@blamejs/core 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -6,6 +6,11 @@ Pre-1.0 the surface is intentionally evolving — every release may
 change something operators depend on. Read each entry before
 upgrading across more than a few patches at a time.
 
+## v0.6.x
+
+- **0.6.1** (2026-05-01) — security tightenings + operator-facing jargon sweep
+- **0.6.0** (2026-05-01) — wiki restructured into 22 focused pages + missing-primitive coverage
+
 ## v0.5.x
 
 - **0.5.18** (2026-05-01) — bypass-fix sweep: route through existing primitives

package/README.md

@@ -17,7 +17,7 @@ The modern Node app is a 1,200-package supply-chain liability with no LTS calend
 
 ## Status
 
-Pre-1.0. Usable end-to-end — operators can build production apps on it today; the surface is still subject to change before 1.0. Recent line is **v0.6.0** ([releases](https://github.com/blamejs/blamejs/releases) · [npm](https://www.npmjs.com/package/@blamejs/core) · [container](https://github.com/blamejs/blamejs/pkgs/container/blamejs-wiki)).
+Pre-1.0. Usable end-to-end — operators can build production apps on it today; the surface is still subject to change before 1.0. Recent line is **v0.6.2** ([releases](https://github.com/blamejs/blamejs/releases) · [npm](https://www.npmjs.com/package/@blamejs/core) · [container](https://github.com/blamejs/blamejs/pkgs/container/blamejs-wiki)).
 
 ```js
 var b = require("@blamejs/core");
@@ -115,7 +115,7 @@ Because when something breaks, `blame` should know exactly where it lives. We ow
 
 ## Contributing
 
-Patches welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for the dev setup, house rules (zero npm runtime deps, PQC-only crypto, audit-on-every-action, no-MVP), and the PR loop. New to the codebase? Start with [ARCHITECTURE.md](ARCHITECTURE.md) for the orientation map.
+Patches welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for the dev setup, house rules (zero npm runtime deps, PQC-only crypto, audit-on-every-action, ship-complete-not-incremental), and the PR loop. New to the codebase? Start with [ARCHITECTURE.md](ARCHITECTURE.md) for the orientation map.
 
 Community standards: [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) (Contributor Covenant 2.1). Be excellent.
 

package/lib/api-key.js

@@ -74,7 +74,12 @@ function _emitEvent(name, value, labels) {
 
 var _err = ApiKeyError.factory;
 
-var TABLE = "_blamejs_api_keys";
+var TABLE   = "_blamejs_api_keys";
+// Pre-quoted form for SQL interpolation. Defense-in-depth: even though
+// our constant is bare-identifier-shaped, every interpolation site uses
+// the wrapped form so a future rename to a reserved-word or
+// whitespace-bearing name would still resolve correctly.
+var Q_TABLE = '"' + TABLE + '"';
 
 // Column order used for INSERT — kept as a constant so the placeholders
 // list and the values list stay in sync. Must match _blamejs_api_keys'
@@ -286,7 +291,7 @@ function create(opts) {
   function _selectAll() {
     return "SELECT id, namespace, ownerId, ownerIdHash, secretHash, " +
            "secondarySecretHash, secondaryExpiresAt, " +
-           "scopes, metadata, createdAt, expiresAt, revokedAt, lastUsedAt, prefix FROM " + TABLE;
+           "scopes, metadata, createdAt, expiresAt, revokedAt, lastUsedAt, prefix FROM " + Q_TABLE;
   }
 
   function _scrubRecord(row) {
@@ -352,7 +357,7 @@ function create(opts) {
     var quoted = COLS.map(function (c) { return '"' + c + '"'; }).join(", ");
 
     await clusterStorage.execute(
-      "INSERT INTO " + TABLE + " (" + quoted + ") VALUES (" + placeholders + ")",
+      "INSERT INTO " + Q_TABLE + " (" + quoted + ") VALUES (" + placeholders + ")",
       values
     );
 
@@ -453,7 +458,7 @@ function create(opts) {
     if (trackLastUsedAt && cluster.isLeader()) {
       try {
         await clusterStorage.execute(
-          "UPDATE " + TABLE + " SET lastUsedAt = ? WHERE id = ?",
+          "UPDATE " + Q_TABLE + " SET lastUsedAt = ? WHERE id = ?",
           [nowMs, compositeId]
         );
       } catch (_e) { /* best-effort; verify success not blocked by lastUsed update */ }
@@ -480,7 +485,7 @@ function create(opts) {
     var compositeId = _composedId(namespace, idHex);
     var nowMs = clock();
     var result = await clusterStorage.execute(
-      "UPDATE " + TABLE + " SET revokedAt = ? WHERE id = ? AND revokedAt IS NULL",
+      "UPDATE " + Q_TABLE + " SET revokedAt = ? WHERE id = ? AND revokedAt IS NULL",
       [nowMs, compositeId]
     );
     var changed = (result.rowCount || 0) > 0;
@@ -537,7 +542,7 @@ function create(opts) {
     if (gracePeriodMs > 0) {
       // Move current hash → secondary slot, install new hash as primary.
       await clusterStorage.execute(
-        "UPDATE " + TABLE + " SET secretHash = ?, " +
+        "UPDATE " + Q_TABLE + " SET secretHash = ?, " +
         "secondarySecretHash = ?, secondaryExpiresAt = ? WHERE id = ?",
         [newHash, existing.secretHash, nowMs + gracePeriodMs, compositeId]
       );
@@ -545,7 +550,7 @@ function create(opts) {
       // Hard cutover — old secret stops working immediately. Clears
       // any prior secondary slot too.
       await clusterStorage.execute(
-        "UPDATE " + TABLE + " SET secretHash = ?, " +
+        "UPDATE " + Q_TABLE + " SET secretHash = ?, " +
         "secondarySecretHash = NULL, secondaryExpiresAt = NULL WHERE id = ?",
         [newHash, compositeId]
       );
@@ -639,7 +644,7 @@ function create(opts) {
     // extra round-trip per purge call which runs on a schedule (not
     // request-rate), so the cost is irrelevant.
     var idRows = await clusterStorage.execute(
-      "SELECT id FROM " + TABLE + " WHERE namespace = ? AND " +
+      "SELECT id FROM " + Q_TABLE + " WHERE namespace = ? AND " +
       "((revokedAt IS NOT NULL AND revokedAt < ?) OR " +
       " (expiresAt IS NOT NULL AND expiresAt < ?))",
       [namespace, threshold, threshold]
@@ -652,7 +657,7 @@ function create(opts) {
     }
 
     var result = await clusterStorage.execute(
-      "DELETE FROM " + TABLE + " WHERE namespace = ? AND " +
+      "DELETE FROM " + Q_TABLE + " WHERE namespace = ? AND " +
       "((revokedAt IS NOT NULL AND revokedAt < ?) OR " +
       " (expiresAt IS NOT NULL AND expiresAt < ?))",
       [namespace, threshold, threshold]

package/lib/auth/jwt.js

@@ -258,11 +258,28 @@ async function verify(token, opts) {
   }
   var tol = typeof opts.clockToleranceSec === "number" ? opts.clockToleranceSec : 0;
   var p = decoded.payload;
-  if (typeof p.exp === "number" && p.exp + tol < nowSec) {
+
+  // Strict registered-claim typing per RFC 7519 §4.1. exp / nbf / iat MUST
+  // be NumericDate values (JSON numeric, seconds since epoch). A claim
+  // present-but-not-a-number is a malformed token — silently skipping the
+  // check would let a token with `exp: "0"` or `exp: "9999999999"` (string)
+  // bypass expiration enforcement entirely.
