@blamejs/core 0.18.51 → 0.18.54

package/lib/guard-filename.js

@@ -253,15 +253,13 @@ function _foldSuperscriptDigits(s) {
 // A `..` segment: the whole name, or bounded by path separators on both sides.
 // Bounded, not merely present — `..foo` and `a..b` are ordinary names.
 function _hasTraversalSegment(name) {
-  for (var i = 0; i + 1 < name.length; i += 1) {
-    if (name.charAt(i) !== "." || name.charAt(i + 1) !== ".") continue;
+  return codepointClass.hasPairWhere(name, ".", ".", function (i) {
     var beforeOk = i === 0 ||
       PATH_SEPARATORS.indexOf(name.charAt(i - 1)) !== -1;
     var afterOk = i + 2 === name.length ||
       PATH_SEPARATORS.indexOf(name.charAt(i + 2)) !== -1;
-    if (beforeOk && afterOk) return true;
-  }
-  return false;
+    return beforeOk && afterOk;
+  });
 }
 
 function _hasAnyFolded(name, needles) {
@@ -280,6 +278,15 @@ function _hasUncPrefix(name) {
 
 // An NTFS alternate-data-stream suffix: a colon followed by a run with no
 // further colon and no separator in it, at the very end of the name.
+// One wording for every path that refuses a stream-suffixed name — sanitize in
+// either mode, validate, gate, verifyExtractionPath — so a caller meets the same
+// answer whichever door they arrive at, and the way out is named where they are
+// standing rather than somewhere else in the documentation.
+var ADS_SNIPPET = "NTFS alternate data stream syntax (name:stream); set " +
+  "adsPolicy \"allow\" when the target filesystem is not NTFS and a colon is " +
+  "an ordinary filename character there";
+var ADS_MESSAGE = "filename contains " + ADS_SNIPPET;
+
 function _hasAdsSuffix(name) {
   var colon = name.lastIndexOf(":");
   if (colon === -1 || colon === name.length - 1) return false;
@@ -461,15 +468,17 @@ function _detectIssues(input, opts) {
 
   // 6. NTFS alternate data streams — `name:stream`. Unconditional: a write to
   // `name:stream` lands on a hidden stream of the base file rather than the
-  // file the caller named, which no policy value makes safe.
+  // file the caller named — on Windows. On the Linux targets `adsPolicy`
+  // exists for, a colon is an ordinary filename character, so the operator
+  // holds the switch and the finding is suppressed when they set it.
   {
-    if (_hasAdsSuffix(name) && name.charAt(0) !== "/") {
+    if (opts.adsPolicy !== "allow" && _hasAdsSuffix(name) && name.charAt(0) !== "/") {
       // Only flag when there's a `:` followed by stream-name characters
       // and we're NOT at the start (relative path indicator).
       issues.push({
         kind: "ntfs-ads", severity: "critical",
         ruleId: "filename.ntfs-ads",
-        snippet: "NTFS alternate data stream syntax (name:stream)",
+        snippet: ADS_SNIPPET,
       });
     }
   }
@@ -660,9 +669,22 @@ function _sanitize(input, opts) {
     name = "_" + name;
   }
 
-  // ADS detection.
-  if (_hasAdsSuffix(name)) {
-    throw _err("filename.ntfs-ads", "filename contains NTFS alternate data stream syntax");
+  // ADS detection. On Windows a `name:stream` write lands on a hidden stream of
+  // the base file rather than on a file anyone can see, so this is refused by
+  // default in every profile.
+  //
+  // It is an opt-out rather than an absolute, because the check is lexical and
+  // a colon is an ordinary filename character on the Linux targets these
+  // policies exist for: `12:30 notes.txt` has the same shape as an attack and
+  // is a timestamped note (#623). Only the operator knows which filesystem the
+  // name will be written to, which is why they get the switch.
+  //
+  // An earlier attempt refused regardless and put the scope in the message,
+  // which reads as a considered boundary right up until a caller has set every
+  // documented opt-out and still cannot store the file. An option that is
+  // accepted and documented as opting out must opt out.
+  if (opts.adsPolicy !== "allow" && _hasAdsSuffix(name)) {
+    throw _err("filename.ntfs-ads", ADS_MESSAGE);
   }
 
