@blamejs/blamejs-shop 0.4.30 → 0.4.32

package/lib/vendor/blamejs/lib/vault/rotate.js

@@ -52,12 +52,13 @@ var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var { DatabaseSync } = require("node:sqlite");
 var atomicFile = require("../atomic-file");
-var safeSql = require("../safe-sql");
+var sql = require("../sql");
 var C = require("../constants");
 var cryptoField = require("../crypto-field");
 var bCrypto = require("../crypto");
 var vaultAad = require("../vault-aad");
 var dbSchema = require("../db-schema");
+var frameworkFiles = require("../framework-files");
 var lazyRequire = require("../lazy-require");
 var { boot } = require("../log");
 var numericBounds = require("../numeric-bounds");
@@ -81,6 +82,11 @@ var agentSnapshotLazy = lazyRequire(function () { return require("../agent-snaps
 // rotation pipeline never walks, so archive-wrap exports the same external
 // AAD_ROTATION descriptor and must be gated here too.
 var archiveWrapLazy = lazyRequire(function () { return require("../archive-wrap"); });
+// The DSR ticket store, when backed by an operator-supplied database, holds
+// {aad:true} sealed cells (subject identifiers + request payload) keyed off the
+// vault root that this pipeline never walks, so dsr exports the same external
+// AAD_ROTATION descriptor and must be gated here too.
+var dsrLazy = lazyRequire(function () { return require("../dsr"); });
 var { defineClass } = require("../framework-error");
 
 var rotateLog = boot("vault-rotate");
@@ -92,18 +98,30 @@ var DEFAULT_DRIFT_SAMPLE_LIMIT = 100;
 var DEFAULT_VERIFY_SAMPLE_MIN  = 5;
 var DEFAULT_VERIFY_SAMPLE_FRAC = 0.01;
 
+// The catalog/PRAGMA statements all compose through b.sql's narrow audited
+// catalog sub-API (b.sql.catalog / b.sql.pragma) - the only path that emits
+// an sqlite_master reference or a PRAGMA verb, allowlisting exactly the
+// statements the key-rotation walk needs and refusing every other internal
+// identifier / PRAGMA verb. Each returns { sql, params }; the node:sqlite
+// handle takes the params positionally.
+function _all(db, built) {
+  var stmt = db.prepare(built.sql);
+  return built.params.length > 0 ? stmt.all.apply(stmt, built.params) : stmt.all();
+}
+function _get(db, built) {
+  var stmt = db.prepare(built.sql);
+  return built.params.length > 0 ? stmt.get.apply(stmt, built.params) : stmt.get();
+}
+
 function _listLiveTables(db) {
-  return db.prepare(
-    "SELECT name FROM sqlite_master " +
-    "WHERE type='table' AND name NOT LIKE 'sqlite_%'"
-  ).all().map(function (r) { return r.name; });
+  return _all(db, sql.catalog.listTables()).map(function (r) { return r.name; });
 }
 
 function _listLiveColumns(db, table) {
   // PRAGMA table_info — table name comes from sqlite_master so it's
-  // already validated as an existing identifier.
-  return db.prepare("PRAGMA table_info(\"" + table.replace(/"/g, '""') + "\")").all()
-    .map(function (c) { return c.name; });
+  // already validated as an existing identifier; b.sql.catalog.tableInfo
+  // quotes it by construction.
+  return _all(db, sql.catalog.tableInfo(table)).map(function (c) { return c.name; });
 }
 
 function _knownColumnsFor(schema, infraColumns) {
@@ -196,12 +214,13 @@ function validateSchemaMatch(db, opts) {
     }
     if (unknown.length === 0) continue;
 
-    var quotedCols = unknown.map(function (n) { return '"' + n.replace(/"/g, '""') + '"'; }).join(", ");
-    var sampleSql = "SELECT " + quotedCols +
-      " FROM \"" + table.replace(/"/g, '""') + "\" LIMIT " + sampleLimit;
+    var sampleBuilt = sql.select(table, { dialect: "sqlite", quoteName: true })
+      .columns(unknown)
+      .limit(sampleLimit)
+      .toSql();
     var sampled;
     try {
-      sampled = db.prepare(sampleSql).all();
+      sampled = _all(db, sampleBuilt);
     } catch (e) {
       warnings.push({
         kind:    "sample_failed",
@@ -307,7 +326,8 @@ function verify(opts) {
     var schema = cryptoField.getSchema(table);
     if (!schema || !Array.isArray(schema.sealedFields) || schema.sealedFields.length === 0) continue;
 
