@blamejs/blamejs-shop 0.4.56 → 0.4.58

package/lib/vendor/blamejs/lib/csp.js

@@ -52,7 +52,12 @@
 var nodeCrypto   = require("node:crypto");
 var validateOpts = require("./validate-opts");
 var bCrypto      = require("./crypto");
+var pick         = require("./pick");
 var { defineClass } = require("./framework-error");
+// The strict framework defaults the per-route merge derives from. One-
+// directional edge: security-headers requires only request-helpers +
+// validate-opts, never csp, so this is not a cycle (§9 top-of-file require).
+var securityHeaderDefaults = require("./middleware/security-headers");
 
 var CspError = defineClass("CspError", { alwaysPermanent: true });
 
@@ -78,6 +83,61 @@ var ALL_DIRECTIVES = [
 var UNSAFE_KEYWORDS = ["'unsafe-inline'", "'unsafe-eval'", "'unsafe-hashes'"];
 var CATCH_ALL_SOURCES = ["*", "https:"];
 
+// _parseCspString — split a CSP header value into an ordered
+// { directive: [sources] } map. Tolerant reader (defensive tier): a
+// malformed base yields whatever directives DO parse. The merge never
+// re-validates these base sources (they are the trusted default), so the
+// parser only needs to be faithful, not strict. First write wins on a
+// duplicate directive (matches UA "honor the first").
+function _parseCspString(value) {
+  var out = {};
+  if (typeof value !== "string") return out;
+  var segments = value.split(";");
+  for (var i = 0; i < segments.length; i += 1) {
+    var tokens = segments[i].trim().split(/\s+/);
+    var name = tokens[0];
+    if (!name) continue;
+    if (Object.prototype.hasOwnProperty.call(out, name)) continue;
+    out[name] = tokens.slice(1);
+  }
+  return out;
+}
+
+// _parsePermissionsPolicyString — split a Permissions-Policy header value
+// into a { feature: "allowlist" } map plus the feature order, preserving
+// each feature's RFC-9651 value-list verbatim ("()" / "*" / "(self ...)").
+function _parsePermissionsPolicyString(value) {
+  var out = {};
+  var order = [];
+  if (typeof value !== "string") return { map: out, order: order };
+  // Split on the literal comma (linear) — the per-item .trim() below handles
+  // the surrounding whitespace, so the prior `/\s*,\s*/` was redundant and
+  // ran in O(n^2) on a comma-less run of whitespace (js/polynomial-redos).
+  var parts = value.split(",");
+  for (var i = 0; i < parts.length; i += 1) {
+    var p = parts[i].trim();
+    if (!p) continue;
+    var eq = p.indexOf("=");
+    if (eq === -1) continue;
+    var feature = p.slice(0, eq).trim();
+    var allow = p.slice(eq + 1).trim();
+    if (!feature) continue;
+    if (!Object.prototype.hasOwnProperty.call(out, feature)) order.push(feature);
+    out[feature] = allow;
+  }
+  return { map: out, order: order };
+}
+
+// RFC-9651 value-list shape for ONE Permissions-Policy feature value (no
+// leading "feature=" — just the allowlist): "*", "()", "self", or a
+// parenthesised origin list "(self \"https://x\")". A hostile value with a
+// comma / CRLF can't pass (no comma inside, the parens are balanced-only).
+var PP_VALUE_RE = /^(?:\*|self|\([^),\r\n]*\))$/;
+// Permissions-Policy feature names are RFC-9651 structured-field tokens —
+// ASCII lowercase, hyphenated. Reject anything else so a hostile key can't
+// inject a comma / CRLF into the header.
+var PP_FEATURE_RE = /^[a-z][a-z0-9-]*$/;   // allow:duplicate-regex — generic ASCII lowercase-hyphen token shape; shared shape, distinct domain (Permissions-Policy feature name)
+
 /**
  * @primitive b.csp.build
  * @signature b.csp.build(directives, opts?)
@@ -184,9 +244,15 @@ function build(directives, opts) {
     directives["trusted-types"] = opts.trustedTypesPolicies;
   }
 