   // Length cap.
@@ -713,9 +735,10 @@ function _sanitize(input, opts) {
  *                                                        //   than refusing is safe
  *   reservedCharPolicy:   "reject"|"strip"|"allow",
  *   reservedNamePolicy:   "reject"|"audit"|"allow",
- *   adsPolicy:            "reject"|"allow",               // reject here; "allow"
- *                                                         //   is honoured only
- *                                                         //   by verifyExtractionPath
+ *   adsPolicy:            "reject"|"allow",               // "allow" when the target
+ *                                                         //   filesystem is not NTFS
+ *                                                         //   and a colon is ordinary
+ *                                                         //   there (Linux, macOS)
  *   leadingTrailingPolicy: "reject"|"strip"|"allow",
  *   shellExecExtPolicy:   "reject"|"audit"|"allow",
  *   pathSeparatorsPolicy: "reject"|"audit"|"allow",
@@ -795,8 +818,8 @@ function _sanitizeStripMode(input, opts) {
   if (_hasUncPrefix(name)) {
     throw _err("filename.unc", "UNC path syntax");
   }
-  if (_hasAdsSuffix(name) && name.charAt(0) !== "/") {
-    throw _err("filename.ntfs-ads", "filename contains NTFS alternate data stream syntax");
+  if (opts.adsPolicy !== "allow" && _hasAdsSuffix(name) && name.charAt(0) !== "/") {
+    throw _err("filename.ntfs-ads", ADS_MESSAGE);
   }
   if (Buffer.byteLength(name, "utf8") > opts.maxBytes) {
     throw _err("filename.length", "filename exceeds maxBytes " + opts.maxBytes);

package/lib/guard-managesieve-command.js

@@ -102,6 +102,7 @@
  *   under strict (RFC 4954 §4 class), validates per-verb shape.
  */
 
+var C = require("./constants");
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
 var codepointClass = require("./codepoint-class");
@@ -112,6 +113,12 @@ var GuardManageSieveCommandError = defineClass("GuardManageSieveCommandError",
 
 var DEFAULT_PROFILE = "strict";
 
+// A SASL token — the AUTHENTICATE initial response and every later response in
+// a multi-step exchange. Bounded far below the script cap because it is a
+// base64 blob of credentials, not a script body, and because the client
+// declaring its size is by definition not yet authenticated.
+var MAX_SASL_TOKEN_BYTES = C.BYTES.kib(4);
+
 var PROFILES = Object.freeze({
   strict: {
     maxLineBytes:        8192,                                                                          // 8 KiB per-line cap (strict)
@@ -339,13 +346,15 @@ function _validateAuthenticate(rest, caps, profileName, opts) {
         throw new GuardManageSieveCommandError("guard-managesieve-command/literal-plus-refused",
           "guardManageSieveCommand.validate: LITERAL+ refused under profile '" + profileName + "'");
       }
-      // Base64-initial-response cap: bound by the script-name cap
-      // (initial-response is a SASL token, not a script body; 4 KiB
-      // is generous).
-      if (n > 4096) {                                                                                   // 4 KiB SASL initial-response cap
+      // A SASL token, not a script body, so it is bounded well below the
+      // script cap. The same number bounds the client's LATER responses in a
+      // multi-step exchange (b.mail.server.managesieve reads it from
+      // MAX_SASL_TOKEN_BYTES): one exchange, one bound, whichever round the
+      // token arrives on and whichever representation it uses.
+      if (n > MAX_SASL_TOKEN_BYTES) {
         throw new GuardManageSieveCommandError("guard-managesieve-command/literal-too-large",
           "guardManageSieveCommand.validate: AUTHENTICATE initial-response " +
-          n + " bytes exceeds 4096-byte cap");
+          n + " bytes exceeds " + MAX_SASL_TOKEN_BYTES + "-byte cap");
       }
       literalBytes = n;
       literalPlus  = isPlus;
@@ -478,10 +487,34 @@ function _validateRenamescript(rest, caps) {
   return { verb: "RENAMESCRIPT", args: [first.value, second.value] };
 }
 