-    var totalRow = db.prepare('SELECT COUNT(*) AS n FROM "' + table.replace(/"/g, '""') + '"').get();
+    var totalRow = _get(db, sql.select(table, { dialect: "sqlite", quoteName: true })
+      .count("*", "n").toSql());
     var total = totalRow ? totalRow.n : 0;
     if (total === 0) continue;
 
@@ -315,10 +335,10 @@ function verify(opts) {
     if (sampleN > total) sampleN = total;
 
     // RANDOM() is fine for a sampler — we're picking representative rows,
-    // not building cryptographic randomness.
-    var sampled = db.prepare(
-      'SELECT * FROM "' + table.replace(/"/g, '""') + '" ORDER BY RANDOM() LIMIT ?'
-    ).all(sampleN);
+    // not building cryptographic randomness. b.sql.catalog.sampleRandom is
+    // the audited ORDER BY RANDOM() form (the general builder has no random-
+    // order clause); columns omitted -> `*`.
+    var sampled = _all(db, sql.catalog.sampleRandom(table, null, { limit: sampleN }));
 
     var foundOldFail = !oldKeys; // when no oldKeys supplied, this check is N/A
     var verifiedRows = 0;
@@ -439,7 +459,7 @@ var VAULT_PREFIX_LEN = C.VAULT_PREFIX.length;
 // so loading rotate.js doesn't eagerly pull the agent modules.
 var EXTERNAL_AAD_MODULE_LOADERS = [
   agentIdempotencyLazy, agentOrchestratorLazy, agentTenantLazy, agentSnapshotLazy,
-  archiveWrapLazy,
+  archiveWrapLazy, dsrLazy,
 ];
 
 function _externalAadTables() {
@@ -464,22 +484,25 @@ function _emit(cb, ev) {
   }
 }
 
-// Open a file for fsync. Different from atomicFile.fsync (which takes
-// an already-open fd) — vault-rotate's fsync-by-path semantic opens
-// then syncs then closes, which is the right shape when we don't have
-// the original write fd around.
-//
-// CodeQL js/insecure-temporary-file: `p` is an operator-supplied path
-// inside opts.stagingDir (an owner-only 0o700 framework directory
-// established via atomicFile.ensureDir at the top of rotate()). Not an
-// os.tmpdir-reachable path. The fd is used solely for fsync and is
-// closed immediately; no bytes are read or written through it, so the
-// tmp-file predictability heuristic does not apply.
-function _fsyncFileByPath(p) {
+// Create a fresh file in the owner-only staging dir with exclusive,
+// no-follow semantics, then fsync it. O_EXCL turns a pre-planted file or
+// symlink into a hard failure instead of a followed write; O_NOFOLLOW
+// refuses a symlinked final component; the explicit 0o600 keeps the bytes
+// owner-only regardless of umask. Any leftover from an aborted prior
+// rotation is cleared first so the exclusive create can proceed. The
+// staging dir is already 0o700 owner-only, so this is defense in depth
+// against a same-user pre-plant / symlink swap (CWE-377 / CWE-379 / CWE-59).
+function _writeStagedFileExclusive(p, data) {
+  try { nodeFs.unlinkSync(p); } catch (_e) { /* no stale entry to clear */ }
+  var fd = nodeFs.openSync(p,
+    nodeFs.constants.O_WRONLY | nodeFs.constants.O_CREAT |
+      nodeFs.constants.O_EXCL | (nodeFs.constants.O_NOFOLLOW || 0), 0o600);
   try {
-    var fd = nodeFs.openSync(p, "r+");
-    try { nodeFs.fsyncSync(fd); } finally { nodeFs.closeSync(fd); }
-  } catch (_e) { /* best-effort across platforms */ }
+    nodeFs.writeFileSync(fd, data);
+    nodeFs.fsyncSync(fd);
+  } finally {
+    nodeFs.closeSync(fd);
+  }
 }
 
 function _reSealValue(sealedValue, oldKeys, newKeys) {
@@ -521,15 +544,19 @@ function _walkAndReSeal(node, oldKeys, newKeys) {
   return { value: node, changed: false };
 }
 
