluate either keyword, so a pattern inside one never compiles and
+// never runs. Screening there could only refuse a schema for a branch that has
+// no effect.
+var _SUBSCHEMA_KEYS = ["additionalProperties", "contains",
+  "else", "if", "items", "not", "propertyNames", "then",
+  "unevaluatedItems", "unevaluatedProperties"];
+var _SUBSCHEMA_LIST_KEYS = ["allOf", "anyOf", "oneOf", "prefixItems", "items"];
+var _SUBSCHEMA_MAP_KEYS = ["$defs", "definitions", "dependentSchemas",
+  "patternProperties", "properties"];
+
+// Walk the subschema positions for the two keywords that carry a regular
+// expression, and hand each to the same screen the compile site uses.
+// Depth-bounded by the ceiling the validator applies to `$ref` chains, so a
+// deeply nested schema cannot spend the walk instead of the match.
+function _screenPatterns(node, depth) {
+  depth = depth || 0;
+  if (depth > MAX_REF_DEPTH || !_isObject(node)) return;
+
+  if (typeof node.pattern === "string") _compileRegex(node.pattern);
+  if (_isObject(node.patternProperties)) {
+    Object.keys(node.patternProperties).forEach(function (p) { _compileRegex(p); });
+  }
+
+  _SUBSCHEMA_KEYS.forEach(function (k) { _screenPatterns(node[k], depth + 1); });
+  _SUBSCHEMA_LIST_KEYS.forEach(function (k) {
+    if (!Array.isArray(node[k])) return;
+    node[k].forEach(function (sub) { _screenPatterns(sub, depth + 1); });
+  });
+  _SUBSCHEMA_MAP_KEYS.forEach(function (k) {
+    if (!_isObject(node[k])) return;
+    Object.keys(node[k]).forEach(function (name) { _screenPatterns(node[k][name], depth + 1); });
+  });
+}
+
 function compile(schema, opts) {
   opts = opts || {};
   if (!_isObject(schema) && typeof schema !== "boolean") {
@@ -304,6 +353,15 @@ function compile(schema, opts) {
   var rootBase = (_isObject(schema) && typeof schema.$id === "string") ? _resolveUri(schema.$id, "") : "";
   registry.add(schema, rootBase);
 
+  // Screen every pattern the schema carries HERE, while the author is still
+  // looking at the schema. Compiling is where a bad schema should be refused;
+  // leaving it to the first instance means the refusal lands on a request, in
+  // a validator the caller has already been handed and treats as good.
+  _screenPatterns(schema);
+  if (_isObject(opts.schemas)) {
+    Object.keys(opts.schemas).forEach(function (uri) { _screenPatterns(opts.schemas[uri]); });
+  }
+
   var assertFormat = opts.assertFormat === true;
   var maxErrors = numericBounds.isPositiveFiniteInt(opts.maxErrors) ? opts.maxErrors : DEFAULT_MAX_ERRORS;
 
@@ -525,15 +583,42 @@ function _checkString(schema, s, ctx, emit) {
   }
 }
 
-var _regexCache = {};
+// Keyed by the schema's own pattern text, so a long-lived process compiling
+// many distinct schemas would otherwise grow this without bound. The
+// framework's own ceiling primitive owns the eviction.
+var _regexCache = boundedMap.boundedMap({ maxEntries: 512 });
 function _compileRegex(pattern, ctx) {
-  if (Object.prototype.hasOwnProperty.call(_regexCache, pattern)) return _regexCache[pattern];
+  if (_regexCache.has(pattern)) return _regexCache.get(pattern);
+  // `pattern` / `patternProperties` decide how much CPU each validation costs,
+  // because the compiled expression runs against the instance. `(a+)+$` against
+  // a run of `a` ending in anything else measured 1.5 seconds at 28 characters
+  // and doubles with every two more, so a schema is a denial-of-service lever
+  // as much as a contract.
+  //
+  // A schema is not automatically the operator's own source: it arrives from a
+  // registry, a tool manifest, an upload or a config file. b.mcp already
+  // screens the pattern in a tool schema for this shape before matching it
+  // against request input, and this is the same construct.
+  //
+  // Screened once per distinct pattern — the cache below means a schema pays
+  // for the analysis at its first use rather than per instance.
+  //
+  // Compiled first and screened AFTER, on the compiled form, which is what
+  // b.safeJson does with the same keyword and for the reason recorded there:
+  // the flags decide what the source means, so a screen reading the source
+  // alone reads `(a|A)+` as two disjoint branches where the engine sees one
+  // branch twice. Compiling a pathological pattern is safe on its own — the
+  // cost is in matching, which has not happened yet.
   var re = null;
-  try { re = new RegExp(pattern, "u"); }                    // allow:dynamic-regex — JSON Schema pattern is part of the (operator-trusted) schema, not instance data
+  try { re = new RegExp(pattern, "u"); }                    // allow:dynamic-regex — ReDoS-screened via guardRegex.assertSafe below, before the compiled form is returned to any caller
   catch (_e) {
-    try { re = new RegExp(pattern); } catch (_e2) { re = null; }
+    try { re = new RegExp(pattern); } catch (_e2) { re = null; }   // allow:dynamic-regex — same screen, non-unicode fallback for a pattern `u` rejects
+  }
+  if (re) {
+    guardRegex().assertSafe(re, "jsonSchema.pattern",
+      JsonSchemaError, "json-schema/unsafe-pattern");
   }
-  _regexCache[pattern] = re;
+  _regexCache.set(pattern, re);
   return re;
 }
 

