@blamejs/blamejs-shop 0.4.69 → 0.4.71

package/lib/vendor/blamejs/lib/atomic-file.js

@@ -40,6 +40,8 @@
  */
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
+var nodeStream = require("node:stream");
+var streamPromises = require("node:stream/promises");
 var { generateToken, sha3Hash } = require("./crypto");
 var safeJson = require("./safe-json");
 var C = require("./constants");
@@ -81,7 +83,11 @@ class AtomicFileError extends FrameworkError {
 // primitive's standard names; jitterFactor 0.5 reproduces the original
 // `delay * (0.5 + Math.random()/2)` range of [delay/2, delay].
 
-var TRANSIENT_FS_ERRNOS = new Set(["EBUSY", "EAGAIN", "ENFILE", "EMFILE", "EPERM"]);
+// EACCES joins the transient set: on Windows a freshly-written file is briefly
+// locked by AV / the search indexer / a file-sync client (Dropbox, OneDrive),
+// surfacing as EACCES (alongside EPERM/EBUSY) on the next open/rename — the same
+// transient contention the sync _renameWithRetry already treats as retryable.
+var TRANSIENT_FS_ERRNOS = new Set(["EBUSY", "EAGAIN", "ENFILE", "EMFILE", "EPERM", "EACCES"]);
 
 function _isFsRetryable(e) {
   return e != null && TRANSIENT_FS_ERRNOS.has(e.code);
@@ -485,6 +491,146 @@ function writeSync(filepath, data, opts) {
   };
 }
 