-function _runStmt(db, sql) { db.prepare(sql).run(); }
+// Transaction-control statements only (BEGIN / COMMIT / ROLLBACK) - fixed
+// keywords, no identifier / value, so they stay verbatim rather than route
+// through b.sql (the builder has no transaction-control verb). The param is
+// named `stmtText` so it does not shadow the module-level `sql` builder.
+function _runStmt(db, stmtText) { db.prepare(stmtText).run(); }
 
 function _rotateColumn(db, table, column, schema, roots, batchSize, progress) {
-  // Identifiers reach SQL through safeSql.quoteIdentifier — runs
-  // validateIdentifier (rejects bad shape / reserved words /
-  // sqlite_-prefix) + emits the dialect-correct quoted form.
-  var qt = safeSql.quoteIdentifier(table, "sqlite");
-  var qc = safeSql.quoteIdentifier(column, "sqlite");
-  var total = db.prepare("SELECT COUNT(*) AS n FROM " + qt + " WHERE " + qc + " IS NOT NULL").get().n;
+  // Every statement composes through b.sql (sqlite dialect, quoteName so
+  // the concrete handle's table is quoted, not left bare for a cluster
+  // rewrite that does not apply here). Identifiers are validated + quoted
+  // by construction; the cursor bound (_id) + LIMIT bind as ? placeholders.
+  var total = _get(db, sql.select(table, { dialect: "sqlite", quoteName: true })
+    .count("*", "n").whereNotNull(column).toSql()).n;
   if (total === 0) return 0;
 
   // AAD-bound tables (registerTable({aad:true})) seal each cell under a
@@ -540,36 +567,54 @@ function _rotateColumn(db, table, column, schema, roots, batchSize, progress) {
   var aadMode = !!(schema && schema.aad);
   var rowIdField = aadMode ? schema.rowIdField : null;
   var needRid = aadMode && rowIdField && rowIdField !== "_id";
-  var qrid = needRid ? safeSql.quoteIdentifier(rowIdField, "sqlite") : null;
 
-  var sel = db.prepare(
-    "SELECT _id, " + qc + " AS v" + (qrid ? ", " + qrid + " AS rid" : "") + " FROM " + qt +
-    " WHERE " + qc + " IS NOT NULL AND _id > ? ORDER BY _id LIMIT ?"
-  );
-  var upd = db.prepare("UPDATE " + qt + " SET " + qc + " = ? WHERE _id = ?");
+  // Keyset-cursor page over (_id) ascending. The projected columns are read
+  // by their REAL names off the result row (no AS alias) - the column value
+  // is row[column], the row-id value is row[rowIdField]. The SQL text is
+  // constant across the loop (only the bound _id-cursor changes; LIMIT is a
+  // builder-inlined integer literal, validated non-negative), so prepare
+  // once + re-run with the fresh cursor param positionally. The SELECT
+  // carries exactly one `?` (the _id cursor); the UPDATE carries two (the
+  // resealed value + the _id).
+  var selCols = ["_id", column];
+  if (needRid) selCols.push(rowIdField);
+  var selBuilt = sql.select(table, { dialect: "sqlite", quoteName: true })
+    .columns(selCols)
+    .whereNotNull(column)
+    .whereOp("_id", ">", "")
+    .orderBy("_id")
+    .limit(batchSize)
+    .toSql();
+  var sel = db.prepare(selBuilt.sql);
+  var updBuilt = sql.update(table, { dialect: "sqlite", quoteName: true })
+    .set(column, "")
+    .where("_id", "")
+    .toSql();
+  var upd = db.prepare(updBuilt.sql);
 
   var processed = 0;
   var lastId = "";
   while (true) {
-    var rows = sel.all(lastId, batchSize);
+    var rows = sel.all(lastId);
     if (rows.length === 0) break;
 
     dbSchema.runInTransaction(db, function () {
       for (var i = 0; i < rows.length; i++) {
         var row = rows[i];
-        if (typeof row.v !== "string") continue;
-        if (aadMode && vaultAad.isAadSealed(row.v)) {
+        var cellVal = row[column];
+        if (typeof cellVal !== "string") continue;
+        if (aadMode && vaultAad.isAadSealed(cellVal)) {
           // Rebuild the exact AAD the seal side used. cryptoField._aadParts
           // reads row[schema.rowIdField]; feed it the rowIdField value we
-          // selected (rid, or _id when rowIdField IS _id).
+          // selected (row[rowIdField], or _id when rowIdField IS _id).
           var rowForAad = {};
-          rowForAad[rowIdField] = needRid ? row.rid : row._id;
+          rowForAad[rowIdField] = needRid ? row[rowIdField] : row._id;
           var aad = cryptoField._aadParts(schema, table, column, rowForAad);
-          upd.run(vaultAad.resealRoot(row.v, aad, roots.oldRootJson, roots.newRootJson), row._id);
-        } else if (row.v.indexOf(C.VAULT_PREFIX) === 0) {
+          upd.run(vaultAad.resealRoot(cellVal, aad, roots.oldRootJson, roots.newRootJson), row._id);
+        } else if (cellVal.indexOf(C.VAULT_PREFIX) === 0) {
           // Plain vault: cell (non-AAD table, or a legacy pre-AAD cell in
           // an AAD table that the next sealRow upgrades).
-          upd.run(_reSealValue(row.v, roots.oldKeys, roots.newKeys), row._id);
+          upd.run(_reSealValue(cellVal, roots.oldKeys, roots.newKeys), row._id);
         }
       }
     });
@@ -581,23 +626,33 @@ function _rotateColumn(db, table, column, schema, roots, batchSize, progress) {
 }
 
