@blamejs/blamejs-shop 0.4.69 → 0.4.71

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.14 (2026-06-20) — **A broad security-hardening release: every request-IP trust decision is peer-gated against the immediate connection (closing an X-Forwarded-For spoofing class — one behavior change, see Migration), a wide set of authentication and signature verifiers now fail closed, pre-auth parsers are hardened against algorithmic-complexity and frame-desync attacks, and untrusted-key allowlist lookups, at-rest encryption binding, and on-disk writes are tightened framework-wide; adds streaming and exclusive atomic-write primitives, a script-context JSON serializer, and HTTP-client bandwidth throttling.** This release tightens existing protections across the framework rather than adding opt-ins. The headline behavior change is how the client IP is trusted: the IP gates that make security decisions (network allowlist, rate limiter, break-glass grant pin) no longer trust a bare leftmost X-Forwarded-For value when trustProxy is set without an explicit proxy allowlist — they resolve the client IP by a peer-gated right-to-left walk anchored at the connecting socket, so a direct caller can no longer forge an allowed address. Operators who terminate behind a proxy now declare its address range in trustedProxies (see Migration). Alongside that, a large set of verifiers that could accept a malformed or unsigned credential now fail closed (SAML audience restriction, FDA electronic-signature, SD-JWT key-binding replay, DPoP, CIBA, mdoc trust anchor, COSE algorithm/curve binding, agent-snapshot plaintext under a regulated posture); pre-authentication parsers that an attacker reaches before any credential check are hardened against quadratic-time and frame-desync denial of service (CBOR, JSONPath, tar/PAX, gzip, YAML, ASN.1 DER, the scheduler's timer math); allowlist and posture lookups keyed by untrusted input can no longer reach Object.prototype; the framework's own file writes are now symlink-refusing and atomic; at-rest and egress paths bind ciphertext to its location and redact nested secrets; and several lost-update races are serialized. New surface is additive: streaming and exclusive atomic-write primitives, a serializer safe to embed in an inline <script>, and download/upload bandwidth throttling on the HTTP client. **Added:** *b.atomicFile.writeStream(filepath, source, opts?) and b.atomicFile.writeExclSync(filepath, data, opts?)* — Two atomic-write primitives that complete the read-side fdSafeReadSync family. writeStream writes a stream to a fresh O_EXCL|O_NOFOLLOW temporary file with an output-byte cap, then renames into place; writeExclSync stages a synchronous write through a verify-then-rename (clearing any stale temp under O_EXCL|O_NOFOLLOW first) for the small sealed-state round-trips (vault seal / unseal / rotate). Both refuse to follow a symlink at the destination or temp path, so an attacker who pre-creates a link can't redirect the write. The framework's own predictable-temp and symlink-following write sites now route through them; fdSafeReadSync also gains a withStat option that returns the bound fd's stat alongside the bytes. · *b.safeJson.stringifyForScript(value, opts?)* — A JSON serializer safe to embed directly in an inline <script> block: it escapes <, >, and & and the U+2028 / U+2029 line separators so a value containing </script> or a JS line terminator cannot break out of the script context (DOM-XSS). The import-map helper gains scriptTag(importMap, { nonce }) built on it, and the speculation-rules inline emitter uses it. · *HTTP-client bandwidth throttling* — b.httpClient requests accept a bandwidth limit that interposes a throttling transform on both the download and upload paths, so a large transfer can be rate-shaped without buffering the whole body. Useful for bounding the egress a single outbound call can consume. · *Incremental audit-chain verification* — The audit verifiers accept a from/to range so a long chain can be verified in increments rather than head-to-tail every time, report an accurate rowsVerified count, and keep the newest review when reconciling. b.vault also exposes getDefaultStore() for callers that need the process's default seal/unseal store handle. **Changed:** *DORA major-incident reporting clock is four hours* — The Digital Operational Resilience Act initial-notification deadline is corrected to four hours from classification (it had used the generic 24-hour default), incident classification weighs the affected-client-base percentage, and the deadline anchors to the prior filing where one exists. · *Range and conditional-request correctness* — Compression skips a 206 Partial Content or any Content-Range response (RFC 7233 §4.1), so it can't drop Content-Length over a now-compressed byte interval; static-file conditional handling gives If-None-Match precedence over If-Modified-Since and If-Match over If-Unmodified-Since (RFC 7232); and the object store honors the [start, end] array range contract that previously fell through to a full read. · *Declared request bodies are always validated* — A route that declares a body schema now validates it even when no body was parsed, so an omitted required body is rejected at the router instead of reaching the handler — mirroring the always-run params and query checks. **Fixed:** *Object store getStream works on remote backends* — getStream() returned a stream wrapping an unresolved promise on every remote backend, so it never delivered bytes; it now resolves the object before streaming. · *Queue and body-parser correctness* — The local queue's fail()/complete() paths guard on the current row status so a stale lease can't resurrect or double-process a job, and the body parser's raw() mode no longer matches every content type by default (it had answered 415 to nothing or everything depending on the wildcard). · *Sanctions screening and GraphQL SDL probing no longer under-match* — Sanctions screening no longer skips a candidate whose type doesn't match the query's type filter (a sanctioned entity of an unspecified type was missed) and reports a typeMatch flag; the GraphQL federation guard probes for the _service / _entities introspection fields by word boundary (an aliased field bypassed the prefix check) and over batched-array request bodies. The per-tenant query budget is a true sliding window, so a burst straddling the window boundary can't briefly double the rate. **Security:** *Request-IP trust is peer-gated end to end* — The client-IP resolution that every IP gate depends on is extracted into one trust model (a trustedProxies-aware, peer-gated right-to-left walk) so the network allowlist, rate limiter, break-glass pin, and bot-guard audit attribution all decide identity the same way. X-Forwarded-Proto is peer-gated across the security middleware on the same model, and a WebSocket reconnect to a swapped target is re-validated against the SSRF / blocked-host guard before the connection is reused. See Migration for the one behavior change. · *Authentication and signature verifiers fail closed* — A set of verifiers that could accept a malformed or unsigned credential now refuse it: SAML verifyResponse fails closed on a missing AudienceRestriction or unparseable Conditions; the FDA 21 CFR 11 electronic-signature verify refuses a record with no signature (recordHash alone is self-consistency, not authentication); the SD-JWT key-binding JWT requires an audience and nonce (replay binding) and an expiry when configured; DPoP cross-checks the proof's alg against its embedded JWK key type before importing it; CIBA verifies the ID token on poll and notification; the mdoc trust anchor is enforced (no fail-open); COSE binds the