@blamejs/blamejs-shop 0.4.56 → 0.4.58

package/lib/vendor/blamejs/lib/archive-tar-read.js

@@ -14,7 +14,9 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var safeBuffer = require("./safe-buffer");
 var archiveTar = require("./archive-tar");
+var archiveEntryPolicy = require("./archive-entry-policy");
 var atomicFile = require("./atomic-file");
+var auditEmit = require("./audit-emit");
 
 var TarError = archiveTar.TarError;
 var _parseHeader = archiveTar._parseHeader;
@@ -45,29 +47,16 @@ var DEFAULT_BOMB_POLICY = Object.freeze({
   maxExpansionRatio:         100,                                                    // tar has no compression-ratio concept, but keep field for orchestrator policy parity
 });
 
-var DEFAULT_ENTRY_TYPE_POLICY = Object.freeze({
-  symlinks:  false,
-  hardlinks: false,
-  devices:   false,
-  fifos:     false,
-  sockets:   false,
-});
+var DEFAULT_ENTRY_TYPE_POLICY = archiveEntryPolicy.DEFAULT_ENTRY_TYPE_POLICY;
 
 function _normalizeBombPolicy(p) {
   if (!p) return DEFAULT_BOMB_POLICY;
   return Object.freeze(Object.assign({}, DEFAULT_BOMB_POLICY, p));
 }
 
-function _normalizeEntryTypePolicy(p) {
-  if (!p) return DEFAULT_ENTRY_TYPE_POLICY;
-  return Object.freeze(Object.assign({}, DEFAULT_ENTRY_TYPE_POLICY, p));
-}
+var _normalizeEntryTypePolicy = archiveEntryPolicy.normalize;
 
-function _emitAudit(opts, action, outcome, metadata) {
-  if (!opts || !opts.audit || typeof opts.audit.safeEmit !== "function") return;
-  try { opts.audit.safeEmit({ action: action, outcome: outcome, metadata: metadata }); }
-  catch (_e) { /* drop-silent */ }
-}
+var _emitAudit = auditEmit.emitToSink;   // operator-sink audit emit (opts.audit)
 
 function _isZeroBlock(buf) {
   for (var i = 0; i < BLOCK_SIZE; i += 1) {

package/lib/vendor/blamejs/lib/archive.js

@@ -58,6 +58,7 @@ var nodeStream = require("node:stream");
 var streamPromises = require("node:stream/promises");
 var C = require("./constants");
 var { defineClass } = require("./framework-error");
+var auditEmit = require("./audit-emit");
 
 var ArchiveError = defineClass("ArchiveError", { alwaysPermanent: true });
 
@@ -481,16 +482,7 @@ function zip() {
     return buf.length;
   }
 
-  function _emitAudit(opts, action, outcome, metadata) {
-    if (!opts || !opts.audit || typeof opts.audit.safeEmit !== "function") return;
-    try {
-      opts.audit.safeEmit({
-        action:   action,
-        outcome:  outcome,
-        metadata: metadata,
-      });
-    } catch (_e) { /* drop-silent — audit sinks must never crash the producer */ }
-  }
+  var _emitAudit = auditEmit.emitToSink;   // operator-sink audit emit (opts.audit)
 
   function _writeChunk(writable, chunk) {
     return new Promise(function (resolve, reject) {

package/lib/vendor/blamejs/lib/arg-parser.js

@@ -36,6 +36,7 @@
  */
 
 var { defineClass } = require("./framework-error");
+var pick = require("./pick");
 
 var ArgParserError = defineClass("ArgParserError", { alwaysPermanent: true });
 
@@ -44,8 +45,8 @@ var SUPPORTED_TYPES = ["string", "number", "boolean", "list"];
 // Names operators can never use for a flag. Prototype-pollution defense:
 // even though the parser internally uses Object.create(null), downstream
 // callers spreading parsed.flags into a normal object would otherwise
-// overwrite the prototype.
-var FORBIDDEN_NAMES = ["__proto__", "constructor", "prototype"];
+// overwrite the prototype. The forbidden-name set is the framework's one
+// prototype-pollution key guard — pick.isPoisonedKey.
 