 function _rotateOverflow(db, table, oldKeys, newKeys, batchSize, progress, warnings) {
-  var qt = '"' + table.replace(/"/g, '""') + '"';
-  var cols = db.prepare("PRAGMA table_info(" + qt + ")").all();
+  var cols = _all(db, sql.catalog.tableInfo(table));
   if (!cols.some(function (c) { return c.name === "data"; })) return 0;
 
-  var total = db.prepare("SELECT COUNT(*) AS n FROM " + qt + " WHERE data IS NOT NULL").get().n;
+  var total = _get(db, sql.select(table, { dialect: "sqlite", quoteName: true })
+    .count("*", "n").whereNotNull("data").toSql()).n;
   if (total === 0) return 0;
 
-  var sel = db.prepare(
-    "SELECT _id, data FROM " + qt +
-    " WHERE data IS NOT NULL AND _id > ? ORDER BY _id LIMIT ?"
-  );
-  var upd = db.prepare("UPDATE " + qt + " SET data = ? WHERE _id = ?");
+  // Same keyset cursor as _rotateColumn over the overflow `data` JSON
+  // column: one bound `?` (the _id cursor), builder-inlined LIMIT literal.
+  var selBuilt = sql.select(table, { dialect: "sqlite", quoteName: true })
+    .columns(["_id", "data"])
+    .whereNotNull("data")
+    .whereOp("_id", ">", "")
+    .orderBy("_id")
+    .limit(batchSize)
+    .toSql();
+  var sel = db.prepare(selBuilt.sql);
+  var updBuilt = sql.update(table, { dialect: "sqlite", quoteName: true })
+    .set("data", "")
+    .where("_id", "")
+    .toSql();
+  var upd = db.prepare(updBuilt.sql);
 
   var processed = 0;
   var lastId = "";
   while (true) {
-    var rows = sel.all(lastId, batchSize);
+    var rows = sel.all(lastId);
     if (rows.length === 0) break;
 
     _runStmt(db, "BEGIN");
@@ -670,7 +725,8 @@ async function rotate(opts) {
         "pipeline and would be orphaned under the retired keypair: " + externalAad.join(", ") +
         ". Re-seal each via its module hook (b.agent.idempotency.reseal / " +
         "b.agent.orchestrator.reseal / b.agent.tenant AAD_ROTATION reseal / " +
-        "b.agent.snapshot.reseal / b.archive.rewrapTenant for archive-wrap:tenant-blobs) " +
+        "b.agent.snapshot.reseal / b.archive.rewrapTenant for archive-wrap:tenant-blobs / " +
+        "b.dsr.reseal for the dsr_tickets store) " +
         "BEFORE retiring the old keypair, then pass " +
         "opts.externalAadResealed: [" + externalAad.map(function (t) { return JSON.stringify(t); }).join(", ") +
         "] to acknowledge. If you do not use these features, pass opts.externalAadResealed: true.");
@@ -680,10 +736,10 @@ async function rotate(opts) {
   var progress = opts.progressCallback;
   var warnings = [];
   var paths = Object.assign({
-    encryptedDb:      "db.enc",
-    dbKeySealed:      "db.key.enc",
-    vaultKeyPlain:    "vault.key",
-    vaultKeySealed:   "vault.key.sealed",
+    encryptedDb:      frameworkFiles.fileName("dbEnc"),
+    dbKeySealed:      frameworkFiles.fileName("dbKeyEnc"),
+    vaultKeyPlain:    frameworkFiles.fileName("vaultKey"),
+    vaultKeySealed:   frameworkFiles.fileName("vaultKey") + ".sealed",
     additionalSealed: [],
     verbatimFiles:    [],
     verbatimDirs:     [],
@@ -709,7 +765,10 @@ async function rotate(opts) {
     }
     var dest = nodePath.join(stagingDir, entry.relativePath);
     atomicFile.ensureDir(nodePath.dirname(dest));
-    nodeFs.copyFileSync(src, dest);
+    // Stage via the exclusive-create + fsync helper rather than a plain copy,
+    // so the verbatim file is durable at write time (no later by-path fsync)
+    // and a pre-planted file/symlink at the staging path hard-fails.
+    _writeStagedFileExclusive(dest, nodeFs.readFileSync(src));
   }
   for (var vd = 0; vd < paths.verbatimDirs.length; vd++) {
     var dent = paths.verbatimDirs[vd];
@@ -737,9 +796,9 @@ async function rotate(opts) {
   var newRootJson = keysJson;
   if (mode === "wrapped") {
     var sealed = await vaultWrap().wrap(keysJson, opts.newPassphrase);
-    nodeFs.writeFileSync(nodePath.join(stagingDir, paths.vaultKeySealed), sealed, { mode: 0o600 });
+    _writeStagedFileExclusive(nodePath.join(stagingDir, paths.vaultKeySealed), sealed);
   } else {
-    nodeFs.writeFileSync(nodePath.join(stagingDir, paths.vaultKeyPlain), keysJson, { mode: 0o600 });
+    _writeStagedFileExclusive(nodePath.join(stagingDir, paths.vaultKeyPlain), keysJson);
   }
 
