@blamejs/blamejs-shop 0.4.31 → 0.4.32

package/lib/vendor/blamejs/lib/middleware/rate-limit.js

@@ -57,13 +57,63 @@
  * Audit: every limit hit emits system.ratelimit.block with the key + path.
  */
 var C = require("../constants");
+var frameworkSchema = require("../framework-schema");
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var safeAsync = require("../safe-async");
+var sql = require("../sql");
 var validateOpts = require("../validate-opts");
 var clusterStorage = require("../cluster-storage");
 var denyResponse = require("./deny-response").denyResponse;
 
+// Cluster-backend table — resolved through frameworkSchema.tableName so a
+// configured table prefix (b.frameworkSchema.setTablePrefix) is honored.
+// The name is identity-mapped in LOCAL_TO_EXTERNAL, so clusterStorage's
+// resolveTables leaves it untouched at dispatch and the resolved name is
+// what reaches the backend on both single-node + cluster sides.
+var RATE_LIMIT_TABLE = "_blamejs_rate_limit_counters";   // allow:hand-rolled-sql — canonical logical table-name declaration
+function _rateLimitSqlTable() { return frameworkSchema.tableName(RATE_LIMIT_TABLE); }
+
+// b.sql opts for every cluster-backend statement: thread the ACTIVE backend
+// dialect (clusterStorage.dialect() — "sqlite" single-node, "postgres" |
+// "mysql" in cluster mode) so the emitted identifier quoting and dialect
+// idioms (ON CONFLICT ... DO UPDATE vs ON DUPLICATE KEY UPDATE) match the
+// backend the SQL dispatches to. b.sql defaults to "sqlite", which works on
+// Postgres only by accident (both double-quote identifiers) and emits the
+// wrong quoting + ON CONFLICT (which MySQL rejects) on MySQL.
+// clusterStorage.execute still rewrites table names + translates `?`
+// placeholders at dispatch; this controls only the builder-side quoting +
+// idiom selection.
+function _rateLimitSqlOpts() { return { dialect: clusterStorage.dialect() }; }
+
+// Dialect-aware references for the conflict-action CASE expressions in
+// take(). The fixed-window counter's update is per-column conditional (a new
+// window resets count to 1; the same window increments), so it can't reduce
+// to doUpdateFromExcluded — it needs a CASE that reads BOTH the proposed row
+// and the existing row. Those two references are spelled differently per
+// dialect and b.sql passes a doUpdate({col: rawExpr}) expression through
+// verbatim (it is NOT EXCLUDED->VALUES translated on MySQL), so the caller
+// must emit the dialect-correct tokens itself:
+//   - proposed-row column: EXCLUDED."<col>" (Postgres/SQLite) vs
+//                          VALUES(`<col>`) (MySQL ON DUPLICATE KEY UPDATE)
+//   - existing-row column: "<table>"."<col>" (Postgres/SQLite) vs
+//                          `<table>`.`<col>` (MySQL)
+// Identifiers here are framework-controlled constants (the table name + the
+// three counter columns), never operator input, so the inline quoting is
+// closed over a fixed set of names.
+function _conflictRefs(dialect, table) {
+  if (dialect === "mysql") {
+    return {
+      proposed: function (col) { return "VALUES(`" + col + "`)"; },
+      existing: function (col) { return "`" + table + "`.`" + col + "`"; },
+    };
+  }
+  return {
+    proposed: function (col) { return "EXCLUDED.\"" + col + "\""; },
+    existing: function (col) { return "\"" + table + "\".\"" + col + "\""; },
+  };
+}
+
 var audit  = lazyRequire(function () { return require("../audit"); });
 var logger = lazyRequire(function () { return require("../log").boot("rate-limit"); });
 
@@ -260,10 +310,10 @@ function _clusterBackend(opts) {
     if (now - lastPruneAt < pruneIntervalMs) return;
     lastPruneAt = now;
     var cutoff = now - windowMs;
-    clusterStorage.execute(
-      "DELETE FROM _blamejs_rate_limit_counters WHERE windowStart < ?",
-      [cutoff]
-    ).catch(function (e) {
+    var built = sql.delete(_rateLimitSqlTable(), _rateLimitSqlOpts())
+      .where("windowStart", "<", cutoff)
+      .toSql();
+    clusterStorage.execute(built.sql, built.params).catch(function (e) {
       try {
         logger().warn("rate-limit prune failed: " + ((e && e.message) || String(e)));
       } catch (_e) { /* logger best-effort */ }
@@ -274,29 +324,49 @@ function _clusterBackend(opts) {
     var now = Date.now();
     var windowStart = Math.floor(now / windowMs) * windowMs;
 