-  // Emit in canonical order (ALL_DIRECTIVES order) so operators
-  // diffing two policies see structural diffs rather than ordering
-  // noise.
+  return _emitCanonical(directives);
+}
+
+// Emit a directive map as a CSP header string in canonical (ALL_DIRECTIVES)
+// order so operators diffing two policies see structural diffs rather than
+// ordering noise. Pure serializer — it does NOT validate sources (build()
+// and mergeDirectives() validate before calling it), so a trusted base
+// policy round-trips through it untouched.
+function _emitCanonical(directives) {
   var out = [];
   for (var di = 0; di < ALL_DIRECTIVES.length; di += 1) {
     var d = ALL_DIRECTIVES[di];
@@ -264,8 +330,174 @@ function hash(scriptBody, alg) {
   return "'" + algName + "-" + digest + "'";
 }
 
+/**
+ * @primitive  b.csp.mergeDirectives
+ * @signature  b.csp.mergeDirectives(base, additions, opts?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.csp.build, b.csp.mergePermissionsPolicy
+ *
+ * Derive a per-route CSP from a strict base by ADDING hosts to named
+ * directives, leaving every other directive exactly as the base. The fix for
+ * the "load a third-party SDK on one route" case: take the framework's strict
+ * default (pass `base` omitted / `undefined`) and add `https://js.stripe.com`
+ * to `script-src` + `frame-src` for the checkout route only, without
+ * re-typing the whole policy or relaxing `frame-ancestors` / `object-src` /
+ * `base-uri`.
+ *
+ * Additive only: each `additions[directive]` array is APPENDED (de-duped) to
+ * that directive's existing sources; a directive absent from the base is
+ * seeded from `default-src` (or `'self'`) first so it never lands wide-open.
+ * Only the ADDED sources are validated (CR/LF/NUL, catch-all `*`/`https:`,
+ * `data:` in img/media/font, unsafe-* in script directives) — the trusted
+ * base round-trips untouched. Returns a policy string for the middleware
+ * `csp:` opt. Throws `CspError` on an unknown directive, a hostile directive
+ * name, or a rejected added source.
+ *
+ * @opts
+ *   acknowledgeUnsafe:  boolean,   // allow an added 'unsafe-*' in a script directive
+ *   allowDataImages:    boolean,   // allow an added data: in img-src/media-src/font-src
+ *
+ * @example
+ *   // Admit Stripe on the checkout route's script + frame directives only.
+ *   var routeCsp = b.csp.mergeDirectives(undefined, {
+ *     "script-src": ["https://js.stripe.com"],
+ *     "frame-src":  ["https://js.stripe.com"],
+ *   });
+ *   // -> the strict default with those two hosts appended; everything else unchanged
+ */
+function mergeDirectives(base, additions, opts) {
+  var baseString = base === undefined ? securityHeaderDefaults.DEFAULT_CSP : base;
+  if (typeof baseString !== "string" || baseString.length === 0) {
+    throw new CspError("csp/bad-base",
+      "csp.mergeDirectives: base must be a non-empty CSP string (or undefined to " +
+      "derive from the framework DEFAULT_CSP)");
+  }
+  if (!additions || typeof additions !== "object" || Array.isArray(additions)) {
+    throw new CspError("csp/bad-additions",
+      "csp.mergeDirectives: additions must be an object keyed by CSP directive name, " +
+      "each value a non-empty array of source strings to ADD");
+  }
+  opts = opts || {};
+  validateOpts(opts, ["acknowledgeUnsafe", "allowDataImages"], "csp.mergeDirectives");
+
+  var addKeys = Object.keys(additions);
+  // Validate directive names (proto-safe) + that each addition is a
+  // non-empty array, before touching the base.
+  for (var ki = 0; ki < addKeys.length; ki += 1) {
+    var nm = addKeys[ki];
+    if (pick.isPoisonedKey(nm)) {
+      throw new CspError("csp/bad-directive-name",
+        "csp.mergeDirectives: '" + nm + "' is not a valid directive name");
+    }
+    if (ALL_DIRECTIVES.indexOf(nm) === -1) {
+      throw new CspError("csp/unknown-directive",
+        "csp.mergeDirectives: '" + nm + "' is not a recognized CSP3 directive");
+    }
+    if (!Array.isArray(additions[nm]) || additions[nm].length === 0) {
+      throw new CspError("csp/bad-directive-value",
+        "csp.mergeDirectives: additions['" + nm + "'] must be a non-empty array of sources");
+    }
+  }
+  // Validate ONLY the added sources by routing a throwaway additions-only
+  // map through build() (reuses every per-source rule). build() may seed
+  // Trusted-Types into the copy; we discard its output and keep the original
+  // additions for the merge.
+  var validationMap = {};