+/**
+ * @primitive b.atomicFile.writeStream
+ * @signature b.atomicFile.writeStream(filepath, source, opts?)
+ * @since     0.15.14
+ * @status    stable
+ * @related   b.atomicFile.writeSync, b.atomicFile.openNoFollowSync
+ *
+ * Streaming sibling of `writeSync` for payloads too large to buffer in
+ * memory. Pipes a Readable `source` into a sibling temp file opened with
+ * `O_EXCL | O_NOFOLLOW` (the same exclusive, symlink-refusing create
+ * every atomic write uses), fsyncs, then atomically renames over
+ * `filepath` and fsyncs the parent directory. A plain
+ * `fs.createWriteStream(filepath)` instead follows a symlink an attacker
+ * pre-planted at `filepath` (CWE-59 arbitrary write) and leaves a
+ * half-written object at the canonical name if the source aborts
+ * mid-stream — this primitive does neither: the file appears at
+ * `filepath` only after the full stream has landed and synced.
+ *
+ * Enforces a byte ceiling while streaming (`maxBytes`, default 64 MiB) so
+ * an unbounded source cannot fill the disk; the partial temp is removed
+ * on overflow or any pipeline error.
+ *
+ * @opts
+ *   fileMode:  0o600,            // mode applied to the temp file (and thus the renamed final)
+ *   maxBytes:  64 * 1024 * 1024, // refuse + clean up once the source exceeds this many bytes
+ *   signal:    undefined,        // optional AbortSignal forwarded to the pipeline
+ *
+ * @example
+ *   await b.atomicFile.writeStream(
+ *     "/var/lib/blamejs/object",
+ *     incomingRequestStream,
+ *     { fileMode: 0o600, maxBytes: b.C.BYTES.gib(2) }
+ *   );
+ *   // → { bytesWritten: 12345 }
+ */
+async function writeStream(filepath, source, opts) {
+  opts = Object.assign({}, DEFAULTS, opts || {});
+  if (!source || typeof source.pipe !== "function") {
+    throw new AtomicFileError(
+      "writeStream: source must be a Readable stream", "atomic-file/invalid-source");
+  }
+  var maxBytes = opts.maxBytes;
+
+  var dir = nodePath.dirname(filepath);
+  if (!nodeFs.existsSync(dir)) nodeFs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+
+  var tmpPath = filepath + ".tmp-" + generateToken(C.BYTES.bytes(8));
+  var fd = _openExclTemp(tmpPath, opts.fileMode);
+  var fileStream = nodeFs.createWriteStream(null, { fd: fd, autoClose: false });
+  var bytesWritten = 0;
+  var renamed = false;
+
+  // Cap the stream as it flows — an unbounded source must not fill the disk.
+  var counter = new nodeStream.Transform({
+    transform: function (chunk, _enc, cb) {
+      bytesWritten += chunk.length;
+      if (typeof maxBytes === "number" && bytesWritten > maxBytes) {
+        return cb(new AtomicFileError(
+          "writeStream: source exceeds maxBytes " + maxBytes, "atomic-file/too-large"));
+      }
+      cb(null, chunk);
+    },
+  });
+
+  try {
+    if (opts.signal) {
+      await streamPromises.pipeline(source, counter, fileStream, { signal: opts.signal });
+    } else {
+      await streamPromises.pipeline(source, counter, fileStream);
+    }
+    _fsync(fd);
+    nodeFs.closeSync(fd);
+    fd = -1;
+    _renameWithRetry(tmpPath, filepath);
+    renamed = true;
+    _fsyncDir(dir);
+  } finally {
+    if (fd >= 0) { try { nodeFs.closeSync(fd); } catch (_e) { /* already closed? */ } }
+    if (!renamed) {
+      // Source aborted, overflowed, or the rename failed — remove the temp so
+      // no half-written object survives at the canonical name.
+      try { nodeFs.unlinkSync(tmpPath); } catch (_e) { /* may not exist */ }
+    }
+  }
+
+  return { bytesWritten: bytesWritten };
+}
+
+/**
+ * @primitive b.atomicFile.writeExclSync
+ * @signature b.atomicFile.writeExclSync(filepath, data, opts?)
+ * @since     0.15.14
+ * @status    stable
+ * @related   b.atomicFile.writeSync, b.atomicFile.openNoFollowSync
+ *
+ * Exclusive, symlink-refusing write to `filepath` WITHOUT the atomic
+ * rename — for staged "write → fsync → verify → rename" flows where the
+ * caller must re-read and validate the written bytes before committing them
+ * over the live file (the vault seal/unseal round-trip re-reads the staged
+ * file and confirms it decrypts before renaming it into place). Clears any
+ * stale leftover at `filepath` first (an aborted prior run, or a planted
+ * symlink — `unlink` removes the LINK, never its target), then creates the
+ * file with `O_EXCL | O_NOFOLLOW`, so a symlink re-planted in the race
+ * window fails the open closed instead of being followed (CWE-59 / CWE-377).
+ * fsyncs the data before returning. For an ordinary write-and-replace use
+ * `writeSync`, which renames atomically; reach for this only when a
+ * verify-before-commit step sits between the write and the rename.
+ *
+ * @opts
+ *   fileMode: 0o600,   // mode applied to the created file
+ *
+ * @example
+ *   b.atomicFile.writeExclSync(stagingPath, bytes, { fileMode: 0o600 });
+ *   // re-read + verify stagingPath, then:
+ *   b.atomicFile.renameWithRetry(stagingPath, finalPath);
+ */
+function writeExclSync(filepath, data, opts) {
+  opts = Object.assign({}, DEFAULTS, opts || {});
+  var buf = safeBuffer.toBuffer(data, {
+    errorClass:  AtomicFileError,
+    typeCode:    "atomic-file/invalid-data",
+    typeMessage: "data must be Buffer, Uint8Array, or string",
+  });
+  // Clear any stale leftover so the exclusive create can proceed; unlink
+  // removes a planted symlink itself (not its target), and the O_EXCL open
+  // then fails closed if anything re-appears at the path in the race window.
+  try { nodeFs.unlinkSync(filepath); } catch (_e) { /* nothing to clear */ }
+  var fd = _openExclTemp(filepath, opts.fileMode);
+  try {
+    var pos = 0;
+    while (pos < buf.length) {
+      pos += nodeFs.writeSync(fd, buf, pos, buf.length - pos, null);
+    }
+    _fsync(fd);
+  } finally {
+    try { nodeFs.closeSync(fd); } catch (_e) { /* already closed? */ }
+  }
+  return { bytesWritten: buf.length };
+}
+
 /**
  * @primitive b.atomicFile.cleanOrphans
  * @signature b.atomicFile.cleanOrphans(filepath, opts)
@@ -730,6 +876,7 @@ function _validateMaxBytes(maxBytes) {
  *   expectedHash:   string,    // SHA3-512 the content must match (default: none)
  *   encoding:       string,    // decode to a string (default: return a Buffer)
  *   allowShortRead: boolean,   // slice to the bytes read instead of throwing (default: false)
+ *   withStat:       boolean,   // return { bytes, stat } — stat of the bound fd (mode/uid/gid/size/ino/nlink/mtimeMs), TOCTOU-free
  *   errorFor:       Function,  // (kind, detail) => Error|undefined; kinds: enoent / symlink / too-large / toctou / short-read / integrity
  *
  * @example
@@ -737,6 +884,11 @@ function _validateMaxBytes(maxBytes) {
  *     maxBytes: b.constants.BYTES.mib(1),
  *     encoding: "utf8",
  *   });
+ *
+ *   // Assert mode + owner on the exact inode the bytes came from (no re-stat):
+ *   var r = b.atomicFile.fdSafeReadSync("/etc/app/secret", { withStat: true });
+ *   if ((r.stat.mode & 0o077) !== 0) throw new Error("secret is group/other-readable");
+ *   // r.bytes is the Buffer (or string under `encoding`)
  */
 function fdSafeReadSync(filepath, opts) {
   opts = opts || {};
@@ -806,7 +958,26 @@ function fdSafeReadSync(filepath, opts) {
       throw errorFor("integrity", { expected: opts.expectedHash, actual: actual });
     }
   }
-  return opts.encoding ? buf.toString(opts.encoding) : buf;
+  var content = opts.encoding ? buf.toString(opts.encoding) : buf;
+  // withStat: return the fstat of the SAME bound fd alongside the bytes, so a
+  // caller that needs the mode / owner (e.g. to assert 0o600 + owned-by-me on a
+  // secrets file) reads it TOCTOU-free — the stat describes the exact inode the
+  // bytes came from, not a re-stat that an attacker could swap underneath.
+  if (opts.withStat) {
+    return {
+      bytes: content,
+      stat: {
+        mode:    fstat.mode,
+        uid:     fstat.uid,
+        gid:     fstat.gid,
+        size:    fstat.size,
+        ino:     fstat.ino,
+        nlink:   fstat.nlink,
+        mtimeMs: fstat.mtimeMs,
+      },
+    };
+  }
+  return content;
 }
 