 function _isPlainNonEmpty(s) {
   return typeof s === "string" && s.length > 0;
@@ -56,7 +57,7 @@ function _validateFlagName(name) {
     throw new ArgParserError("arg-parser/flag-name-invalid",
       "flag name must be a non-empty string");
   }
-  if (FORBIDDEN_NAMES.indexOf(name) !== -1) {
+  if (pick.isPoisonedKey(name)) {
     throw new ArgParserError("arg-parser/flag-name-forbidden",
       "flag name '" + name + "' is reserved");
   }
@@ -298,7 +299,7 @@ function _consumeFlags(index, tokens) {
 
     if (tok.indexOf("--") === 0) {
       var rest = tok.slice(2);
-      if (FORBIDDEN_NAMES.indexOf(rest.split("=")[0]) !== -1) {
+      if (pick.isPoisonedKey(rest.split("=")[0])) {
         throw new ArgParserError("arg-parser/argv-forbidden-name",
           "flag '--" + rest.split("=")[0] + "' is reserved");
       }
@@ -672,14 +673,14 @@ function parseRaw(argv) {
       } else {
         val = true;
       }
-      if (FORBIDDEN_NAMES.indexOf(name) !== -1) {
+      if (pick.isPoisonedKey(name)) {
         throw new ArgParserError("arg-parser/argv-forbidden-name",
           "flag '--" + name + "' is reserved");
       }
       flags[name] = val;
     } else if (tok.indexOf("-") === 0 && tok.length === 2) {
       var s = tok.slice(1);
-      if (FORBIDDEN_NAMES.indexOf(s) !== -1) {
+      if (pick.isPoisonedKey(s)) {
         throw new ArgParserError("arg-parser/argv-forbidden-name",
           "flag '-" + s + "' is reserved");
       }

package/lib/vendor/blamejs/lib/asyncapi-traits.js

@@ -109,12 +109,8 @@ function _mergeKey(key, base, overlay) {
   if (typeof base === "object" && typeof overlay === "object" &&
       !Array.isArray(base) && !Array.isArray(overlay)) {
     var out = {};
-    for (var k1 in base) {
-      if (Object.prototype.hasOwnProperty.call(base, k1)) out[k1] = base[k1];
-    }
-    for (var k2 in overlay) {
-      if (Object.prototype.hasOwnProperty.call(overlay, k2)) out[k2] = overlay[k2];
-    }
+    validateOpts.assignOwnEnumerable(out, base);
+    validateOpts.assignOwnEnumerable(out, overlay);
     return out;
   }
   return overlay;        // scalar overrides