-// _parseQuotedString — extract a leading `"..."` quoted string from
-// `s` and return `{ value, rest }`, where `rest` is whitespace-trimmed.
-// Returns null if `s` does not begin with a DQUOTE. RFC 5804 §1.2
-// quoted strings allow UTF-8 content and `\"` / `\\` escape sequences.
+/**
+ * @primitive  b.guardManageSieveCommand.parseQuotedString
+ * @signature  b.guardManageSieveCommand.parseQuotedString(s)
+ * @since      0.18.54
+ * @status     stable
+ * @related    b.guardManageSieveCommand.validate, b.mail.server.managesieve.create
+ *
+ * Read a leading RFC 5804 §1.2 quoted string off `s` and return
+ * `{ value, rest }`, where `value` is the unescaped content and `rest` is
+ * what follows with leading whitespace removed. Returns `null` when `s` does
+ * not begin with a double quote.
+ *
+ * The production honours the `\"` and `\\` escapes, and refuses NUL, CR and
+ * LF inside the quotes: those end a line-oriented protocol record, so a
+ * string carrying one would split the command it appears in.
+ *
+ * Exposed because a `string` also arrives outside a command, as the client's
+ * reply to a SASL challenge. That line never reaches `validate`, and a second
+ * hand-rolled unquoting there would be free to lose the escape handling and
+ * the control-byte refusal this one has. `b.mail.server.managesieve` reads
+ * its SASL responses through this.
+ *
+ * @example
+ *   b.guardManageSieveCommand.parseQuotedString('"PLAIN" {12+}');
+ *   // → { value: "PLAIN", rest: "{12+}" }
+ *   b.guardManageSieveCommand.parseQuotedString("PLAIN");
+ *   // → null
+ */
 function _parseQuotedString(s) {
   if (s.length === 0 || s.charCodeAt(0) !== 0x22) return null;                                          // DQUOTE
   var out = "";
@@ -572,5 +605,12 @@ module.exports = gateContract.defineParser({
   extra: {
     KNOWN_VERBS:    KNOWN_VERBS,
     ZERO_ARG_VERBS: ZERO_ARG_VERBS,
+    MAX_SASL_TOKEN_BYTES: MAX_SASL_TOKEN_BYTES,
+    // The RFC 5804 §1.2 "string" production. The listener needs it for the
+    // client's reply to a SASL challenge, which arrives as a bare string on its
+    // own line rather than as a command argument — so it never reaches
+    // validate(), and hand-rolling a second dquote-strip there would drop this
+    // one's escape handling and its refusal of NUL / CR / LF inside the quotes.
+    parseQuotedString: _parseQuotedString,
   },
 });

package/lib/guard-regex.js

@@ -454,8 +454,7 @@ function _scanBraces(src, at) {
 // running the construct it screens over operator-supplied text, which is the
 // shape this module exists to keep away from.
 function _turnsFoldingOn(src) {
-  for (var i = 0; i + 2 < src.length; i += 1) {
-    if (src.charAt(i) !== "(" || src.charAt(i + 1) !== "?") continue;
+  return codepointClass.hasPairWhere(src, "(", "?", function (i) {
     var at = i + 2;
     var enablesFold = false;
     while (at < src.length && _isFlagLetter(src.charAt(at))) {
@@ -466,9 +465,8 @@ function _turnsFoldingOn(src) {
       at += 1;
       while (at < src.length && _isFlagLetter(src.charAt(at))) at += 1;
     }
-    if (enablesFold && src.charAt(at) === ":") return true;
-  }
-  return false;
+    return enablesFold && src.charAt(at) === ":";
+  });
 }
 
 function _parsePattern(src, flags, budget) {

package/lib/guard-yaml.js

@@ -68,6 +68,7 @@
  */
 
 var codepointClass = require("./codepoint-class");
+var yamlLex = require("./yaml-lex");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
@@ -95,11 +96,11 @@ var SAFE_CORE_TAGS = Object.freeze([
   "!!binary", "!!timestamp", "!!merge",
 ]);
 
