@blamejs/blamejs-shop 0.4.68 → 0.4.70

package/lib/vendor/blamejs/lib/request-helpers.js

@@ -44,6 +44,11 @@
 var structuredFields = require("./structured-fields");
 var pick = require("./pick");
 var codepointClass = require("./codepoint-class");
+var lazyRequire = require("./lazy-require");
+// Lazy — ssrf-guard pulls in the network/DNS stack, and request-helpers is
+// required very early in the boot graph. Only touched at middleware-construction
+// time by trustedClientIp(), never on the hot path.
+var _ssrfGuard = lazyRequire(function () { return require("./ssrf-guard"); });
 
 var HTTP_STATUS = Object.freeze({
   OK:                            0xC8,
@@ -214,15 +219,24 @@ function resolveActorWithOverride(callerOpts, baseOverride) {
  *
  * Resolve the originating client IP from a request. Default reads
  * only `req.socket.remoteAddress` — `X-Forwarded-For` is ignored
- * because without a sanitizing reverse proxy it's
- * attacker-forgeable. Behind a trusted proxy, operators opt in via
- * `trustProxy: true` (use the leftmost XFF hop) or
- * `trustProxy: <N>` (skip N trusted hops from the right and return
- * the Nth-from-rightmost). Returns `null` when no address can be
- * read — never throws.
+ * because without a sanitizing reverse proxy it's attacker-forgeable.
+ *
+ * For an access-control decision (allowlist, rate-limit key, IP-bound
+ * grant), pass `trustProxy` as a PREDICATE `function(addr) => boolean`
+ * naming your trusted reverse proxies. The header is then honored only
+ * when the immediate TCP peer is itself a trusted proxy, and the client
+ * is the first untrusted address walking the chain right-to-left. A
+ * direct attacker cannot forge it — this is the only peer-gated form.
+ *
+ * The legacy `trustProxy: true` (leftmost XFF hop) and `trustProxy: <N>`
+ * (Nth-from-rightmost) forms do NOT verify the peer: a client connecting
+ * directly can forge any value. They are safe only when an upstream you
+ * control terminates and rewrites X-Forwarded-For on every request — never
+ * for a security decision on an internet-facing listener. Prefer the
+ * predicate form. Returns `null` when no address can be read — never throws.
  *
  * @opts
- *   trustProxy: boolean | number   // false (default) | true | hop count
+ *   trustProxy: boolean | number | function   // false (default) | predicate (peer-gated) | legacy true/hop-count
  *
  * @example
  *   var req = {
@@ -232,30 +246,55 @@ function resolveActorWithOverride(callerOpts, baseOverride) {
  *   b.requestHelpers.clientIp(req);
  *   // → "10.0.0.1"   (forwarded headers ignored by default)
  *
- *   b.requestHelpers.clientIp(req, { trustProxy: true });
- *   // → "203.0.113.7"   (leftmost XFF hop)
+ *   var fromTrusted = function (a) { return a.indexOf("10.") === 0; };
+ *   b.requestHelpers.clientIp(req, { trustProxy: fromTrusted });
+ *   // → "203.0.113.7"   (peer 10.0.0.1 trusted; first untrusted hop)
  *
- *   b.requestHelpers.clientIp(req, { trustProxy: 1 });
- *   // → "10.0.0.5"   (1 trusted hop from the right)
+ *   var forged = { socket: { remoteAddress: "198.51.100.66" },
+ *                  headers: { "x-forwarded-for": "203.0.113.7" } };
+ *   b.requestHelpers.clientIp(forged, { trustProxy: fromTrusted });
+ *   // → "198.51.100.66"   (peer untrusted → forged header ignored)
  *
  *   b.requestHelpers.clientIp(undefined);
  *   // → null
  */
 function clientIp(req, opts) {
   if (!req) return null;
+  var socketAddr =
+    (req.socket && typeof req.socket.remoteAddress === "string" && req.socket.remoteAddress) ? req.socket.remoteAddress
+    : (req.connection && typeof req.connection.remoteAddress === "string" && req.connection.remoteAddress) ? req.connection.remoteAddress
+    : null;
   var trust = opts && opts.trustProxy;
   if (trust && req.headers) {
     var xff = req.headers["x-forwarded-for"];
     if (xff) {
       var hops = parseListHeader(xff);
-      if (trust === true) return hops[0];
-      if (typeof trust === "number" && trust >= 1 && hops.length >= trust) {
-        return hops[hops.length - trust];
+      if (hops.length) {
+        if (typeof trust === "function") {
+          // Peer-gated resolution: `trust(addr)` names the trusted reverse
+          // proxies. X-Forwarded-For is honored ONLY when the immediate TCP
+          // peer is itself a trusted proxy; the real client is then the first
+          // untrusted address walking the chain right-to-left (each hop is
+          // appended by the proxy that observed it). A direct attacker — whose
+          // socket peer is not a trusted proxy — cannot forge the result: the
+          // forgeable header is ignored and we fall through to the socket
+          // address. This is the only form safe for an access-control decision.
+          if (socketAddr && trust(socketAddr)) {
+            for (var i = hops.length - 1; i >= 0; i--) {
+              if (!trust(hops[i])) return hops[i];
+            }
+            return hops[0];   // entire chain trusted — earliest claimed client
+          }
+          // peer is not a trusted proxy → ignore forgeable XFF, fall through
+        } else if (trust === true) {
+          return hops[0];
+        } else if (typeof trust === "number" && trust >= 1 && hops.length >= trust) {
+          return hops[hops.length - trust];
+        }
       }
     }
   }
-  if (req.socket && typeof req.socket.remoteAddress === "string") return req.socket.remoteAddress;
-  if (req.connection && typeof req.connection.remoteAddress === "string") return req.connection.remoteAddress;
+  if (socketAddr) return socketAddr;
   // Express-shaped requests expose the resolved client address as `req.ip`
   // (Express derives it from the socket, honoring its own trust-proxy
   // setting) without a `socket.remoteAddress` surface. Fall back to it so a
@@ -266,6 +305,125 @@ function clientIp(req, opts) {
   return null;
 }
 