+  for (var vk = 0; vk < addKeys.length; vk += 1) validationMap[addKeys[vk]] = additions[addKeys[vk]].slice();
+  build(validationMap, { acknowledgeUnsafe: opts.acknowledgeUnsafe === true,
+                         allowDataImages: opts.allowDataImages === true,
+                         requireTrustedTypes: false });
+
+  var directives = _parseCspString(baseString);
+  for (var ai = 0; ai < addKeys.length; ai += 1) {
+    var name = addKeys[ai];
+    var existing = Object.prototype.hasOwnProperty.call(directives, name)
+      ? directives[name].slice()
+      : (directives["default-src"] ? directives["default-src"].slice() : ["'self'"]);
+    var added = additions[name];
+    for (var si = 0; si < added.length; si += 1) {
+      if (existing.indexOf(added[si]) === -1) existing.push(added[si]);
+    }
+    directives[name] = existing;
+  }
+  return _emitCanonical(directives);
+}
+
+/**
+ * @primitive  b.csp.mergePermissionsPolicy
+ * @signature  b.csp.mergePermissionsPolicy(base, overrides, opts?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.csp.mergeDirectives, b.csp.build
+ *
+ * Derive a per-route Permissions-Policy from a strict base by replacing the
+ * allowlist of NAMED features only, leaving every other feature at its `()`
+ * deny default. The companion to `mergeDirectives` for the Permissions-Policy
+ * header: re-enable `payment` to `(self "https://js.stripe.com")` on the
+ * checkout route while `camera` / `microphone` / `geolocation` stay denied.
+ *
+ * Each override value is validated as an RFC-9651 feature value-list (`*`,
+ * `()`, `self`, or a parenthesised origin list) — a value carrying a comma or
+ * CR/LF is refused so it can't inject a second feature or a header break. A
+ * feature not present in the base is added (opting it in); one present is
+ * replaced. Returns a header string for the middleware `permissionsPolicy:`
+ * opt. Throws `CspError` on a hostile feature name or a malformed value.
+ *
+ * @opts
+ *   (none)
+ *
+ * @example
+ *   var routePp = b.csp.mergePermissionsPolicy(undefined, {
+ *     payment: '(self "https://js.stripe.com")',
+ *   });
+ *   // -> the strict default with payment re-enabled to that allowlist; all else denied
+ */
+function mergePermissionsPolicy(base, overrides, opts) {
+  var baseString = base === undefined
+    ? securityHeaderDefaults.DEFAULT_PERMISSIONS.join(", ")
+    : base;
+  if (typeof baseString !== "string" || baseString.length === 0) {
+    throw new CspError("csp/bad-base",
+      "csp.mergePermissionsPolicy: base must be a non-empty Permissions-Policy string " +
+      "(or undefined to derive from the framework default)");
+  }
+  if (!overrides || typeof overrides !== "object" || Array.isArray(overrides)) {
+    throw new CspError("csp/bad-overrides",
+      "csp.mergePermissionsPolicy: overrides must be an object keyed by feature name, " +
+      "each value an RFC-9651 allowlist string");
+  }
+  if (opts !== undefined) validateOpts(opts || {}, [], "csp.mergePermissionsPolicy");
+
+  var parsed = _parsePermissionsPolicyString(baseString);
+  var map = parsed.map;
+  var order = parsed.order;
+  var keys = Object.keys(overrides);
+  for (var ki = 0; ki < keys.length; ki += 1) {
+    var feature = keys[ki];
+    if (pick.isPoisonedKey(feature) ||
+        !PP_FEATURE_RE.test(feature)) {                                                          // allow:regex-no-length-cap — anchored token shape (no backtracking); a feature name is a short RFC-9651 token
+      throw new CspError("csp/bad-feature-name",
+        "csp.mergePermissionsPolicy: '" + feature + "' is not a valid feature name");
+    }
+    var value = overrides[feature];
+    if (typeof value !== "string" || !PP_VALUE_RE.test(value)) {                                  // allow:regex-no-length-cap — anchored alternation (no backtracking); a feature value is a short RFC-9651 value-list
+      throw new CspError("csp/bad-feature-value",
+        "csp.mergePermissionsPolicy: " + feature + " value must be one of *, (), self, or a " +
+        "parenthesised origin list (got " + JSON.stringify(value) + ")");
+    }
+    if (!Object.prototype.hasOwnProperty.call(map, feature)) order.push(feature);
+    map[feature] = value;
+  }
+  var out = [];
+  for (var oi = 0; oi < order.length; oi += 1) out.push(order[oi] + "=" + map[order[oi]]);
+  return out.join(", ");
+}
+
 module.exports = {
   build:  build,
+  mergeDirectives:       mergeDirectives,
+  mergePermissionsPolicy: mergePermissionsPolicy,
   nonce:  nonce,
   hash:   hash,
   CspError: CspError,