-    // Atomic increment: a fresh window resets count to 1; an existing
-    // row in the same window gets count + 1. Postgres + SQLite both
-    // support ON CONFLICT...DO UPDATE...RETURNING.
-    var result = await clusterStorage.execute(
-      "INSERT INTO _blamejs_rate_limit_counters (key, windowStart, count) " +
-      "VALUES (?, ?, 1) " +
-      "ON CONFLICT (key) DO UPDATE SET " +
-      "  count = CASE " +
-      "    WHEN excluded.windowStart > _blamejs_rate_limit_counters.windowStart " +
-      "    THEN 1 " +
-      "    ELSE _blamejs_rate_limit_counters.count + 1 " +
-      "  END, " +
-      "  windowStart = CASE " +
-      "    WHEN excluded.windowStart > _blamejs_rate_limit_counters.windowStart " +
-      "    THEN excluded.windowStart " +
-      "    ELSE _blamejs_rate_limit_counters.windowStart " +
-      "  END " +
-      "RETURNING count, windowStart",
-      [key, windowStart]
-    );
-    var row = result.rows && result.rows[0];
-    var count = row ? row.count : 1;
-    var rowWindow = row ? row.windowStart : windowStart;
+    // Atomic increment: a fresh window resets count to 1; an existing row in
+    // the same window gets count + 1. The per-column conflict action is a
+    // CASE that reads the proposed row AND the existing row, so it goes
+    // through the STRUCTURED upsert().doUpdate({...}) form with the dialect
+    // threaded — b.sql then renders ON CONFLICT...DO UPDATE...RETURNING
+    // (Postgres/SQLite) or ON DUPLICATE KEY UPDATE + a readback SELECT
+    // (MySQL). The CASE bodies spell the proposed-row (EXCLUDED / VALUES())
+    // and existing-row (table self-reference) tokens per dialect via
+    // _conflictRefs so the same logic compiles on every backend. No `?` in
+    // the CASE bodies; the count seed of 1 binds as the third inserted value.
+    var t = _rateLimitSqlTable();
+    var dialect = clusterStorage.dialect();
+    var refs = _conflictRefs(dialect, t);
+    var newerWindow = refs.proposed("windowStart") + " > " + refs.existing("windowStart");
+    var countExpr = "CASE WHEN " + newerWindow + " THEN 1 ELSE " +
+      refs.existing("count") + " + 1 END";
+    var windowExpr = "CASE WHEN " + newerWindow + " THEN " + refs.proposed("windowStart") +
+      " ELSE " + refs.existing("windowStart") + " END";
+    var built = sql.upsert(t, _rateLimitSqlOpts())
+      .columns(["key", "windowStart", "count"])
+      .values({ key: key, windowStart: windowStart, count: 1 })
+      .onConflict(["key"])
+      .doUpdate({ count: countExpr, windowStart: windowExpr })
+      .returning(["count", "windowStart"])
+      .toSql();
+    var row;
+    if (built.readbackSql) {
+      // MySQL: ON DUPLICATE KEY UPDATE has no RETURNING. Run the upsert,
+      // then the readback SELECT b.sql emits (keyed on the conflict key) to
+      // learn the post-upsert count/windowStart. clusterStorage.execute
+      // coerces the framework int columns (count/windowStart) back to JS
+      // numbers on both reads.
+      await clusterStorage.execute(built.sql, built.params);
+      var readback = await clusterStorage.execute(built.readbackSql.sql, built.readbackSql.params);
+      row = readback.rows && readback.rows[0];
+    } else {
+      var result = await clusterStorage.execute(built.sql, built.params);
+      row = result.rows && result.rows[0];
+    }
+    // count/windowStart are framework int columns coerced to JS numbers by
+    // clusterStorage; the absent-row fall-back keeps the verdict math finite.
+    var count = row ? Number(row.count) : 1;
+    var rowWindow = row ? Number(row.windowStart) : windowStart;
 
     _maybePrune();
 