signature algorithm to the key curve; and agent-snapshot refuses allowPlaintext under a regulated compliance posture and gates sealing on vault initialization. · *Pre-auth parsers hardened against complexity and frame-desync denial of service* — Parsers an attacker reaches before any credential check are bounded. CBOR rejects the quadratic-time duplicate-map-key construction (it ran O(n^2) on every COSE / CWT / EAT / mdoc verify) and rejects non-minimal integer/key encodings in canonical mode; JSONPath caps the node-list cross-product that could exhaust memory and rejects the filter expression that could overflow the parser stack; the tar reader caps a random-access entry read and resynchronizes a PAX header whose size field is non-numeric; the gzip reader caps a random-access output size; the YAML scanner replaces a backtracking pattern with a linear scan; the ASN.1 DER reader caps high-tag-number and OID sub-identifier decoding and rejects non-minimal forms; and the scheduler clamps far-future timers so a 32-bit overflow can't make a timer fire immediately or an interval tight-loop. · *Allowlist and posture lookups keyed by untrusted input can't reach the prototype* — Lookups of the form map[untrustedKey] across the framework's allowlist and compliance-posture tables are now own-property checks, so a key like __proto__ or constructor resolves as absent instead of returning an inherited value and walking the gate (CWE-1321). The shared posture-accessor that several guards built by hand is centralized, and an inverse detector flags any re-introduced unguarded indexed lookup. · *Framework file writes are symlink-refusing and atomic* — The predictable-temp and symlink-following write sites (cookie jar, config-drift snapshot, archive extraction, local object store, backup bundle, and the vault passphrase seal/unseal/rotate) now write through the atomic-write primitives above, so a pre-planted symlink at the destination or temp path can no longer redirect a privileged write, and a partial write can't leave a torn file. A re-introduced raw write without the exclusive/no-follow flags is flagged by a detector. · *X.509 issuer chains enforce the CA basic constraint* — Node's checkIssued() does not verify that the issuer certificate is actually a CA (CVE-2002-0862 class), so a leaf signed by a non-CA certificate could be accepted as an issuer. Certificate-chain walking is centralized in one helper that requires the issuer's basicConstraints cA bit and verifies the signature, and every chain consumer (TSA, BIMI, S/MIME, mdoc, content-credentials, the FIDO MDS3 anchor match) routes through it. · *Header, value, and markup injection closed* — Mail rejects CRLF in Reply-To and in custom header keys/values (SMTP header injection); the GDPR data-export CSV writer neutralizes formula-injection prefixes; the content guards decode no-semicolon numeric HTML entities when revealing a dangerous URL scheme (so &#106;avascript: is caught); the early-hints emitter rejects CRLF in pushed link values; the HTML/SVG/BIMI comment scanners honor the WHATWG abrupt-comment-close forms (--!>, <!-->) so a mutation-XSS comment can't smuggle markup; and the CSP builder no longer emits a host source alongside 'none'. · *At-rest and egress data is bound to its context* — Backup restore binds each encrypted file blob to its manifest path as additional authenticated data, so a blob remapped to another entry fails the AEAD tag on restore (signed and unsigned bundles alike), and threads the signature-verification options through extraction; the data-subject-request lookup dual-reads the keyed and legacy subject hashes so a subject is still found across the hashing change (GDPR Art. 17); the log redactor collapses a secret nested as an array or object value, not only as a scalar; and the OTLP exporter redacts the span name and status message, not just attributes, before they leave the process. · *Network-protocol verification hardened* — OCSP responses are bound to the requested certificate serial; the WebSocket reader rejects reserved opcodes and reserved bits; the DNS parser refuses a record that reads past the message buffer; the NTP client rejects a reply whose origin timestamp does not echo the request (and the SNTP cookie path was reworked to bind the exchange); DANE TLSA matching is constant-time; and MTA-STS policy fetch fails closed rather than degrading to no-policy on an ambiguous response. · *Byte caps are measured in bytes, and middleware enforcement is per-instance* — Size limits that compared a byte budget against a string's character length (so multibyte input slipped a ~2-4x looser bound) now measure actual bytes — guard-json per-string cap, the per-tenant quota header budget, the JMAP request cap. The CSRF and fetch-metadata middleware track their gate per instance, so mounting a second, stricter instance still enforces (a shared request flag previously let the first, lenient mount disable it); the CSRF cookie is still issued once per response. The WebAssembly global is stripped from the sandbox worker so sandboxed code cannot JIT around the isolation. · *Lost-update races serialized* — Concurrent failure recording in the login lockout and bot-challenge gates is serialized per key, so parallel failed attempts can no longer each read the same pre-write counter and stay under the lockout / challenge threshold. The inline webhook delivery is claimed before the POST so a concurrent retry pass can't double-send it, and a transient transport failure now backs off and retries instead of being dead-lettered. **Migration:** *X-Forwarded-For trust now requires an explicit proxy allowlist* — The IP gates that enforce a security decision — network allowlist, rate limiter, and the break-glass grant IP pin — previously resolved the client IP from the leftmost X-Forwarded-For value whenever trustProxy was truthy. A direct caller could set that header to any address and walk an IP allowlist or evade a rate-limit key (CWE-290 / CWE-348). These gates now fail closed: with trustProxy set but no trustedProxies, they ignore X-Forwarded-For and use the connecting socket's peer address. To keep trusting a forwarded client IP, set trustedProxies to the CIDR(s) of your front proxy/load balancer — the client IP is then resolved by a peer-gated right-to-left walk that stops at the first hop not in the allowlist. For an allowlist / rate-limit / break-glass gate the new default is stricter (it trusts less), so an operator who has not migrated sees tighter enforcement, never looser. Display-only consumers (error pages, request logs) keep the lenient resolution and carry a docstring warning. The wiki example's WIKI_TRUST_PROXY flag is replaced by WIKI_ADMIN_TRUSTED_PROXIES (a CIDR list).
+