+  function _requireNumericDate(name, value) {
+    if (typeof value !== "number" || !isFinite(value)) {
+      throw new AuthError("auth-jwt/malformed",
+        "claim '" + name + "' must be a finite number (RFC 7519 NumericDate), got " +
+        (value === null ? "null" : typeof value));
+    }
+  }
+  if (p.exp !== undefined) _requireNumericDate("exp", p.exp);
+  if (p.nbf !== undefined) _requireNumericDate("nbf", p.nbf);
+  if (p.iat !== undefined) _requireNumericDate("iat", p.iat);
+
+  if (p.exp !== undefined && p.exp + tol < nowSec) {
     throw new AuthError("auth-jwt/expired",
       "token expired at exp=" + p.exp + " (now=" + nowSec + ", tolerance=" + tol + "s)");
   }
-  if (typeof p.nbf === "number" && p.nbf - tol > nowSec) {
+  if (p.nbf !== undefined && p.nbf - tol > nowSec) {
     throw new AuthError("auth-jwt/not-yet-valid",
       "token not yet valid: nbf=" + p.nbf + " (now=" + nowSec + ", tolerance=" + tol + "s)");
   }

package/lib/break-glass.js

@@ -48,6 +48,7 @@ var observability = require("./observability");
 var requestHelpers = require("./request-helpers");
 var safeAsync = require("./safe-async");
 var safeJson = require("./safe-json");
+var safeSql = require("./safe-sql");
 var totp = require("./totp");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -248,8 +249,12 @@ async function migrate(table, opts) {
   var lastId = "";
   // Iterate via _id-keyset paging so we don't load the whole table into memory.
   while (true) {
+    // table is already validated as a safe identifier shape via
+    // _validatePolicySet — wrap in "..." per the framework's
+    // identifier-quoting convention.
+    var qTable = '"' + table + '"';
     var rows = await clusterStorage.executeAll(
-      "SELECT * FROM " + table + " WHERE _id > ? ORDER BY _id ASC LIMIT ?",
+      "SELECT * FROM " + qTable + " WHERE _id > ? ORDER BY _id ASC LIMIT ?",
       [lastId, batchSize]
     );
     if (!rows || rows.length === 0) break;
@@ -275,11 +280,14 @@ async function migrate(table, opts) {
         // the cell ciphertext stays as a literal string, not double-sealed.
         var setCols = Object.keys(update).filter(function (k) { return k !== "_id"; });
         if (setCols.length > 0) {
-          var setSql = setCols.map(function (k) { return k + " = ?"; }).join(", ");
+          // Column names came from the validated policy.columns —
+          // also wrap each in "..." for the same identifier-quoting
+          // convention.
+          var setSql = setCols.map(function (k) { return '"' + k + '" = ?'; }).join(", ");
           var vals = setCols.map(function (k) { return update[k]; });
           vals.push(row._id);
           await clusterStorage.execute(
-            "UPDATE " + table + " SET " + setSql + " WHERE _id = ?",
+            "UPDATE " + qTable + " SET " + setSql + " WHERE _id = ?",
             vals
           );
           migratedRows++;
@@ -343,6 +351,20 @@ function _validatePolicySet(table, opts) {
     throw new BreakGlassError("breakglass/bad-policy",
       "policy.set: table must be a non-empty string");
   }
+  // Identifier safety: the table name flows raw into SQL via interpolation
+  // in migrate() / unsealRowAsService(). safeSql.validateIdentifier closes
+  // the shape so a malicious / mistyped name with embedded `"` or
+  // SQL-keyword shape can't break out of the wrapping quotes.
+  // allowReserved: true because every interpolation site quotes the
+  // identifier, so reserved-word names work via the SQL standard quoting
+  // rule.
+  try {
+    safeSql.validateIdentifier(table, { allowReserved: true });
+  } catch (e) {
+    throw new BreakGlassError("breakglass/bad-policy",
+      "policy.set: table '" + table + "' is not a valid SQL identifier: " +
+      ((e && e.message) || String(e)));
+  }
   if (!opts || typeof opts !== "object") {
     throw new BreakGlassError("breakglass/bad-policy",
       "policy.set: opts is required");
@@ -358,10 +380,20 @@ function _validatePolicySet(table, opts) {
       "policy.set: columns must be a non-empty array");
   }
   for (var i = 0; i < opts.columns.length; i++) {
-    if (typeof opts.columns[i] !== "string" || opts.columns[i].length === 0) {
+    var colName = opts.columns[i];
+    if (typeof colName !== "string" || colName.length === 0) {
       throw new BreakGlassError("breakglass/bad-policy",
         "policy.set: columns[" + i + "] must be a non-empty string");
     }
+    // Same identifier-shape check as the table — column names flow into
+    // the migrate() UPDATE statement as bare names.
+    try {
+      safeSql.validateIdentifier(colName, { allowReserved: true });
+    } catch (e) {
+      throw new BreakGlassError("breakglass/bad-policy",
+        "policy.set: columns[" + i + "]='" + colName + "' is not a valid SQL identifier: " +
+        ((e && e.message) || String(e)));
+    }
   }
   if (!Array.isArray(opts.factors) || opts.factors.length === 0) {
     throw new BreakGlassError("breakglass/bad-policy",
@@ -894,7 +926,7 @@ async function unsealRow(grantHandle, table, rowId, opts) {
   // glass-locked columns separately (their ciphertext was written
   // by encryptCell at app-write time, not by cryptoField.sealRow).
   var rows = await clusterStorage.executeAll(
-    "SELECT * FROM " + table + " WHERE _id = ?",
+    "SELECT * FROM " + '"' + table + '"' + " WHERE _id = ?",
     [String(rowId)]
   );
   if (!rows || rows.length === 0) {
@@ -1093,7 +1125,7 @@ async function unsealRowAsService(req, table, rowId, opts) {
   // Fetch + unseal the row (Model A or Model B path, same as
   // operator-initiated unsealRow).
   var rows = await clusterStorage.executeAll(
-    "SELECT * FROM " + table + " WHERE _id = ?",
+    "SELECT * FROM " + '"' + table + '"' + " WHERE _id = ?",
     [String(rowId)]
   );
   if (!rows || rows.length === 0) {

package/lib/cluster.js

@@ -57,6 +57,7 @@ var lazyRequire = require("./lazy-require");
 var { boot } = require("./log");
 var safeAsync = require("./safe-async");
 var safeJson = require("./safe-json");
+var safeSql = require("./safe-sql");
 var safeUrl = require("./safe-url");
 var { FrameworkError, ClusterError } = require("./framework-error");
 
@@ -273,12 +274,21 @@ async function init(opts) {
 //     hash → FATAL via process.exit(1). Same posture as the
 //     single-node audit.tip sidecar rollback check.
 async function _checkChainTipRollback(chainName, logTable, tipTable) {
+  // Both tables are framework-internal constants from the call sites
+  // (`_blamejs_audit_log`, `_blamejs_consent_log`, etc.). Validate +
+  // quote per the framework's identifier-quoting convention so a
+  // future rename can't silently break the query.