package/lib/vendor/blamejs/lib/daemon.js

@@ -42,7 +42,6 @@ var nodePath = require("node:path");
 var numericBounds = require("./numeric-bounds");
 var appShutdown = require("./app-shutdown");
 var processSpawn = require("./process-spawn");
-var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
 var atomicFile = require("./atomic-file");
 var validateOpts = require("./validate-opts");
@@ -50,7 +49,7 @@ var C = require("./constants");
 var { boot } = require("./log");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var DaemonError = defineClass("DaemonError", { alwaysPermanent: true });
 var log = boot("daemon");
@@ -63,13 +62,7 @@ var DEFAULT_POLL_MS         = 100;
 var DEFAULT_LOG_FILE_MODE   = 0o600;
 
 function _safeAuditEmit(action, outcome, metadata) {
-  try {
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome || "success",
-      metadata: metadata || {},
-    });
-  } catch (_e) { /* drop-silent — by design */ }
+  auditEmit.emit(action, metadata, outcome);
 }
 
 function _isLivePid(pid) {
@@ -87,41 +80,49 @@ function _readPidFile(pidFile) {
 }
 
 function _validateStartOpts(opts) {
-  validateOpts.requireObject(opts, "daemon.start", DaemonError, "daemon/bad-opts");
-  validateOpts.requireNonEmptyString(opts.pidFile,
-    "daemon.start: opts.pidFile (absolute path recommended)",
-    DaemonError, "daemon/bad-pid-file");
-  validateOpts.optionalNonEmptyString(opts.logFile,
-    "daemon.start: opts.logFile", DaemonError, "daemon/bad-log-file");
-  validateOpts.optionalNonEmptyStringArray(opts.signals,
-    "daemon.start: opts.signals", DaemonError, "daemon/bad-signals");
-  if (Array.isArray(opts.signals) && opts.signals.length === 0) {
-    throw new DaemonError("daemon/bad-signals",
-      "daemon.start: opts.signals must be a non-empty array of POSIX signal names");
-  }
-  validateOpts.optionalNonEmptyString(opts.command,
-    "daemon.start: opts.command (path to executable)",
-    DaemonError, "daemon/bad-command");
-  if (opts.args !== undefined && !Array.isArray(opts.args)) {
-    throw new DaemonError("daemon/bad-args",
-      "daemon.start: opts.args must be an array of strings when present");
-  }
-  if (opts.command === undefined && opts.args !== undefined) {
-    throw new DaemonError("daemon/bad-args",
-      "daemon.start: opts.args requires opts.command");
-  }
+  validateOpts.shape(opts, {
+    pidFile: { rule: "required-string", code: "daemon/bad-pid-file",
+               label: "daemon.start: opts.pidFile (absolute path recommended)" },
+    logFile: { rule: "optional-string", code: "daemon/bad-log-file",
+               label: "daemon.start: opts.logFile" },
+    signals: function (value) {
+      validateOpts.optionalNonEmptyStringArray(value,
+        "daemon.start: opts.signals", DaemonError, "daemon/bad-signals");
+      if (Array.isArray(value) && value.length === 0) {
+        throw new DaemonError("daemon/bad-signals",
+          "daemon.start: opts.signals must be a non-empty array of POSIX signal names");
+      }
+    },
+    command: { rule: "optional-string", code: "daemon/bad-command",
+               label: "daemon.start: opts.command (path to executable)" },
+    args: function (value) {
+      if (value !== undefined && !Array.isArray(value)) {
+        throw new DaemonError("daemon/bad-args",
+          "daemon.start: opts.args must be an array of strings when present");
+      }
+      if (opts.command === undefined && value !== undefined) {
+        throw new DaemonError("daemon/bad-args",
+          "daemon.start: opts.args requires opts.command");
+      }
+    },
+  }, "daemon.start", DaemonError, "daemon/bad-opts");
 }
 