 - v0.15.13 (2026-06-19) — **Consolidates a large set of duplicated, security-sensitive code paths — injected-dependency validation, positive-integer option caps, TOCTOU-safe file reads, markup escaping, audit emission, structured-field parsing, and untrusted-JWK import — onto shared hardened primitives, so a fix or guard now applies everywhere at once; adds a TOCTOU-safe file reader; and makes several configuration errors throw typed framework errors instead of a bare Error.** Across the framework, logic that had been hand-rolled in many places (and had quietly drifted between copies) is now single-sourced through shared primitives. The practical effect for operators is consistency: the strongest available guard is applied everywhere a given operation happens, rather than in whichever copy happened to have it. Injected dependencies (stores, backends, vaults, db handles, query objects) are validated through one contract; operator-tunable positive-integer options (pool sizes, byte caps, timeouts, stream limits) validate through one bounds primitive that forwards the caller's non-retryable / HTTP-status flags; the open-fd → fstat → read-fully pattern that several call sites used to defend file reads against a swap-after-stat race (CWE-367) is now the b.atomicFile.fdSafeReadSync primitive, with symlink refusal, inode-equality, a byte cap, and an integrity hash available as options and each caller's exact typed error preserved; and the XML/HTML markup escapers (including the b.guardHtml / b.guardSvg sanitizer output) route through one b.markupEscape so the base & < > " chain can't drift between them. A few configuration-validation paths that threw a bare Error (httpClient.configurePool, b.db stream-limit validation) now throw the module's typed framework error. No security defaults change; this release tightens and unifies existing protections rather than adding opt-ins. **Added:** *b.atomicFile.fdSafeReadSync(filepath, opts?)* — A TOCTOU-safe synchronous file read (CWE-367 / js/file-system-race): it opens the path read-only, then binds the size, content, and integrity measurement to the inode the fd holds open, so a swap between stat and read can't change which bytes are returned. Optional guards layer on top — maxBytes (refuse an over-cap file), refuseSymlink + inodeCheck (refuse a symlink source and any inode swap, the strongest posture for operator-writable paths), expectedHash (SHA3-512), encoding (return a string), allowShortRead — and an errorFor(kind, detail) callback lets each caller keep its own typed error. The framework's own file reads (atomic-file, the TLS certificate-path loader, the sealed-PEM source reader, the backup bundle reader) all route through it. · *Shared substrate primitives for previously-duplicated logic* — A set of shared primitives now back call sites that had each re-implemented the same logic: validateOpts.requireMethods (gains a `permanent` flag) for injected-dependency contract checks; numericBounds positive-finite-int validators (gain an errorOpts { permanent, statusCode }) for tunable integer options; b.markupEscape for the & < > " markup chain; structured-field parsing helpers (parseTagList, forEachKeyValue, splitUnquoted, stripDoubleQuotes, unfoldHeaderContinuations); crypto.importPublicJwk and crypto.makeBase64UrlDecoder; safeSql.toPositional; safeBuffer.makeByteCoercer; nonceStore.enforceReplay; and the audit/observability namespaced emitters. These are mostly invisible substrate — the operator-visible benefit is that a guard or fix added to one of them now covers every caller. **Changed:** *Configuration errors throw typed framework errors* — Two configuration-validation paths that threw a bare `Error` now throw the module's typed framework error: httpClient.configurePool (bad maxSockets / maxFreeSockets / keepAliveMsecs → HttpClientError, code httpclient/bad-opts) and the b.db stream-limit validation (Query.stream → DbQueryError). The thrown error remains an Error subclass, so existing `instanceof Error` / try-catch handling is unaffected; code that matched the old free-text message should match the typed error's `code` instead. Several routed validators also report a slightly more precise message ("positive finite integer" instead of "positive integer"). **Fixed:** *Webhook deliveries retry transient transport failures instead of dead-lettering them* — A delivery that failed with a transient transport error (connection reset, timeout, 5xx) was recorded as permanently failed and dead-lettered rather than retried. The destination-safety check (SSRF / blocked-host guard) now runs in its own step and is the only permanent failure; a transport failure backs off and retries up to the configured limit. · *Webhook deliveries table creates on MySQL* — The pending-delivery index used a partial-index (WHERE) clause that MySQL does not support, so the deliveries table failed to create on a MySQL backend. The index is now dialect-aware — partial on PostgreSQL / SQLite, plain on MySQL. · *Inline webhook delivery can't be double-sent by concurrent retry processing* — An inline delivery is now claimed (status set to in-flight with a claim timestamp) before the POST, so a concurrent retry pass can't pick up and re-send the same delivery; a row left in-flight by a crash is reclaimed after the stale-claim window. · *Audit checkpoint can never be anchored against a replaced database* — close() fires a best-effort final checkpoint as the database shuts down. In a narrow close-then-reopen window that checkpoint's write could resume after a fresh database had opened and anchor the prior database's chain tip into it. checkpoint() now binds to the database it read the tip from and refuses to write (returns null, fail-closed) if that handle has since been closed or replaced — so a checkpoint is only ever written against the database it measured. **Security:** *TOCTOU-safe file reads applied uniformly* — The open-fd → fstat → read pattern that anchors a file read to one inode against a swap-after-stat race is now centralized in b.atomicFile.fdSafeReadSync, and every framework file read routes through it. The sealed-PEM source reader keeps the strongest posture (symlink refusal + inode-equality + byte cap), and those guards are now available as options to any caller — a re-introduced hand-rolled read-loop is flagged by a codebase-pattern detector. · *Injected-dependency and integer-option validation can't silently drift* — Injected stores / backends / vaults / db handles / query objects are validated through one contract (validateOpts.requireMethods), and operator-tunable positive-integer options through one bounds primitive (numericBounds), both forwarding the caller's non-retryable / HTTP-status error flags so a config error stays permanent / carries its 4xx. Inverse detectors flag any re-introduced inline check, so the validation can no longer be partially copied or weakened in one place. · *Single markup-escape chain for the HTML/SVG sanitizers* — The b.guardHtml and b.guardSvg sanitizer output escapers, the AI-Act transparency and mail HTML escapers, and the XML report escapers now share one b.markupEscape for the base & < > " chain (apostrophe form as a parameter; each caller keeps its own input coercion and any extra escapes such as guardHtml.escapeAttr's backtick / = IE-attribute-injection hardening). Byte-for-byte parity with the prior escapers was verified across an XSS-vector corpus, so the consolidation cannot have introduced an escaping gap; a re-inlined & < > " chain anywhere else is flagged by a detector. · *One hardening point for untrusted public-JWK import* — The createPublicKey-from-JWK call that imports attacker-controlled key material (DID publicKeyJwk, DNSKEY, COSE_Key, DPoP / OAuth / OIDC / DBSC proof JWKs) is centralized in b.crypto.importPublicJwk, so the untrusted-key import has a single audited home; each caller keeps its own kty/crv pre-validation and typed error. · *Linear-time Content-Security-Policy header parsing* — The CSP response-header parser split directives on a `/\s*,\s*/` regex that ran in O(n^2) on a long comma-less run of whitespace, letting a crafted header stall a worker (js/polynomial-redos). It now splits on the literal comma and trims each item, which is linear and byte-for-byte equivalent. · *Parsed INI and OpenAPI path maps can't reach Object.prototype* — The INI parser already refuses a `__proto__` / `constructor` / `prototype` section or key (it throws before any write); as defense-in-depth, every parsed node — and the OpenAPI paths map keyed by URL pattern — is now a null-prototype object, so even a future gap could only ever set an own property, never mutate Object.prototype (CWE-1321).
 