   // 3. re-seal db.key.enc + any operator-supplied additionalSealed files
@@ -759,14 +818,14 @@ async function rotate(opts) {
       var dbKeyB64Aad = vaultAad.unsealRoot(sealedKey, dbKeyAad, oldRootJson);
       dbKey = Buffer.from(dbKeyB64Aad, "base64");
       var resealedAad = vaultAad.sealRoot(dbKeyB64Aad, dbKeyAad, newRootJson);
-      nodeFs.writeFileSync(nodePath.join(stagingDir, paths.dbKeySealed), resealedAad, { mode: 0o600 });
+      _writeStagedFileExclusive(nodePath.join(stagingDir, paths.dbKeySealed), resealedAad);
     } else if (sealedKey.indexOf(C.VAULT_PREFIX) === 0) {
       // Legacy plain-sealed db.key.enc (pre-AAD). Re-key in place; db.init
       // read-migrates plain -> AAD on the next boot.
       var dbKeyB64 = bCrypto.decrypt(sealedKey.substring(VAULT_PREFIX_LEN), oldKeys);
       dbKey = Buffer.from(dbKeyB64, "base64");
       var resealedKey = C.VAULT_PREFIX + bCrypto.encrypt(dbKeyB64, newKeys);
-      nodeFs.writeFileSync(nodePath.join(stagingDir, paths.dbKeySealed), resealedKey, { mode: 0o600 });
+      _writeStagedFileExclusive(nodePath.join(stagingDir, paths.dbKeySealed), resealedKey);
     } else {
       throw new VaultRotateError("vault-rotate/bad-dbkey",
         "rotate: db.key.enc does not start with a vault prefix (vault: or vault.aad:)");
@@ -789,8 +848,8 @@ async function rotate(opts) {
     }
     var asDestDir = nodePath.join(stagingDir, nodePath.dirname(ase.relativePath));
     if (!nodeFs.existsSync(asDestDir)) atomicFile.ensureDir(asDestDir);
-    nodeFs.writeFileSync(nodePath.join(stagingDir, ase.relativePath),
-      _reSealValue(current, oldKeys, newKeys), { mode: 0o600 });
+    _writeStagedFileExclusive(nodePath.join(stagingDir, ase.relativePath),
+      _reSealValue(current, oldKeys, newKeys));
   }
 
   // 3b. Framework-managed crypto-field derived-hash files — always
@@ -801,14 +860,17 @@ async function rotate(opts) {
   // re-seals to the same value since the keypair is unchanged).
   var saltSrc = nodePath.join(dataDir, "vault.derived-hash-salt");
   if (nodeFs.existsSync(saltSrc)) {
-    nodeFs.copyFileSync(saltSrc, nodePath.join(stagingDir, "vault.derived-hash-salt"));
+    // Stage via the exclusive-create + fsync helper (not a plain copy) so the
+    // salt is durable at write time and no later by-path fsync is needed.
+    _writeStagedFileExclusive(nodePath.join(stagingDir, "vault.derived-hash-salt"),
+      nodeFs.readFileSync(saltSrc));
   }
   var macSrc = nodePath.join(dataDir, "vault.derived-hash-mac.sealed");
   if (nodeFs.existsSync(macSrc)) {
     var macCurrent = nodeFs.readFileSync(macSrc, "utf8").trim();
     if (macCurrent.indexOf(C.VAULT_PREFIX) === 0) {
-      nodeFs.writeFileSync(nodePath.join(stagingDir, "vault.derived-hash-mac.sealed"),
-        _reSealValue(macCurrent, oldKeys, newKeys), { mode: 0o600 });
+      _writeStagedFileExclusive(nodePath.join(stagingDir, "vault.derived-hash-mac.sealed"),
+        _reSealValue(macCurrent, oldKeys, newKeys));
     }
   }
 