package/lib/vendor/blamejs/lib/atomic-file.js

@@ -703,39 +703,88 @@ function _validateMaxBytes(maxBytes) {
   }
 }
 
-function _readSyncCore(filepath, opts) {
-  _validateMaxBytes(opts.maxBytes);
-  // CodeQL js/file-system-race defense — TOCTOU-safe-read scaffold.
-  // Open the fd first, then fstat the same fd (so size + content
-  // measurement bind to the inode the fd holds open). An attacker
-  // can't swap the file between size-check and read because the fd
-  // is anchored to the original inode. ENOENT surfaces from open()
-  // rather than the previous existsSync() pre-check.
-  //
-  // The third argument pins an owner-only mode (0o600). The flag is
-  // read-only ("r" → O_RDONLY, no O_CREAT) so the mode is inert on
-  // disk, but specifying it keeps this open out of the insecure-temp-
-  // file class (CWE-377): the read can never create a world/group-
-  // accessible file even when `filepath` is rooted under a temp dir.
+/**
+ * @primitive b.atomicFile.fdSafeReadSync
+ * @signature b.atomicFile.fdSafeReadSync(filepath, opts?)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.atomicFile.readSync, b.atomicFile.read
+ *
+ * TOCTOU-safe synchronous file read (CWE-367 / js/file-system-race). Opens
+ * the path read-only, then binds every subsequent measurement — size,
+ * content, integrity — to the inode the fd holds open, so an attacker who
+ * swaps the file between stat and read can't change which bytes come back.
+ * The optional guards layer on top of that core: a byte cap (`maxBytes`),
+ * symlink refusal + inode-equality (`refuseSymlink` / `inodeCheck` — the
+ * strongest defense, for operator-writable source paths), an integrity
+ * hash (`expectedHash`, SHA3-512), and a short-read policy (throw, or
+ * slice when `allowShortRead`). Each caller maps a failure KIND to its own
+ * typed error via `errorFor`, so the message / code / audit posture stays
+ * per-domain; the default raises an `AtomicFileError`.
+ *
+ * @opts
+ *   mode:           number,    // open mode (default 0o600; inert under O_RDONLY)
+ *   maxBytes:       number,    // refuse a file larger than this (default: no cap)
+ *   refuseSymlink:  boolean,   // lstat + refuse a symlink source (default: false)
+ *   inodeCheck:     boolean,   // refuse if the fd inode != the lstat inode (needs refuseSymlink)
+ *   expectedHash:   string,    // SHA3-512 the content must match (default: none)
+ *   encoding:       string,    // decode to a string (default: return a Buffer)
+ *   allowShortRead: boolean,   // slice to the bytes read instead of throwing (default: false)
+ *   errorFor:       Function,  // (kind, detail) => Error|undefined; kinds: enoent / symlink / too-large / toctou / short-read / integrity
+ *
+ * @example
+ *   var cfg = b.atomicFile.fdSafeReadSync("/etc/app/config.json", {
+ *     maxBytes: b.constants.BYTES.mib(1),
+ *     encoding: "utf8",
+ *   });
+ */
+function fdSafeReadSync(filepath, opts) {
+  opts = opts || {};
+  var errorFor = opts.errorFor || function (kind, detail) {
+    return new AtomicFileError((detail && detail.message) || ("atomic-file: " + kind), "atomic-file/" + kind);
+  };
+  if (opts.maxBytes !== undefined) _validateMaxBytes(opts.maxBytes);
+  var mode = opts.mode === undefined ? 0o600 : opts.mode;
+  // refuseSymlink: lstat the path first and refuse a symlink source —