 - v0.15.12 (2026-06-14) — **Hardens a set of defense-in-depth seams: a single-pass structured-field unescape, a constant-time content-digest member match, complete reserved-character stripping, a Trojan-Source escape on the boot logger, generic body-parse error responses, and an audit trail whenever outbound TLS certificate validation is disabled.** A sweep of low-severity but real hardening items. RFC 8941 structured-field string values (HTTP Message Signatures, Client Hints, Cache-Control) were un-escaped with two chained replaces that mis-decoded an escaped backslash adjacent to another escape; they now use one left-to-right pass that decodes each escape exactly once. The HTTP Message Signature content-digest check dropped a dead identity-replace and now matches the sha3-512 member by an exact, top-level, constant-time comparison instead of an unanchored substring scan. b.guardFilename's reserved-character strip used a non-global regex that left every separator after the first; it now strips all of them. The boot logger's TTY branch wrote raw text, bypassing the Trojan-Source / control-character escape the main logger applies — it now escapes the bidi and C0/newline control classes on every sink. The body parser no longer echoes a caught exception's detail (an fs errno + temp path, or a parse hook's thrown message) to the HTTP client — the client gets a generic status phrase while the full detail stays on the audit chain. And any outbound TLS connection that runs with peer-certificate validation disabled (an explicit operator opt-in, never a default) now emits a tls.insecure_skip_verify audit + observability event so the degraded posture is visible for compliance and incident response. **Added:** *b.structuredFields.unescapeSfStringBody(body)* — A single-pass decode of the RFC 8941 §3.3.3 quoted-string backslash escapes (the bytes between the surrounding quotes). It replaces the chained two-`.replace()` form, which is not equivalent to one decode — whichever pass runs first can rewrite a backslash the other escape sequence owns, so a lone escaped backslash decoded to two. The HTTP Message Signature, Client Hints, and Cache-Control sf-string readers now route through it. · *tls.insecure_skip_verify audit event* — b.network.tls.auditInsecureTls(meta) emits an audit + observability event at the point an outbound TLS connection honors rejectUnauthorized:false / allowInsecure. The connectWithEch, OTLP-gRPC log stream, syslog-TLS log stream, and SMTP transports all emit it when an operator disables certificate validation — parallel to the existing tls.classical_downgrade audit. No default changes; the framework never disables validation itself. **Security:** *Single-pass structured-field string unescape* — The RFC 8941 sf-string readers in HTTP Message Signatures (Signature-Input covered-component names), Client Hints, and Cache-Control directive values un-escaped with `.replace(/\\\\/g,"\\").replace(/\\"/g,'"')` — two sequential passes that mis-decode adjacent escapes (a lone escaped backslash became two). All four sites now use the single-pass b.structuredFields.unescapeSfStringBody. It is fail-closed (a mis-decoded covered-component name just fails the signature check, never bypasses it); the fix restores RFC-conformant interop with peers that legitimately escape these values. · *Constant-time, member-anchored content-digest verification* — b.crypto.httpSig.verify's covered content-digest check dropped a dead no-op replace and now parses the Content-Digest header into its top-level members and matches the sha3-512 member EXACTLY, in constant time (b.crypto.timingSafeEqual), rather than scanning for the digest text as a substring anywhere in the header. The Content-Digest header is already bound by the signature, so the substring form was not reachably exploitable; the change removes the latent ambiguity and the timing channel. · *Reserved-character filename strip removes every occurrence* — b.guardFilename's reservedCharPolicy:"strip" (the permissive profile) used a non-global regex, so only the FIRST reserved character — including path separators — was replaced and the rest leaked through. The strip is now global: every reserved character is removed. Not a traversal bypass (the unconditional security floor still throws on `..`, null bytes, NTFS ADS, UNC, overlong UTF-8), but the strip is now complete and consistent. · *Boot logger escapes control + bidi characters on every sink* — The boot-time logger's TTY branch wrote the raw message, bypassing the Trojan-Source (bidi) and control-character escapes the main logger applies — a hostile message could forge extra log lines on a terminal (CWE-117) or re-order the visible line (CVE-2021-42574). Both boot branches now escape the bidi and C0/newline control classes, matching the create() path and the logger's advertised guarantee. · *Body-parser error responses never echo internal detail* — The body-parser's terminal error path surfaced a caught exception's message verbatim to the HTTP client — a multipart filesystem error leaked the errno + temp path, and a parse hook's thrown error (which can carry secrets) was echoed back. The client now gets a curated message only for a framework-classified 4xx error and a generic status phrase otherwise; the parse-hook wrapper carries a fixed message, and full diagnostics stay on the audit chain server-side (CWE-209). The cluster leader-discovery endpoint's error body is generalized the same way.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.15.13",
-  "createdAt": "2026-06-19T21:36:12.932Z",
+  "frameworkVersion": "0.15.14",
+  "createdAt": "2026-06-21T06:07:03.428Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -2346,6 +2346,10 @@
           "type": "function",
           "arity": 3
         },
+        "openNoFollowSync": {
+          "type": "function",
+          "arity": 2
+        },
         "pathTimestamp": {
           "type": "function",
           "arity": 1
@@ -2370,10 +2374,18 @@
           "type": "function",
           "arity": 3
         },
+        "writeExclSync": {
+          "type": "function",
+          "arity": 3
+        },
         "writeJson": {
           "type": "function",
           "arity": 3
         },
+        "writeStream": {
+          "type": "function",
+          "arity": 3
+        },
         "writeSync": {
           "type": "function",
           "arity": 3
@@ -4921,7 +4933,7 @@
         },
         "decryptWithPassphrase": {
           "type": "function",
-          "arity": 3
+          "arity": 4
         },
         "deriveKey": {
           "type": "function",
@@ -4929,11 +4941,11 @@
         },
         "encryptWithFreshSalt": {
           "type": "function",
-          "arity": 2
+          "arity": 3
         },
         "encryptWithPassphrase": {
           "type": "function",
-          "arity": 3
+          "arity": 4
         }
       }
     },
@@ -15280,6 +15292,10 @@
           "type": "primitive",
           "valueType": "number"
         },
+        "INITIAL_REPORT_OUTER_DEADLINE_MS": {
+          "type": "primitive",
+          "valueType": "number"
+        },
         "INTERMEDIATE_REPORT_DEADLINE_MS": {
           "type": "primitive",
           "valueType": "number"
@@ -17538,6 +17554,10 @@
           "type": "function",
           "arity": 4
         },
+        "makePostureAccessor": {
+          "type": "function",
+          "arity": 2
+        },
         "makeProfileBuilder": {
           "type": "function",
           "arity": 1
@@ -39868,6 +39888,10 @@
         "build": {
           "type": "function",
           "arity": 1
+        },
+        "scriptTag": {
+          "type": "function",
+          "arity": 2
         }
       }
     },
@@ -49218,6 +49242,14 @@
         "safeHeadersDistinct": {
           "type": "function",
           "arity": 1
+        },
+        "trustedClientIp": {
+          "type": "function",
+          "arity": 1
+        },
+        "trustedProtocol": {
+          "type": "function",
+          "arity": 1
         }
       }
     },
@@ -50638,6 +50670,10 @@
           "type": "function",
           "arity": 2
         },
+        "stringifyForScript": {
+          "type": "function",
+          "arity": 2
+        },
         "validate": {
           "type": "function",
           "arity": 3
@@ -53134,6 +53170,19 @@
           "type": "function",
           "arity": 4
         },
+        "Store": {
+          "type": "object",
+          "members": {
+            "seal": {
+              "type": "function",
+              "arity": 1
+            },
+            "unseal": {
+              "type": "function",
+              "arity": 1
+            }
+          }
+        },
         "VaultError": {
           "type": "function",
           "arity": 4
@@ -53199,6 +53248,10 @@
           "type": "function",
           "arity": 0
         },
+        "getDefaultStore": {
+          "type": "function",
+          "arity": 0
+        },
         "getDerivedHashMacKey": {
           "type": "function",
           "arity": 0