package/lib/mail-auth.js

@@ -1227,12 +1227,9 @@ function _dmarcAuthorDomainLabels(domain) {
   if (!d) return null;
   // Both RFC 1035 §2.3.4 bounds — 63 octets per label and 253 for the whole
   // name — are enforced by `canonicalDomain` itself, so an over-long or empty
-  // label has already returned "" above. This function used to re-check the
-  // label bound because canonicalDomain enforced only the total; the comment
-  // here argued a label cap was a DNS wire rule rather than a naming one, which
-  // did not survive the observation that the 253 cap is equally a wire rule and
-  // was enforced there anyway. Fixing it at the definition means every caller
-  // gets it, not just this one.
+  // label has already returned "" above. No re-check here: both are wire rules
+  // of the same kind, and enforcing them where the name is defined gives them
+  // to every caller rather than to whichever ones remembered.
   return d.split(".");
 }
 

package/lib/mail-scan.js

@@ -104,6 +104,26 @@ var CLAMAV_LENGTH_PREFIX_BYTES = 4;
 // ClamAV INSTREAM chunk size for streaming.
 var CLAMAV_CHUNK_BYTES = 65536;
 
+// Trailing CR / LF / NUL off a daemon reply, walked backwards from the end.
+//
+// The regex form of this, `/[\r\n\0]+$/`, is quadratic: `$` does not stop the
+// engine retrying from every start position, so a reply carrying a long
+// interior run of newlines costs O(n^2) — measured 135ms at 20k characters,
+// 538ms at 40k and 2207ms at 80k, and 1223ms through the real scan path.
+// The reply IS capped, but by `maxResponseBytes`, which is 50 MiB on the strict
+// profile and 300 MiB on permissive, so the cap is not what would save it.
+//
+// `String.prototype.trim` is not the substitute here: NUL is not whitespace.
+function _stripTrailingEol(s) {
+  var end = s.length;
+  while (end > 0) {
+    var c = s.charCodeAt(end - 1);
+    if (c !== 0x0D && c !== 0x0A && c !== 0x00) break;
+    end -= 1;
+  }
+  return end === s.length ? s : s.slice(0, end);
+}
+
 var PROFILES = Object.freeze({
   strict:     { timeoutMs: C.TIME.seconds(30),  maxMessageBytes: C.BYTES.mib(25),  maxResponseBytes: C.BYTES.mib(50) },   // operator-facing default mailbox cap
   balanced:   { timeoutMs: C.TIME.seconds(60),  maxMessageBytes: C.BYTES.mib(50),  maxResponseBytes: C.BYTES.mib(100) },  // operator-facing default mailbox cap
@@ -385,7 +405,7 @@ function create(opts) {
         if (done) return;
         done = true;
         clearTimeout(to);
-        var reply = collector.result().toString("utf8").replace(/[\r\n\0]+$/g, "");                // allow:regex-no-length-cap — trailing-trim anchored
+        var reply = _stripTrailingEol(collector.result().toString("utf8"));
         // ClamAV INSTREAM reply: "<id>: <verdict>" where verdict is
         // "stream: OK", "stream: <Sig.Name> FOUND", or "INSTREAM size
         // limit exceeded. ERROR". This is a security verdict classifier,