+  // the strongest TOCTOU posture (open() would follow the link). The
+  // fd's inode is re-checked against this lstat's inode below.
+  var lstat = null;
+  if (opts.refuseSymlink) {
+    lstat = nodeFs.lstatSync(filepath);
+    if (lstat.isSymbolicLink()) throw errorFor("symlink", { path: filepath });
+    if (opts.maxBytes !== undefined && lstat.size > opts.maxBytes) {
+      throw errorFor("too-large", { size: lstat.size, max: opts.maxBytes });
+    }
+  }
+  // The third argument pins an owner-only mode (0o600 default). The flag
+  // is read-only ("r" → O_RDONLY, no O_CREAT) so the mode is inert on
+  // disk, but specifying it keeps this open out of the insecure-temp-file
+  // class (CWE-377). ENOENT surfaces from open() rather than a pre-check;
+  // a caller's errorFor("enoent") may translate it, else it rethrows raw.
   var fd;
   try {
-    fd = nodeFs.openSync(filepath, "r", 0o600);
+    fd = nodeFs.openSync(filepath, "r", mode);
   } catch (openErr) {
     if (openErr && openErr.code === "ENOENT") {
-      var e = new AtomicFileError("file not found: " + filepath, "atomic-file/not-found");
-      e.code = "ENOENT";
-      throw e;
+      var typed = errorFor("enoent", { path: filepath, cause: openErr });
+      if (typed) throw typed;
     }
     throw openErr;
   }
   var buf;
   try {
     var fstat = nodeFs.fstatSync(fd);
-    if (fstat.size > opts.maxBytes) {
-      throw new AtomicFileError(
-        "file size " + fstat.size + " > maxBytes " + opts.maxBytes,
-        "atomic-file/too-large"
-      );
+    // inodeCheck: the fd must point at the same inode lstat saw — any
+    // swap between lstat and open is a TOCTOU and is refused. A file that
+    // GREW past the cap between lstat and open is the same class of swap,
+    // so under inodeCheck a post-open over-cap is reported as toctou; a
+    // plain (no-inodeCheck) reader reports an over-cap as too-large.
+    if (lstat && opts.inodeCheck) {
+      if (fstat.ino !== lstat.ino || (opts.maxBytes !== undefined && fstat.size > opts.maxBytes)) {
+        throw errorFor("toctou", { path: filepath });
+      }
+    } else if (opts.maxBytes !== undefined && fstat.size > opts.maxBytes) {
+      throw errorFor("too-large", { size: fstat.size, max: opts.maxBytes });
     }
     buf = Buffer.alloc(fstat.size);
     var read = 0;
@@ -745,10 +794,8 @@ function _readSyncCore(filepath, opts) {
       read += n;
     }
     if (read !== fstat.size) {
-      throw new AtomicFileError(
-        "short read: " + read + " of " + fstat.size + " bytes",
-        "atomic-file/short-read"
-      );
+      if (opts.allowShortRead) { buf = buf.slice(0, read); }
+      else { throw errorFor("short-read", { read: read, size: fstat.size }); }
     }
   } finally {
     try { nodeFs.closeSync(fd); } catch (_c) { /* close best-effort */ }
@@ -756,15 +803,44 @@ function _readSyncCore(filepath, opts) {
   if (opts.expectedHash) {
     var actual = sha3Hash(buf);
     if (actual !== opts.expectedHash) {
-      throw new AtomicFileError(
-        "integrity check failed: expected " + opts.expectedHash + " got " + actual,
-        "atomic-file/integrity"
-      );
+      throw errorFor("integrity", { expected: opts.expectedHash, actual: actual });
     }
   }
   return opts.encoding ? buf.toString(opts.encoding) : buf;
 }
 