+/**
+ * @primitive b.requestHelpers.trustedClientIp
+ * @signature b.requestHelpers.trustedClientIp(opts?)
+ * @since     0.15.14
+ * @related   b.requestHelpers.clientIp
+ *
+ * Build a peer-gated client-IP resolver for an access-control decision
+ * (allowlist, rate-limit key, IP-bound grant). The bare `trustProxy`
+ * forms of `clientIp` are forgeable; this is the shape every gate shares
+ * so the trust model is identical across them. Returns
+ * `{ resolve(req), peerGated }`: `resolve` reads the client IP, `peerGated`
+ * is true when `trustedProxies` or `clientIpResolver` was supplied — a
+ * gate uses it to refuse a bare `trustProxy` at construction (fail closed).
+ *
+ * With `clientIpResolver(req)` the operator owns resolution entirely. With
+ * `trustedProxies` (CIDRs of the reverse proxies), `X-Forwarded-For` is
+ * honored only when the immediate peer is one of them. With neither, only
+ * the socket address is used and forwarded headers are ignored.
+ *
+ * @opts
+ *   trustedProxies:   string | string[],          // CIDRs — peer-gate X-Forwarded-For
+ *   clientIpResolver: function(req): string|null,  // own resolution entirely
+ *
+ * @example
+ *   var tip = b.requestHelpers.trustedClientIp({ trustedProxies: ["10.0.0.0/8"] });
+ *   var ip  = tip.resolve(req);   // peer-gated; forged XFF from a direct caller ignored
+ */
+// Build the trusted-proxy predicate shared by trustedClientIp / trustedProtocol.
+// Validates each CIDR (a CIDR is valid iff it contains its own network address,
+// reusing the same matcher the predicate uses so format rules can't diverge) and
+// returns fn(addr)=>boolean, or null when no trustedProxies were given. `where`
+// names the calling helper for the error message.
+function _trustedProxyPredicate(trustedProxies, where) {
+  if (!trustedProxies || !trustedProxies.length) return null;
+  var ssrfGuard = _ssrfGuard();
+  for (var i = 0; i < trustedProxies.length; i++) {
+    var cidr = trustedProxies[i];
+    var slash = typeof cidr === "string" ? cidr.indexOf("/") : -1;
+    if (slash === -1 || !ssrfGuard.cidrContains(cidr, cidr.slice(0, slash))) {
+      throw new TypeError(where + ": trustedProxies[" + i + "] is not a valid CIDR, got " + JSON.stringify(cidr));
+    }
+  }
+  return function (addr) {
+    // Fold an IPv4-mapped IPv6 peer (::ffff:a.b.c.d, common on a dual-stack
+    // listener) to its dotted IPv4 form so it matches an IPv4 trustedProxies
+    // CIDR — cidrContains rejects a cross-family compare, so without this a
+    // mapped proxy peer reads as untrusted and X-Forwarded-* is ignored. Only
+    // the ::ffff:0:0/96 block folds (canonicalizeHost leaves NAT64 / 6to4 as
+    // IPv6), so this can't widen the trusted set.
+    var canon = ssrfGuard.canonicalizeHost(addr);
+    for (var j = 0; j < trustedProxies.length; j++) {
+      if (ssrfGuard.cidrContains(trustedProxies[j], canon)) return true;
+    }
+    return false;
+  };
+}
+
+function _normTrustedProxies(opts) {
+  return Array.isArray(opts.trustedProxies) ? opts.trustedProxies.slice()
+    : (typeof opts.trustedProxies === "string" && opts.trustedProxies.length ? [opts.trustedProxies] : []);
+}
+
+function trustedClientIp(opts) {
+  opts = opts || {};
+  var resolver = opts.clientIpResolver;
+  if (resolver != null && typeof resolver !== "function") {
+    throw new TypeError("trustedClientIp: clientIpResolver must be a function(req) => ip|null");
+  }
+  var predicate = _trustedProxyPredicate(_normTrustedProxies(opts), "trustedClientIp");
+  return {
+    peerGated: !!(resolver || predicate),
+    resolve: function (req) {
+      if (resolver) return resolver(req);
+      if (predicate) return clientIp(req, { trustProxy: predicate });
+      return clientIp(req, { trustProxy: false });
+    },
+  };
+}
+
+/**
+ * @primitive b.requestHelpers.trustedProtocol
+ * @signature b.requestHelpers.trustedProtocol(opts?)
+ * @since     0.15.14
+ * @related   b.requestHelpers.requestProtocol, b.requestHelpers.trustedClientIp
+ *
+ * Peer-gated companion to trustedClientIp for the request scheme. The
+ * Secure-cookie / HSTS / secure-context decisions hinge on whether a request
+ * arrived over HTTPS; behind a TLS-terminating proxy that comes from
+ * X-Forwarded-Proto, which is forgeable unless the immediate peer is a trusted