 // Atomic-file's own reads route through fdSafeReadSync with an errorFor
@@ -1137,12 +1308,43 @@ function listDir(dir, opts) {
   return out;
 }
 
+/**
+ * @primitive b.atomicFile.openNoFollowSync
+ * @signature b.atomicFile.openNoFollowSync(filepath, mode?)
+ * @since      0.15.14
+ * @status     stable
+ * @related    b.atomicFile.fdSafeReadSync, b.atomicFile.readSync
+ *
+ * Open a path read-only with `O_NOFOLLOW` so a symlink at the final path
+ * component is refused (`ELOOP`) instead of followed — the streaming-read
+ * counterpart to `fdSafeReadSync` for callers that must `fs.createReadStream`
+ * (range serving, SRI/ETag hashing, large-object download) and cannot buffer
+ * the whole file. Stream from the returned fd: `fs.createReadStream(path, { fd
+ * })`. Defends a post-confinement symlink swap (CWE-22 / CWE-367) on
+ * request-reachable static-serve and object-store read paths, where a lexical
+ * `_assertInsideRoot` check alone leaves a swap window between the check and the
+ * open. `O_NOFOLLOW` is POSIX-only; on platforms without it the flag is 0 (a
+ * plain `O_RDONLY` open) — Windows symlink semantics differ and are out of
+ * scope. Throws the raw `openSync` error (caller maps `ELOOP` / `ENOENT`).
+ *
+ * @example
+ *   var fd = b.atomicFile.openNoFollowSync(absPath);
+ *   var stream = fs.createReadStream(absPath, { fd: fd });   // autoClose closes fd
+ */
+function openNoFollowSync(filepath, mode) {
+  var flags = nodeFs.constants.O_RDONLY | (nodeFs.constants.O_NOFOLLOW || 0);
+  return nodeFs.openSync(filepath, flags, mode === undefined ? 0o600 : mode);
+}
+
 module.exports = {
   write:             write,
   writeSync:         writeSync,
+  writeStream:       writeStream,
+  writeExclSync:     writeExclSync,
   read:              read,
   readSync:          readSync,
   fdSafeReadSync:    fdSafeReadSync,
+  openNoFollowSync:  openNoFollowSync,
   writeJson:         writeJson,
   readJson:          readJson,
   copy:              copy,

package/lib/vendor/blamejs/lib/audit-chain.js

@@ -39,6 +39,7 @@ var clusterStorage = require("./cluster-storage");
 var frameworkSchema = require("./framework-schema");
 var sql = require("./sql");
 var safeSql = require("./safe-sql");
+var safeBuffer = require("./safe-buffer");
 var { sha3Hash } = require("./crypto");
 