 function _validateStopOpts(opts) {
-  validateOpts.requireObject(opts, "daemon.stop", DaemonError, "daemon/bad-opts");
-  validateOpts.requireNonEmptyString(opts.pidFile,
-    "daemon.stop: opts.pidFile", DaemonError, "daemon/bad-pid-file");
-  validateOpts.optionalNonEmptyString(opts.signal,
-    "daemon.stop: opts.signal", DaemonError, "daemon/bad-signal");
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.timeoutMs,
-    "daemon.stop: opts.timeoutMs", DaemonError, "daemon/bad-timeout");
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.pollMs,
-    "daemon.stop: opts.pollMs", DaemonError, "daemon/bad-poll");
+  validateOpts.shape(opts, {
+    pidFile: { rule: "required-string", code: "daemon/bad-pid-file",
+               label: "daemon.stop: opts.pidFile" },
+    signal:  { rule: "optional-string", code: "daemon/bad-signal",
+               label: "daemon.stop: opts.signal" },
+    timeoutMs: function (value) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value,
+        "daemon.stop: opts.timeoutMs", DaemonError, "daemon/bad-timeout");
+    },
+    pollMs: function (value) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value,
+        "daemon.stop: opts.pollMs", DaemonError, "daemon/bad-poll");
+    },
+  }, "daemon.stop", DaemonError, "daemon/bad-opts");
 }
 
 function _maybeReapStale(pidFile) {

package/lib/vendor/blamejs/lib/data-act.js

@@ -116,9 +116,12 @@ var DESIGNATED_GATEKEEPERS = Object.freeze([
  *   });
  */
 function declareProduct(opts) {
-  validateOpts.requireObject(opts, "dataAct.declareProduct", DataActError, "dataact/bad-opts");
-  validateOpts.requireNonEmptyString(opts.productId, "productId", DataActError, "dataact/no-product-id");
-  validateOpts.requireNonEmptyString(opts.dataHolder, "dataHolder", DataActError, "dataact/no-data-holder");
+  validateOpts.shape(opts, {
+    productId:   { rule: "required-string", label: "productId",  code: "dataact/no-product-id" },
+    dataHolder:  { rule: "required-string", label: "dataHolder", code: "dataact/no-data-holder" },
+    productKind: "optional-string",
+    dataScope:   "optional-string",
+  }, "dataAct.declareProduct", DataActError, "dataact/bad-opts");
   var kind = opts.productKind || "connected-product";
   if (kind !== "connected-product" && kind !== "related-service") {
     throw new DataActError("dataact/bad-kind",
@@ -218,9 +221,13 @@ function recordUserAccess(opts) {
 function shareWithThirdParty(opts) {
   validateOpts.requireObject(opts, "dataAct.shareWithThirdParty", DataActError, "dataact/bad-opts");
   _requireProduct(opts.productId, "shareWithThirdParty");
-  validateOpts.requireNonEmptyString(opts.userId, "userId", DataActError, "dataact/no-user-id");
-  validateOpts.requireNonEmptyString(opts.recipient, "recipient", DataActError, "dataact/no-recipient");
-  validateOpts.requireNonEmptyString(opts.scope, "scope", DataActError, "dataact/no-scope");
+  validateOpts.shape(opts, {
+    productId:        { rule: "required-string", label: "productId", code: "dataact/no-product-id" },
+    userId:           { rule: "required-string", label: "userId",    code: "dataact/no-user-id" },
+    recipient:        { rule: "required-string", label: "recipient", code: "dataact/no-recipient" },
+    scope:            { rule: "required-string", label: "scope",     code: "dataact/no-scope" },
+    acceptGatekeeper: "optional-plain-object",
+  }, "dataAct.shareWithThirdParty", DataActError, "dataact/bad-opts");
 