@@ -830,22 +892,19 @@ async function rotate(opts) {
     try { plainBytes = bCrypto.decryptPacked(packed, dbKey, dbEncAad); }
     catch (_eAad) { plainBytes = bCrypto.decryptPacked(packed, dbKey); }
     var tmpDbPath = nodePath.join(stagingDir, "_blamejs_rotate.tmp.db");
-    nodeFs.writeFileSync(tmpDbPath, plainBytes, { mode: 0o600 });
+    _writeStagedFileExclusive(tmpDbPath, plainBytes);
 
     var db = new DatabaseSync(tmpDbPath);
     try {
-      _runStmt(db, "PRAGMA journal_mode=WAL");
-      _runStmt(db, "PRAGMA synchronous=NORMAL");
+      db.prepare(sql.pragma("journal_mode", "WAL").sql).run();
+      db.prepare(sql.pragma("synchronous", "NORMAL").sql).run();
 
       // Walk tables. For each, re-seal every column declared sealed
       // by the field-crypto registry, plus the overflow `data` JSON
       // column if present.
       var tablesToRotate = Array.isArray(opts.tables) && opts.tables.length > 0
         ? opts.tables.slice()
-        : db.prepare(
-            "SELECT name FROM sqlite_master " +
-            "WHERE type='table' AND name NOT LIKE 'sqlite_%'"
-          ).all().map(function (r) { return r.name; });
+        : _listLiveTables(db);
 
       // Serialized roots threaded to the AAD reseal path; oldRootJson /
       // newRootJson match b.vault.getKeysJson() so rotated AAD cells unseal
@@ -854,15 +913,11 @@ async function rotate(opts) {
 
       for (var ti = 0; ti < tablesToRotate.length; ti++) {
         var table = tablesToRotate[ti];
-        var tableExists = db.prepare(
-          "SELECT name FROM sqlite_master WHERE type='table' AND name = ?"
-        ).get(table);
+        var tableExists = _get(db, sql.catalog.tableExists(table));
         if (!tableExists) continue;
 
         var schema = cryptoField.getSchema(table);
-        var liveCols = db.prepare(
-          'PRAGMA table_info("' + table.replace(/"/g, '""') + '")'
-        ).all().map(function (c) { return c.name; });
+        var liveCols = _listLiveColumns(db, table);
         var liveColSet = Object.create(null);
         for (var lc = 0; lc < liveCols.length; lc++) liveColSet[liveCols[lc]] = true;
 
@@ -879,7 +934,7 @@ async function rotate(opts) {
         if (tableRows > 0) { tablesProcessed++; totalRowsProcessed += tableRows; }
       }
 
-      _runStmt(db, "PRAGMA wal_checkpoint(TRUNCATE)");
+      db.prepare(sql.pragma("wal_checkpoint", "TRUNCATE").sql).run();
     } finally {
       db.close();
     }
@@ -893,25 +948,23 @@ async function rotate(opts) {
     try { nodeFs.unlinkSync(tmpDbPath + "-shm"); }
     catch (e) { rotateLog.debug("cleanup-failed", { op: "fs.unlinkSync", path: tmpDbPath + "-shm", error: e.message }); }
 
-    // CodeQL js/insecure-temporary-file: every "tmp" path here is inside
-    // opts.stagingDir — operator-supplied, ensureDir'd 0o700 owner-only,
-    // never under os.tmpdir(). The filenames are framework-internal
-    // markers (`_blamejs_rotate.tmp.db`, `_blamejs_verify.tmp.db`); their
-    // predictability does not enable a symlink attack because the staging
-    // dir's owner-only perms prevent any other user from creating entries
-    // inside it. Files are written 0o600 implicitly via the dir's umask
-    // and removed before the rotation completes.
+    // Every staged path lives inside opts.stagingDir (operator-supplied,
+    // ensureDir'd 0o700 owner-only, never under os.tmpdir()) and carries a
+    // framework-internal marker name. The staged writes go through
+    // _writeStagedFileExclusive — exclusive + no-follow create, owner-only
+    // 0o600 — so a same-user pre-plant or symlink swap is a hard failure
+    // rather than a followed write, and the bytes never inherit a wider mode.
     var rotatedBytes = nodeFs.readFileSync(tmpDbPath);
     // Re-encrypt under the SAME dataDir AAD so db.init's AAD-first open
     // succeeds after the staged dir is swapped over dataDir in place.
-    nodeFs.writeFileSync(nodePath.join(stagingDir, paths.encryptedDb),
+    _writeStagedFileExclusive(nodePath.join(stagingDir, paths.encryptedDb),
       bCrypto.encryptPacked(rotatedBytes, dbKey, dbEncAad));
     nodeFs.unlinkSync(tmpDbPath);
 