+ * proxy. Returns `{ resolve(req)=>"http"|"https", peerGated }`. With
+ * `trustedProxies` (CIDRs) the header is honored only from a trusted peer; with
+ * `protocolResolver(req)` the operator owns the decision; with neither only the
+ * real TLS socket is consulted (forwarded headers ignored).
+ *
+ * @opts
+ *   trustedProxies:   string | string[],
+ *   protocolResolver: function(req): "http"|"https",
+ *
+ * @example
+ *   var tp = b.requestHelpers.trustedProtocol({ trustedProxies: ["10.0.0.0/8"] });
+ *   tp.resolve(req);   // "https" only when X-Forwarded-Proto came via a trusted peer
+ */
+function trustedProtocol(opts) {
+  opts = opts || {};
+  var resolver = opts.protocolResolver;
+  if (resolver != null && typeof resolver !== "function") {
+    throw new TypeError("trustedProtocol: protocolResolver must be a function(req) => 'http'|'https'");
+  }
+  var predicate = _trustedProxyPredicate(_normTrustedProxies(opts), "trustedProtocol");
+  return {
+    peerGated: !!(resolver || predicate),
+    resolve: function (req) {
+      if (resolver) return resolver(req);
+      if (predicate) return requestProtocol(req, { trustProxy: predicate });
+      return requestProtocol(req, { trustProxy: false });
+    },
+  };
+}
+
 /**
  * @primitive b.requestHelpers.requestProtocol
  * @signature b.requestHelpers.requestProtocol(req, opts?)
@@ -274,14 +432,17 @@ function clientIp(req, opts) {
  *
  * Resolve the inbound transport scheme. Default returns `"https"`
  * when `req.socket.encrypted` is set, otherwise `"http"`. Behind a
- * trusted reverse proxy that terminates TLS, set `trustProxy: true`
- * to read the leftmost `X-Forwarded-Proto` hop instead — without
- * the explicit opt-in the framework refuses to pick up the
- * attacker-forgeable header. Always returns a string; on bad input
- * falls back to `"http"`.
+ * trusted reverse proxy that terminates TLS, pass `trustProxy` as a
+ * PREDICATE `function(addr)=>boolean` naming your proxies:
+ * `X-Forwarded-Proto` is then honored only when the immediate peer is
+ * a trusted proxy, so a direct caller can't forge it (use
+ * `b.requestHelpers.trustedProtocol` to build this). The legacy
+ * `trustProxy: true` reads the leftmost hop without checking the peer —
+ * forgeable, safe only behind an edge that rewrites the header. Always
+ * returns a string; on bad input falls back to `"http"`.
  *
  * @opts
- *   trustProxy: boolean   // false (default) | true
+ *   trustProxy: boolean | function   // false (default) | predicate (peer-gated) | legacy true
  *
  * @example
  *   var req = { socket: { encrypted: true } };
@@ -305,7 +466,22 @@ function requestProtocol(req, opts) {
     var fwd = req.headers["x-forwarded-proto"];
     if (typeof fwd === "string" && fwd.length > 0) {
       var hops = parseListHeader(fwd, { lowercase: true });
-      if (hops.length > 0) return hops[0];
+      if (hops.length > 0) {
+        if (typeof trust === "function") {
+          // Peer-gated: honor X-Forwarded-Proto only when the immediate TCP
+          // peer is a trusted proxy. A direct caller's forged header is
+          // ignored — fall through to the real TLS socket. The only form safe
+          // for a Secure-cookie / HSTS / secure-context decision.
+          var peer =
+            (req.socket && typeof req.socket.remoteAddress === "string" && req.socket.remoteAddress) ? req.socket.remoteAddress
+            : (req.connection && typeof req.connection.remoteAddress === "string" && req.connection.remoteAddress) ? req.connection.remoteAddress
+            : null;
+          if (peer && trust(peer)) return hops[0];
+          // peer not a trusted proxy → ignore forgeable header, fall through
+        } else {
+          return hops[0];   // legacy true/number — spoofable, see docstring
+        }
+      }
     }
   }
   if (req.socket && req.socket.encrypted) return "https";
@@ -890,7 +1066,9 @@ module.exports = {
   parseListHeader:           parseListHeader,
   // proxy-trust primitives (default refuses forwarded headers)
   clientIp:                  clientIp,
+  trustedClientIp:           trustedClientIp,
   requestProtocol:           requestProtocol,
+  trustedProtocol:           trustedProtocol,
   appendVary:                appendVary,
   // CVE-2026-21710 wrap — safe alternative to req.headersDistinct
   safeHeadersDistinct:       safeHeadersDistinct,