 // b.sql opts for the chain read SQL these primitives compose. The reader
@@ -219,6 +220,8 @@ async function getChainTip(queryOneAsync, tableName, opts) {
  *   maxRows:   number,   // stop after N rows per (sub-)chain (default: walk every row)
  *   chainKey:  string,   // partition column — verify each sub-chain independently
  *   maxChains: number,   // max partitions to verify under chainKey (default 100000; fails closed)
+ *   from:      number,   // single-chain only: verify rows with monotonicCounter >= from, anchored at the predecessor's rowHash (incremental verify after a known-good checkpoint)
+ *   to:        number,   // single-chain only: verify rows with monotonicCounter <= to
  *
  * @example
  *   async function queryAll(sql) { return await myDriver.query(sql); }
@@ -275,7 +278,12 @@ function _walkRows(rows, tableName, startPrevHash, opts) {
 
     if (opts.maxRows && i >= opts.maxRows - 1) break;
   }
-  return { ok: true, table: tableName, rowsVerified: rows.length, lastHash: prevHash };
+  // Report the count ACTUALLY walked, not rows.length — under maxRows the walk
+  // stops early, so rows.length would over-report coverage (a caller reading
+  // rowsVerified to judge how much of the chain was checked must see the real
+  // number, not be told the whole table verified when only maxRows did).
+  var verifiedCount = opts.maxRows ? Math.min(rows.length, opts.maxRows) : rows.length;
+  return { ok: true, table: tableName, rowsVerified: verifiedCount, lastHash: prevHash };
 }
 
 async function verifyChain(queryAllAsync, tableName, opts) {
@@ -349,11 +357,30 @@ async function verifyChain(queryAllAsync, tableName, opts) {
       anchor = [];
     }
     if (Array.isArray(anchor) && anchor.length > 0) {
-      prevHash = anchor[0].lastPurgedRowHash;
-      skipBeforeCounter = Number(anchor[0].lastPurgedCounter);
+      var aHash = anchor[0].lastPurgedRowHash;
+      var aCounter = Number(anchor[0].lastPurgedCounter);
+      // A corrupted / tampered purge anchor (non-hex lastPurgedRowHash or a
+      // non-numeric lastPurgedCounter) must fail CLOSED with a clear reason.
+      // Passing a garbage prevHash into _walkRows → computeRowHash would THROW
+      // ("prevHash must be a 128-char hex"), turning a defensive verify into an
+      // uncaught exception; a NaN counter would skip nothing and surface as an
+      // opaque chain-break. Detect it here and return { ok:false }.
+      if (!safeBuffer.isHex(aHash, SHA3_512_HEX_LEN) || !isFinite(aCounter) || aCounter < 0) {
+        return { ok: false, table: tableName, rowsVerified: 0, reason: "corrupted purge anchor" };
+      }
+      prevHash = aHash;
+      skipBeforeCounter = aCounter;
     }
   }
 
+  // Incremental verify (b.audit.verify { from, to }): verify only rows whose
+  // monotonicCounter is in [from, to]. `from` must anchor on the rowHash of the
+  // row immediately BEFORE it, so the scoped walk chains correctly — otherwise
+  // the first in-range row's prevHash (= the predecessor's rowHash) wouldn't
+  // match ZERO_HASH and a good chain would falsely report a break.
+  var fromCounter = (opts.from != null && isFinite(Number(opts.from))) ? Number(opts.from) : null;
+  var toCounter   = (opts.to != null && isFinite(Number(opts.to)))   ? Number(opts.to)   : null;
+
   var rowsBuilt = sql.select(tableName, _sqlOpts())
     .orderBy("monotonicCounter", "asc")
     .toSql();
@@ -364,9 +391,31 @@ async function verifyChain(queryAllAsync, tableName, opts) {
   // verified on SQLite without this. coerceRow makes the recompute
   // type-stable across backends (no-op on already-numeric SQLite rows).
   rows = frameworkSchema.coerceRows(rows);
-  if (skipBeforeCounter > 0) {
+
+  // Resolve the incremental-verify anchor: the highest row strictly below
+  // `from` (derived from the already-read rows, no extra query). Raise
+  // skipBeforeCounter to it and adopt its rowHash as the chain anchor.
+  if (fromCounter != null && fromCounter > skipBeforeCounter + 1) {
+    var pred = null;
+    for (var pi = 0; pi < rows.length; pi++) {
+      var pc = Number(rows[pi].monotonicCounter);
+      if (pc < fromCounter && pc > skipBeforeCounter) pred = rows[pi]; else if (pc >= fromCounter) break;
+    }
+    if (pred) {
+      if (!safeBuffer.isHex(pred.rowHash, SHA3_512_HEX_LEN)) {
+        return { ok: false, table: tableName, rowsVerified: 0, reason: "incremental-verify anchor row has a corrupt rowHash" };
+      }
+      prevHash = pred.rowHash;
+      skipBeforeCounter = Math.max(skipBeforeCounter, Number(pred.monotonicCounter));
+    }
+  }
+
+  if (skipBeforeCounter > 0 || toCounter != null) {
     rows = rows.filter(function (r) {
-      return Number(r.monotonicCounter) > skipBeforeCounter;
+      var c = Number(r.monotonicCounter);
+      if (c <= skipBeforeCounter) return false;
+      if (toCounter != null && c > toCounter) return false;
+      return true;
     });
   }
 