@@ -318,10 +388,10 @@ function _clusterBackend(opts) {
   }
 
   async function reset(key) {
-    await clusterStorage.execute(
-      "DELETE FROM _blamejs_rate_limit_counters WHERE key = ?",
-      [key]
-    );
+    var built = sql.delete(_rateLimitSqlTable(), _rateLimitSqlOpts())
+      .where("key", key)
+      .toSql();
+    await clusterStorage.execute(built.sql, built.params);
   }
 
   function close() { /* no resources to release */ }
@@ -417,7 +487,7 @@ function create(opts) {
   // pass "RateLimit-", or a gateway's own prefix. Kept as a matched pair.
   var headerPrefix = (typeof opts.headerPrefix === "string" && opts.headerPrefix.length > 0)
     ? opts.headerPrefix : "X-RateLimit-";
-  var limitHeader = headerPrefix + "Limit";
+  var limitHeader = headerPrefix + "Limit";   // allow:hand-rolled-sql — HTTP response-header name (X-RateLimit-Limit), not a SQL LIMIT clause
   var remainingHeader = headerPrefix + "Remaining";
   var skipPaths = opts.skipPaths || [];
   // Throw at create(): each entry must be a string prefix or a RegExp.

package/lib/vendor/blamejs/lib/middleware/security-headers.js

@@ -10,8 +10,12 @@
  *   Referrer-Policy: no-referrer     — don't leak full URL to outbound links
  *   Permissions-Policy               — disable common-attack APIs (camera, geolocation, payment, etc.)
  *   Cross-Origin-Opener-Policy: same-origin
- *   Cross-Origin-Embedder-Policy: require-corp / credentialless   (off by default — breaks images from CDNs; credentialless is the
- *   CR 2024-12 relaxed mode that lets cross-origin no-cors requests load without CORP markers as long as they don't carry credentials)
+ *   Cross-Origin-Embedder-Policy: credentialless   (default-on — with COOP
+ *   same-origin this yields cross-origin isolation; credentialless is the
+ *   relaxed enforcing mode that lets cross-origin no-cors requests load
+ *   without CORP markers as long as they don't carry credentials, so CDN
+ *   images/fonts keep working. Pass coep: "require-corp" to tighten, or
+ *   coep: false to disable.)
  *   Cross-Origin-Resource-Policy: same-origin
  *   Origin-Agent-Cluster: ?1        — origin-keyed agent cluster; extra process isolation
  *   X-DNS-Prefetch-Control: off     — don't pre-resolve DNS for off-page links
@@ -173,8 +177,9 @@ function _validatePermissionsPolicy(value) {
  * nosniff, X-Frame-Options DENY, Referrer-Policy no-referrer, an
  * extensive Permissions-Policy denylist (camera / geolocation /
  * payment / Privacy-Sandbox attribution-reporting / bluetooth /
- * etc.), COOP same-origin, CORP same-origin, Origin-Agent-Cluster
- * `?1`, and a strict default CSP with `require-trusted-types-for
+ * etc.), COOP same-origin, COEP credentialless (cross-origin isolation
+ * on by default; pass `coep: false` to disable), CORP same-origin,
+ * Origin-Agent-Cluster `?1`, and a strict default CSP with `require-trusted-types-for
  * 'script'`. Each header can be softened by passing the option
  * value or disabled by passing `false`. Mount FIRST (after
  * `requestId`) so headers are set before any response could be
@@ -233,7 +238,18 @@ function create(opts) {
   var refPolicy = opts.referrerPolicy === undefined ? "no-referrer" : opts.referrerPolicy;
   var permPolicy = opts.permissionsPolicy === undefined ? DEFAULT_PERMISSIONS.join(", ") : opts.permissionsPolicy;
   var coop  = opts.coop === undefined ? "same-origin" : opts.coop;
-  var coep  = opts.coep === undefined ? false : opts.coep;
+  // COEP default-on (v0.15.0): emit Cross-Origin-Embedder-Policy:
+  // credentialless. With COOP same-origin this completes cross-origin
+  // isolation (crossOriginIsolated === true), re-enabling SharedArrayBuffer
+  // / high-resolution timers while closing the Spectre-class cross-origin
+  // read surface. `credentialless` (HTML spec, shipped Chrome 110+) is the
+  // least-breaking enforcing mode: cross-origin no-cors subresources (CDN
+  // images, fonts) still load — they're fetched WITHOUT credentials rather
+  // than requiring an explicit CORP/CORS opt-in, so existing pages keep
+  // working where `require-corp` would have broken them. Operators serving
+  // credentialed cross-origin subresources pass coep: "require-corp" (and
+  // add CORP/CORS headers), or coep: false to opt out of COEP entirely.
+  var coep  = opts.coep === undefined ? "credentialless" : opts.coep;
   var corp  = opts.corp === undefined ? "same-origin" : opts.corp;
   var oac   = opts.originAgentCluster === undefined ? "?1" : opts.originAgentCluster;
   var dpc   = opts.dnsPrefetchControl === undefined ? "off" : opts.dnsPrefetchControl;