package/lib/mail-server-submission.js

@@ -198,7 +198,14 @@ function _extractDkimSignatures(headerBlock) {
 function _extractDkimDTag(sigValue) {
   var tags = sigValue.split(";");
   for (var i = 0; i < tags.length; i += 1) {
-    var t = tags[i].replace(/^\s+|\s+$/g, "");                                                          // allow:regex-no-length-cap — tag length bounded by header line cap // allow:duplicate-regex — trim shape
+    // Native trim, not `/^\s+|\s+$/`. The regex form is the classic quadratic
+    // trim: `\s+$` is retried from every start position when the run does not
+    // reach the end. The tag is NOT bounded by the line cap, because the header
+    // is unfolded first — every empty continuation line adds one space to the
+    // run, so 40,000 of them in a 120 KB message produced a 40,000-character
+    // run and 446ms of backtracking. `String.prototype.trim` uses the same
+    // WhiteSpace and LineTerminator set as `\s`, so this decides identically.
+    var t = tags[i].trim();
     if (t.length > 2 && t.charAt(0) === "d" && t.charAt(1) === "=") {
       return t.slice(2).replace(/\s+/g, "");                                                            // allow:regex-no-length-cap — value length bounded by tag length // allow:duplicate-regex — internal-WS strip
     }

package/lib/mail-sieve.js

@@ -43,9 +43,10 @@
  *   parse time (require 'comparator-NAME' not in KNOWN_CAPABILITIES).
  *
  *   Match-type wildcards: `:matches` uses `*` (any sequence) and `?`
- *   (one byte), per RFC 5228 §2.7.1. Both wildcards are converted to
- *   a bounded RegExp built from escaped literal byte segments — no
- *   user-controlled backtracking surface.
+ *   (one byte), per RFC 5228 §2.7.1. The pattern is matched directly
+ *   against the value rather than translated into a regular
+ *   expression, so a script author cannot spend the delivery thread's
+ *   CPU by writing a pattern that a backtracking engine explores.
  *
  *   The interpreter does NOT execute multi-script chains, sieve
  *   `include`s (RFC 6609), `notify` actions (RFC 5435), or `vacation`
@@ -63,7 +64,6 @@ var safeSieve = require("./safe-sieve");
 var { defineClass } = require("./framework-error");
 var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
-var codepointClass = require("./codepoint-class");
 
 var MailSieveError = defineClass("MailSieveError", { alwaysPermanent: true });
 
@@ -124,22 +124,64 @@ function _envelopeAddresses(env, key) {
 
 // ---- match-type ---------------------------------------------------------
 
-function _escapeRe(s) {
-  return codepointClass.escapeRegExp(s);
+// RFC 5228 §2.7.1 — `*` matches any sequence, `?` matches exactly one. Matched
+// directly rather than translated into a regular expression.
+//
+// The translation is the obvious implementation and it is a denial of service.
+// `*` becomes `.*`, so a pattern with N stars hands a backtracking engine N
+// independent `.*` groups, and on a subject that never supplies the trailing
+// literal the engine tries every way of dividing the subject between them: the
+// cost is polynomial in the subject length with degree N. Three stars measured
+// x7.7 per doubling of the subject, and ten stars — which a mailbox owner can
+// type without meaning anything by it — did not finish on a 64-character
+// Subject. A Sieve script is USER-authored in most deployments, and the gas
+// budget does not help: gas counts operations, and one match is one operation
+// however long the engine spends inside it.
+//
+// This walks the two strings with a single remembered wildcard position to fall
+// back to. It is not linear: `*` followed by a long literal, matched against a
+// subject that keeps almost matching it, re-walks the literal from each new
+// alignment, so the worst case is the product of the two lengths. Measured at
+// 3.9ms for a 500-character pattern against 2,000 characters, 11.4ms at
+// 1,000 x 4,000, and 52.2ms at 2,000 x 8,000 — the quadratic shape, and a
+// bound that both the script size and the header size already cap.
+//
+// What it is NOT is a function of how many wildcards the pattern contains,
+// which is the property that mattered: the regex translation was polynomial
+// with degree equal to the wildcard count, so a tenth `*` cost another factor
+// of the subject length and a short Subject stopped returning at all.
+// `i;ascii-casemap` folds US-ASCII A-Z to a-z and leaves every other character
+// alone (RFC 4790 §9.2), which is also the only fold that preserves length.
+// `String.prototype.toLowerCase` does not: `"İ".toLowerCase()` is two
+// UTF-16 units, so folding the whole subject up front would shift every
+// position after it and leave `?` — which matches exactly one character —
+// facing two.
+function _asciiLower(ch) {
+  var c = ch.charCodeAt(0);
+  return (c >= 0x41 && c <= 0x5A) ? String.fromCharCode(c + 0x20) : ch;
 }
 