-// Characters that may precede an anchor declaration (`&name`) or an alias
-// reference (`*name`) — the start of the document, whitespace, or one of the
-// structural characters a name can follow.
-var ANCHOR_LEAD_CHARS = ":-";
-var ALIAS_LEAD_CHARS  = ":-[{,";
+// There is no table of characters an anchor or alias is allowed to follow any
+// more. Two of them existed, one per sigil, and each was a guess at YAML's
+// grammar written as a character class: they admitted a sigil in the middle of
+// a plain scalar and excluded the compact flow form `{"a":&anchor v}` that YAML
+// permits. Position is decided once, by the shared lexer's mask.
 
 // The YAML 1.1 boolean-shaped tokens that make an unquoted scalar change type.
 // `true` and `false` are valid YAML 1.2 booleans and are not flagged; these
@@ -119,14 +120,17 @@ function _isSpace(cc) {
 
 // Every `&name` / `*name` in the document, given the sigil and the characters
 // that may precede it. Returns the names, in order.
-function _collectSigilNames(text, sigil, leadChars) {
+// `text` is the MASK, in which a sigil survives only where it opens a node, so
+// there is no test on the preceding character here at all. That judgement used
+// to be a hand-written list of characters a sigil was allowed to follow, kept
+// separately for anchors and for aliases, and it was wrong in both directions:
+// it admitted a `&` in the middle of a plain scalar, and it had no way to allow
+// `{"a":&anchor v}`, where YAML's JSON compatibility lets a quoted key take its
+// colon with no space after it. One scanner decides position now.
+function _collectSigilNames(text, sigil) {
   var out = [];
   for (var i = 0; i < text.length; i += 1) {
     if (text.charAt(i) !== sigil) continue;
-    if (i > 0) {
-      var lead = text.charCodeAt(i - 1);
-      if (!_isSpace(lead) && leadChars.indexOf(text.charAt(i - 1)) === -1) continue;
-    }
     if (!_isNameStart(text.charCodeAt(i + 1))) continue;
     var end = i + 2;
     while (end < text.length && _isNameChar(text.charCodeAt(end))) end += 1;
@@ -175,17 +179,33 @@ function _hasLeadingZeroOctal(text) {
 
 // A merge key with an anchor reference — `<<` then optional whitespace, `:`,
 // optional whitespace, `*`.
-function _hasMergeKeyAlias(text) {
-  for (var i = 0; i + 1 < text.length; i += 1) {
-    if (text.charAt(i) !== "<" || text.charAt(i + 1) !== "<") continue;
+// A merge key is `<<: *anchor` — a mapping key, so a structural question, and
+// asked of the lexer rather than of the source.
+//
+// The test is whether a NODE can begin at the `<<`, not whether what follows is
+// well-formed: `<<:*d` with no space after the colon is not a mapping entry and
+// is reported anyway, because that is the shape being smuggled past a parser
+// variant that reads it as a merge. A node cannot begin inside a comment, a
+// quoted body, a block scalar's body, or a plain scalar's continuation line, so
+// one question covers all of them.
+//
+// Enumerating those regions instead was tried and is the wrong shape. Without
+// any of this, `<<: *base` written inside a block scalar — a line of someone's
+// shell script — was reported as a merge key; excluding block bodies and quoted
+// bodies then still reported one written in a comment, on a continuation line,
+// and after a document marker. Same root as the duplicate-key screen (#642): a
+// structural rule reading raw source, and a fix that lists regions is the same
+// mistake with a longer list.
+function _hasMergeKeyAlias(text, nodeStarts) {
+  return codepointClass.hasPairWhere(text, "<", "<", function (i) {
+    if (nodeStarts && !nodeStarts[i]) return false;
     var j = i + 2;
     while (j < text.length && _isSpace(text.charCodeAt(j))) j += 1;
-    if (text.charAt(j) !== ":") continue;
+    if (text.charAt(j) !== ":") return false;
     j += 1;
     while (j < text.length && _isSpace(text.charCodeAt(j))) j += 1;
-    if (text.charAt(j) === "*") return true;
-  }
-  return false;
+    return text.charAt(j) === "*";
+  });
 }
 