     // Round-trip verify on the staged DB
     _emit(progress, { phase: "verify" });
     var verifyTmp = nodePath.join(stagingDir, "_blamejs_verify.tmp.db");
-    nodeFs.writeFileSync(verifyTmp,
+    _writeStagedFileExclusive(verifyTmp,
       bCrypto.decryptPacked(nodeFs.readFileSync(nodePath.join(stagingDir, paths.encryptedDb)), dbKey, dbEncAad));
     var vdb = new DatabaseSync(verifyTmp);
     try {
@@ -934,19 +987,26 @@ async function rotate(opts) {
     }
   }
 
-  // 5. fsync staging for durability before caller does the swap
+  // 5. fsync staging directory entries for durability before the caller swaps.
+  // Every staged FILE is already fsync'd at write time by
+  // _writeStagedFileExclusive (the re-encrypted db, the resealed vault/db keys,
+  // sealed files, the derived-hash salt, and verbatim files), so re-opening
+  // each by path here is redundant — and opening a staged file by path is the
+  // os-temp-dir open the static analyzer refuses (CWE-377 heuristic). Only the
+  // optional verbatimDirs are copied with copyFileSync (no per-file fsync);
+  // their directory entries + the rename are made durable by fsyncDir and their
+  // source files in dataDir remain intact, so a crash in that narrow window is
+  // recoverable.
   _emit(progress, { phase: "fsync" });
-  function fsyncTree(dir) {
+  function fsyncDirTree(dir) {
     var entries = nodeFs.readdirSync(dir);
     for (var i = 0; i < entries.length; i++) {
       var p = nodePath.join(dir, entries[i]);
-      var st = nodeFs.statSync(p);
-      if (st.isFile()) _fsyncFileByPath(p);
-      else if (st.isDirectory()) fsyncTree(p);
+      if (nodeFs.statSync(p).isDirectory()) fsyncDirTree(p);
     }
     atomicFile.fsyncDir(dir);
   }
-  fsyncTree(stagingDir);
+  fsyncDirTree(stagingDir);
 
   var durationMs = Date.now() - startedAt;
   _emit(progress, {

package/lib/vendor/blamejs/lib/vault-aad.js

@@ -304,6 +304,12 @@ module.exports = {
   isAadSealed:        isAadSealed,
   buildColumnAad:     buildColumnAad,
   buildContextAad:    buildContextAad,
+  // canonicalizeAad — the length-prefixed, sorted-keys AAD-bytes
+  // encoder. Exported (internal) so a sibling primitive that runs its
+  // own AEAD (crypto-field's per-row K_row cells) threads byte-identical
+  // AAD into encryptPacked/decryptPacked as this module does for its
+  // own seal/unseal — one canonical encoder, no drift.
+  canonicalizeAad:    _canonicalize,
   AAD_PREFIX:         AAD_PREFIX,
   AAD_VERSION:        AAD_VERSION,
   VaultAadError:      VaultAadError,

package/lib/vendor/blamejs/lib/vendor-data.js

@@ -130,6 +130,7 @@ function _timingSafeHexEqual(a, b) {
 var KNOWN_VENDOR_DATA = Object.freeze({
   "public-suffix-list": {
     module: "./vendor/public-suffix-list.data",
+    // allow:hand-rolled-sql — `_blamejs_canary_*` is an in-payload tamper-canary token, not a SQL table name (no DB sink in this file)
     canary: "_blamejs_canary_v0_9_8_.local",
     // Canary parse check — operator-side `b.publicSuffix.isPublicSuffix(canary)`
     // MUST return true after the PSL parser ingests the data. The check
@@ -138,6 +139,7 @@ var KNOWN_VENDOR_DATA = Object.freeze({
   },
   "common-passwords-top-10000": {
     module: "./vendor/common-passwords-top-10000.data",
+    // allow:hand-rolled-sql — `_blamejs_canary_*` is an in-payload tamper-canary token, not a SQL table name (no DB sink in this file)
     canary: "_blamejs_canary_password_2026_05_13_blamejs_internal_",
     description: "Top-10000 most common passwords (SecLists). Used by b.auth.password to refuse known-breached credentials.",
   },