package/lib/vendor/blamejs/lib/migrations.js

@@ -41,10 +41,13 @@
 var nodePath = require("node:path");
 var atomicFile = require("./atomic-file");
 var dbSchema = require("./db-schema");
+var frameworkSchema = require("./framework-schema");
 var lazyRequire = require("./lazy-require");
 var { boot } = require("./log");
 var migrationFiles = require("./migration-files");
 var numericBounds = require("./numeric-bounds");
+var safeSql = require("./safe-sql");
+var sql = require("./sql");
 var db = lazyRequire(function () { return require("./db"); });
 var validateOpts = require("./validate-opts");
 var { FrameworkError } = require("./framework-error");
@@ -60,11 +63,29 @@ class MigrationError extends FrameworkError {
   }
 }
 
-var MIGRATIONS_TABLE = "_blamejs_migrations";
-// Always interpolate identifiers wrapped in `"..."` so a reserved-word
-// or whitespace-bearing name resolves correctly (defense-in-depth even
-// though our constant is bare-identifier-shaped).
-var Q_MIGRATIONS_TABLE = '"' + MIGRATIONS_TABLE + '"';
+// Logical names; the physical names resolve through
+// frameworkSchema.tableName so a configured table prefix flows here too.
+// SQL is composed with b.sql (quoteName: true) so the resolved name is
+// quoted by construction — a reserved-word / whitespace-bearing name
+// still emits a valid `"..."` identifier.
+var MIGRATIONS_TABLE = "_blamejs_migrations";  // allow:hand-rolled-sql — logical name declaration; physical name + prefix resolve via frameworkSchema.tableName below
+function _migrationsTable() { return frameworkSchema.tableName(MIGRATIONS_TABLE); }
+// b.sql opts for the migration bookkeeping statements. db.prepare /
+// runSqlOnHandle run these directly against the handle (never
+// clusterStorage), so the dialect must match the handle: db.from()'s local
+// node:sqlite default, or an operator's own Postgres / MySQL handle (which
+// declares `handle.dialect`). The handle-dialect / opts / key-text-type
+// resolution is shared with db-schema's reconciler + seeders.js, so it is
+// composed from db-schema rather than re-derived here. The historical
+// default (sqlite) is byte-identical for every existing local-handle caller.
+var _handleDialect = dbSchema.handleDialect;
+var _sqlOpts = dbSchema.sqlOpts;
+var _keyTextType = dbSchema.keyTextType;
+// A ms-epoch column type. Date.now() exceeds a 32-bit INTEGER, so the
+// lock timestamp needs a 64-bit type on Postgres + MySQL (BIGINT) — b.sql's
+// logical "int" resolves to BIGINT on both and INTEGER on SQLite, so passing
+// the logical name through the handle dialect is enough.
+var _MS_EPOCH_TYPE = "int";
 // Filename grammar: leading numeric prefix (any width), then '-', then a
 // non-empty body, then '.js'. Numeric prefix orders execution. Letters
 // in the body include hyphens, underscores, and alphanumerics; anything
@@ -87,31 +108,36 @@ function _isMigrationFile(name) {
 var _runSql = dbSchema.runSqlOnHandle;
 
 function _ensureTable(db) {
-  _runSql(db,
-    "CREATE TABLE IF NOT EXISTS " + Q_MIGRATIONS_TABLE + " (" +
-    "  name        TEXT PRIMARY KEY," +
-    "  description TEXT," +
-    "  appliedAt   TEXT NOT NULL" +
-    ")"
-  );
+  _runSql(db, sql.createTable(_migrationsTable(), [
+    { name: "name",        type: _keyTextType(db), primaryKey: true },
+    { name: "description", type: "text" },
+    { name: "appliedAt",   type: "text", notNull: true },
+  ], _sqlOpts(db)).sql);
 }
 