+  safeSql.validateIdentifier(logTable, { allowReserved: true });
+  safeSql.validateIdentifier(tipTable, { allowReserved: true });
+  var qLogTable = safeSql.quoteIdentifier(logTable);
+  var qTipTable = safeSql.quoteIdentifier(tipTable);
+
   var tipRows;
   try {
     tipRows = await externalDb().query(
-      "SELECT atMonotonicCounter, rowHash FROM " + tipTable +
-      " WHERE scope = '" + chainName + "'",
-      [],
+      "SELECT atMonotonicCounter, rowHash FROM " + qTipTable +
+      " WHERE scope = " + (configuredDialect === "postgres" ? "$1" : "?"),
+      [chainName],
       { backend: configuredExternalDbBackend }
     );
   } catch (e) {
@@ -298,7 +308,7 @@ async function _checkChainTipRollback(chainName, logTable, tipTable) {
   var tipHash = tip.rowHash;
 
   var currentRows = await externalDb().query(
-    "SELECT MAX(monotonicCounter) AS m FROM " + logTable,
+    "SELECT MAX(monotonicCounter) AS m FROM " + qLogTable,
     [],
     { backend: configuredExternalDbBackend }
   );
@@ -317,7 +327,7 @@ async function _checkChainTipRollback(chainName, logTable, tipTable) {
 
   if (tipHash) {
     var hashRows = await externalDb().query(
-      "SELECT rowHash FROM " + logTable + " WHERE monotonicCounter = " +
+      "SELECT rowHash FROM " + qLogTable + " WHERE monotonicCounter = " +
       (configuredDialect === "postgres" ? "$1" : "?"),
       [tipCounter],
       { backend: configuredExternalDbBackend }

package/lib/db-query.js

@@ -29,11 +29,33 @@
 var { Readable } = require("node:stream");
 var cryptoField = require("./crypto-field");
 var { generateToken } = require("./crypto");
+var safeSql = require("./safe-sql");
 
 var ALLOWED_OPS = new Set(["=", "!=", "<>", "<", "<=", ">", ">=", "IS", "IS NOT", "LIKE", "IN"]);
 
 class Query {
   constructor(database, tableName) {
+    // Identifier safety: tableName flows into SQL via interpolation
+    // (parameter placeholders only bind values, not names). Validate at
+    // construction so an attacker-controlled name with embedded `"` or
+    // SQL keywords can't break out of the wrapping quotes downstream.
+    // Cross-schema queries (e.g., Postgres `public.users`) need the
+    // schema-qualified API, not a dotted single-identifier — reject `.`
+    // here so the failure mode is explicit.
+    if (typeof tableName !== "string") {
+      throw new TypeError("Query: tableName must be a string, got " + typeof tableName);
+    }
+    if (tableName.indexOf(".") !== -1) {
+      throw new Error("Query: tableName '" + tableName + "' contains '.' — use a single " +
+        "identifier; cross-schema queries are not supported by db.from(). " +
+        "For Postgres-style schema.table access, use b.externalDb.query directly.");
+    }
+    // allowReserved: true — db-query always wraps the identifier in
+    // `"..."` so a table named `order` resolves correctly via the SQL
+    // standard quoting rule. The reserved-word block in safeSql is for
+    // call sites that interpolate unquoted.
+    safeSql.validateIdentifier(tableName, { allowReserved: true });
+
     this._db          = database;
     this._table       = tableName;
     this._where       = [];

package/lib/db-schema.js

@@ -33,10 +33,14 @@ function runSql(database, sql) { return database["exec"](sql); }
 // ---- Internal migrations table ----
 
 var MIGRATIONS_TABLE = "_blamejs_migrations";
+// Pre-quoted for SQL interpolation — keeps the call sites consistent
+// with lib/migrations.js and lib/seeders.js so an identifier rename
+// doesn't silently break.
+var Q_MIGRATIONS_TABLE = '"' + MIGRATIONS_TABLE + '"';
 
 function ensureMigrationsTable(database) {
   runSql(database,
-    "CREATE TABLE IF NOT EXISTS " + MIGRATIONS_TABLE + " (" +
+    "CREATE TABLE IF NOT EXISTS " + Q_MIGRATIONS_TABLE + " (" +
     "  name        TEXT PRIMARY KEY," +
     "  description TEXT," +
     "  appliedAt   TEXT NOT NULL" +
@@ -200,7 +204,7 @@ function runMigrations(database, migrationDir) {
   }).map(function (e) { return e.name; }).sort();
 
   var appliedSet = new Set();
-  database.prepare("SELECT name FROM " + MIGRATIONS_TABLE).all().forEach(function (r) {
+  database.prepare("SELECT name FROM " + Q_MIGRATIONS_TABLE).all().forEach(function (r) {
     appliedSet.add(r.name);
   });
 
@@ -227,7 +231,7 @@ function runMigrations(database, migrationDir) {
       runSql(database, "BEGIN");
       mig.up(database);
       database.prepare(
-        "INSERT INTO " + MIGRATIONS_TABLE + " (name, description, appliedAt) VALUES (?, ?, ?)"
+        "INSERT INTO " + Q_MIGRATIONS_TABLE + " (name, description, appliedAt) VALUES (?, ?, ?)"
       ).run(file, mig.description || "", new Date().toISOString());
       runSql(database, "COMMIT");
     } catch (e) {

package/lib/http-client.js

@@ -122,13 +122,62 @@ var _transports = new Map();
 // idle sockets reaped quickly between bursts. ecdhCurve / minVersion
 // come from pqc-agent and cannot be set here — the framework's
 // PQC-only TLS posture is one place, in lib/pqc-agent.js.
-var HTTP_CLIENT_AGENT_OPTS = {
+//
+// Operators tune at boot via `b.httpClient.configurePool({...})`.
+// Existing transports stay on whichever values were active when they
+// were created — reconfigure runs before any outbound request to take
+// effect on the per-origin cache.
+var DEFAULT_AGENT_OPTS = Object.freeze({
   keepAlive:        true,
   keepAliveMsecs:   1000,
   maxSockets:       16,
   maxFreeSockets:   8,
   scheduling:       "lifo",
-};
+});
+
+var HTTP_CLIENT_AGENT_OPTS = Object.assign({}, DEFAULT_AGENT_OPTS);
+
+function configurePool(opts) {
+  if (!opts || typeof opts !== "object") {
+    throw new Error("httpClient.configurePool: opts must be an object");
+  }
+  var allowed = ["keepAlive", "keepAliveMsecs", "maxSockets", "maxFreeSockets", "scheduling"];
+  for (var k in opts) {
+    if (!Object.prototype.hasOwnProperty.call(opts, k)) continue;
+    if (allowed.indexOf(k) === -1) {
+      throw new Error("httpClient.configurePool: unknown option '" + k +
+        "'. Allowed: " + allowed.join(", "));
+    }
+  }
+  function _requirePositiveInt(name, value) {
+    if (typeof value !== "number" || !isFinite(value) || value <= 0 || Math.floor(value) !== value) {
+      throw new Error("httpClient.configurePool: " + name +
+        " must be a positive integer, got " + JSON.stringify(value));
+    }
+  }
+  if (opts.maxSockets     !== undefined) _requirePositiveInt("maxSockets",     opts.maxSockets);
+  if (opts.maxFreeSockets !== undefined) _requirePositiveInt("maxFreeSockets", opts.maxFreeSockets);
+  if (opts.keepAliveMsecs !== undefined) _requirePositiveInt("keepAliveMsecs", opts.keepAliveMsecs);
+  if (opts.keepAlive      !== undefined && typeof opts.keepAlive !== "boolean") {
+    throw new Error("httpClient.configurePool: keepAlive must be a boolean");
+  }
+  if (opts.scheduling     !== undefined && opts.scheduling !== "lifo" && opts.scheduling !== "fifo") {
+    throw new Error("httpClient.configurePool: scheduling must be 'lifo' or 'fifo'");
+  }
+  Object.assign(HTTP_CLIENT_AGENT_OPTS, opts);
+  // Existing transports keep their old values (Agent constructor
+  // copies). Drop the per-origin cache + tear down idle sockets so
+  // subsequent requests build fresh transports with the new opts.