-function _wildcardToRe(pattern, caseInsensitive) {
-  // RFC 5228 §2.7.1 — `*` matches any sequence, `?` matches one. Escape
-  // every other regex meta. Anchored both ends.
-  var out = "^";
-  for (var i = 0; i < pattern.length; i++) {
-    var c = pattern[i];
-    if (c === "*") out += ".*";
-    else if (c === "?") out += ".";
-    else out += _escapeRe(c);
-  }
-  out += "$";
-  return new RegExp(out, caseInsensitive ? "i" : "");                                                  // allow:dynamic-regex — built from operator Sieve `:matches` pattern; every meta-char except `*`/`?` is regex-escaped, so the resulting NFA is linear in input length (no polynomial-backtrack surface)
+function _wildcardMatches(pattern, subject, caseInsensitive) {
+  var pat = pattern, sub = subject;
+  var p = 0, s = 0;
+  var starP = -1, starS = 0;
+  function same(a, bChar) {
+    return caseInsensitive ? _asciiLower(a) === _asciiLower(bChar) : a === bChar;
+  }
+
+  while (s < sub.length) {
+    if (p < pat.length && (pat[p] === "?" || same(pat[p], sub[s]))) { p += 1; s += 1; continue; }
+    if (p < pat.length && pat[p] === "*") { starP = p; starS = s; p += 1; continue; }
+    // No match here. If a `*` came earlier, give it one more character and
+    // resume from just after it; otherwise the subject cannot match.
+    if (starP === -1) return false;
+    starS += 1;
+    s = starS;
+    p = starP + 1;
+  }
+  // Trailing stars can absorb the empty remainder; anything else cannot.
+  while (p < pat.length && pat[p] === "*") p += 1;
+  return p === pat.length;
 }
 
 function _matches(haystack, needle, matchType, comparator) {
@@ -155,7 +197,7 @@ function _matches(haystack, needle, matchType, comparator) {
       : haystack.indexOf(needle) !== -1;
   }
   if (matchType === "matches") {
-    return _wildcardToRe(needle, ci).test(haystack);
+    return _wildcardMatches(needle, haystack, ci);
   }
   throw new MailSieveError("mail-sieve/bad-match-type",
     "unknown match-type: " + matchType);

package/lib/metrics.js

@@ -1024,7 +1024,7 @@ function _serializeRegistry(registry) {
   // a JSON-friendly structured shape. Histograms get full buckets +
   // bucket counts so downstream consumers compose
   // `histogram_quantile()` against the snapshot without a separate
-  // exposition endpoint (issue #100).
+  // exposition endpoint.
   var out = {};
   var names = registry.metrics instanceof Map
     ? Array.from(registry.metrics.keys()).sort()
@@ -1073,8 +1073,8 @@ function snapshotStartWriter(opts) {
     throw new MetricsError("metrics-snapshot/bad-fields",
       "metrics.snapshot.startWriter: opts.fields must be a function returning the snapshot object");
   }
-  // Issue #100 — optional `registry` handle pulls every registered
-  // metric into a structured `metrics` field in the JSON snapshot:
+  // The optional `registry` handle pulls every registered metric into a
+  // structured `metrics` field in the JSON snapshot:
   // counters / gauges as `{ value }` per label set, histograms as
   // `{ buckets, observations }` with bucket counts + sum + count.
   // Sidecar readers compose `histogram_quantile()` against the
@@ -1420,7 +1420,7 @@ function snapshotRender(snap, opts) {
       "metrics.snapshot.render: snap must be a startWriter-produced object (got " + typeof snap + ")");
   }
   var fields = snap.fields;
-  // Labeled registry families (issue #430) — a snapshot written with
+  // Labeled registry families — a snapshot written with
   // startWriter's `registry` option carries every registered counter /
   // gauge / histogram under `metrics`. Both formats render them so a
   // sidecar consuming a snapshot written by another process gets the