 // Single-row advisory-lock table. Two processes running `migrate up`
 // concurrently against the same DB race on this table: the winner of
 // the INSERT acquires the lock; the loser sees a UNIQUE violation and
 // the operator gets a clear "lock held by other process" error.
-var LOCK_TABLE   = "_blamejs_migrations_lock";
-var Q_LOCK_TABLE = '"' + LOCK_TABLE + '"';
+var LOCK_TABLE = "_blamejs_migrations_lock";  // allow:hand-rolled-sql — logical name declaration; physical name + prefix resolve via frameworkSchema.tableName below
+function _lockTable() { return frameworkSchema.tableName(LOCK_TABLE); }
 
 function _ensureLockTable(db) {
-  _runSql(db,
-    "CREATE TABLE IF NOT EXISTS " + Q_LOCK_TABLE + " (" +
-    "  scope     TEXT PRIMARY KEY," +
-    "  lockedAt  INTEGER NOT NULL," +
-    "  lockedBy  TEXT NOT NULL," +
-    "  CHECK (scope = 'lock')" +
-    ")"
-  );
+  // The single-row invariant (CHECK scope = 'lock') is a static,
+  // framework-controlled column constraint — b.sql guards the verbatim
+  // fragment (allowLiterals) and quotes the column by construction. The
+  // CHECK references `scope` with the handle's identifier quoting (backtick
+  // on mysql) so the constraint parses on every dialect. lockedAt is an
+  // ms-epoch value (`int` → BIGINT on Postgres/MySQL, INTEGER on SQLite);
+  // a 32-bit INTEGER would overflow Date.now() and make the lock
+  // unacquirable on Postgres.
+  var dialect = _handleDialect(db);
+  var scopeCheck = "CHECK (" + safeSql.quoteIdentifier("scope", dialect, { allowReserved: true }) + " = 'lock')";
+  _runSql(db, sql.createTable(_lockTable(), [
+    { name: "scope",    type: _keyTextType(db), primaryKey: true, constraints: scopeCheck },
+    { name: "lockedAt", type: _MS_EPOCH_TYPE,   notNull: true },
+    { name: "lockedBy", type: "text",           notNull: true },
+  ], _sqlOpts(db)).sql);
 }
 