package/lib/vendor/blamejs/examples/wiki/README.md

@@ -105,7 +105,7 @@ The wiki ships with development-friendly defaults (`vault: { mode: "plaintext" }
 3. Change `db.atRest` to `"encrypted"` (default; requires tmpfs at `/dev/shm` or `BLAMEJS_TMPDIR`)
 4. Change `db.auditSigning.mode` to `"wrapped"`
 5. Deploy behind a TLS-terminating reverse proxy OR enable `b.pqcGate`
-6. Set `WIKI_TRUST_PROXY=1` if (and only if) the wiki sits behind a reverse proxy that injects `x-forwarded-proto`. With trustProxy off (the default), the wiki ignores `x-forwarded-proto` for cookie Secure-flag detection, so a misconfigured deployment can't accept attacker-supplied `x-forwarded-proto: https` as proof a request was over TLS.
+6. Set `WIKI_ADMIN_TRUSTED_PROXIES` to your reverse proxy's CIDR(s) if the wiki sits behind a TLS terminator that injects `x-forwarded-*`. The wiki then peer-gates those headers — `x-forwarded-proto` (cookie Secure flag) and `x-forwarded-for` (the `/admin` CIDR fence) are honoured only when the request arrives via a trusted proxy, so a direct caller can't forge `https` or an allowed IP. Left empty (the default), forwarded headers are ignored and only the real TLS socket / socket address count.
 7. Set `WIKI_ADMIN_PASSWORD` to a strong value managed by your secret-store
 
 ## Trust model for editable page bodies

package/lib/vendor/blamejs/examples/wiki/docker-compose.prod.yml

@@ -31,7 +31,7 @@
 #   BLAMEJS_DEPRECATIONS=warn
 #
 #   # security hardening (production overlay defaults shown)
-#   WIKI_TRUST_PROXY=1                              # honour x-forwarded-proto from Caddy
+#   WIKI_ADMIN_TRUSTED_PROXIES=10.0.0.0/8,172.16.0.0/12   # peer-gate x-forwarded-* to your proxy CIDRs
 #   WIKI_REQUIRE_PROD_ASSERTS=1                     # refuse to boot on weak posture
 #   WIKI_ADMIN_ALLOWED_CIDRS=10.0.0.0/8,192.168.0.0/16   # in-process CIDR fence on /admin
 #   WIKI_ADMIN_DENIED_CIDRS=                        # deny-then-allow precedence
@@ -94,13 +94,14 @@ services:
       WIKI_WEBHOOK_URL:     ${WIKI_WEBHOOK_URL:-}
       WIKI_WEBHOOK_SECRET:  ${WIKI_WEBHOOK_SECRET:-}
       # ---- Wiki security hardening ----
-      # Caddy terminates TLS in this stack and injects x-forwarded-*,
-      # so trust-proxy is on by default in the production overlay.
-      # The cookie Secure flag honours x-forwarded-proto when this
-      # is set; without it, only req.socket.encrypted counts and a
-      # misconfigured deploy can't accept attacker-supplied
-      # x-forwarded-proto: https as proof a request was over TLS.
-      WIKI_TRUST_PROXY:     ${WIKI_TRUST_PROXY:-1}
+      # Caddy terminates TLS on the internal docker network and injects
+      # x-forwarded-*. Peer-gating honours those headers ONLY from a
+      # trusted-proxy peer, so the default is the private ranges (Caddy's
+      # internal address) — the wiki container receives traffic only from
+      # Caddy, so a forged X-Forwarded-For / -Proto from a non-internal
+      # peer is rejected. Drives the /admin CIDR fence and the cookie
+      # Secure flag. Narrow this to Caddy's exact CIDR for a tighter gate.
+      WIKI_ADMIN_TRUSTED_PROXIES: ${WIKI_ADMIN_TRUSTED_PROXIES:-10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}
       # In-process CIDR fence on /admin paths. The production overlay
       # leaves this empty by default — the operator sets the corporate
       # bastion / VPN / cloud-LB private CIDRs in their .env. Both