package/lib/vendor/blamejs/lib/resource-access-lock.js

@@ -49,7 +49,7 @@ function create(opts) {
   validateOpts.requireNonEmptyString(opts.resource, "resource",
     ResourceAccessLockError, "resource-access-lock/no-resource");
   var startMode = opts.startMode || "open";
-  if (!VALID_MODES[startMode]) {
+  if (!Object.prototype.hasOwnProperty.call(VALID_MODES, startMode)) {
     throw new ResourceAccessLockError(
       "resource-access-lock/bad-start-mode",
       "startMode must be one of: " + Object.keys(VALID_MODES).join(" / "));
@@ -71,12 +71,12 @@ function create(opts) {
   function permits(action) {
     if (mode === "open") return true;
     if (mode === "locked") return false;
-    return !!READ_ACTIONS[action];
+    return !!Object.prototype.hasOwnProperty.call(READ_ACTIONS, action);
   }
 
   function set(newMode, ctx) {
     ctx = ctx || {};
-    if (!VALID_MODES[newMode]) {
+    if (!Object.prototype.hasOwnProperty.call(VALID_MODES, newMode)) {
       throw new ResourceAccessLockError(
         "resource-access-lock/bad-mode",
         "set: mode must be one of: " + Object.keys(VALID_MODES).join(" / "));