 function _lockHolderId() {
@@ -139,23 +165,24 @@ function _acquireLock(db, opts) {
   } else {
     staleAfterMs = opts.staleAfterMs;
   }
+  var insertLock = sql.insert(_lockTable(), _sqlOpts(db))
+    .values({ scope: "lock", lockedAt: nowMs, lockedBy: holder }).toSql();
   // Try to insert; if there's a stale lock, optionally force-replace it.
   try {
-    db.prepare(
-      "INSERT INTO " + Q_LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
-    ).run(nowMs, holder);
+    var insStmt = db.prepare(insertLock.sql);
+    insStmt.run.apply(insStmt, insertLock.params);
     return holder;
   } catch {
     // PRIMARY KEY conflict → existing lock. Inspect it.
-    var existing = db.prepare(
-      "SELECT lockedAt, lockedBy FROM " + Q_LOCK_TABLE + " WHERE scope = 'lock'"
-    ).get();
+    var selExisting = sql.select(_lockTable(), _sqlOpts(db))
+      .columns(["lockedAt", "lockedBy"]).where("scope", "lock").toSql();
+    var selStmt = db.prepare(selExisting.sql);
+    var existing = selStmt.get.apply(selStmt, selExisting.params);
     if (!existing) {
       // Race window between INSERT failure and SELECT — try once more.
       try {
-        db.prepare(
-          "INSERT INTO " + Q_LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
-        ).run(nowMs, holder);
+        var retryStmt = db.prepare(insertLock.sql);
+        retryStmt.run.apply(retryStmt, insertLock.params);
         return holder;
       } catch (e2) {
         throw new MigrationError("migrations/lock-busy",
@@ -165,25 +192,32 @@ function _acquireLock(db, opts) {
     }
     var ageMs = nowMs - Number(existing.lockedAt);
     if (staleAfterMs > 0 && ageMs > staleAfterMs) {
-      // Force-replace the stale lock. Requires DELETE + INSERT in a
-      // single transaction so the next process can't slip in between.
-      _runSql(db, "BEGIN IMMEDIATE");
+      // Force-replace the stale lock. The DELETE + INSERT run in a single
+      // transaction so the next process can't slip in between. The
+      // transaction boundary is dialect-aware: only SQLite has the
+      // `BEGIN IMMEDIATE` write-lock-up-front form — Postgres + MySQL
+      // reject the `IMMEDIATE` keyword, so the shared runInTransaction
+      // helper emits a plain portable `BEGIN`/`COMMIT`/`ROLLBACK` there.
+      var lockMode = _handleDialect(db) === "sqlite" ? "IMMEDIATE" : null;
       try {
-        db.prepare("DELETE FROM " + Q_LOCK_TABLE + " WHERE scope = 'lock' AND lockedAt = ?")
-          .run(existing.lockedAt);
-        db.prepare(
-          "INSERT INTO " + Q_LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
-        ).run(nowMs, holder);
-        _runSql(db, "COMMIT");
-        return holder;
+        return dbSchema.runInTransaction(db, function () {
+          var delStale = sql.delete(_lockTable(), _sqlOpts(db))
+            .where("scope", "lock").where("lockedAt", existing.lockedAt).toSql();
+          var delStaleStmt = db.prepare(delStale.sql);
+          delStaleStmt.run.apply(delStaleStmt, delStale.params);
+          var replStmt = db.prepare(insertLock.sql);
+          replStmt.run.apply(replStmt, insertLock.params);
+          return holder;
+        }, {
+          lockMode: lockMode,
+          onRollbackFail: function (rollbackErr) {
+            log.debug("rollback-failed", {
+              op: "lock-stale-replace",
+              error: rollbackErr && rollbackErr.message,
+            });
+          },
+        });
       } catch (forceErr) {
-        try { _runSql(db, "ROLLBACK"); }
-        catch (rollbackErr) {
-          log.debug("rollback-failed", {
-            op: "lock-stale-replace",
-            error: rollbackErr && rollbackErr.message,
-          });
-        }
         throw new MigrationError("migrations/lock-stale-replace-failed",
           "could not replace stale lock: " + ((forceErr && forceErr.message) || String(forceErr)),
           true);
@@ -202,9 +236,10 @@ function _releaseLock(db, holder) {
   // shouldn't have its lock cleared by an unrelated next deploy unless
   // the operator explicitly used the staleAfterMs nodePath.
   try {
-    db.prepare(
-      "DELETE FROM " + Q_LOCK_TABLE + " WHERE scope = 'lock' AND lockedBy = ?"
-    ).run(holder);
+    var rel = sql.delete(_lockTable(), _sqlOpts(db))
+      .where("scope", "lock").where("lockedBy", holder).toSql();
+    var relStmt = db.prepare(rel.sql);
+    relStmt.run.apply(relStmt, rel.params);
   } catch (_e) { /* best-effort release; operator can DELETE manually */ }
 }
 
@@ -271,10 +306,11 @@ function create(opts) {
   function _appliedRows() {
     var db = _resolveDb(opts);
     _ensureTable(db);
-    return db.prepare(
-      "SELECT name, description, appliedAt FROM " + Q_MIGRATIONS_TABLE +
-      " ORDER BY appliedAt ASC, name ASC"
-    ).all();
+    var q = sql.select(_migrationsTable(), _sqlOpts(db))
+      .columns(["name", "description", "appliedAt"])
+      .orderBy("appliedAt", "asc").orderBy("name", "asc").toSql();
+    var stmt = db.prepare(q.sql);
+    return stmt.all.apply(stmt, q.params);
   }
 