+  _transports.forEach(function (t) {
+    if (t && t.kind === "h1" && t.agent && typeof t.agent.destroy === "function") {
+      try { t.agent.destroy(); } catch (_e) {}
+    }
+    if (t && t.kind === "h2" && t.session && typeof t.session.close === "function") {
+      try { t.session.close(); } catch (_e) {}
+    }
+  });
+  _transports.clear();
+}
 
 // h2 session connect options. Same TLS posture as h1 Agent.
 var DEFAULT_H2_TLS_OPTS = {
@@ -1026,8 +1075,10 @@ function _getCachedTransportKind(url) {
 
 module.exports = {
   request:                    request,
+  configurePool:              configurePool,
   DEFAULT_CONTROL_PLANE_CAP:  DEFAULT_CONTROL_PLANE_CAP,
   DEFAULT_GET_CAP:            DEFAULT_GET_CAP,
+  DEFAULT_AGENT_OPTS:         DEFAULT_AGENT_OPTS,
   _resetForTest:              _resetForTest,
   _getCachedTransportCount:   _getCachedTransportCount,
   _getCachedTransportKind:    _getCachedTransportKind,

package/lib/middleware/body-parser.js

@@ -203,12 +203,31 @@ function _typeMatches(actual, allowed) {
   return false;
 }
 
+// RFC 9112 §6.1: Content-Length MUST be a sequence of decimal digits with
+// no whitespace, sign, or trailing garbage. parseInt("123abc") returning
+// 123 is the lenient parse that lets malformed headers slip past the
+// preflight cap; the strict regex catches them at the boundary.
+var STRICT_CONTENT_LENGTH = /^\d+$/;
+
+function _parseContentLength(cl) {
+  if (typeof cl !== "string" || !STRICT_CONTENT_LENGTH.test(cl)) return null;
+  var n = Number(cl);
+  return isFinite(n) ? n : null;
+}
+
 function _hasBody(req) {
   if (!BODY_BEARING_METHODS.has(req.method)) return false;
   var cl = req.headers && req.headers["content-length"];
-  if (cl === "0") return false;
-  // Either Content-Length > 0 OR Transfer-Encoding: chunked → there's a body.
-  if (typeof cl === "string" && cl !== "0") return true;
+  if (typeof cl === "string") {
+    var clNum = _parseContentLength(cl);
+    // Spec-shaped zero (the only RFC 9112 §6.1 zero) → no body. Malformed
+    // values (non-decimal-digits) flow through as "yes, has body" so the
+    // downstream _bufferBody call rejects with 400 — silently treating
+    // a malformed header as "no body" would let the request slip past
+    // the parser entirely.
+    if (clNum === 0) return false;
+    return true;
+  }
   var te = req.headers && req.headers["transfer-encoding"];
   if (typeof te === "string" && te.length > 0) return true;
   return false;
@@ -230,14 +249,22 @@ function _bufferBody(req, limit) {
   return new Promise(function (resolve, reject) {
     var cl = req.headers && req.headers["content-length"];
     if (typeof cl === "string") {
-      var clNum = parseInt(cl, 10);
-      if (!isNaN(clNum) && clNum > limit) {
-        var err = new BodyParserError(
+      var clNum = _parseContentLength(cl);
+      if (clNum === null) {
+        // RFC 9112 §6.1 — malformed Content-Length is a 400.
+        reject(new BodyParserError(
+          "body-parser/bad-content-length",
+          "Content-Length is not a sequence of decimal digits: " + JSON.stringify(cl),
+          true, 400
+        ));
+        return;
+      }
+      if (clNum > limit) {
+        reject(new BodyParserError(
           "body-parser/too-large",
           "request body exceeds limit (" + clNum + " > " + limit + ")",
           true, 413
-        );
-        reject(err);
+        ));
         return;
       }
     }

package/lib/middleware/cors.js

@@ -13,14 +13,19 @@
  *      works behind TLS-terminating proxies where the framework can't
  *      infer scheme), or
  *   2. Origin === request's inferred scheme/host/port (from req.socket
- *      and req.headers.host — correct for direct deployments), or
- *   3. Origin == "null" AND Sec-Fetch-Site == "same-origin" or "none".
- *      Browsers send `Origin: null` on form-navigation POSTs from a
- *      page whose response carries `Referrer-Policy: no-referrer` (or
- *      similarly strict policy) — the Origin is opaqued to prevent a
- *      cross-site leak of the page's origin. Sec-Fetch-Site is the
- *      Fetch-metadata signal that distinguishes a same-origin nav
- *      from a genuine cross-site post in that opaque-origin world.
+ *      and req.headers.host — correct for direct deployments).
+ *
+ * Origin: null shortcut (opt-in via strictNullOrigin: false): browsers
+ * send `Origin: null` on form-navigation POSTs from a page whose response
+ * carries `Referrer-Policy: no-referrer` (or similarly strict policy) —
+ * the Origin is opaqued to prevent a cross-site leak. The Sec-Fetch-Site
+ * Fetch-metadata signal distinguishes a same-origin nav from a genuine
+ * cross-site post in that opaque-origin world. Default is to REFUSE the
+ * shortcut (strictNullOrigin: true) — non-browser clients can forge
+ * Sec-Fetch-Site freely, and operators using `refuseUnknown: true` as a
+ * stricter "refuse unrecognized origin" policy expect the gate to hold.
+ * Operators with a no-referrer page that legitimately produces
+ * Origin: null on same-origin POSTs flip strictNullOrigin: false.
  *
  * Options:
  *   {
@@ -33,14 +38,16 @@
  *     maxAgeSeconds:  600
  *     refuseUnknown:  true     (refuse cross-origin requests from unlisted
  *                                origins instead of just omitting CORS headers)
+ *     strictNullOrigin: true   (default — refuse Origin: null even with
+ *                                Sec-Fetch-Site: same-origin. Set false to
+ *                                allow the no-referrer-page edge case.)
  *   }
  *
  * Audit: refuseUnknown blocks emit system.cors.block with the offending Origin.
  *
- * Validation tier: Tier A (config-time throw) — opts.siteOrigin must
- * parse as an http(s) URL, opts.origins entries must be strings or
- * RegExp. Bad config surfaces at create() not at first cross-origin
- * request.
+ * Configuration validation: opts.siteOrigin must parse as an http(s) URL,
+ * opts.origins entries must be strings or RegExp. Bad config surfaces at
+ * create() not at first cross-origin request.