   var recipientLower = opts.recipient.toLowerCase();
   var isGatekeeper = DESIGNATED_GATEKEEPERS.some(function (g) {
@@ -291,9 +298,12 @@ function shareWithThirdParty(opts) {
  *   });
  */
 function recordSwitchRequest(opts) {
-  validateOpts.requireObject(opts, "dataAct.recordSwitchRequest", DataActError, "dataact/bad-opts");
-  validateOpts.requireNonEmptyString(opts.customerId, "customerId", DataActError, "dataact/no-customer-id");
-  validateOpts.requireNonEmptyString(opts.targetProvider, "targetProvider", DataActError, "dataact/no-target");
+  validateOpts.shape(opts, {
+    customerId:       { rule: "required-string", label: "customerId",     code: "dataact/no-customer-id" },
+    targetProvider:   { rule: "required-string", label: "targetProvider", code: "dataact/no-target" },
+    dataSlices:       "optional-string-array",
+    noticePeriodDays: "optional-non-negative",
+  }, "dataAct.recordSwitchRequest", DataActError, "dataact/bad-opts");
   if (!Array.isArray(opts.dataSlices) || opts.dataSlices.length === 0) {
     throw new DataActError("dataact/no-data-slices",
       "recordSwitchRequest: dataSlices must be a non-empty array");

package/lib/vendor/blamejs/lib/db-query.js

@@ -51,6 +51,7 @@ var sql = require("./sql");
 var audit = require("./audit");
 var lazyRequire = require("./lazy-require");
 var { DbQueryError } = require("./framework-error");
+var numericBounds = require("./numeric-bounds");
 
 // Circular load — db.js requires db-query at module scope, so the
 // residency gate reaches back for getDataResidency() lazily.
@@ -682,11 +683,8 @@ class Query {
     var dbModule = require("./db");                                                                    // allow:inline-require — circular-load defense (db imports db-query)
     perCallLimit = dbModule.getStreamLimit();
     if (opts && opts.streamLimit !== undefined) {
-      if (typeof opts.streamLimit !== "number" || !isFinite(opts.streamLimit) ||
-          opts.streamLimit <= 0 || Math.floor(opts.streamLimit) !== opts.streamLimit) {
-        throw new Error("Query.stream: opts.streamLimit must be a positive finite integer; got " +
-          JSON.stringify(opts.streamLimit));
-      }
+      numericBounds.requirePositiveFiniteIntIfPresent(opts.streamLimit,
+        "Query.stream: opts.streamLimit", DbQueryError, "db-query/bad-stream-limit");
       perCallLimit = opts.streamLimit;
     }
     var stmt = this._db.prepare(built.sql);
@@ -1299,41 +1297,9 @@ class WhereBuilder {
 // Single linear pass, no backtracking regex; shares the scan shape with
 // b.safeSql.countPlaceholders.
 function _assertRawNoStringLiteral(rawSql, where) {
-  var i = 0;
-  var len = rawSql.length;
-  while (i < len) {
-    var ch = rawSql.charAt(i);
-    var next = i + 1 < len ? rawSql.charAt(i + 1) : "";
-    if (ch === '"') {
-      i += 1;
-      while (i < len) {
-        if (rawSql.charAt(i) === '"') {
-          if (rawSql.charAt(i + 1) === '"') { i += 2; continue; }
-          i += 1; break;
-        }
-        i += 1;
-      }
-      continue;
-    }
-    if (ch === "-" && next === "-") {
-      while (i < len && rawSql.charAt(i) !== "\n") i += 1;
-      continue;
-    }
-    if (ch === "/" && next === "*") {
-      i += 2;
-      while (i < len && !(rawSql.charAt(i) === "*" && rawSql.charAt(i + 1) === "/")) i += 1;
-      i += 2;
-      continue;
-    }
-    if (ch === "'") {
-      throw new safeSql.SafeSqlError(
-        where + ": raw SQL must not contain a string literal ('...') — bind every " +
-        "value with a ? placeholder, or pass { allowLiterals: true } when the literal " +
-        "is static and operator-controlled.",
-        "sql/raw-literal");
-    }
-    i += 1;
-  }
+  // Routes through the shared safeSql scanner; the default error reproduces
+  // this module's exact SafeSqlError("sql/raw-literal") message.
+  safeSql.assertNoRawStringLiteral(rawSql, where);
 }
 