+// Atomic-file's own reads route through fdSafeReadSync with an errorFor
+// that reproduces this module's exact codes + messages (a pure refactor).
+function _readSyncCore(filepath, opts) {
+  return fdSafeReadSync(filepath, {
+    mode:         0o600,
+    maxBytes:     opts.maxBytes,
+    expectedHash: opts.expectedHash,
+    encoding:     opts.encoding,
+    errorFor: function (kind, detail) {
+      if (kind === "enoent") {
+        var e = new AtomicFileError("file not found: " + filepath, "atomic-file/not-found");
+        e.code = "ENOENT";
+        return e;
+      }
+      if (kind === "too-large") {
+        return new AtomicFileError(
+          "file size " + detail.size + " > maxBytes " + detail.max, "atomic-file/too-large");
+      }
+      if (kind === "short-read") {
+        return new AtomicFileError(
+          "short read: " + detail.read + " of " + detail.size + " bytes", "atomic-file/short-read");
+      }
+      if (kind === "integrity") {
+        return new AtomicFileError(
+          "integrity check failed: expected " + detail.expected + " got " + detail.actual,
+          "atomic-file/integrity");
+      }
+      return new AtomicFileError("atomic-file: " + kind, "atomic-file/" + kind);
+    },
+  });
+}
+
 /**
  * @primitive b.atomicFile.writeJson
  * @signature b.atomicFile.writeJson(filepath, value, opts)
@@ -1066,6 +1142,7 @@ module.exports = {
   writeSync:         writeSync,
   read:              read,
   readSync:          readSync,
+  fdSafeReadSync:    fdSafeReadSync,
   writeJson:         writeJson,
   readJson:          readJson,
   copy:              copy,

package/lib/vendor/blamejs/lib/audit-chain.js

@@ -38,6 +38,7 @@ var C = require("./constants");
 var clusterStorage = require("./cluster-storage");
 var frameworkSchema = require("./framework-schema");
 var sql = require("./sql");
+var safeSql = require("./safe-sql");
 var { sha3Hash } = require("./crypto");
 