package/lib/vendor/blamejs/lib/audit-daily-review.js

@@ -83,9 +83,15 @@ function _defaultClassify(event) {
 }
 
 function _severityAtLeast(severity, threshold) {
-  var sIdx = SEVERITY_ORDER.indexOf(severity);
   var tIdx = SEVERITY_ORDER.indexOf(threshold);
-  if (sIdx === -1 || tIdx === -1) return false;
+  if (tIdx === -1) return false;   // unknown threshold (validated at config)
+  var sIdx = SEVERITY_ORDER.indexOf(severity);
+  // An UNKNOWN event severity — e.g. a custom classify(event) returning an
+  // unexpected value — must NOT silently drop the event from the review. Fail
+  // SAFE: treat it as meeting the threshold so the operator still sees the
+  // event (and notices their classify mis-returned) rather than missing a
+  // flagged event.
+  if (sIdx === -1) return true;
   return sIdx >= tIdx;
 }
 
@@ -247,6 +253,10 @@ function create(opts) {
         from:  fromMs,
         to:    startedAt,
         limit: queryLimit,
+        // Newest-first: if the window holds more than queryLimit events, keep
+        // the MOST RECENT (the actionable ones) — an ascending+limit query would
+        // keep the oldest and silently drop the newest from the review.
+        order: "desc",
       });
     } catch (e) {
       _emit("audit.daily_review.failed", {

package/lib/vendor/blamejs/lib/audit-sign.js

@@ -59,6 +59,7 @@
  *   SLH-DSA-SHAKE-256f post-quantum signature for audit-chain checkpoints.
  */
 var nodeFs = require("node:fs");
+var numericBounds = require("./numeric-bounds");
 var nodePath = require("node:path");
 var nodeCrypto = require("node:crypto");
 var atomicFile = require("./atomic-file");
@@ -835,7 +836,7 @@ function _normalizeTip(tip, fnLabel) {
       "auditSign." + fnLabel + ": tip must be an object { counter, tipHash }");
   }
   var counter = tip.counter;
-  if (typeof counter !== "number" || !isFinite(counter) || counter < 0 || Math.floor(counter) !== counter) {
+  if (!numericBounds.isNonNegativeFiniteInt(counter)) {
     throw _err("ANCHOR_BAD_COUNTER",
       "auditSign." + fnLabel + ": tip.counter must be a non-negative integer (got: " + counter + ")");
   }

package/lib/vendor/blamejs/lib/audit-tools.js

@@ -58,6 +58,7 @@ var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var pkg = require("../package.json");
 var atomicFile = require("./atomic-file");
+var C = require("./constants");
 var auditChain = require("./audit-chain");
 var canonicalJson = require("./canonical-json");
 var auditSign = require("./audit-sign");
@@ -349,6 +350,12 @@ async function _defaultReadPredecessorRowHash(firstCounter) {
 async function _buildBundle(args) {
   var kind         = args.kind;
   var rows         = args.rows;
+  // Verification witnesses: the rows between the purgeable slice's tip and
+  // the covering checkpoint's anchored counter. They ride the bundle so the
+  // chain can be walked up to the SIGNED atRowHash, but they are NOT part of
+  // the purgeable range (the manifest range below is computed from `rows`,
+  // and purge() only deletes [first..lastCounter]).
+  var witnessRows  = args.witnessRows || [];
   var checkpoint   = args.checkpoint || null;
   var passphrase   = args.passphrase;
   var predecessorRowHash = args.predecessorRowHash;
@@ -357,8 +364,9 @@ async function _buildBundle(args) {
   var lastRow  = rows[rows.length - 1];
   var files = {};
 