package/lib/vendor/blamejs/lib/restore-bundle.js

@@ -48,6 +48,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("./atomic-file");
+var C = require("./constants");
 var backupCrypto = require("./backup/crypto");
 var backupManifest = require("./backup/manifest");
 var validateOpts = require("./validate-opts");
@@ -146,13 +147,21 @@ async function extract(opts) {
   // 1. Read + parse + validate manifest
   _emit(progress, { phase: "read_manifest" });
   var manifestPath = nodePath.join(bundleDir, "manifest.json");
-  if (!nodeFs.existsSync(manifestPath)) {
-    throw new RestoreBundleError("restore-bundle/missing-manifest",
-      "extract: bundleDir has no manifest.json — bundle is incomplete or not a blamejs backup");
-  }
+  // Capped fd-bound read OUTSIDE the parse try/catch, so a missing / oversized
+  // bundle manifest surfaces the precise restore-bundle code (not a generic
+  // parse error). A backup manifest is small JSON; 4 MiB bounds a hostile one
+  // before backupManifest.parse materializes it.
+  var manifestRaw = atomicFile.fdSafeReadSync(manifestPath, {
+    maxBytes: C.BYTES.mib(4), encoding: "utf8",
+    errorFor: function (kind, detail) {
+      if (kind === "enoent") return new RestoreBundleError("restore-bundle/missing-manifest", "extract: bundleDir has no manifest.json — bundle is incomplete or not a blamejs backup");
+      if (kind === "too-large") return new RestoreBundleError("restore-bundle/bad-manifest", "extract: manifest.json exceeds " + detail.max + " bytes");
+      return new RestoreBundleError("restore-bundle/bad-manifest", "extract: manifest unreadable: " + kind);
+    },
+  });
   var manifest;
   try {
-    manifest = backupManifest.parse(nodeFs.readFileSync(manifestPath, "utf8"));
+    manifest = backupManifest.parse(manifestRaw);
   } catch (e) {
     if (e && e.isBackupManifestError) throw e;
     throw new RestoreBundleError("restore-bundle/bad-manifest",
@@ -216,12 +225,20 @@ async function extract(opts) {
       }
 
       var blobPath = nodePath.join(bundleDir, entry.encryptedPath);
-      if (!nodeFs.existsSync(blobPath)) {
-        throw new RestoreBundleError("restore-bundle/missing-blob",
-          "extract: manifest references '" + entry.encryptedPath +
-          "' but the bundle has no such file");
-      }
-      var blob = nodeFs.readFileSync(blobPath);
+      // Cap the read to the manifest's declared encryptedSize so an oversize-on-
+      // disk blob is refused BEFORE it is read into memory (was: read fully, then
+      // compare → an OOM window for a huge swapped blob). A valid blob is exactly
+      // encryptedSize; the post-read compare still catches the under-size case.
+      var blobCap = (typeof entry.encryptedSize === "number" && entry.encryptedSize > 0)
+        ? entry.encryptedSize : C.BYTES.gib(8);
+      var blob = atomicFile.fdSafeReadSync(blobPath, {
+        maxBytes: blobCap,
+        errorFor: function (kind, detail) {
+          if (kind === "enoent") return new RestoreBundleError("restore-bundle/missing-blob", "extract: manifest references '" + entry.encryptedPath + "' but the bundle has no such file");
+          if (kind === "too-large") return new RestoreBundleError("restore-bundle/size-mismatch", "extract: blob '" + entry.encryptedPath + "' has size " + detail.size + " but manifest expected " + entry.encryptedSize);
+          return new RestoreBundleError("restore-bundle/missing-blob", "extract: blob '" + entry.encryptedPath + "' unreadable: " + kind);
+        },
+      });
       if (blob.length !== entry.encryptedSize) {
         throw new RestoreBundleError("restore-bundle/size-mismatch",
           "extract: blob '" + entry.encryptedPath + "' has size " + blob.length +
@@ -235,12 +252,18 @@ async function extract(opts) {
 