 // Apply one recorded WhereBuilder part onto a b.sql Predicate. `or`

package/lib/vendor/blamejs/lib/db.js

@@ -161,6 +161,14 @@ var statfsProbe   = null;      // free-space reader (fs.statfsSync; injectable f
 var _exitHandlerRegistered = false;
 var dataDir   = null;
 var initialized = false;
+// Monotonic identity of the live `database` handle. Bumped on every (re)open,
+// close, and reset so a deferred operation that captured the generation while
+// one database was live can detect — before it writes — that the handle has
+// since changed (closed / replaced). Anchors the fix for a fire-and-forget
+// audit.checkpoint() launched by close() whose deferred insert would otherwise
+// land in whatever database is live when its continuation resumes.
+var _dbGenerationCounter = 0;
+function dbGeneration() { return _dbGenerationCounter; }
 var dataResidency = null;   // operator's declared region config (validated by storage backends)
 var subjectTables = [];     // [{ name, subjectField, personalDataCategories }] — for subject.export/erase
 var tableMetadata = {};     // table name → metadata snapshot (PK/FK/sealed/derived) for getTableMetadata
@@ -193,6 +201,7 @@ var RESERVED_TABLE_NAMES = new Set([
   "_blamejs_subject_restrictions",   // allow:hand-rolled-sql — canonical reserved local table-name declaration
   "_blamejs_subject_erasures",       // allow:hand-rolled-sql — canonical reserved local table-name declaration
   "_blamejs_sessions",               // allow:hand-rolled-sql — canonical reserved local table-name declaration
+  "_blamejs_session_valid_from",     // allow:hand-rolled-sql — canonical reserved local table-name declaration
   "_blamejs_jobs",                   // allow:hand-rolled-sql — canonical reserved local table-name declaration
   "_blamejs_migrations",             // allow:hand-rolled-sql — canonical reserved local table-name declaration
   "_blamejs_counters",               // allow:hand-rolled-sql — canonical reserved local table-name declaration
@@ -480,6 +489,23 @@ var FRAMEWORK_SCHEMA = [
     sealedFields:  ["userId", "data"],
     derivedHashes: { userIdHash: { from: "userId" } },
   },
+  {
+    // _blamejs_session_valid_from — per-subject valid-from boundary for
+    // stateless-token revocation (b.session.bump / check / validFrom). Same
+    // dual-storage pattern as _blamejs_sessions: mirrors the cluster-mode DDL
+    // in framework-schema.js so cluster-storage routes to either backend.
+    // subjectHash is the PRIMARY KEY — the plaintext subject id never lands
+    // here. No sealed columns: the hash is non-reversible and the epoch is not
+    // personal data.
+    name: "_blamejs_session_valid_from",   // allow:hand-rolled-sql — canonical local-schema table-name declaration
+    columns: {
+      subjectHash:    "TEXT PRIMARY KEY",
+      validFromEpoch: "INTEGER NOT NULL",
+      updatedAt:      "INTEGER NOT NULL",
+    },
+    indexes: [],
+    sealedFields: [],
+  },
   {
     // _blamejs_api_keys — operator-facing API-key registry. Sealed
     // columns: ownerId / scopes / metadata. The secret never lands
@@ -1043,12 +1069,8 @@ async function init(opts) {
   // on bad shape so a typo surfaces at boot rather than as an
   // unbounded stream at first export.
   if (opts.streamLimit !== undefined) {
-    if (typeof opts.streamLimit !== "number" || !isFinite(opts.streamLimit) ||
-        opts.streamLimit <= 0 || Math.floor(opts.streamLimit) !== opts.streamLimit) {
-      throw new DbError("db/bad-init",
-        "db.init: streamLimit must be a positive finite integer; got " +
-        JSON.stringify(opts.streamLimit));
-    }
+    require("./numeric-bounds").requirePositiveFiniteIntIfPresent(opts.streamLimit,
+      "db.init: streamLimit", DbError, "db/bad-init");
     streamLimit = opts.streamLimit;
   }
   // Column-membership gate mode — throw at config-time on a typo so it
@@ -1171,6 +1193,7 @@ async function init(opts) {
       sqlLength: C.BYTES.mib(1),
     },
   });
+  _dbGenerationCounter++;   // a new live handle — see dbGeneration()
 