 // b.sql opts for the chain read SQL these primitives compose. The reader
@@ -135,7 +136,7 @@ function computeRowHash(prevHash, rowFields, nonce) {
 
 /**
  * @primitive b.auditChain.getChainTip
- * @signature b.auditChain.getChainTip(queryOneAsync, tableName)
+ * @signature b.auditChain.getChainTip(queryOneAsync, tableName, opts?)
  * @since     0.4.0
  * @related   b.auditChain.verifyChain, b.auditChain.computeRowHash
  *
@@ -146,6 +147,14 @@ function computeRowHash(prevHash, rowFields, nonce) {
  * drivers can use any await-able query function of the shape
  * `async (sql, params?) -> row | null`.
  *
+ * Pass `{ chainKey, keyValue }` to scope the tip to one partition of a
+ * multi-chain table (one chain per account / device / tenant) — the tip read
+ * filters `WHERE <chainKey> = ?` with the value bound, never interpolated.
+ *
+ * @opts
+ *   chainKey:  string,   // partition column for a multi-chain table
+ *   keyValue:  any,      // the partition value to scope the tip to (bound)
+ *
  * @example
  *   async function queryOne(sql) {
  *     var rows = await myDriver.query(sql);
@@ -154,16 +163,22 @@ function computeRowHash(prevHash, rowFields, nonce) {
  *   var tip = await b.auditChain.getChainTip(queryOne, "audit_log");
  *   // → { prevHash: "<128-char hex>", counter: 4217 }
  */
-async function getChainTip(queryOneAsync, tableName) {
+async function getChainTip(queryOneAsync, tableName, opts) {
+  opts = opts || {};
   // Emit a BARE logical table name — the operator-supplied reader routes
   // through clusterStorage, which rewrites bare framework names to the
   // configured-prefix form and placeholderizes. b.sql quotes the camelCase
-  // columns + runs the output validator.
-  var built = sql.select(tableName, _sqlOpts())
+  // columns + runs the output validator. A chainKey scopes the tip to one
+  // partition; the key value binds as a ? placeholder.
+  var q = sql.select(tableName, _sqlOpts())
     .columns(["rowHash", "monotonicCounter"])
     .orderBy("monotonicCounter", "desc")
-    .limit(1)
-    .toSql();
+    .limit(1);
+  if (opts.chainKey) {
+    safeSql.validateIdentifier(opts.chainKey);
+    q = q.where(opts.chainKey, opts.keyValue);
+  }
+  var built = q.toSql();
   var row = await queryOneAsync(built.sql, built.params);
   if (!row) return { prevHash: ZERO_HASH, counter: 0 };
   // Normalize driver shape (Postgres returns BIGINT monotonicCounter as a
@@ -192,60 +207,30 @@ async function getChainTip(queryOneAsync, tableName) {
  * after a successful archive and lets the chain math survive deletion
  * of historical rows without the archive bundle as source of truth.
  *
+ * Pass `{ chainKey }` to verify a MULTI-chain table partitioned by a key
+ * column (one chain per account / device / tenant): each key's sub-chain is
+ * walked independently from `ZERO_HASH`, and the first break in any key returns
+ * `{ ok:false, chainKey, breakAt, ... }`. Under `chainKey`, `maxRows` is
+ * per-sub-chain and `maxChains` bounds the partition fan-out, failing closed
+ * when exceeded. The `audit_log` purge-anchor logic is single-chain-only and
+ * is skipped when a `chainKey` is given.
+ *
  * @opts
- *   {
- *     maxRows?: number,   // stop after N rows (default: walk every row)
- *   }
+ *   maxRows:   number,   // stop after N rows per (sub-)chain (default: walk every row)
+ *   chainKey:  string,   // partition column — verify each sub-chain independently
+ *   maxChains: number,   // max partitions to verify under chainKey (default 100000; fails closed)
  *
  * @example
  *   async function queryAll(sql) { return await myDriver.query(sql); }
  *   var result = await b.auditChain.verifyChain(queryAll, "audit_log", {});
  *   // → { ok: true, table: "audit_log", rowsVerified: 4217, lastHash: "<hex>" }
  */
-async function verifyChain(queryAllAsync, tableName, opts) {
-  opts = opts || {};
-
-  var prevHash = ZERO_HASH;
-  var skipBeforeCounter = 0;
-  if (tableName === "audit_log") {
-    var anchor;
-    try {
-      // External-only table whose LOGICAL name IS the `_blamejs_`-prefixed
-      // name (self-mapped in LOCAL_TO_EXTERNAL), passed bare so the reader's
-      // clusterStorage rewrites it; the 'audit' scope binds as a ? param.
-      // allow:hand-rolled-sql — bare logical key.
-      var anchorBuilt = sql.select("_blamejs_audit_purge_anchor", _sqlOpts())   // allow:hand-rolled-sql
-        .columns(["lastPurgedCounter", "lastPurgedRowHash"])
-        .where("scope", "audit")
-        .toSql();
-      anchor = await queryAllAsync(anchorBuilt.sql, anchorBuilt.params);
-    } catch (_e) {
-      // Anchor table may not exist on a deployment that has never been
-      // through a purge. Treat as no anchor.
-      anchor = [];
-    }
-    if (Array.isArray(anchor) && anchor.length > 0) {
-      prevHash = anchor[0].lastPurgedRowHash;
-      skipBeforeCounter = Number(anchor[0].lastPurgedCounter);
-    }
-  }
-
-  var rowsBuilt = sql.select(tableName, _sqlOpts())
-    .orderBy("monotonicCounter", "asc")
-    .toSql();
-  var rows = await queryAllAsync(rowsBuilt.sql, rowsBuilt.params);
-  // Normalize driver shape before hashing: node-postgres returns BIGINT
-  // columns (recordedAt / monotonicCounter) as strings, which would hash
-  // differently from the numbers the chain-writer signed — the chain only
-  // verified on SQLite without this. coerceRow makes the recompute
-  // type-stable across backends (no-op on already-numeric SQLite rows).
-  rows = frameworkSchema.coerceRows(rows);
-  if (skipBeforeCounter > 0) {
-    rows = rows.filter(function (r) {
-      return Number(r.monotonicCounter) > skipBeforeCounter;
-    });
-  }
-
+// Walk one (sub-)chain forward from startPrevHash, recomputing each row's
+// hash. Returns the same { ok, table, rowsVerified, lastHash | breakAt... }
+// shape verifyChain documents. Shared by the single-chain path and each
+// per-key partition.
+function _walkRows(rows, tableName, startPrevHash, opts) {
+  var prevHash = startPrevHash;
   if (rows.length === 0) {
     return { ok: true, table: tableName, rowsVerified: 0, lastHash: prevHash };
   }
@@ -293,6 +278,101 @@ async function verifyChain(queryAllAsync, tableName, opts) {
   return { ok: true, table: tableName, rowsVerified: rows.length, lastHash: prevHash };
 }
 