  */
 var lazyRequire = require("../lazy-require");
 var audit = lazyRequire(function () { return require("../audit"); });
@@ -60,12 +67,26 @@ function _xffIpFor(trustProxy) {
 
 var CorsError = defineClass("CorsError", { alwaysPermanent: true });
 
+// allowList entries:
+//   - { kind: "string", canonical: "https://app.example.com", original: "..." }
+//   - { kind: "regex",  pattern: /.../  }
+// Both raw entry and the inbound origin run through _canonicalOrigin
+// before equality so case differences ("https://APP" vs "https://app")
+// and default-port differences ("https://x:443" vs "https://x") match.
 function _matchOrigin(origin, allowList) {
   if (!origin) return null;
+  var canon = _canonicalOrigin(origin);
   for (var i = 0; i < allowList.length; i++) {
     var entry = allowList[i];
-    if (typeof entry === "string" && entry === origin) return origin;
-    if (entry instanceof RegExp && entry.test(origin)) return origin;
+    if (entry.kind === "string") {
+      if (canon !== null && entry.canonical === canon) return origin;
+    } else if (entry.kind === "regex") {
+      // Regex entries match against the raw origin (operator wrote the
+      // pattern with whatever case / port shape they intended). Also try
+      // the canonical form so case-insensitive intent works without /i.
+      if (entry.pattern.test(origin)) return origin;
+      if (canon !== null && entry.pattern.test(canon)) return origin;
+    }
   }
   return null;
 }
@@ -104,12 +125,15 @@ function _inferRequestOrigin(req, trustProxy) {
   return _canonicalOrigin(proto + "://" + host);
 }
 
-function _isSameOrigin(req, originHeader, configuredSiteOrigins, trustProxy) {
-  // Origin: null + Sec-Fetch-Site: same-origin|none — browser opaqued
-  // the Origin (typically because of Referrer-Policy: no-referrer on the
-  // page) but is also explicitly telling us the request is same-origin.
-  // Trust the Fetch-metadata signal in that case.
+function _isSameOrigin(req, originHeader, configuredSiteOrigins, trustProxy, strictNullOrigin) {
+  // Origin: null arrives when a browser opaques the Origin (e.g.
+  // Referrer-Policy: no-referrer on the page). Sec-Fetch-Site can
+  // distinguish the same-origin case, but non-browser clients can forge
+  // that header freely — strictNullOrigin: true (default) refuses the
+  // shortcut so refuseUnknown holds against forged callers. Operators
+  // with a legitimate no-referrer page flip strictNullOrigin: false.
   if (originHeader === "null") {
+    if (strictNullOrigin) return false;
     var sfs = req && req.headers && req.headers["sec-fetch-site"];
     if (sfs === "same-origin" || sfs === "none") return true;
     return false;
@@ -137,17 +161,31 @@ function create(opts) {
   validateOpts(opts, [
     "origins", "siteOrigin", "methods", "headers", "exposeHeaders",
     "credentials", "maxAgeSeconds", "refuseUnknown", "trustProxy",
+    "strictNullOrigin",
   ], "middleware.cors");
   var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
     ? opts.trustProxy : false;
   var _xffIp = _xffIpFor(trustProxy);
 
-  var origins = opts.origins || [];
-
-  // Tier A validation on opts.origins — strings or RegExp only.
-  for (var oi = 0; oi < origins.length; oi++) {
-    var entry = origins[oi];
-    if (typeof entry !== "string" && !(entry instanceof RegExp)) {
+  // Build a canonicalized allowList at create() time. String entries
+  // get parsed through _canonicalOrigin so case + default-port
+  // differences match consistently between the configured value and
+  // the inbound Origin header. RegExp entries stay as the operator
+  // wrote them.
+  var rawOrigins = opts.origins || [];
+  var origins = [];
+  for (var oi = 0; oi < rawOrigins.length; oi++) {
+    var entry = rawOrigins[oi];
+    if (typeof entry === "string") {
+      var canonEntry = _canonicalOrigin(entry);
+      if (canonEntry === null) {
+        throw new CorsError("cors/bad-origin",
+          "origins[" + oi + "]='" + entry + "' is not a parseable http(s) URL");
+      }
+      origins.push({ kind: "string", canonical: canonEntry, original: entry });
+    } else if (entry instanceof RegExp) {
+      origins.push({ kind: "regex", pattern: entry });
+    } else {
       throw new CorsError("cors/bad-origin",
         "origins[" + oi + "] must be a string or RegExp (got " + typeof entry + ")");
     }
@@ -185,6 +223,11 @@ function create(opts) {
   var credentials = !!opts.credentials;
   var maxAge = String(opts.maxAgeSeconds || 600);
   var refuseUnknown = opts.refuseUnknown !== false;
+  // strictNullOrigin defaults true: refuse Origin: null even with
+  // Sec-Fetch-Site: same-origin (non-browser callers can forge that
+  // header). Operators with a no-referrer page producing legitimate
+  // Origin: null on same-origin POSTs flip to false explicitly.
+  var strictNullOrigin = opts.strictNullOrigin !== false;
 
   return function cors(req, res, next) {
     var origin = req.headers && req.headers.origin;
@@ -193,7 +236,7 @@ function create(opts) {
     // Same-origin POST/PUT/etc. carry an Origin header per the Fetch
     // spec but should not be subject to CORS allow-listing — they're
     // the operator's own site talking to itself.
-    if (_isSameOrigin(req, origin, siteOrigins, trustProxy)) return next();
+    if (_isSameOrigin(req, origin, siteOrigins, trustProxy, strictNullOrigin)) return next();
 
     var matched = _matchOrigin(origin, origins);
     if (!matched) {

package/lib/middleware/csrf-protect.js

@@ -50,7 +50,9 @@
  * Full options:
  *   {
  *     cookie:      true | {                  EITHER this...
- *       name:      "csrf",
+ *       name:      auto: "__Host-csrf" over HTTPS, "csrf" over HTTP.
+ *                  Operators with a custom name override here; the framework
+ *                  validates that __Host-* names carry path="/" and Secure.
  *       sameSite:  "Lax" | "Strict" | "None",
  *       secure:    auto-detected from request scheme,
  *       path:      "/",
@@ -73,7 +75,15 @@ var audit = lazyRequire(function () { return require("../audit"); });
 var DEFAULT_FIELD_NAME    = "_csrf";
 var DEFAULT_HEADER_NAME   = "X-CSRF-Token";
 var DEFAULT_METHODS       = Object.freeze(["POST", "PUT", "DELETE", "PATCH"]);
-var DEFAULT_COOKIE_NAME   = "csrf";
+
+// Default cookie name uses the RFC 6265bis __Host- prefix when the request
+// is over HTTPS. The prefix forces browsers to refuse the cookie unless
+// it carries Secure + Path=/ + no Domain attribute — closing the
+// "malicious sibling subdomain sets a cookie on the parent domain to
+// subvert double-submit verification" attack class. On plain HTTP (dev),
+// browsers reject __Host- entirely, so we fall back to the bare name.
+var DEFAULT_COOKIE_NAME_SECURE   = "__Host-csrf";
+var DEFAULT_COOKIE_NAME_INSECURE = "csrf";
 
 function _parseCookieHeader(header) {
   // Minimal cookie-header parser — RFC 6265 §5.2 form. Ignores attributes,
@@ -191,7 +201,9 @@ function create(opts) {
       throw new Error("middleware.csrfProtect: opts.cookie must be true or an object");
     }
     cookieCfg = {
-      name:     raw.name     || DEFAULT_COOKIE_NAME,
+      // name: explicit operator override wins; otherwise auto-resolved
+      // per-request based on whether the cookie is being issued Secure.