   // Performance pragmas
   runSql(database, "PRAGMA journal_mode=WAL");
@@ -1813,12 +1836,8 @@ function stream(sql) {
   // typo surfaces instead of an unbounded stream.
   var perCallLimit = streamLimit;
   if (opts && opts.streamLimit !== undefined) {
-    if (typeof opts.streamLimit !== "number" || !isFinite(opts.streamLimit) ||
-        opts.streamLimit <= 0 || Math.floor(opts.streamLimit) !== opts.streamLimit) {
-      throw new DbError("db/bad-stream-limit",
-        "db.stream: opts.streamLimit must be a positive finite integer; got " +
-        JSON.stringify(opts.streamLimit));
-    }
+    require("./numeric-bounds").requirePositiveFiniteIntIfPresent(opts.streamLimit,
+      "db.stream: opts.streamLimit", DbError, "db/bad-stream-limit");
     perCallLimit = opts.streamLimit;
   }
 
@@ -2355,6 +2374,7 @@ function close() {
   // boot (integrity-probed, falling back to db.enc if it is itself corrupt).
   if (atRest === "encrypted" && encryptOk) removePlaintextFiles();
   database = null;
+  _dbGenerationCounter++;   // handle gone — invalidate any deferred op that captured the prior generation
   initialized = false;
 }
 
@@ -2879,6 +2899,7 @@ function _resetForTest() {
   try { if (database) database.close(); }
   catch (e) { log.debug("test-reset close failed", { error: e.message }); }
   database = null;
+  _dbGenerationCounter++;   // handle gone — see dbGeneration()
   dbPath = null;
   encPath = null;
   encKey = null;
@@ -3308,6 +3329,7 @@ function getActivePosture() { return _activePosture; }
 
 module.exports = {
   init:                init,
+  _dbGeneration:       dbGeneration,
   applyPosture:        applyPosture,
   getActivePosture:    getActivePosture,
   vacuumAfterErase:    vacuumAfterErase,

package/lib/vendor/blamejs/lib/dbsc.js

@@ -198,12 +198,11 @@ function verifyBindingAssertion(assertion, opts) {
   // import boundary (alg-confusion defense — JWT_KEY_CONFUSION-class
   // attacks pass an HS256 jwk for an ES256-claimed token).
   jwtExternal._assertAlgKtyMatch(headerJson.alg, headerJson.jwk);
-  var pubKey;
-  try { pubKey = nodeCrypto.createPublicKey({ key: headerJson.jwk, format: "jwk" }); }
-  catch (e) {
-    throw new DbscError("dbsc/bad-jwk",
-      "verifyBindingAssertion: jwk could not be imported: " + ((e && e.message) || String(e)));
-  }
+  var pubKey = bCrypto.importPublicJwk(headerJson.jwk, {
+    errorClass:    DbscError,
+    code:          "dbsc/bad-jwk",
+    messagePrefix: "verifyBindingAssertion: jwk could not be imported: ",
+  });
   var signingInput = parts[0] + "." + parts[1];
   var sigBytes = Buffer.from(parts[2], "base64url");
   var ok;