+async function verifyChain(queryAllAsync, tableName, opts) {
+  opts = opts || {};
+
+  // Multi-chain table: verify each partition independently. Each key's
+  // sub-chain anchors at ZERO_HASH and is walked in monotonic-counter order;
+  // the first break in ANY key returns { ok:false, chainKey, ... }. maxRows is
+  // per-sub-chain; maxChains bounds the partition fan-out (fails closed when
+  // exceeded). The audit_log purge-anchor logic is single-chain-only, so it is
+  // skipped under a chainKey.
+  if (opts.chainKey) {
+    safeSql.validateIdentifier(opts.chainKey);
+    var keysBuilt = sql.select(tableName, _sqlOpts())
+      .distinct()
+      .columns([opts.chainKey])
+      .orderBy(opts.chainKey, "asc")
+      .toSql();
+    // coerce so a Postgres INTEGER/BIGINT chainKey is type-stable in the
+    // reported break-shape and the per-key WHERE bind, matching SQLite.
+    var keyRows = frameworkSchema.coerceRows(await queryAllAsync(keysBuilt.sql, keysBuilt.params));
+    var maxChains = (typeof opts.maxChains === "number" && opts.maxChains > 0) ? opts.maxChains : 100000;   // allow:numeric-opt-Infinity — partition fan-out cap; non-number / <=0 falls back to the default
+    if (keyRows.length > maxChains) {
+      return {
+        ok:           false,
+        table:        tableName,
+        rowsVerified: 0,
+        reason:       "too many chains: " + keyRows.length + " partitions exceeds maxChains " + maxChains,
+      };
+    }
+    var totalVerified = 0;
+    var lastHashByKey = {};
+    for (var ki = 0; ki < keyRows.length; ki++) {
+      var keyValue = keyRows[ki][opts.chainKey];
+      var rowsBuiltK = sql.select(tableName, _sqlOpts())
+        .where(opts.chainKey, keyValue)
+        .orderBy("monotonicCounter", "asc")
+        .toSql();
+      var rowsK = frameworkSchema.coerceRows(await queryAllAsync(rowsBuiltK.sql, rowsBuiltK.params));
+      var resK = _walkRows(rowsK, tableName, ZERO_HASH, opts);
+      if (!resK.ok) { resK.chainKey = keyValue; return resK; }
+      totalVerified += resK.rowsVerified;
+      lastHashByKey[String(keyValue)] = resK.lastHash;
+    }
+    return {
+      ok:           true,
+      table:        tableName,
+      rowsVerified: totalVerified,
+      chains:       keyRows.length,
+      lastHashByKey: lastHashByKey,
+    };
+  }
+
+  var prevHash = ZERO_HASH;
+  var skipBeforeCounter = 0;
+  if (tableName === "audit_log") {
+    var anchor;
+    try {
+      // External-only table whose LOGICAL name IS the `_blamejs_`-prefixed
+      // name (self-mapped in LOCAL_TO_EXTERNAL), passed bare so the reader's
+      // clusterStorage rewrites it; the 'audit' scope binds as a ? param.
+      // allow:hand-rolled-sql — bare logical key.
+      var anchorBuilt = sql.select("_blamejs_audit_purge_anchor", _sqlOpts())   // allow:hand-rolled-sql
+        .columns(["lastPurgedCounter", "lastPurgedRowHash"])
+        .where("scope", "audit")
+        .toSql();
+      anchor = await queryAllAsync(anchorBuilt.sql, anchorBuilt.params);
+    } catch (_e) {
+      // Anchor table may not exist on a deployment that has never been
+      // through a purge. Treat as no anchor.
+      anchor = [];
+    }
+    if (Array.isArray(anchor) && anchor.length > 0) {
+      prevHash = anchor[0].lastPurgedRowHash;
+      skipBeforeCounter = Number(anchor[0].lastPurgedCounter);
+    }
+  }
+
+  var rowsBuilt = sql.select(tableName, _sqlOpts())
+    .orderBy("monotonicCounter", "asc")
+    .toSql();
+  var rows = await queryAllAsync(rowsBuilt.sql, rowsBuilt.params);
+  // Normalize driver shape before hashing: node-postgres returns BIGINT
+  // columns (recordedAt / monotonicCounter) as strings, which would hash
+  // differently from the numbers the chain-writer signed — the chain only
+  // verified on SQLite without this. coerceRow makes the recompute
+  // type-stable across backends (no-op on already-numeric SQLite rows).
+  rows = frameworkSchema.coerceRows(rows);
+  if (skipBeforeCounter > 0) {
+    rows = rows.filter(function (r) {
+      return Number(r.monotonicCounter) > skipBeforeCounter;
+    });
+  }
+
+  return _walkRows(rows, tableName, prevHash, opts);
+}
+
 module.exports = {
   ZERO_HASH:      ZERO_HASH,
   canonicalize:   canonicalize,