   function status() {
@@ -293,8 +329,10 @@ function create(opts) {
     var db = _resolveDb(opts);
     _ensureTable(db);
     return _withLock(db, opts, function () {
+      var namesQ = sql.select(_migrationsTable(), _sqlOpts(db)).columns(["name"]).toSql();
+      var namesStmt = db.prepare(namesQ.sql);
       var appliedSet = new Set(
-        db.prepare("SELECT name FROM " + Q_MIGRATIONS_TABLE).all()
+        namesStmt.all.apply(namesStmt, namesQ.params)
           .map(function (r) { return r.name; })
       );
       var files = _list(dir);
@@ -307,10 +345,11 @@ function create(opts) {
         try {
           _txn(db, function () {
             mod.up(db);
-            db.prepare(
-              "INSERT INTO " + Q_MIGRATIONS_TABLE +
-              " (name, description, appliedAt) VALUES (?, ?, ?)"
-            ).run(file, mod.description || "", new Date().toISOString());
+            var insQ = sql.insert(_migrationsTable(), _sqlOpts(db))
+              .values({ name: file, description: mod.description || "",
+                        appliedAt: new Date().toISOString() }).toSql();
+            var insStmt = db.prepare(insQ.sql);
+            insStmt.run.apply(insStmt, insQ.params);
           });
         } catch (e) {
           throw new MigrationError("migrations/up-failed",
@@ -336,11 +375,12 @@ function create(opts) {
     return _withLock(db, opts, function () {
       // Most-recent applied first (reverse chronological by appliedAt
       // then by name as a stable tiebreaker for fixtures with identical
-      // timestamps).
-      var rows = db.prepare(
-        "SELECT name FROM " + Q_MIGRATIONS_TABLE +
-        " ORDER BY appliedAt DESC, name DESC LIMIT ?"
-      ).all(steps);
+      // timestamps). steps is a validated positive integer, so b.sql
+      // inlines the LIMIT.
+      var downQ = sql.select(_migrationsTable(), _sqlOpts(db)).columns(["name"])
+        .orderBy("appliedAt", "desc").orderBy("name", "desc").limit(steps).toSql();
+      var downStmt = db.prepare(downQ.sql);
+      var rows = downStmt.all.apply(downStmt, downQ.params);
 
       var reverted = [];
       for (var i = 0; i < rows.length; i++) {
@@ -355,7 +395,9 @@ function create(opts) {
         try {
           _txn(db, function () {
             mod.down(db);
-            db.prepare("DELETE FROM " + Q_MIGRATIONS_TABLE + " WHERE name = ?").run(file);
+            var delQ = sql.delete(_migrationsTable(), _sqlOpts(db)).where("name", file).toSql();
+            var delStmt = db.prepare(delQ.sql);
+            delStmt.run.apply(delStmt, delQ.params);
           });
         } catch (e) {
           throw new MigrationError("migrations/down-failed",

package/lib/vendor/blamejs/lib/network-heartbeat.js

@@ -72,6 +72,13 @@ function _probeHttp(target, timeoutMs) {
         url:        target.url,
         method:     target.method || "GET",
         timeoutMs:  timeoutMs,
+        // Forward the target's protocol/host allowlists so an operator who
+        // opts a cleartext http:// heartbeat in (allowedProtocols:
+        // b.safeUrl.ALLOW_HTTP_ALL) is honoured. Left undefined, httpClient
+        // applies its https-only default (ALLOW_HTTP_TLS) — so an http://
+        // target with no opt-in is still rejected, not silently probed.
+        allowedProtocols: target.allowedProtocols,
+        allowedHosts:     target.allowedHosts,
         allowInternal: target.allowInternal === true ? true : target.allowInternal,
       });
       p.then(function (res) {

package/lib/vendor/blamejs/lib/network-proxy.js

@@ -20,6 +20,11 @@ var DEFAULT_HTTPS_PORT   = 443;                 // RFC 9110 §4.2.2
 var DEFAULT_HTTP_PORT    = C.BYTES.bytes(80);   // RFC 9110 §4.2.1
 
 var observability = lazyRequire(function () { return require("./observability"); });
+// Lazy so pqc-agent's TLS/audit graph isn't pulled into every process that
+// imports network-proxy but never proxies an https upstream. Used only to audit
+// a classical-group fallback on a proxy-tunneled TLS handshake (the direct path
+// audits in pqc-agent.create()).
+var pqcAgent = lazyRequire(function () { return require("./pqc-agent"); });
 