+      name:     raw.name || null,
       sameSite: raw.sameSite || "Lax",
       // secure: undefined means auto-detect from request scheme; explicit
       // true/false overrides.
@@ -203,6 +215,27 @@ function create(opts) {
     if (["Lax", "Strict", "None"].indexOf(cookieCfg.sameSite) === -1) {
       throw new Error("middleware.csrfProtect: opts.cookie.sameSite must be Lax|Strict|None");
     }
+    // __Host- prefix safety: if operator picks a __Host- name, the
+    // Path/Domain/Secure constraints must be compatible. Path must be "/",
+    // no Domain (we never set one), Secure resolved per-request. Catch
+    // operator-side typos (e.g. __Host-csrf with a custom path) at boot.
+    if (cookieCfg.name && /^__Host-/.test(cookieCfg.name)) {
+      if (cookieCfg.path !== "/") {
+        throw new Error("middleware.csrfProtect: __Host-* cookie name requires path='/'");
+      }
+      if (cookieCfg.secure === false) {
+        throw new Error("middleware.csrfProtect: __Host-* cookie name requires secure (cannot be explicit false)");
+      }
+    }
+  }
+
+  // Resolve the cookie name for a specific request — operator override
+  // wins; otherwise __Host-csrf when the cookie will be Secure, plain
+  // csrf when over HTTP (browsers reject __Host- without Secure).
+  function _resolveCookieName(req) {
+    if (cookieCfg.name) return cookieCfg.name;
+    var willBeSecure = cookieCfg.secure == null ? _isHttps(req) : !!cookieCfg.secure;
+    return willBeSecure ? DEFAULT_COOKIE_NAME_SECURE : DEFAULT_COOKIE_NAME_INSECURE;
   }
 
   function _emitDenied(req, reason) {
@@ -221,14 +254,15 @@ function create(opts) {
   // req.csrfToken so templates have something to render.
   function _issueIfNeeded(req, res) {
     if (!cookieCfg) return null;
+    var cookieName = _resolveCookieName(req);
     var cookies = _parseCookieHeader(req.headers && req.headers.cookie);
-    var existing = cookies[cookieCfg.name];
+    var existing = cookies[cookieName];
     if (existing && /^[a-f0-9]{2,}$/.test(existing)) {
       req.csrfToken = existing;
       return existing;
     }
     var fresh = forms.generateCsrfToken();
-    var setCookie = _formatSetCookie(cookieCfg.name, fresh, {
+    var setCookie = _formatSetCookie(cookieName, fresh, {
       path:     cookieCfg.path,
       sameSite: cookieCfg.sameSite,
       secure:   cookieCfg.secure == null ? _isHttps(req) : !!cookieCfg.secure,

package/lib/middleware/rate-limit.js

@@ -64,11 +64,23 @@ function _clientIpFor(trustProxy) {
   };
 }
 
+// Reject NaN / Infinity / negative / non-positive / non-number at create
+// time so a misconfigured rate-limit can't silently degrade to "no
+// limit" or produce divide-by-zero verdicts at request time.
+function _requirePositiveNumber(name, value) {
+  if (typeof value !== "number" || !isFinite(value) || value <= 0) {
+    throw new Error("middleware.rateLimit: " + name + " must be a positive finite number, got " +
+      JSON.stringify(value));
+  }
+}
+
 // ---- Memory backend (token bucket) ----
 
 function _memoryBackend(opts) {
-  var burst = opts.burst || 60;
-  var refillPerSecond = opts.refillPerSecond || 10;
+  var burst = opts.burst != null ? opts.burst : 60;
+  var refillPerSecond = opts.refillPerSecond != null ? opts.refillPerSecond : 10;
+  _requirePositiveNumber("burst", burst);
+  _requirePositiveNumber("refillPerSecond", refillPerSecond);
   var buckets = new Map();
 
   // Periodic GC of stale buckets so the map doesn't grow unbounded.
@@ -128,9 +140,13 @@ function _memoryBackend(opts) {
 // ---- Cluster backend (fixed-window counter, SQL-backed) ----
 
 function _clusterBackend(opts) {
-  var limit    = opts.limit    || 60;
-  var windowMs = opts.windowMs || C.TIME.minutes(1);
-  var pruneIntervalMs = opts.pruneIntervalMs || C.TIME.minutes(5);
+  var limit    = opts.limit    != null ? opts.limit    : 60;
+  var windowMs = opts.windowMs != null ? opts.windowMs : C.TIME.minutes(1);
+  var pruneIntervalMs = opts.pruneIntervalMs != null
+    ? opts.pruneIntervalMs : C.TIME.minutes(5);
+  _requirePositiveNumber("limit", limit);
+  _requirePositiveNumber("windowMs", windowMs);
+  _requirePositiveNumber("pruneIntervalMs", pruneIntervalMs);
   var lastPruneAt = 0;
 
   // Best-effort prune of expired window rows. Rate-limited at the

package/lib/migrations.js

@@ -55,6 +55,10 @@ class MigrationError extends FrameworkError {
 }
 
 var MIGRATIONS_TABLE = "_blamejs_migrations";
+// Always interpolate identifiers wrapped in `"..."` so a reserved-word
+// or whitespace-bearing name resolves correctly (defense-in-depth even
+// though our constant is bare-identifier-shaped).
+var Q_MIGRATIONS_TABLE = '"' + MIGRATIONS_TABLE + '"';
 // Filename grammar: leading numeric prefix (any width), then '-', then a
 // non-empty body, then '.js'. Numeric prefix orders execution. Letters
 // in the body include hyphens, underscores, and alphanumerics; anything
@@ -68,7 +72,7 @@ function _runSql(db, sql) { return db["exec"](sql); }
 
 function _ensureTable(db) {
   _runSql(db,
-    "CREATE TABLE IF NOT EXISTS " + MIGRATIONS_TABLE + " (" +
+    "CREATE TABLE IF NOT EXISTS " + Q_MIGRATIONS_TABLE + " (" +
     "  name        TEXT PRIMARY KEY," +
     "  description TEXT," +
     "  appliedAt   TEXT NOT NULL" +
@@ -80,11 +84,12 @@ function _ensureTable(db) {
 // concurrently against the same DB race on this table: the winner of
 // the INSERT acquires the lock; the loser sees a UNIQUE violation and
 // the operator gets a clear "lock held by other process" error.
-var LOCK_TABLE = "_blamejs_migrations_lock";
+var LOCK_TABLE   = "_blamejs_migrations_lock";
+var Q_LOCK_TABLE = '"' + LOCK_TABLE + '"';
 
 function _ensureLockTable(db) {
   _runSql(db,
-    "CREATE TABLE IF NOT EXISTS " + LOCK_TABLE + " (" +
+    "CREATE TABLE IF NOT EXISTS " + Q_LOCK_TABLE + " (" +
     "  scope     TEXT PRIMARY KEY," +
     "  lockedAt  INTEGER NOT NULL," +
     "  lockedBy  TEXT NOT NULL," +
@@ -108,19 +113,19 @@ function _acquireLock(db, opts) {
   // Try to insert; if there's a stale lock, optionally force-replace it.
   try {
     db.prepare(
-      "INSERT INTO " + LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
+      "INSERT INTO " + Q_LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
     ).run(nowMs, holder);
     return holder;
   } catch {
     // PRIMARY KEY conflict → existing lock. Inspect it.
     var existing = db.prepare(
-      "SELECT lockedAt, lockedBy FROM " + LOCK_TABLE + " WHERE scope = 'lock'"
+      "SELECT lockedAt, lockedBy FROM " + Q_LOCK_TABLE + " WHERE scope = 'lock'"
     ).get();
     if (!existing) {
       // Race window between INSERT failure and SELECT — try once more.
       try {
         db.prepare(
-          "INSERT INTO " + LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
+          "INSERT INTO " + Q_LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
         ).run(nowMs, holder);
         return holder;
       } catch (e2) {
@@ -135,10 +140,10 @@ function _acquireLock(db, opts) {
       // single transaction so the next process can't slip in between.