       var plaintext;
       try {
-        plaintext = await backupCrypto.decryptWithPassphrase(blob, passphrase, entry.salt);
+        // Bundles written with manifest.aadBound sealed each blob with its
+        // relativePath as AEAD associated data — pass the SAME path so a blob
+        // remapped to a different manifest entry fails the tag here (the
+        // blob-remap / restore-corruption defense). Legacy bundles without
+        // the flag decrypt with no AAD (backward compatible).
+        var blobAad = manifest.aadBound === true ? Buffer.from(entry.relativePath, "utf8") : undefined;
+        plaintext = await backupCrypto.decryptWithPassphrase(blob, passphrase, entry.salt, blobAad);
       } catch (e) {
         if (e && e.isBackupCryptoError && e.code === "backup-crypto/decrypt-failed") {
           throw new RestoreBundleError("restore-bundle/decrypt-failed",
             "extract: blob '" + entry.encryptedPath + "' did not decrypt — " +
-            "passphrase rejected or ciphertext tampered");
+            "passphrase rejected, ciphertext tampered, or blob remapped to a different path");
         }
         throw e;
       }
@@ -326,11 +349,16 @@ function inspect(opts) {
       "inspect: opts.bundleDir is required and must exist");
   }
   var manifestPath = nodePath.join(opts.bundleDir, "manifest.json");
-  if (!nodeFs.existsSync(manifestPath)) {
-    throw new RestoreBundleError("restore-bundle/missing-manifest",
-      "inspect: bundleDir has no manifest.json");
-  }
-  return backupManifest.parse(nodeFs.readFileSync(manifestPath, "utf8"));
+  // Capped fd-bound read (no-passphrase preview path, reachable with only read
+  // access to the bundle): bound a hostile manifest before parse.
+  return backupManifest.parse(atomicFile.fdSafeReadSync(manifestPath, {
+    maxBytes: C.BYTES.mib(4), encoding: "utf8",
+    errorFor: function (kind) {
+      if (kind === "enoent") return new RestoreBundleError("restore-bundle/missing-manifest", "inspect: bundleDir has no manifest.json");
+      if (kind === "too-large") return new RestoreBundleError("restore-bundle/bad-manifest", "inspect: manifest.json too large");
+      return new RestoreBundleError("restore-bundle/missing-manifest", "inspect: manifest unreadable: " + kind);
+    },
+  }));
 }
 
 module.exports = {

package/lib/vendor/blamejs/lib/restore-rollback.js

@@ -283,10 +283,16 @@ function list(opts) {
     var p = nodePath.join(rollbackRoot, name);
     var markerPath = p + ".marker.json";
     var marker = null;
-    if (nodeFs.existsSync(markerPath)) {
-      try { marker = safeJson.parse(nodeFs.readFileSync(markerPath, "utf8"), { maxBytes: C.BYTES.kib(64) }); }
-      catch (_e) { marker = null; }
-    }
+    // Capped fd-bound read (no existsSync check-then-read window): the fs read is
+    // now bounded to 64 KiB too, so a tampered multi-GB marker.json is refused
+    // BEFORE allocation (the parse-only cap let readFileSync slurp the whole file
+    // first). refuseSymlink: the marker lives under the operator's rollbackRoot,
+    // never a secret-mount. Any failure → marker:null, the best-effort behavior.
+    try {
+      marker = safeJson.parse(
+        atomicFile.fdSafeReadSync(markerPath, { maxBytes: C.BYTES.kib(64), encoding: "utf8", refuseSymlink: true }),
+        { maxBytes: C.BYTES.kib(64) });
+    } catch (_e) { marker = null; }
     var stat;
     try { stat = nodeFs.statSync(p); } catch (_e) { continue; }
     out.push({

package/lib/vendor/blamejs/lib/restore.js

@@ -83,6 +83,7 @@ function create(opts) {
   validateOpts(opts, [
     "dataDir", "storage", "passphrase", "rollbackRoot", "audit",
     "maxPulledBytes", "maxPulledFiles",
+    "requireSignature", "expectedFingerprint", "verifySignature",
   ], "restore");
   validateOpts.requireNonEmptyString(opts.dataDir, "create: opts.dataDir", RestoreError, "restore/no-datadir");
   _validateStorage(opts.storage);
@@ -96,6 +97,19 @@ function create(opts) {
   var passphrase = opts.passphrase;
   var rollbackRoot = opts.rollbackRoot || (dataDir + ".rollbacks");
   var auditOn = opts.audit !== false;
+  // Manifest-signature policy. The framework signs bundles best-effort (an
+  // unsigned bundle is the documented CLI / standalone / worker case), so the
+  // non-opt-in integrity default is the per-blob AEAD path-binding below
+  // (which defeats the blob-remap attack on EVERY bundle, signed or not);
+  // requireSignature is the additional provenance policy operators under
+  // HIPAA/PCI opt into to mandate a verified signer. expectedFingerprint pins
+  // a signer; verifySignature:false allows a cold/cross-org restore. All
+  // three are threaded into restoreBundle.extract on every run — previously
+  // omitted entirely, so a present signature was never even verified and a
+  // requireSignature policy could not be enforced (CWE-347).
+  var requireSignature = opts.requireSignature === true;
+  var expectedFingerprint = opts.expectedFingerprint;
+  var verifySignature = opts.verifySignature;
 