 var STATE = {
   http:    null,
@@ -167,6 +172,13 @@ function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
   function done(err, sock) { if (settled) return; settled = true; callback(err, sock); }
   proxySocket.on("error", function (e) { done(e); });
   proxySocket.on(proxyUrl.protocol === "https:" ? "secureConnect" : "connect", function () {
+    if (proxyUrl.protocol === "https:") {
+      // The CONNECT-tunnel leg to an https proxy is itself a TLS handshake;
+      // audit a classical fallback to the proxy too, not only to the upstream.
+      pqcAgent()._auditClassicalDowngrade(proxySocket, {
+        host: proxyUrl.hostname, port: proxyPort,
+      });
+    }
     var lines = [
       "CONNECT " + targetHost + ":" + targetPort + " HTTP/1.1",
       "Host: " + targetHost + ":" + targetPort,
@@ -218,7 +230,18 @@ function agentFor(targetUrl) {
           minVersion: "TLSv1.3",
           ecdhCurve:  C.TLS_GROUP_CURVE_STR,
           ALPNProtocols: options.ALPNProtocols,
-        }, function () { cb(null, secure); });
+        }, function () {
+          // Audit a classical-group fallback on the upstream (target) handshake
+          // reached through the proxy tunnel, so the "every outbound TLS path
+          // emits tls.classical_downgrade" guarantee holds for proxied requests
+          // too (the direct path audits in pqc-agent.create). Drop-silent; the
+          // handshake itself is unchanged (still hybrid-preferred TLSv1.3).
+          pqcAgent()._auditClassicalDowngrade(secure, {
+            host: options.servername || options.host,
+            port: options.port,
+          });
+          cb(null, secure);
+        });
         secure.on("error", function (e) { cb(e); });
       });
     };

package/lib/vendor/blamejs/lib/nonce-store.js

@@ -43,10 +43,30 @@
 
 var clusterStorage = require("./cluster-storage");
 var C = require("./constants");
+var frameworkSchema = require("./framework-schema");
 var safeAsync = require("./safe-async");
+var sql = require("./sql");
 var { defineClass } = require("./framework-error");
 var { boundedMap } = require("./bounded-map");
 
+// Cluster-backend table — resolved through frameworkSchema.tableName so a
+// configured table prefix (b.frameworkSchema.setTablePrefix) is honored.
+// The name is identity-mapped in LOCAL_TO_EXTERNAL, so clusterStorage's
+// resolveTables leaves it untouched at dispatch and the resolved name is
+// what reaches the backend on both sides.
+var NONCE_TABLE = "_blamejs_api_encrypt_nonces";   // allow:hand-rolled-sql — canonical logical table-name declaration
+
+// b.sql opts for every cluster-backend statement: thread the ACTIVE backend
+// dialect (clusterStorage.dialect() — "sqlite" single-node, "postgres" |
+// "mysql" in cluster mode) so the emitted identifier quoting and dialect
+// idioms (ON CONFLICT vs ON DUPLICATE KEY) match the backend the SQL
+// dispatches to. Defaulting to "sqlite" works on Postgres only by accident
+// (both double-quote identifiers) and emits invalid quoting + ON CONFLICT on
+// MySQL. clusterStorage.execute still rewrites table names + translates `?`
+// placeholders at dispatch; this controls only the builder-side quoting +
+// idiom selection.
+function _nonceSqlOpts() { return { dialect: clusterStorage.dialect() }; }
+
 var NonceStoreError = defineClass("NonceStoreError");
 
 var DEFAULT_SWEEP_INTERVAL_MS = C.TIME.minutes(5);
@@ -148,19 +168,21 @@ function _clusterBackend(_opts) {
     // (someone else already inserted the same nonce, i.e. replay).
     // The middleware hashes the raw nonce before passing it here so
     // the table only ever sees hashes, not the originals.
-    var result = await clusterStorage.execute(
-      "INSERT INTO _blamejs_api_encrypt_nonces (nonceHash, expireAt) " +
-      "VALUES (?, ?) ON CONFLICT (nonceHash) DO NOTHING",
-      [nonce, expireAt]
-    );
+    var built = sql.upsert(frameworkSchema.tableName(NONCE_TABLE), _nonceSqlOpts())
+      .columns(["nonceHash", "expireAt"])
+      .values({ nonceHash: nonce, expireAt: expireAt })
+      .onConflict(["nonceHash"])
+      .doNothing()
+      .toSql();
+    var result = await clusterStorage.execute(built.sql, built.params);
     return (result && result.rowCount > 0);
   }
 
   async function purgeExpired() {
-    var result = await clusterStorage.execute(
-      "DELETE FROM _blamejs_api_encrypt_nonces WHERE expireAt <= ?",
-      [Date.now()]
-    );
+    var built = sql.delete(frameworkSchema.tableName(NONCE_TABLE), _nonceSqlOpts())
+      .where("expireAt", "<=", Date.now())
+      .toSql();
+    var result = await clusterStorage.execute(built.sql, built.params);
     return (result && result.rowCount) || 0;
   }