       _runSql(db, "BEGIN IMMEDIATE");
       try {
-        db.prepare("DELETE FROM " + LOCK_TABLE + " WHERE scope = 'lock' AND lockedAt = ?")
+        db.prepare("DELETE FROM " + Q_LOCK_TABLE + " WHERE scope = 'lock' AND lockedAt = ?")
           .run(existing.lockedAt);
         db.prepare(
-          "INSERT INTO " + LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
+          "INSERT INTO " + Q_LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
         ).run(nowMs, holder);
         _runSql(db, "COMMIT");
         return holder;
@@ -163,7 +168,7 @@ function _releaseLock(db, holder) {
   // the operator explicitly used the staleAfterMs path.
   try {
     db.prepare(
-      "DELETE FROM " + LOCK_TABLE + " WHERE scope = 'lock' AND lockedBy = ?"
+      "DELETE FROM " + Q_LOCK_TABLE + " WHERE scope = 'lock' AND lockedBy = ?"
     ).run(holder);
   } catch (_e) { /* best-effort release; operator can DELETE manually */ }
 }
@@ -240,7 +245,7 @@ function create(opts) {
     var db = _resolveDb(opts);
     _ensureTable(db);
     return db.prepare(
-      "SELECT name, description, appliedAt FROM " + MIGRATIONS_TABLE +
+      "SELECT name, description, appliedAt FROM " + Q_MIGRATIONS_TABLE +
       " ORDER BY appliedAt ASC, name ASC"
     ).all();
   }
@@ -262,7 +267,7 @@ function create(opts) {
     _ensureTable(db);
     return _withLock(db, opts, function () {
       var appliedSet = new Set(
-        db.prepare("SELECT name FROM " + MIGRATIONS_TABLE).all()
+        db.prepare("SELECT name FROM " + Q_MIGRATIONS_TABLE).all()
           .map(function (r) { return r.name; })
       );
       var files = _list(dir);
@@ -276,7 +281,7 @@ function create(opts) {
           _txn(db, function () {
             mod.up(db);
             db.prepare(
-              "INSERT INTO " + MIGRATIONS_TABLE +
+              "INSERT INTO " + Q_MIGRATIONS_TABLE +
               " (name, description, appliedAt) VALUES (?, ?, ?)"
             ).run(file, mod.description || "", new Date().toISOString());
           });
@@ -306,7 +311,7 @@ function create(opts) {
       // then by name as a stable tiebreaker for fixtures with identical
       // timestamps).
       var rows = db.prepare(
-        "SELECT name FROM " + MIGRATIONS_TABLE +
+        "SELECT name FROM " + Q_MIGRATIONS_TABLE +
         " ORDER BY appliedAt DESC, name DESC LIMIT ?"
       ).all(steps);
 
@@ -323,7 +328,7 @@ function create(opts) {
         try {
           _txn(db, function () {
             mod.down(db);
-            db.prepare("DELETE FROM " + MIGRATIONS_TABLE + " WHERE name = ?").run(file);
+            db.prepare("DELETE FROM " + Q_MIGRATIONS_TABLE + " WHERE name = ?").run(file);
           });
         } catch (e) {
           throw new MigrationError("migrations/down-failed",

package/lib/safe-sql.js

@@ -124,6 +124,43 @@ function quoteIdentifier(name, dialect) {
   return '"' + name + '"';
 }
 
+// Quote a multi-part qualified name like `schema.table` or
+// `database.schema.table`. Each segment is validated + quoted
+// independently so the dotted form `"schema"."table"` resolves
+// correctly. Replaces the wrong shape `"schema.table"` (one literal
+// identifier with a dot in it). Accepts an array of parts OR a string
+// with `.` as the separator.
+//
+//   quoteQualified(["public", "users"])     → '"public"."users"'
+//   quoteQualified("public.users")          → '"public"."users"'
+//   quoteQualified(["public", "Order"], "postgres")
+//                                          → '"public"."Order"'   (case preserved)
+//   quoteQualified("dbA.public.users")      → '"dbA"."public"."users"'
+function quoteQualified(parts, dialect) {
+  var arr;
+  if (typeof parts === "string") {
+    if (parts.length === 0) {
+      throw new SafeSqlError("qualified name must not be empty", "sql/empty");
+    }
+    arr = parts.split(".");
+  } else if (Array.isArray(parts)) {
+    arr = parts.slice();
+  } else {
+    throw new SafeSqlError(
+      "qualified name must be a string or array, got " + typeof parts,
+      "sql/bad-type"
+    );
+  }
+  if (arr.length === 0) {
+    throw new SafeSqlError("qualified name must have at least one segment", "sql/empty");
+  }
+  var quoted = [];
+  for (var i = 0; i < arr.length; i++) {
+    quoted.push(quoteIdentifier(arr[i], dialect));
+  }
+  return quoted.join(".");
+}
+
 function assertOneOf(name, allowlist) {
   if (typeof name !== "string") {
     throw new SafeSqlError("name must be a string", "sql/bad-type");
@@ -149,6 +186,7 @@ function assertOneOf(name, allowlist) {
 module.exports = {
   validateIdentifier:  validateIdentifier,
   quoteIdentifier:     quoteIdentifier,
+  quoteQualified:      quoteQualified,
   assertOneOf:         assertOneOf,
   SafeSqlError:        SafeSqlError,
   // Exposed so consumers can compose their own validators

package/lib/seeders.js

@@ -68,6 +68,11 @@ var _err = SeederError.factory;
 
 var SEEDERS_TABLE = "_blamejs_seeders";
 var LOCK_TABLE    = "_blamejs_seeders_lock";
+// Pre-quoted forms used at every SQL interpolation site — defense in
+// depth so a future rename to a reserved-word or whitespace-bearing
+// table name doesn't silently break the query.
+var Q_SEEDERS_TABLE = '"' + SEEDERS_TABLE + '"';
+var Q_LOCK_TABLE    = '"' + LOCK_TABLE    + '"';
 
 // Filename grammar: leading numeric prefix (any width), '-', non-empty
 // body of [A-Za-z0-9_-], '.js'. Same shape as migrations to avoid
@@ -285,7 +290,7 @@ function _ensureTables(db) {
   // EXISTS here is defensive for tests that hand-seed a fresh
   // node:sqlite Database without going through b.db.