-  // 1. Encrypt the rows JSONL
-  var jsonl = rows.map(function (r) {
+  // 1. Encrypt the rows JSONL — purgeable slice followed by any witnesses
+  // (contiguous, ascending) so the verifier walks one unbroken chain.
+  var jsonl = rows.concat(witnessRows).map(function (r) {
     return JSON.stringify(_rowToWireForm(r));
   }).join("\n") + "\n";
   var rowsEnc = await backupCrypto.encryptWithFreshSalt(jsonl, passphrase);
@@ -437,26 +445,39 @@ async function _readBundle(inDir, passphrase) {
       "bundle directory does not exist: " + inDir);
   }
   var manifestPath = nodePath.join(inDir, "manifest.json");
-  if (!nodeFs.existsSync(manifestPath)) {
-    throw new AuditToolsError("audit-tools/no-manifest",
-      "manifest.json missing in " + inDir);
-  }
-  var manifest = safeJson.parse(nodeFs.readFileSync(manifestPath, "utf8"));
+  // Capped fd-bound read (no existsSync check-then-read window): an externally-
+  // supplied bundle manifest is parsed before verification, so an oversized
+  // manifest.json would OOM the verifier before safeJson sees it. 4 MiB is far
+  // above any real manifest.
+  var manifest = safeJson.parse(atomicFile.fdSafeReadSync(manifestPath, {
+    maxBytes: C.BYTES.mib(4), encoding: "utf8",
+    errorFor: function (kind, detail) {
+      if (kind === "enoent") return new AuditToolsError("audit-tools/no-manifest", "manifest.json missing in " + inDir);
+      if (kind === "too-large") return new AuditToolsError("audit-tools/bad-format", "manifest.json too large (" + detail.size + " > " + detail.max + ")");
+      return new AuditToolsError("audit-tools/bad-format", "manifest.json unreadable: " + kind);
+    },
+  }), { maxBytes: C.BYTES.mib(4) });
   if (!manifest || manifest.format !== BUNDLE_FORMAT) {
     throw new AuditToolsError("audit-tools/bad-format",
       "manifest.format is not " + BUNDLE_FORMAT);
   }
-  if (!VALID_KINDS[manifest.kind]) {
+  if (!Object.prototype.hasOwnProperty.call(VALID_KINDS, manifest.kind)) {
     throw new AuditToolsError("audit-tools/bad-kind",
       "manifest.kind must be one of " + Object.keys(VALID_KINDS).join(", "));
   }
 
   var rowsEncPath = nodePath.join(inDir, frameworkFiles.fileName("rowsEnc"));
-  if (!nodeFs.existsSync(rowsEncPath)) {
-    throw new AuditToolsError("audit-tools/no-rows-blob",
-      "rows.enc missing in " + inDir);
-  }
-  var rowsEnc = nodeFs.readFileSync(rowsEncPath);
+  // Capped fd-bound read: rows.enc is the PQC-encrypted archived audit slice
+  // (can be large); a hostile multi-GB blob would be read + decrypted in memory
+  // before the checksum check. 512 MiB ceiling bounds it (opt-tunable).
+  var rowsEnc = atomicFile.fdSafeReadSync(rowsEncPath, {
+    maxBytes: C.BYTES.mib(512),
+    errorFor: function (kind) {
+      if (kind === "enoent") return new AuditToolsError("audit-tools/no-rows-blob", "rows.enc missing in " + inDir);
+      if (kind === "too-large") return new AuditToolsError("audit-tools/rows-too-large", "rows.enc exceeds the bundle size cap");
+      return new AuditToolsError("audit-tools/no-rows-blob", "rows.enc unreadable: " + kind);
+    },
+  });
   if (manifest.checksum && manifest.checksum.rowsSha3_512 &&
       backupCrypto.checksum(rowsEnc) !== manifest.checksum.rowsSha3_512) {
     throw new AuditToolsError("audit-tools/rows-checksum-mismatch",
@@ -470,11 +491,16 @@ async function _readBundle(inDir, passphrase) {
   var checkpoint = null;
   if (manifest.kind === KIND_ARCHIVE) {
     var ckptPath = nodePath.join(inDir, frameworkFiles.fileName("checkpointEnc"));
-    if (!nodeFs.existsSync(ckptPath)) {
-      throw new AuditToolsError("audit-tools/no-checkpoint-blob",
-        "checkpoint.enc missing in " + inDir + " (archive bundles must include the covering checkpoint)");
-    }
-    var ckptEnc = nodeFs.readFileSync(ckptPath);
+    // Capped fd-bound read: checkpoint.enc is a single PQC-encrypted
+    // audit_checkpoints row (a few KiB); 4 MiB bounds a hostile blob.
+    var ckptEnc = atomicFile.fdSafeReadSync(ckptPath, {
+      maxBytes: C.BYTES.mib(4),
+      errorFor: function (kind) {
+        if (kind === "enoent") return new AuditToolsError("audit-tools/no-checkpoint-blob", "checkpoint.enc missing in " + inDir + " (archive bundles must include the covering checkpoint)");
+        if (kind === "too-large") return new AuditToolsError("audit-tools/checkpoint-too-large", "checkpoint.enc exceeds the cap");
+        return new AuditToolsError("audit-tools/no-checkpoint-blob", "checkpoint.enc unreadable: " + kind);
+      },
+    });
     if (manifest.checksum && manifest.checksum.checkpointSha3_512 &&
         backupCrypto.checksum(ckptEnc) !== manifest.checksum.checkpointSha3_512) {
       throw new AuditToolsError("audit-tools/checkpoint-checksum-mismatch",
@@ -562,10 +588,31 @@ async function archive(opts) {
 