package/lib/vendor/blamejs/examples/wiki/docker-compose.yml

@@ -33,19 +33,20 @@ services:
       WIKI_ADMIN_PASSWORD: ${WIKI_ADMIN_PASSWORD:-}
       WIKI_WEBHOOK_URL: ${WIKI_WEBHOOK_URL:-}
       WIKI_WEBHOOK_SECRET: ${WIKI_WEBHOOK_SECRET:-}
-      # Trust-proxy posture: set to "1" only when this container sits
-      # behind a TLS terminator (Caddy / Nginx / Traefik / cloud LB)
-      # that injects x-forwarded-proto. With it OFF (default), the
-      # cookie Secure-flag honours only req.socket.encrypted — a
-      # misconfigured deploy can't accept attacker-supplied
-      # x-forwarded-proto: https as proof a request was over TLS.
-      WIKI_TRUST_PROXY: ${WIKI_TRUST_PROXY:-}
+      # Reverse-proxy CIDRs (Caddy / Nginx / Traefik / cloud LB). When
+      # set, the wiki peer-gates the forwarded headers: X-Forwarded-For
+      # (the /admin CIDR fence) and X-Forwarded-Proto (the cookie Secure
+      # flag) are honoured ONLY when the request's immediate peer is one
+      # of these, so a direct caller can't forge an allowed IP or claim
+      # https. Empty (default) = ignore forwarded headers and use the
+      # socket address / real TLS state.
+      WIKI_ADMIN_TRUSTED_PROXIES: ${WIKI_ADMIN_TRUSTED_PROXIES:-}
       # In-process CIDR fence on /admin paths. Comma-separated CIDRs;
       # empty = no fence (operators using a reverse proxy / NACL
       # typically gate at that layer). When set, the wiki mounts
       # b.middleware.networkAllowlist as the in-process layer above
-      # the application-layer auth gate. Pair with WIKI_TRUST_PROXY=1
-      # if the proxy injects x-forwarded-for.
+      # the application-layer auth gate. Pair with WIKI_ADMIN_TRUSTED_PROXIES
+      # so X-Forwarded-For is peer-gated.
       WIKI_ADMIN_ALLOWED_CIDRS: ${WIKI_ADMIN_ALLOWED_CIDRS:-}
       WIKI_ADMIN_DENIED_CIDRS:  ${WIKI_ADMIN_DENIED_CIDRS:-}
       # Production-posture assertion gate. "1" = the wiki refuses to

package/lib/vendor/blamejs/examples/wiki/env-snapshot.json

@@ -54,6 +54,7 @@
     "WIKI_ADMIN_DENIED_CIDRS",
     "WIKI_ADMIN_EMAIL",
     "WIKI_ADMIN_PASSWORD",
+    "WIKI_ADMIN_TRUSTED_PROXIES",
     "WIKI_AUDIT_SIGNING_MODE",
     "WIKI_BIND",
     "WIKI_DATA_DIR",
@@ -72,7 +73,6 @@
     "WIKI_PORT",
     "WIKI_REQUIRE_PROD_ASSERTS",
     "WIKI_SITE_URL",
-    "WIKI_TRUST_PROXY",
     "WIKI_VAULT_MODE",
     "WIKI_WEBHOOK_SECRET",
     "WIKI_WEBHOOK_URL"
@@ -131,6 +131,7 @@
     "WIKI_ADMIN_DENIED_CIDRS",
     "WIKI_ADMIN_EMAIL",
     "WIKI_ADMIN_PASSWORD",
+    "WIKI_ADMIN_TRUSTED_PROXIES",
     "WIKI_AUDIT_SIGNING_MODE",
     "WIKI_BIND",
     "WIKI_DATA_DIR",
@@ -138,7 +139,6 @@
     "WIKI_PORT",
     "WIKI_REQUIRE_PROD_ASSERTS",
     "WIKI_SITE_URL",
-    "WIKI_TRUST_PROXY",
     "WIKI_VAULT_MODE",
     "WIKI_WEBHOOK_SECRET",
     "WIKI_WEBHOOK_URL"
@@ -202,14 +202,15 @@
     "WIKI_ADMIN_DENIED_CIDRS",
     "WIKI_ADMIN_EMAIL",
     "WIKI_ADMIN_PASSWORD",
+    "WIKI_ADMIN_TRUSTED_PROXIES",
     "WIKI_AUDIT_SIGNING_MODE",
     "WIKI_BIND",
     "WIKI_DATA_DIR",
     "WIKI_DB_AT_REST",
     "WIKI_PORT",
+    "WIKI_PORT",
     "WIKI_REQUIRE_PROD_ASSERTS",
     "WIKI_SITE_URL",
-    "WIKI_TRUST_PROXY",
     "WIKI_VAULT_MODE",
     "WIKI_WEBHOOK_SECRET",
     "WIKI_WEBHOOK_URL"

package/lib/vendor/blamejs/examples/wiki/lib/build-app.js

@@ -65,6 +65,13 @@ async function buildApp(opts) {
   var adminPassword = opts.adminPassword || null;
   var webhookUrl = opts.webhookUrl || null;
   var webhookSecret = opts.webhookSecret || null;
+  // Rate-limit burst (token count). Default: 2 minutes' worth of refill at
+  // 2 tokens/sec, ample for real browsing. Overridable so the e2e link/nav
+  // crawler — which fetches every page in a tight loop, far above any human
+  // rate — isn't 429'd while exercising completeness.
+  var rateLimitBurst = opts.rateLimitBurst !== undefined
+    ? opts.rateLimitBurst
+    : 2 * (b.constants.TIME.minutes(2) / b.constants.TIME.seconds(1));
 
   // ---- Build client assets via b.bundler ----
   // Hashes wiki.js + editor.js into public/dist/<name>.<hash>.js so
@@ -231,13 +238,6 @@ async function buildApp(opts) {
     audit:     b.audit,
   });
 