 // ---- Profile presets ----
@@ -325,9 +345,11 @@ function _scanTags(text) {
   var tags = [];
   for (var i = 0; i < text.length; i += 1) {
     if (text.charAt(i) !== "!") continue;
-    var atStart = i === 0 ||
-                  codepointClass.inRanges(text.charCodeAt(i - 1), codepointClass.WHITESPACE_RANGES);
-    if (!atStart) continue;
+    // No "preceded by whitespace" test. That WAS the original defect, and once
+    // the mask decides position it is not merely redundant but harmful: in
+    // `{"a":!!python/object x}` the character before the tag is the colon of a
+    // JSON-style key, so the test skipped it and a deserialization tag reached
+    // both screens unreported. Position is the mask's question now.
     var nameAt = text.charAt(i + 1) === "!" ? i + 2 : i + 1;
     if (!codepointClass.isAsciiLetter(text.charCodeAt(nameAt))) continue;
     var end = nameAt + 1;
@@ -354,8 +376,29 @@ function _detectIssues(input, opts) {
   if (pre.done) return pre.issues;
   var issues = pre.issues;
 
+  // Sigil scans run against the MASK, not the source. A `!`, `&` or `*` means
+  // what it looks like only at a node start, and the previous rule — "after
+  // whitespace" — cannot tell a node start from the middle of a scalar. It
+  // reported a tag for the bang in a comment, in a quoted string, in a block
+  // scalar's shell script, and in ordinary prose: `x: 1 # note !bang` was
+  // refused. The mask is index-aligned with the source and the same length, so
+  // every location and line number reported below is still the source's.
+  //
+  // Every STRUCTURAL screen uses it: the three sigil scans, the duplicate-key
+  // scan, and the merge key. The value-shaped detectors (the Norway problem,
+  // leading zeros) are asking about scalar CONTENT, which is exactly what the
+  // mask removes, so those keep reading the source.
+  //
+  // Merge keys were on the wrong side of that line, listed with the
+  // value-shaped ones: `<<:` is a mapping key, and reading it from the source
+  // reported one written inside a block scalar. The test is not what the rule
+  // is looking for but what kind of question it asks — "is this a mapping
+  // entry?" is structure however scalar-shaped the token looks.
+  var lexed = yamlLex.lexLines(input);
+  var masked = lexed.masked;
+
   // 1. Tag-injection scan.
-  var tagHits = _scanTags(input);
+  var tagHits = _scanTags(masked);
   for (var ti = 0; ti < tagHits.length; ti += 1) {
     var t = tagHits[ti];
     if (t.kind === "dangerous") {
@@ -392,8 +435,8 @@ function _detectIssues(input, opts) {
   }
 
   // 2. Anchor / alias recursion scan.
-  var anchors = _collectSigilNames(input, "&", ANCHOR_LEAD_CHARS);
-  var aliases = _collectSigilNames(input, "*", ALIAS_LEAD_CHARS);
+  var anchors = _collectSigilNames(masked, "&");
+  var aliases = _collectSigilNames(masked, "*");
   if (anchors.length > opts.maxAnchors) {
     issues.push({
       kind: "anchor-cap", severity: "high",
@@ -468,7 +511,8 @@ function _detectIssues(input, opts) {
   }
 