package/lib/vendor/blamejs/lib/websocket.js

@@ -530,22 +530,32 @@ function _parseExtensionHeader(header) {
   for (var i = 0; i < entries.length; i++) {
     var parts = structuredFields.splitTopLevel(entries[i], ";").map(function (s) { return s.trim(); });
     if (!parts[0]) continue;
-    // `params` has no prototype chain — `Object.create(null)` defends
-    // against `__proto__` / `constructor` / `prototype` parameter names
-    // in the Sec-WebSocket-Extensions header polluting downstream lookups.
-    var ext = { name: parts[0].toLowerCase(), params: Object.create(null) };
+    // Collect [name, value] pairs, then materialize the params map via
+    // Object.fromEntries onto a null-prototype object. The extension-
+    // parameter name is taken from the client-supplied Sec-WebSocket-
+    // Extensions header, so it is never used as a computed-write key
+    // (`params[name] = value`) — that is the CWE-915 unsafe-reflection /
+    // CWE-1321 prototype-pollution sink. POISONED params (`__proto__` /
+    // `constructor` / `prototype`) are dropped, and the null-prototype
+    // accumulator means even a slipped name cannot reach Object.prototype.
+    var paramPairs = [];
     for (var j = 1; j < parts.length; j++) {
       var kv = parts[j].split("=");
       var k = kv[0].trim().toLowerCase();
       if (!k) continue;
+      if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
       var v = kv.length > 1 ? kv.slice(1).join("=").trim() : true;
       // Strip surrounding quotes per the token-or-quoted-string grammar.
       if (typeof v === "string") {
         var _unq = structuredFields.unquoteSfString(v);
         if (_unq !== null) v = _unq;
       }
-      ext.params[k] = v;
+      paramPairs.push([k, v]);
     }
+    var ext = {
+      name:   parts[0].toLowerCase(),
+      params: Object.assign(Object.create(null), Object.fromEntries(paramPairs)),
+    };
     out.push(ext);
   }
   return out;
@@ -961,6 +971,22 @@ class WebSocketConnection extends EventEmitter {
         self._transitionToClosed(1006, "abnormal closure", false, null);
       }
     });
+    socket.on("end", function ()        {
+      // Peer half-closed (TCP FIN) without sending a Close frame. HTTP
+      // 'upgrade' sockets default to allowHalfOpen=true, so this arrives
+      // as 'end' (readable side ended) while the writable side stays
+      // open — the 'close' handler above never fires and the connection
+      // would otherwise wedge open (ping timer running, no 'close' event,
+      // peer's socket never destroyed). RFC 6455 §7.1.1 treats a TCP
+      // close without a prior Close frame as abnormal closure: surface
+      // the lifecycle event and end our writable side so the socket
+      // actually tears down. _transitionToClosed is idempotent, so the
+      // native 'close' that follows is a no-op.
+      if (self._state !== STATE_CLOSED) {
+        self._transitionToClosed(1006, "abnormal closure", false, null);
+      }
+      try { socket.end(); } catch (_e) { /* socket already closing */ }
+    });
   }
 
   // Single state-transition method. Idempotent — repeat calls after
@@ -1541,6 +1567,10 @@ module.exports = {
   // Server-side entrypoints
   handleUpgrade:           handleUpgrade,           // h1 — RFC 6455 HTTP upgrade
   handleExtendedConnect:   handleExtendedConnect,   // h2 — RFC 8441 Extended CONNECT
+  // Internal helper exposed for tests — the Sec-WebSocket-Extensions
+  // parser (RFC 7692 negotiation feeds off this). Underscore-prefixed so
+  // it is not part of the public primitive surface.
+  _parseExtensionHeader:   _parseExtensionHeader,
   // Constants
   GUID:                    GUID,
   REFUSED_AUTH_QUERY_PARAMS: REFUSED_AUTH_QUERY_PARAMS,

package/lib/vendor/blamejs/lib/worker-pool.js

@@ -287,6 +287,11 @@ function create(scriptPath, opts) {
       reason:   "workerpool/worker-error",
       message:  (err && err.message) || String(err),
     });
+    // Mark the slot dying BEFORE _finishTask. _finishTask sets slot.busy =
+    // false and drains the queue, so an unmarked slot would be handed a
+    // freshly-queued task that then dies with this same worker. _recycleWorker
+    // re-asserts the flag idempotently.
+    slot.recycling = true;
     if (failingTask) {
       _finishTask(slot, true,
         new WorkerPoolError("workerpool/worker-error",
@@ -331,6 +336,12 @@ function create(scriptPath, opts) {
       workerId: slot.id, taskId: taskId, taskTimeoutMs: taskTimeoutMs,
     });
     var failingTask = slot.currentTask;
+    // Mark the slot dying BEFORE _finishTask drains the queue, so the drain
+    // skips this about-to-be-terminated slot instead of dispatching a queued
+    // task onto it (which would die with the worker on terminate, surfacing as
+    // workerpool/worker-exit on a task that never ran). _recycleWorker
+    // re-asserts the flag idempotently.
+    slot.recycling = true;
     if (failingTask) {
       _finishTask(slot, true,
         new WorkerPoolError("workerpool/timeout",