   // Preflight footprint caps. Defended against storage that returns a
   // tampered or oversized bundle: we cap both the storage-reported size
@@ -271,6 +285,9 @@ function create(opts) {
         passphrase:       passphrase,
         filter:           runOpts.filter,
         progressCallback: runOpts.progressCallback,
+        requireSignature:    requireSignature,
+        expectedFingerprint: expectedFingerprint,
+        verifySignature:     verifySignature,
       });
     } catch (e) {
       _cleanupTmp();
@@ -283,6 +300,8 @@ function create(opts) {
       else if (code === "restore-bundle/missing-manifest")  mappedCode = "restore/missing-manifest";
       else if (code === "restore-bundle/missing-blob")      mappedCode = "restore/missing-blob";
       else if (code === "restore-bundle/size-mismatch")     mappedCode = "restore/size-mismatch";
+      else if (code === "restore-bundle/missing-signature") mappedCode = "restore/missing-signature";
+      else if (code === "restore-bundle/bad-signature")     mappedCode = "restore/bad-signature";
       _emitAudit("restore.failure",
         { bundleId: bundleId, reason: (e && e.message) || String(e) }, "failure");
       throw new RestoreError(mappedCode,

package/lib/vendor/blamejs/lib/retention.js

@@ -431,17 +431,29 @@ function create(opts) {
 
     try {
       var moreRows = true;
+      // Keyset pagination cursor. Without it the loop re-selects the SAME batch
+      // forever whenever a full batch of rows is NOT removed from the candidate
+      // set by its action — legal-hold-skipped, "warn"-stage, errored, and
+      // (critically) EVERY row under dryRun mutate nothing, so a LIMIT-from-the-
+      // top query returns the identical rows each pass and `rows.length ===
+      // batchSize` never goes false. Ordering by _id and advancing past the last
+      // row seen guarantees forward progress regardless of whether a row was
+      // actioned. (Deleted / anonymized rows are also simply skipped past.)
+      var lastId = null;
       while (moreRows) {
         var rows;
         // The candidate WHERE-clause: age + not-already-erased + not-on-legal-hold +
-        // (when soft-delete is configured) not-already-soft-deleted. Built
-        // through b.sql so the operator-supplied table / ageField / softDeleteField
-        // identifiers are quoted by construction and every value binds as a
-        // placeholder (the '' empty-string compare included — no embedded literal).
+        // (when soft-delete is configured) not-already-soft-deleted + keyset cursor.
+        // Built through b.sql so the operator-supplied table / ageField /
+        // softDeleteField identifiers are quoted by construction and every value
+        // binds as a placeholder (the '' empty-string compare included — no
+        // embedded literal).
         function _candidateBase() {
           var qb = sql.select(rule.table, SQL_OPTS)
             .where(rule.ageField, "<=", cutoff);
           if (rule.softDeleteField) qb.whereNull(rule.softDeleteField);
+          if (lastId !== null) qb.where("_id", ">", lastId);
+          qb.orderBy("_id", "asc");
           return qb;
         }
         var selStmt;
@@ -504,6 +516,10 @@ function create(opts) {
               reason: (e && e.message) || String(e) });
           }
         }
+        // Advance the keyset cursor past this batch so already-seen rows
+        // (including skipped / warned / errored / dry-run rows that stay in the
+        // candidate set) are never re-selected — the loop-termination guarantee.
+        lastId = rows[rows.length - 1]._id;
         if (rows.length < rule.batchSize) moreRows = false;
       }
     } catch (e) {