   // 6. Merge-key chain depth.
-  if (opts.mergeKeyPolicy !== "allow" && _hasMergeKeyAlias(input)) {
+  if (opts.mergeKeyPolicy !== "allow" &&
+      _hasMergeKeyAlias(input, lexed.nodeStarts)) {
     issues.push({
       kind: "merge-key",
       severity: opts.mergeKeyPolicy === "reject" ? "high" : "warn",
@@ -517,12 +561,25 @@ function _detectIssues(input, opts) {
 // FIRST colon that is followed by whitespace or ends the line, which is where
 // a value begins — a colon inside the key (a timestamp, a URL) does not end
 // it unless whitespace follows.
-function _mappingEntryAt(line) {
+// `masked` is the same line with every non-structural region blanked by
+// yaml-lex. It decides WHICH colons are mapping separators; the raw line
+// supplies the key text, because the mask blanks that too.
+//
+// Without it, a colon inside a block scalar's body or a quoted value read as a
+// mapping entry, and two such lines inside one scalar were reported as a
+// duplicate key (#642). That is the same root as #631/#632 — a screen deciding
+// structure by reading the source — which survived here because only the sigil
+// scans were moved onto the mask.
+function _mappingEntryAt(line, masked) {
   var indent = 0;
   while (indent < line.length && _isSpace(line.charCodeAt(indent))) indent += 1;
   if (indent === line.length) return null;
   for (var i = indent; i < line.length; i += 1) {
     if (line.charAt(i) !== ":") continue;
+    // Structural only: the mask keeps a mapping separator and blanks a colon
+    // that is part of a scalar. Absent a mask, every colon counts, which is the
+    // pre-#642 behaviour and is what the non-masked callers still want.
+    if (masked !== undefined && masked.charAt(i) !== ":") continue;
     var after = line.charCodeAt(i + 1);
     if (i + 1 < line.length && !_isSpace(after)) continue;
     if (i === indent) return null;                                     // no key before the colon
@@ -531,6 +588,24 @@ function _mappingEntryAt(line) {
   return null;
 }
 