package/lib/mtls-ca.js

@@ -25,9 +25,9 @@
  *   `ca.crl` (signed CRL derived from the registry).
  *
  *   `caKeySealedMode` defaults to "required" — sealed file required,
- *   plaintext refused. The legacy "auto" fallback was removed; it
- *   defaulted to writing plaintext on a fresh install, which is the
- *   inverse of the framework's security-defaults-on posture for
+ *   plaintext refused. There is no "auto" mode, because deciding
+ *   for the operator means writing plaintext on a fresh install,
+ *   which is the inverse of the framework's security-defaults-on posture for
  *   at-rest key material. The "disabled" mode is a dev-only opt-out
  *   (operator must justify with audited reason).
  *
@@ -2554,7 +2554,7 @@ function create(opts) {
              path: paths.crl };
   }
 
-  // ---- Algorithm migration (issue #532) ----
+  // ---- Algorithm migration ----
 
   // Serialize rotations on this handle. Two concurrent rotate() calls must not
   // both read the same current generation, both mint the next one, and clobber

package/lib/network-dns.js

@@ -535,8 +535,8 @@ function _dnsQueryLabels(host, primitive) {
   // A delimiter is the one that bites, because `domainToASCII` TRUNCATES at
   // one, so `example.com/evil` can masquerade as a trusted prefix of itself.
   //
-  // Mirroring the rule was tried first, and the list of near-misses above is
-  // what that produced. Asking the owner is the version that cannot drift.
+  // Mirroring the rule locally produces the list of near-misses above. Asking
+  // the owner is the version that cannot drift.
   var canonical = publicSuffix.canonicalDomain(h);
   if (!canonical) {
     throw new DnsError("dns/bad-host",

package/lib/session-device-binding.js

@@ -301,8 +301,8 @@ function create(opts) {
   // A no-store instance is still useful: the stateless fingerprint() reads no
   // store and is the soft device-binding building block for self-validating
   // tokens (a sealed cookie / JWT carrying the fingerprint inside). Rather than
-  // refuse to construct (issue #330 — fingerprint() unreachable without a
-  // store), build the instance and let the persisted bind()/verify() lifecycle
+  // refuse to construct, which would put fingerprint() out of reach for want of
+  // a store, build the instance and let the persisted bind()/verify() lifecycle
   // throw a clear "no store configured" when actually called. Operators wanting
   // ONLY the stateless digest can also use the static
   // b.sessionDeviceBinding.fingerprint(req, opts) with no create() at all.

package/lib/vault/index.js

@@ -472,8 +472,8 @@ async function initFirstRunWrapped() {
       "failed to wrap new vault key: " + e.message);
   }
 
-  // Atomic write via the framework's atomic-file primitive (temp + fsync +
-  // rename + dir fsync — same flow this code used to inline manually).
+  // Atomic write via the framework's atomic-file primitive: temp + fsync +
+  // rename + dir fsync.
   atomicFile.writeSync(paths.sealed, sealed, { fileMode: 0o600 });
 
   log("generated and sealed new vault keypair (ML-KEM-1024 + P-384 hybrid)");

package/lib/ws-client.js

@@ -453,8 +453,8 @@ class WsClient extends EventEmitter {
       if (lookup) tlsOpts.lookup = lookup;
       // The group preference arrives with the shared posture above, already
       // reflecting a runtime setKeyShares(). It lands as `ecdhCurve`: node:tls
-      // has no `curves` option — it accepts that key and ignores it, which is
-      // how this preference used to be dropped from the handshake in silence,
+      // has no `curves` option — it accepts that key and ignores it, so a
+      // preference sent under that name leaves the handshake in silence,
       // whereas a bad `ecdhCurve` throws. An operator value in dialTlsOpts
       // still wins, since it is merged last.
       socket = tls.connect(tlsOpts);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.48",
+  "version": "0.18.50",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a63c2af3-b9b9-4c06-b74a-dd7049ac3f6c",
+  "serialNumber": "urn:uuid:0535e946-47d0-4e95-879e-65d801bc533b",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-22T16:44:54.517Z",
+    "timestamp": "2026-08-22T21:30:23.773Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.48",
+      "bom-ref": "@blamejs/core@0.18.50",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.48",
+      "version": "0.18.50",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.48",
+      "purl": "pkg:npm/%40blamejs/core@0.18.50",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.48",
+      "ref": "@blamejs/core@0.18.50",
       "dependsOn": []
     }
   ]