package/lib/vendor/blamejs/lib/router.js

@@ -36,6 +36,7 @@ var http  = require("node:http");
 var http2 = require("node:http2");
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
+var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var requestHelpers = require("./request-helpers");
 var lazyRequire = require("./lazy-require");
@@ -147,7 +148,11 @@ function _makeSchemaValidator(spec) {
       if (!qq.ok) return _writeValidationError(req, res, "query", qq.errors);
       req.query = qq.value;
     }
-    if (spec.body && req.body !== undefined) {
+    if (spec.body) {
+      // Validate even when req.body is undefined (no body parsed / empty POST):
+      // a required body schema must report the violation, not be silently
+      // skipped. safeParse(undefined) fails a non-optional schema and passes an
+      // optional()/default() one. Mirrors the always-run params/query checks.
       var bb = spec.body.safeParse(req.body);
       if (!bb.ok) return _writeValidationError(req, res, "body", bb.errors);
       req.body = bb.value;
@@ -1425,11 +1430,19 @@ function serveStatic(dir) {
     // that shares the root's name as a prefix — e.g. root `/srv/public`
     // vs `/srv/public-evil` — cannot satisfy the containment check.
     if (filePath !== root && !filePath.startsWith(root + nodePath.sep)) return next();
-    if (!nodeFs.existsSync(filePath) || nodeFs.statSync(filePath).isDirectory()) return next();
+    // Open the (lexically-confined) path ONCE with O_NOFOLLOW and bind existence,
+    // stat, and streaming to that single fd. The previous existsSync → statSync →
+    // statSync → createReadStream sequence was a triple check-then-read TOCTOU
+    // (CWE-367) on a request-derived pathname, and the plain createReadStream
+    // would follow a symlink swapped in after the lexical check (CWE-22).
+    // Opening before writeHead lets a refusal still fall through to next().
+    var fd;
+    try { fd = atomicFile.openNoFollowSync(filePath); } catch (_e) { return next(); }
+    var stat = nodeFs.fstatSync(fd);
+    if (stat.isDirectory()) { nodeFs.closeSync(fd); return next(); }
 
     var ext = nodePath.extname(filePath).toLowerCase();
     var mime = MIME_TYPES[ext] || "application/octet-stream";
-    var stat = nodeFs.statSync(filePath);
     var hasVersion = req.url && req.url.includes("?v=");
     var cacheControl = hasVersion
       ? "public, max-age=31536000, immutable"
@@ -1439,7 +1452,7 @@ function serveStatic(dir) {
       "Content-Length": stat.size,
       "Cache-Control":  cacheControl,
     });
-    nodeFs.createReadStream(filePath).pipe(res);
+    nodeFs.createReadStream(filePath, { fd: fd }).pipe(res);
   };
 }
 

package/lib/vendor/blamejs/lib/safe-ical.js

@@ -444,7 +444,7 @@ function _parseComponent(lines, startIdx, ctx, depth) {
       "safeIcal.parse: expected BEGIN, got '" + begin.name + "'");
   }
   var compName = begin.value.toUpperCase();
-  if (!KNOWN_COMPONENTS[compName] && !ctx.extraComps[compName] &&
+  if (!Object.prototype.hasOwnProperty.call(KNOWN_COMPONENTS, compName) && !ctx.extraComps[compName] &&
       compName.indexOf("X-") !== 0) {
     throw new SafeIcalError("safe-ical/unknown-component",
       "safeIcal.parse: unknown component '" + compName +
@@ -475,7 +475,7 @@ function _parseComponent(lines, startIdx, ctx, depth) {
     }
     // Validate property name.
     var pn = ln.name;
-    if (!KNOWN_PROPERTIES[pn] && !ctx.extraProps[pn] && pn.indexOf("X-") !== 0) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_PROPERTIES, pn) && !ctx.extraProps[pn] && pn.indexOf("X-") !== 0) {
       throw new SafeIcalError("safe-ical/unknown-property",
         "safeIcal.parse: unknown property '" + pn +
         "' (extend via opts.extraProperties or use X- prefix)");

package/lib/vendor/blamejs/lib/safe-icap.js

@@ -426,7 +426,7 @@ function _parseEncapsulated(value) {
     }
     var part = token.slice(0, eq);
     var offStr = token.slice(eq + 1);
-    if (!ENCAPSULATED_PARTS[part]) {
+    if (!Object.prototype.hasOwnProperty.call(ENCAPSULATED_PARTS, part)) {
       throw new SafeIcapError("safe-icap/bad-encapsulated",
         "safeIcap.parse: Encapsulated part '" + part + "' is not one of " +
         Object.keys(ENCAPSULATED_PARTS).join(", "));