+// The column the line's content starts in.
+function _indentOfLine(line) {
+  var i = 0;
+  while (i < line.length && _isSpace(line.charCodeAt(i))) i += 1;
+  return i;
+}
+
+// The indent of a sequence dash opening this line, or -1 when the line does not
+// open a sequence item. A dash counts only when it stands alone as a token: `-`
+// at end of line, or followed by a space. `-quux` and `-1` are scalars.
+function _sequenceDashIndent(line) {
+  var i = 0;
+  while (i < line.length && _isSpace(line.charCodeAt(i))) i += 1;
+  if (i >= line.length || line.charAt(i) !== "-") return -1;
+  if (i + 1 < line.length && !_isSpace(line.charCodeAt(i + 1))) return -1;
+  return i;
+}
+
 // Is the line blank, or a comment?
 function _isCommentLine(line) {
   var i = 0;
@@ -543,20 +618,126 @@ var _splitLines = codepointClass.splitLines;
 function _detectDuplicateKeysYaml(text) {
   var dups = Object.create(null);
   var lines = _splitLines(text);
+  // Whether a line carries a mapping entry is a STRUCTURAL question, so it is
+  // asked of the lexer's mask rather than of the source. Split the same way, so
+  // line i of one is line i of the other.
+  var maskedLines = _splitLines(yamlLex.maskNonStructural(text));
   var indentScopes = Object.create(null);
+  // The sequence items currently open, outermost first, each with the column
+  // its first key sat in. Every key of an item at its top level is filed under
+  // one scope whatever column it is written in, because it is one mapping.
+  //
+  // A STACK, because sequences nest. Holding the innermost item in a pair of
+  // variables let a nested sequence overwrite its parent's scope and never give
+  // it back, so a key repeated in the OUTER item after the nested one closed
+  // was filed somewhere else and went unreported:
+  //
+  //     - a: 1
+  //       inner:
+  //         - x: 1
+  //       a: 2      <- a duplicate of the first `a`, and it was missed
+  //
+  // The same shape as the defect this detector reports, one level up: a single
+  // slot standing in for something there can be several of.
+  var itemStack = [];
   for (var i = 0; i < lines.length; i += 1) {
     var line = lines[i];
     if (line.length === 0 || _isCommentLine(line)) continue;
-    var entry = _mappingEntryAt(line);
+    // A sequence item OPENS A NEW MAPPING, so it ends the previous item's and
+    // everything nested inside it. That is decided from the DASH, before
+    // anything else, because a line may be a sequence item and carry no mapping
+    // entry of its own:
+    //
+    //     steps:
+    //       -
+    //         p: 1
+    //       -
+    //         p: 2
+    //
+    // A dash alone has no `key: value` on it, so a reset that waited for one
+    // never ran and the second item's `p` was still read as a duplicate of the
+    // first's. The boundary is the dash; whether the item writes its first key
+    // beside it or underneath it is a matter of layout.
+    var dashAt = _sequenceDashIndent(line);
+    // An item is over once the document comes back out to its dash's column or
+    // further left. That is true of the next item's own dash as much as of a
+    // key belonging to the enclosing mapping, so it is measured here, before
+    // this line is classified at all.
+    var lineIndent = dashAt >= 0 ? dashAt : _indentOfLine(line);
+    while (itemStack.length &&
+           itemStack[itemStack.length - 1].dash >= lineIndent) itemStack.pop();
+    if (dashAt >= 0) {
+      Object.keys(indentScopes).forEach(function (k) {
+        if (Number(k) > dashAt) delete indentScopes[k];
+      });
+      // keyIndent is set by this item's first key, wherever it is written.
+      itemStack.push({ dash: dashAt, keyIndent: -1 });
+    }
+    // Passed straight through, with no `|| ""` fallback: an empty mask line
+    // blanks every colon, so a missing one would exempt the line from the screen
+    // altogether. `undefined` means "no mask" instead, which counts every colon
+    // — over-reporting rather than under-reporting if the two ever desynchronise.
+    var entry = _mappingEntryAt(line, maskedLines[i]);
     if (!entry) continue;
     var indent = entry.indent;
     var key = entry.key.trim();
-    if (key.charAt(0) === "-" || key.charAt(0) === "[" || key.charAt(0) === "{") continue;
-    if (!indentScopes[indent]) indentScopes[indent] = Object.create(null);
-    if (indentScopes[indent][key]) dups[key] = true;
-    else indentScopes[indent][key] = true;
+    if (key.charAt(0) === "[" || key.charAt(0) === "{") continue;
+    // The key written INLINE with the dash belongs to the item's mapping, and
+    // sits at the indent AFTER the dash and its space — so that is the scope it
+    // is registered in, alongside the keys written underneath it. It used to be
+    // skipped entirely, which meant repeating it went unreported.
+    var dash = key.charAt(0) === "-" &&
+               (key.length === 1 || _isSpace(key.charCodeAt(1)));
+    var scopeAt = indent;
+    if (dash) {
+      var after = 1;
+      while (after < key.length && _isSpace(key.charCodeAt(after))) after += 1;
+      key = key.slice(after).trim();
+      // `- ` alone, or `- - x`: no inline key of this item's own to register.
+      if (!key || key.charAt(0) === "-" || key.charAt(0) === "[" ||
+          key.charAt(0) === "{") continue;
+      scopeAt = indent + after;
+    }
+    // The item's mapping is ONE mapping however its keys are laid out, so the
+    // scope it is tracked under must not depend on spacing. `-   a: 1` puts its
+    // inline key at column 4 while the key written under it sits at column 2,
+    // and keying on the raw column filed them separately — so a repeat across
+    // those two lines went unreported, which is exactly the smuggling shape
+    // this detector exists for (one parser reads two keys, another reads one).
+    //
+    // The item's top level is every key deeper than the dash and no deeper than
+    // the first key it saw. Anything past that is genuinely nested and keeps
+    // its own column, so `- a: 1` / `  b:` / `    a: 2` is still not a
+    // duplicate.
+    // Half a column past the dash: a number, so the pruning comparisons below
+    // and at the dash keep working unchanged, and one that sorts between the
+    // dash and anything nested inside the item.
+    var item = itemStack.length ? itemStack[itemStack.length - 1] : null;
+    if (item && scopeAt > item.dash) {
+      // The item's top level is every key no deeper than the SHALLOWEST key it
+      // has shown, and the bound moves down as shallower ones appear. Two
+      // failures pinned this from opposite sides:
+      //
+      //   -   a: 1        the inline key sits at column 4 because of the extra
+      //     b:            spacing, but the item's mapping is written at 2. If
+      //       a: 2        4 is taken as the bound, the NESTED `a` at 4 counts
+      //                   as top level and reads as a duplicate.
+      //
+      //   - a:            here the inline key IS the bound, at 2. If it sets
+      //       x: 1        nothing, the first nested key at 4 becomes the bound
+      //       a: 2        and the nested `a` reads as a duplicate instead.
+      //
+      // So the inline key establishes the bound and a later, shallower key
+      // lowers it. Extra spacing after the indicator is presentation; the
+      // shallowest key is the structure.
+      if (item.keyIndent === -1 || scopeAt < item.keyIndent) item.keyIndent = scopeAt;
+      if (scopeAt <= item.keyIndent) scopeAt = item.dash + 0.5;
+    }
+    if (!indentScopes[scopeAt]) indentScopes[scopeAt] = Object.create(null);
+    if (indentScopes[scopeAt][key]) dups[key] = true;
+    else indentScopes[scopeAt][key] = true;
     Object.keys(indentScopes).forEach(function (k) {
-      if (Number(k) > indent) delete indentScopes[k];
+      if (Number(k) > scopeAt) delete indentScopes[k];
     });
   }
   return Object.keys(dups);