   var predecessorRowHash = await readPredecessorHash(firstCounter);
 
+  // The signed checkpoint is the bundle's only unforgeable anchor; it commits
+  // the row at checkpoint.atMonotonicCounter. When that counter sits BEYOND
+  // the purgeable slice's tip (the operator archived a subset older than the
+  // last checkpoint), carry the in-between rows as verification witnesses so
+  // verifyBundle can chain-walk up to the anchored row and bind atRowHash to
+  // it. Without them an attacker could pair any genuine high-counter
+  // checkpoint with a wholly fabricated slice. The witnesses are NOT purged.
+  var anchorCounter = Number(checkpoint.atMonotonicCounter);
+  var witnessRows = [];
+  if (anchorCounter > lastCounter) {
+    witnessRows = await readRows({ firstCounter: lastCounter + 1, lastCounter: anchorCounter });
+    var witnessTip = witnessRows.length ? Number(witnessRows[witnessRows.length - 1].monotonicCounter) : null;
+    if (witnessTip !== anchorCounter) {
+      throw new AuditToolsError("audit-tools/anchor-rows-missing",
+        "archive: covering checkpoint anchors counter=" + anchorCounter +
+        " but the rows up to it are not all available (read up to " + witnessTip +
+        ") — cannot prove the slice chains to the signed anchor");
+    }
+  }
+
   if (returnBytes) {
     var built = await _buildBundle({
       kind:       KIND_ARCHIVE,
       rows:       rows,
+      witnessRows: witnessRows,
       checkpoint: checkpoint,
       passphrase: opts.passphrase,
       predecessorRowHash: predecessorRowHash,
@@ -582,6 +629,7 @@ async function archive(opts) {
     outDir:     opts.out,
     kind:       KIND_ARCHIVE,
     rows:       rows,
+    witnessRows: witnessRows,
     checkpoint: checkpoint,
     passphrase: opts.passphrase,
     predecessorRowHash: predecessorRowHash,
@@ -769,26 +817,41 @@ async function verifyBundle(opts) {
     };
   }
 
-  // 2. Confirm the stored firstRowHash + lastRowHash match the slice
+  // 2. Confirm the stored firstRowHash + lastRowHash match the PURGEABLE
+  // slice boundary. The slice tip is the row at range.lastCounter — not
+  // necessarily the physical last row, which may be a verification witness
+  // carried past the slice so the chain can reach the signed checkpoint.
+  var lastCounterN = Number(read.manifest.range.lastCounter);
+  var sliceLastRow = null;
+  for (var ri = 0; ri < read.rows.length; ri++) {
+    if (Number(read.rows[ri].monotonicCounter) === lastCounterN) { sliceLastRow = read.rows[ri]; break; }
+  }
   if (read.rows[0].rowHash !== read.manifest.range.firstRowHash) {
     return {
       ok: false, kind: read.manifest.kind, rowsVerified: read.rows.length,
       reason: "manifest.range.firstRowHash does not match first row's rowHash",
     };
   }
-  if (read.rows[read.rows.length - 1].rowHash !== read.manifest.range.lastRowHash) {
+  if (!sliceLastRow || sliceLastRow.rowHash !== read.manifest.range.lastRowHash) {
     return {
       ok: false, kind: read.manifest.kind, rowsVerified: read.rows.length,
-      reason: "manifest.range.lastRowHash does not match last row's rowHash",
+      reason: "manifest.range.lastRowHash does not match the slice row at lastCounter",
     };
   }
 