   _runSql(db,
-    "CREATE TABLE IF NOT EXISTS " + SEEDERS_TABLE + " (" +
+    "CREATE TABLE IF NOT EXISTS " + Q_SEEDERS_TABLE + " (" +
     "  env         TEXT NOT NULL," +
     "  name        TEXT NOT NULL," +
     "  description TEXT," +
@@ -295,7 +300,7 @@ function _ensureTables(db) {
     ")"
   );
   _runSql(db,
-    "CREATE TABLE IF NOT EXISTS " + LOCK_TABLE + " (" +
+    "CREATE TABLE IF NOT EXISTS " + Q_LOCK_TABLE + " (" +
     "  scope     TEXT PRIMARY KEY CHECK (scope = 'lock')," +
     "  lockedAt  INTEGER NOT NULL," +
     "  lockedBy  TEXT NOT NULL" +
@@ -312,18 +317,18 @@ function _acquireLock(db, lockStaleAfterMs, clock) {
   var nowMs = clock();
   try {
     db.prepare(
-      "INSERT INTO " + LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
+      "INSERT INTO " + Q_LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
     ).run(nowMs, holder);
     return holder;
   } catch (_e) {
     var existing = db.prepare(
-      "SELECT lockedAt, lockedBy FROM " + LOCK_TABLE + " WHERE scope = 'lock'"
+      "SELECT lockedAt, lockedBy FROM " + Q_LOCK_TABLE + " WHERE scope = 'lock'"
     ).get();
     if (!existing) {
       // Race window between INSERT failure and SELECT — try once more.
       try {
         db.prepare(
-          "INSERT INTO " + LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
+          "INSERT INTO " + Q_LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
         ).run(nowMs, holder);
         return holder;
       } catch (e2) {
@@ -335,10 +340,10 @@ function _acquireLock(db, lockStaleAfterMs, clock) {
     if (lockStaleAfterMs > 0 && ageMs > lockStaleAfterMs) {
       _runSql(db, "BEGIN IMMEDIATE");
       try {
-        db.prepare("DELETE FROM " + LOCK_TABLE + " WHERE scope = 'lock' AND lockedAt = ?")
+        db.prepare("DELETE FROM " + Q_LOCK_TABLE + " WHERE scope = 'lock' AND lockedAt = ?")
           .run(existing.lockedAt);
         db.prepare(
-          "INSERT INTO " + LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
+          "INSERT INTO " + Q_LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
         ).run(nowMs, holder);
         _runSql(db, "COMMIT");
         return holder;
@@ -358,7 +363,7 @@ function _acquireLock(db, lockStaleAfterMs, clock) {
 function _releaseLock(db, holder) {
   try {
     db.prepare(
-      "DELETE FROM " + LOCK_TABLE + " WHERE scope = 'lock' AND lockedBy = ?"
+      "DELETE FROM " + Q_LOCK_TABLE + " WHERE scope = 'lock' AND lockedBy = ?"
     ).run(holder);
   } catch (_e) { /* best-effort */ }
 }
@@ -409,7 +414,7 @@ function create(opts) {
 
   function _appliedRows(db, env) {
     return db.prepare(
-      "SELECT name, description, appliedAt, rerunnable FROM " + SEEDERS_TABLE +
+      "SELECT name, description, appliedAt, rerunnable FROM " + Q_SEEDERS_TABLE +
       " WHERE env = ? ORDER BY appliedAt ASC, name ASC"
     ).all(env);
   }
@@ -472,7 +477,7 @@ function create(opts) {
     var holder = _acquireLock(db, lockStaleAfterMs, clock);
     try {
       var appliedSet = new Set(
-        db.prepare("SELECT name FROM " + SEEDERS_TABLE + " WHERE env = ?").all(env)
+        db.prepare("SELECT name FROM " + Q_SEEDERS_TABLE + " WHERE env = ?").all(env)
           .map(function (r) { return r.name; })
       );
 
@@ -507,21 +512,21 @@ function create(opts) {
               await mod.run(db, ctx);
               if (alreadyApplied && mod.rerunnable) {
                 db.prepare(
-                  "UPDATE " + SEEDERS_TABLE +
+                  "UPDATE " + Q_SEEDERS_TABLE +
                   " SET appliedAt = ?, description = ?, rerunnable = ?" +
                   " WHERE env = ? AND name = ?"
                 ).run(new Date(clock()).toISOString(), mod.description || "",
                       mod.rerunnable ? 1 : 0, env, name);
               } else if (alreadyApplied && force) {
                 db.prepare(
-                  "UPDATE " + SEEDERS_TABLE +
+                  "UPDATE " + Q_SEEDERS_TABLE +
                   " SET appliedAt = ?, description = ?" +
                   " WHERE env = ? AND name = ?"
                 ).run(new Date(clock()).toISOString(), mod.description || "",
                       env, name);
               } else {
                 db.prepare(
-                  "INSERT INTO " + SEEDERS_TABLE +
+                  "INSERT INTO " + Q_SEEDERS_TABLE +
                   " (env, name, description, appliedAt, rerunnable) VALUES (?, ?, ?, ?, ?)"
                 ).run(env, name, mod.description || "",
                       new Date(clock()).toISOString(), mod.rerunnable ? 1 : 0);

package/lib/session.js

@@ -47,6 +47,22 @@ var { SessionError } = require("./framework-error");
 var _err = SessionError.factory;
 
 var DEFAULT_TTL_MS = C.TIME.days(7);
+// Sanity bound: any session that lives longer than this is almost
+// certainly a misconfigured Infinity / oversized literal. Keeps
+// expiresAt away from epoch overflow + database-int boundary issues.
+var MAX_TTL_MS     = C.TIME.days(3650);   // ~10 years
+
+function _validateTtl(ttl, where) {
+  if (typeof ttl !== "number" || !isFinite(ttl) || ttl <= 0) {
+    throw _err("INVALID_ARG",
+      where + ": ttlMs must be a positive finite number, got " + JSON.stringify(ttl), true);
+  }
+  if (ttl > MAX_TTL_MS) {
+    throw _err("INVALID_ARG",
+      where + ": ttlMs " + ttl + " exceeds maximum " + MAX_TTL_MS + " (~10 years). " +
+      "Sessions this long suggest a misconfigured value.", true);
+  }
+}
 var SID_NAMESPACE  = "bj-session:";
 
 // Column order used for INSERT — kept as a constant so the placeholders
@@ -76,8 +92,8 @@ async function create(opts) {
   if (!opts || !opts.userId) {
     throw _err("INVALID_ARG", "session.create requires { userId }", true);
   }
-  var ttl = typeof opts.ttlMs === "number" ? opts.ttlMs : DEFAULT_TTL_MS;
-  if (ttl <= 0) throw _err("INVALID_ARG", "session.create: ttlMs must be > 0", true);
+  var ttl = opts.ttlMs !== undefined ? opts.ttlMs : DEFAULT_TTL_MS;
+  _validateTtl(ttl, "session.create");
 
   var sid       = generateToken(32);             // 64 hex chars; only place the plaintext sid lives
   var sidHash   = _hashSid(sid);
@@ -243,8 +259,11 @@ async function rotate(oldToken, opts) {
   var newSidHash   = _hashSid(newSid);
   var oldSidHash   = _hashSid(oldToken);
   var nowMs        = Date.now();
-  var newExpires   = (typeof opts.ttlMs === "number" && opts.ttlMs > 0)
-                       ? nowMs + opts.ttlMs : null;
+  var newExpires = null;
+  if (opts.ttlMs !== undefined) {
+    _validateTtl(opts.ttlMs, "session.rotate");
+    newExpires = nowMs + opts.ttlMs;
+  }
 
   var setParts = ['"sidHash" = ?', '"lastActivity" = ?'];
   var setParams = [newSidHash, nowMs];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",