package/lib/mail-agent.js

@@ -539,19 +539,33 @@ async function _expunge(ctx, args) {
       "agent.expunge: { folder, objectIds, [candidateTtlMs] } required");
   }
 
-  // Look up the regulator-mandated retention floor for the operator's
-  // active posture. For expunge semantics, the floor IS the minimum
-  // TTL — messages younger than the floor MUST NOT be hard-deleted,
-  // even on operator request. Distinct from `b.retention.
-  // complianceFloor(posture, candidateTtl)` which composes the
-  // candidate TTL into a max — that primitive's "candidate must be
-  // positive" contract doesn't apply here because expunge means TTL=0.
-  // Read the floor table directly.
+  // Look up the regulator-mandated retention floor for the operator's active
+  // posture. For expunge semantics the floor IS the minimum TTL — messages
+  // younger than it MUST NOT be hard-deleted, even on operator request.
+  //
+  // Through b.retention.complianceFloor, not the floor table it wraps. The
+  // direct read fell back to zero for anything the table did not contain, so a
+  // misspelled posture, a capitalised one ("HIPAA"), or one the table simply
+  // does not carry all permitted an unbounded hard delete with no error — a
+  // typo refused where retention windows are computed and accepted at the one
+  // call that destroys mail permanently. It also read through the prototype:
+  // posture "constructor" returned a function, which is truthy, so the `|| 0`
+  // fallback kept it and every age comparison against it was nonsense.
+  //
+  // No posture at all is a legitimate configuration and keeps the zero floor.
+  // A posture that was supplied and is not understood now throws.
   var retentionModule = require("./retention");                                                    // allow:inline-require — lazy-load until first expunge call
   var posture = (ctx && ctx.posture) || (args && args.posture) || null;
   var floorMs = 0;
   if (typeof posture === "string" && posture.length > 0) {
-    floorMs = retentionModule.COMPLIANCE_RETENTION_FLOOR_MS[posture] || 0;
+    try {
+      floorMs = retentionModule.complianceFloor(posture);
+    } catch (e) {
+      throw new MailAgentError("mail-agent/unknown-posture",
+        "expunge: posture '" + posture + "' is not a posture the framework knows, " +
+        "so no retention floor can be established and the hard delete is refused " +
+        "rather than run unbounded: " + ((e && e.message) || String(e)));
+    }
   }
 
   // Read message metadata BEFORE invoking hardExpunge so the per-id