-  // 3. (archive only) verify the covering checkpoint signature
+  // 3. (archive only) verify the covering checkpoint signature AND bind its
+  // anchored rowHash to the slice. The signature alone proves only that a
+  // checkpoint exists for some (counter, rowHash); without binding atRowHash
+  // to the archived rows, any genuine high-counter checkpoint could be paired
+  // with a wholly fabricated slice. The row at checkpoint.atMonotonicCounter
+  // must be present in the bundle (slice or witness) and its rowHash must
+  // equal checkpoint.atRowHash — mirroring b.audit.verifyCheckpoints against
+  // the live table.
   if (read.manifest.kind === KIND_ARCHIVE) {
     if (!read.checkpoint) {
       return { ok: false, kind: KIND_ARCHIVE, reason: "checkpoint missing from archive bundle" };
     }
-    if (Number(read.checkpoint.atMonotonicCounter) < Number(read.manifest.range.lastCounter)) {
+    if (Number(read.checkpoint.atMonotonicCounter) < lastCounterN) {
       return {
         ok: false, kind: KIND_ARCHIVE,
         reason: "checkpoint atMonotonicCounter (" + read.checkpoint.atMonotonicCounter +
@@ -805,6 +868,28 @@ async function verifyBundle(opts) {
         };
       }
     }
+    // Bind: the row the signature anchors must be in the bundle and match.
+    var anchorCounterN = Number(read.checkpoint.atMonotonicCounter);
+    var anchoredRow = null;
+    for (var ai = 0; ai < read.rows.length; ai++) {
+      if (Number(read.rows[ai].monotonicCounter) === anchorCounterN) { anchoredRow = read.rows[ai]; break; }
+    }
+    if (!anchoredRow) {
+      return {
+        ok: false, kind: KIND_ARCHIVE,
+        reason: "checkpoint anchors counter=" + anchorCounterN +
+                " but no such row is present in the bundle — checkpoint not bound to the archived slice",
+      };
+    }
+    if (anchoredRow.rowHash !== read.checkpoint.atRowHash) {
+      return {
+        ok: false, kind: KIND_ARCHIVE,
+        reason: "checkpoint atRowHash does not match the bundle row at counter=" + anchorCounterN +
+                " — the signed anchor does not bind this slice",
+        expected: read.checkpoint.atRowHash,
+        actual:   anchoredRow.rowHash,
+      };
+    }
   }
 
   return {

package/lib/vendor/blamejs/lib/audit.js

@@ -797,7 +797,12 @@ async function query(criteria) {
   if (criteria.resourceKind)    q = q.where({ resourceKind: criteria.resourceKind });
   if (criteria.outcome)         q = q.where({ outcome: criteria.outcome });
 
-  q.orderBy("monotonicCounter", "asc");
+  // order: "asc" (default, chronological) | "desc" (newest-first). A capped
+  // query (limit set) returns the FIRST `limit` rows in this order — so a
+  // consumer that wants the most RECENT events under a cap (e.g. the daily
+  // review) must pass order:"desc", else `limit` keeps the OLDEST and drops the
+  // newest events in the window.
+  q.orderBy("monotonicCounter", criteria.order === "desc" ? "desc" : "asc");
   if (criteria.limit  != null)  q.limit(criteria.limit);
   if (criteria.offset != null)  q.offset(criteria.offset);
 
@@ -834,7 +839,7 @@ async function _queryCluster(criteria) {
   if (criteria.resourceKind) qb.where("resourceKind", criteria.resourceKind);
   if (criteria.outcome)      qb.where("outcome", criteria.outcome);
 
-  qb.orderBy("monotonicCounter", "asc");
+  qb.orderBy("monotonicCounter", criteria.order === "desc" ? "desc" : "asc");
   if (criteria.limit  != null) qb.limit(criteria.limit);
   if (criteria.offset != null) qb.offset(criteria.offset);
 

package/lib/vendor/blamejs/lib/auth/access-lock.js

@@ -54,7 +54,7 @@ var SAFE_METHODS = Object.freeze({ GET: 1, HEAD: 1, OPTIONS: 1 });
 function _normalizeMode(mode) {
   if (typeof mode !== "string") return null;
   var m = mode.toLowerCase();
-  return VALID_MODES[m] ? m : null;
+  return Object.prototype.hasOwnProperty.call(VALID_MODES, m) ? m : null;
 }
 
 function create(opts) {
@@ -164,7 +164,7 @@ function create(opts) {
       if (_hasUnlockRole(req)) return next();
       if (currentMode === "read-only") {
         var method = (req.method || "GET").toUpperCase();
-        if (SAFE_METHODS[method]) return next();
+        if (Object.prototype.hasOwnProperty.call(SAFE_METHODS, method)) return next();
         _emitAudit("refused", "denied", { mode: currentMode, method: method, path: req.url });
         _emitMetric("refused", 1, { mode: currentMode, reason: "non-safe-method" });
         return _refuse(res, "non-safe-method-in-read-only");