-  // Trust-proxy posture: when WIKI_TRUST_PROXY is set (the operator is
-  // behind a TLS terminator that injects x-forwarded-proto), the wiki
-  // honours that header for cookie Secure-flag detection. Default off
-  // so a misconfigured deployment doesn't accept attacker-supplied
-  // x-forwarded-proto: https as proof the request was over TLS.
-  var trustProxy = b.safeEnv.readVar("WIKI_TRUST_PROXY", { type: "boolean", default: false });
-
   // Network allowlist for /admin paths — when WIKI_ADMIN_ALLOWED_CIDRS
   // is set (comma-separated CIDR list), the wiki mounts
   // b.middleware.networkAllowlist as the in-process CIDR fence above
@@ -251,6 +251,19 @@ async function buildApp(opts) {
   // deny rules.
   var adminDeniedCidrs = (b.safeEnv.readVar("WIKI_ADMIN_DENIED_CIDRS") || "")
     .split(",").map(function (s) { return s.trim(); }).filter(function (s) { return s.length > 0; });
+  // Reverse-proxy CIDRs for the deployment. X-Forwarded-For / -Proto are
+  // honored only when the request's immediate peer is one of these
+  // (peer-gating) — without it the framework uses the socket address /
+  // real TLS state and ignores the forgeable headers, so a direct caller
+  // can't spoof an allowed IP or claim https. Drives both the /admin CIDR
+  // gate and the admin Secure-cookie HTTPS detection.
+  var adminTrustedProxies = (b.safeEnv.readVar("WIKI_ADMIN_TRUSTED_PROXIES") || "")
+    .split(",").map(function (s) { return s.trim(); }).filter(function (s) { return s.length > 0; });
+  // Peer-gated HTTPS detector for the admin Secure-cookie flag — resolves
+  // "https" only when X-Forwarded-Proto arrives via a trusted proxy, else
+  // from the real TLS socket. Replaces a bare trust-proxy boolean a direct
+  // caller could forge to suppress the Secure attribute.
+  var secureProtocol = b.requestHelpers.trustedProtocol({ trustedProxies: adminTrustedProxies }).resolve;
 
   // Network configurability — read NTP / DNS / proxy / DPI-trust / socket
   // env vars and apply them before the framework's outbound code paths
@@ -368,12 +381,15 @@ async function buildApp(opts) {
         credentials: false,
       },
       rateLimit: {
-        // burst sized as 2 minutes' worth of refill at 2 tokens/sec —
-        // an idle visitor accrues a full minute-scale buffer between
-        // bursts so static-asset preloads don't trip the limiter.
+        // burst is a TOKEN COUNT, not a duration: 2 minutes' worth of refill at
+        // 2 tokens/sec, so an idle visitor accrues a minute-scale buffer between
+        // bursts and static-asset preloads don't trip the limiter. Expressed as
+        // refillPerSecond × window-in-seconds so the count is never a bare magic
+        // number. (Was C.TIME.minutes(2) = 120000 — a ms/count unit error that
+        // set burst to 120k and effectively disabled the limiter.)
         backend:         "memory",
-        burst:           b.constants.TIME.minutes(2),
         refillPerSecond: 2,
+        burst:           rateLimitBurst,
         skipPaths:       ["/healthz", "/readyz"],
       },
       // cookies + cspNonce + fetchMetadata ride createApp's secure
@@ -397,11 +413,11 @@ async function buildApp(opts) {
       // unset — operators using a reverse proxy / NACL leave this off.
       if (adminAllowedCidrs.length > 0) {
         router.use(b.middleware.networkAllowlist({
-          paths:        ["/admin", "/admin/", "/healthz/internal"],
-          allowedCidrs: adminAllowedCidrs,
-          deniedCidrs:  adminDeniedCidrs,
-          trustProxy:   trustProxy,
-          audit:        b.audit,
+          paths:          ["/admin", "/admin/", "/healthz/internal"],
+          allowedCidrs:   adminAllowedCidrs,
+          deniedCidrs:    adminDeniedCidrs,
+          trustedProxies: adminTrustedProxies,
+          audit:          b.audit,
         }));
       }
       // bodyParser + cspNonce are wired by createApp (see the middleware
@@ -461,7 +477,7 @@ async function buildApp(opts) {
         notify:       notify,
         apiKeys:      apiKeys,
         loginLockout: loginLockout,
-        trustProxy:   trustProxy,
+        secureProtocol: secureProtocol,
         assets:       assets,
         nonceMw:      nonceMw,
         siteUrl:      opts.siteUrl || "https://blamejs.com",

package/lib/vendor/blamejs/examples/wiki/routes/admin.js

@@ -41,17 +41,14 @@ function register(router, ctx) {
   var notify = ctx.notify;
   var apiKeys = ctx.apiKeys;
   var loginLockout = ctx.loginLockout;
-  var trustProxy = ctx.trustProxy;
-
-  // Resolve the cookie Secure attribute through the framework's
-  // trust-proxy-aware protocol detector. With trustProxy:false (the
-  // default), x-forwarded-proto is ignored and only req.socket.encrypted
-  // counts — preventing an attacker from spoofing https with a header
-  // injection. Operators behind a real TLS terminator opt in via
-  // WIKI_TRUST_PROXY=1 in build-app.js.
+  // Resolve the cookie Secure attribute through the peer-gated protocol
+  // detector built in build-app.js: X-Forwarded-Proto is honored only when the
+  // request arrives via a declared reverse proxy (WIKI_ADMIN_TRUSTED_PROXIES),
+  // otherwise only req.socket.encrypted counts. A direct caller can't forge
+  // https with a header to suppress (or force) the Secure flag.
+  var secureProtocol = ctx.secureProtocol;
   function _secureCookieFlag(req) {
-    return b.requestHelpers.requestProtocol(req, { trustProxy: trustProxy }) === "https"
-      ? "; Secure" : "";
+    return secureProtocol(req) === "https" ? "; Secure" : "";
   }
 
   // ---- Login form ----

package/lib/vendor/blamejs/examples/wiki/server.js

@@ -31,10 +31,11 @@
  *
  *   Security hardening (read directly by lib/build-app.js):
  *
- *   WIKI_TRUST_PROXY                    "1" / "true" — honour x-forwarded-proto for
- *                                       cookie Secure-flag detection. Set ONLY when
- *                                       behind a TLS terminator (Caddy / Nginx /
- *                                       cloud LB) that injects the header.
+ *   WIKI_ADMIN_TRUSTED_PROXIES          comma-separated reverse-proxy CIDRs. When set,
+ *                                       peer-gates x-forwarded-for (the /admin fence)
+ *                                       and x-forwarded-proto (cookie Secure flag) — the
+ *                                       headers are honoured ONLY from a trusted peer, so
+ *                                       a direct caller can't forge an IP or claim https.
  *   WIKI_ADMIN_ALLOWED_CIDRS            comma-separated CIDR list. When set, mounts
  *                                       b.middleware.networkAllowlist as the in-process
  *                                       CIDR fence on /admin paths. Empty = no fence.