package/lib/vendor/blamejs/lib/audit-daily-review.js

@@ -164,20 +164,30 @@ function create(opts) {
     throw _err("auditDailyReview/audit-query-missing",
       "auditDailyReview.create: opts.audit.query must be a function");
   }
-  validateOpts.optionalFunction(opts.notify,
-    "auditDailyReview: notify", AuditDailyReviewError, "auditDailyReview/bad-notify");
-  validateOpts.optionalFunction(opts.classify,
-    "auditDailyReview: classify", AuditDailyReviewError, "auditDailyReview/bad-classify");
-  validateOpts.optionalFunction(opts.now,
-    "auditDailyReview: now", AuditDailyReviewError, "auditDailyReview/bad-now");
-  validateOpts.optionalNonEmptyString(opts.posture,
-    "auditDailyReview: posture", AuditDailyReviewError, "auditDailyReview/bad-posture");
-  validateOpts.optionalNonEmptyString(opts.cron,
-    "auditDailyReview: cron", AuditDailyReviewError, "auditDailyReview/bad-cron");
-  validateOpts.optionalPositiveInt(opts.queryLimit,
-    "auditDailyReview: queryLimit", AuditDailyReviewError, "auditDailyReview/bad-querylimit");
-  validateOpts.optionalPositiveInt(opts.historyLimit,
-    "auditDailyReview: historyLimit", AuditDailyReviewError, "auditDailyReview/bad-historylimit");
+  validateOpts.shape(opts, {
+    audit:        { methods: ["query", "safeEmit"] },
+    notify:       { rule: "optional-function",     code: "auditDailyReview/bad-notify" },
+    classify:     { rule: "optional-function",     code: "auditDailyReview/bad-classify" },
+    now:          { rule: "optional-function",     code: "auditDailyReview/bad-now" },
+    posture:      { rule: "optional-string",       code: "auditDailyReview/bad-posture" },
+    cron:         { rule: "optional-string",       code: "auditDailyReview/bad-cron" },
+    severityThreshold: { rule: "optional-string",  code: "auditDailyReview/bad-severity" },
+    queryLimit:   { rule: "optional-positive-int", code: "auditDailyReview/bad-querylimit" },
+    historyLimit: { rule: "optional-positive-int", code: "auditDailyReview/bad-historylimit" },
+    // lookbackHours — positive finite number (hours, not bytes). Bespoke
+    // check preserves the auditDailyReview/bad-lookback code the message
+    // below depends on; a positive-int token would reject fractional hours.
+    lookbackHours: function (value, label) {
+      if (value === undefined || value === null) return;
+      if (typeof value !== "number" || !isFinite(value) || value <= 0) {
+        throw _err("auditDailyReview/bad-lookback",
+          "auditDailyReview.create: lookbackHours must be a positive finite number");
+      }
+    },
+  }, "auditDailyReview", AuditDailyReviewError, "auditDailyReview/bad-opts",
+     // scheduler is forwarded to the b.scheduler instance at start() and not
+     // validated locally at create-time (start() requires it on its own).
+     { allow: ["scheduler"] });
 
   // lookbackHours — default 24 per PCI DSS 4.0 daily cadence. Caller can
   // pass weekly / monthly via larger numbers.