package/lib/vendor/blamejs/examples/wiki/test/e2e.js

@@ -93,6 +93,11 @@ async function _bootApp() {
     port:          0,                 // ephemeral
     adminEmail:    ADMIN_EMAIL,
     adminPassword: ADMIN_PASSWORD,
+    // The completeness crawler fetches every nav page + internal link in a
+    // tight loop — far above any human browsing rate. Raise the rate-limit
+    // burst so those checks aren't 429'd; the limiter's own enforcement is
+    // covered by the brute-force lockout assertions below.
+    rateLimitBurst: 100000,
   });
 }
 

package/lib/vendor/blamejs/lib/a2a-tasks.js

@@ -380,6 +380,18 @@ function middlewareTasks(opts) {
       throw new A2aTasksError("a2a-tasks/bad-mw-opts",
         "middleware.tasks: opts.scopes must be an object when provided", true);
     }
+    // Every scope VALUE must be a non-empty string. A non-string value (e.g.
+    // {transfer: ["a2a:transfer"]}) would make the runtime `typeof requiredScope
+    // === "string"` gate silently skip — a fail-open authorization bypass on a
+    // gated skill. Catch the operator typo at boot, not at request time.
+    var scopeKeys = Object.keys(opts.scopes);
+    for (var sk = 0; sk < scopeKeys.length; sk += 1) {
+      var sv = opts.scopes[scopeKeys[sk]];
+      if (typeof sv !== "string" || sv.length === 0) {
+        throw new A2aTasksError("a2a-tasks/bad-mw-opts",
+          "middleware.tasks: opts.scopes['" + scopeKeys[sk] + "'] must be a non-empty string", true);
+      }
+    }
   }
   var maxBytes = opts.maxBytes !== undefined ? opts.maxBytes : C.BYTES.mib(1);
   var emitAudit = opts.audit !== false;
@@ -429,16 +441,36 @@ function middlewareTasks(opts) {
       }
       var params = body.params || {};
 
-      // Scope enforcement for tasks/send (task references a skill).
-      if (body.method === "tasks/send" && scopes) {
-        if (!params.task || typeof params.task !== "object" || typeof params.task.skill !== "string") {
-          res.statusCode = 200;                                                                    // JSON-RPC error envelope returns 200
+      // Validate the protocol identifiers on the UNTRUSTED-peer ingress before
+      // handing them to the operator handler — the client send/get/cancel
+      // dispatchers enforce these shapes on egress, the server must too (the
+      // sibling b.mcp middleware validates toolName/resourceUri identically).
+      if (body.method === "tasks/send") {
+        try { _validateTaskShape(params.task, "middleware.tasks.task"); }
+        catch (eShape) {
+          res.statusCode = 200;
           res.setHeader("Content-Type", "application/json");
           res.end(JSON.stringify(_jsonRpcError(reqId, JSONRPC_INVALID_PARAMS,
-            "tasks/send: params.task.skill required")));
+            (eShape && eShape.message) || "tasks/send: invalid task")));
           return;
         }
-        var requiredScope = scopes[params.task.skill];
+      } else if (body.method === "tasks/get" || body.method === "tasks/cancel") {
+        if (typeof params.taskId !== "string" || params.taskId.length > 64 || !TASK_ID_RE.test(params.taskId)) {
+          res.statusCode = 200;
+          res.setHeader("Content-Type", "application/json");
+          res.end(JSON.stringify(_jsonRpcError(reqId, JSONRPC_INVALID_PARAMS,
+            body.method + ": params.taskId must match " + TASK_ID_RE)));
+          return;
+        }
+      }
+
+      // Scope enforcement for tasks/send (task references a skill).
+      if (body.method === "tasks/send" && scopes) {
+        // Own-property lookup ONLY — an attacker-controlled skill like
+        // "constructor"/"toString" must not resolve an inherited Object.prototype
+        // member (proto-shadow). The skill shape is already validated above.
+        var hasScope = Object.prototype.hasOwnProperty.call(scopes, params.task.skill);
+        var requiredScope = hasScope ? scopes[params.task.skill] : undefined;
         if (typeof requiredScope === "string") {
           var grantedScopes = Array.isArray(req.a2aScopes) ? req.a2aScopes : [];
           if (grantedScopes.indexOf(requiredScope) === -1) {

package/lib/vendor/blamejs/lib/agent-event-bus.js

@@ -422,6 +422,19 @@ async function _subscribe(topics, pubsub, name, handler, sOpts, permissions, aud
         topic: name, reason: "require-mac-disabled", phase: "delivery",
       });
     }
+    // Channel binding: the authenticated _topic must match the channel this
+    // handler was registered for. The MAC binds _topic, so a pubsub-write
+    // attacker cannot FORGE it — but they CAN replay a genuinely-MAC'd
+    // envelope from topic A onto topic B's channel. If A and B share a
+    // schema and tenant, that replay would otherwise be delivered to B's
+    // handler as a B-event. Drop on mismatch.
+    if (wrapped._topic !== name) {
+      _safeAudit(auditImpl, "agent.event_bus.delivery_dropped", sOpts.actor, {
+        topic: name, reason: "topic-channel-mismatch",
+        envelopeTopic: typeof wrapped._topic === "string" ? wrapped._topic : null,
+      });
+      return;
+    }
     // Tenant-scope check: subscriber's tenantId must match the
     // publisher's tenantId from the wire envelope. If the envelope
     // lacks _tenantId (publisher omitted), that's a tampered or

package/lib/vendor/blamejs/lib/agent-idempotency.js

@@ -310,7 +310,11 @@ async function _get(store, method, actorId, key, auditImpl, ttlMs, maxResultByte
   var updatedReplayCount;
   if (typeof store.incrementReplayCount === "function") {
     var updated = await store.incrementReplayCount(method, actorId, hash);
-    updatedReplayCount = updated && updated.replayCount ? updated.replayCount : (row.replayCount || 0) + 1;
+    // Coerce the store's returned count to a number — a backend that returns it
+    // as a string (some drivers stringify integer columns) would otherwise make
+    // updatedReplayCount a string and corrupt downstream arithmetic/comparison.
+    var inc = updated && updated.replayCount != null ? Number(updated.replayCount) : NaN;
+    updatedReplayCount = Number.isFinite(inc) ? inc : (Number(row.replayCount) || 0) + 1;
   } else {
     _safeAudit(auditImpl, "agent.idempotency.non_atomic_increment", null, {
       method: method, actorIdHash: _truncHash(_actorIdHash(actorId)),