@blamejs/blamejs-shop 0.4.69 → 0.4.71

package/lib/vendor/blamejs/lib/db.js

@@ -57,7 +57,7 @@ var { generateToken, generateBytes, encryptPacked, decryptPacked, sha3Hash } = r
 var cryptoField = require("./crypto-field");
 var dbDeclareRowPolicy = require("./db-declare-row-policy");
 var dbDeclareView = require("./db-declare-view");
-var { Query, _isRawWriteToResidencyTable, _assertRawWriteResidency } = require("./db-query");
+var { Query, _isRawWriteToResidencyTable, _assertRawWriteResidency, _stripLeadingSqlComments } = require("./db-query");
 var dbSchema = require("./db-schema");
 var { defineClass } = require("./framework-error");
 var frameworkFiles = require("./framework-files");
@@ -748,7 +748,7 @@ function loadOrCreateDbKey(dataDirPath, keyPathOverride) {
   var keyPath = keyPathOverride || nodePath.join(dataDirPath, frameworkFiles.fileName("dbKeyEnc"));
   var aad = _dbKeyAad(dataDirPath, keyPath);
   if (nodeFs.existsSync(keyPath)) {
-    var sealed = atomicFile.readSync(keyPath, { encoding: "utf8" }).trim();
+    var sealed = atomicFile.readSync(keyPath, { encoding: "utf8", maxBytes: C.BYTES.kib(64) }).trim();
     var b64;
     // isAadSealed is checked FIRST and is load-bearing: AAD_PREFIX
     // ("vault.aad:") is NOT a prefix of VAULT_PREFIX ("vault:"), so a
@@ -811,7 +811,10 @@ function decryptToTmp() {
       try { nodeFs.unlinkSync(dbPath + "-shm"); } catch (_e) { /* may not exist */ }
     }
   }
-  var packed = nodeFs.readFileSync(encPath);
+  // Cap + fd-bound db.enc read at db.init. NO refuseSymlink: the data dir may be
+  // a symlink-mounted volume (k8s PVC). db.enc is AEAD-verified downstream, so
+  // the cap is the OOM-before-cap defense (was an uncapped read).
+  var packed = atomicFile.fdSafeReadSync(encPath, { maxBytes: C.BYTES.gib(2) });
   if (packed.length < 26) return; // too short to be a valid envelope
   // AAD binds the envelope to this deployment's data dir so two
   // installs sharing the same operator passphrase can't swap each
@@ -890,11 +893,27 @@ function _probeStorageHeadroom() {
 // DELETE, PRAGMA, and DDL pass through ungated. Called once in init() after
 // schema setup so init's own writes are never gated (writesRefused is false
 // until the first probe anyway).
+// A growth write for the storage-low gate: INSERT/UPDATE/REPLACE at the head
+// AFTER stripping leading comments, OR a writable-CTE / EXPLAIN-prefixed write
+// (`WITH c AS (...) INSERT INTO t ...`) whose effective verb places rows. The
+// leading-keyword-only test missed both a `/* x */ INSERT` and a WITH-prefixed
+// growth write, letting them proceed into a near-full tmpfs (the ENOSPC the gate
+// exists to prevent). Matches write SYNTAX (INTO / UPDATE..SET) so a WITH..SELECT
+// carrying the word "insert" in a value is not refused.
+function _isGrowthWrite(sql) {
+  if (typeof sql !== "string") return false;
+  var s = _stripLeadingSqlComments(sql);
+  if (/^\s*(?:INSERT|UPDATE|REPLACE)\b/i.test(s)) return true;
+  if (/^\s*(?:WITH|EXPLAIN)\b/i.test(s) &&
+      /\b(?:(?:INSERT|REPLACE|MERGE)\s+(?:OR\s+[A-Za-z]+\s+)?INTO|UPDATE\s+[\w".`]+\s+SET)\b/i.test(s)) return true;
+  return false;
+}
+
 function _installWriteGate() {
   var rawPrepare = database.prepare.bind(database);
   database.prepare = function (sql) {
     var stmt = rawPrepare(sql);
-    if (/^\s*(?:INSERT|UPDATE|REPLACE)\b/i.test(sql)) {
+    if (_isGrowthWrite(sql)) {
       var rawRun = stmt.run.bind(stmt);
       stmt.run = function () {
         if (writesRefused) {
@@ -915,7 +934,7 @@ function encryptToDisk() {
   // Force WAL checkpoint so the .db file holds all committed transactions.
   try { runSql(database, "PRAGMA wal_checkpoint(TRUNCATE)"); } catch (_e) { /* best effort */ }
   if (!nodeFs.existsSync(dbPath)) return;
-  atomicFile.writeSync(encPath, encryptPacked(nodeFs.readFileSync(dbPath), encKey, _dbEncAad(dataDir)));
+  atomicFile.writeSync(encPath, encryptPacked(atomicFile.fdSafeReadSync(dbPath, { maxBytes: C.BYTES.gib(2) }), encKey, _dbEncAad(dataDir)));
 }
 
 /**
@@ -952,7 +971,7 @@ function snapshot() {
     throw _dbErr("db/snapshot-no-source",
       "snapshot: plaintext DB at " + dbPath + " is missing — did init complete?");
   }
-  var plain = nodeFs.readFileSync(dbPath);
+  var plain = atomicFile.fdSafeReadSync(dbPath, { maxBytes: C.BYTES.gib(2) });
   if (!encPath || !encKey) {
     // atRest: 'plain' — return the raw bytes. Operators wanting an
     // encrypted snapshot under plain mode wrap with their own
@@ -2611,14 +2630,12 @@ function declareRequireDualControl(args) {
   }
   var m = args.m === undefined ? 2 : args.m;
   var n = args.n === undefined ? Math.max(2, m) : args.n;
-  if (typeof m !== "number" || !isFinite(m) || m < 2 || Math.floor(m) !== m) {
-    throw new DbError("db/dual-control-bad-quorum",
-      "declareRequireDualControl: m must be an integer >= 2");
-  }
-  if (typeof n !== "number" || !isFinite(n) || n < m || Math.floor(n) !== n) {
-    throw new DbError("db/dual-control-bad-quorum",
-      "declareRequireDualControl: n must be an integer >= m");
-  }
+  // m >= 2, n >= m, both integers — via numericBounds (matches db.js's existing
+  // inline numeric-bounds usage; throws DbError("db/dual-control-bad-quorum")).
+  require("./numeric-bounds").requirePositiveFiniteInt(m,
+    "declareRequireDualControl: m", DbError, "db/dual-control-bad-quorum", { min: 2 });
+  require("./numeric-bounds").requirePositiveFiniteInt(n,
+    "declareRequireDualControl: n", DbError, "db/dual-control-bad-quorum", { min: m });
   if (args.posture !== undefined && args.posture !== null &&
       (typeof args.posture !== "string" || args.posture.length === 0)) {
     throw new DbError("db/dual-control-bad-posture",
@@ -2785,7 +2802,7 @@ function _checkRollback(dataDirPath) {
   }
   var tip;
   try {
-    tip = safeJson.parse(atomicFile.readSync(tipPath), { schema: AUDIT_TIP_SCHEMA });
+    tip = safeJson.parse(atomicFile.readSync(tipPath, { maxBytes: C.BYTES.kib(64) }), { schema: AUDIT_TIP_SCHEMA });
   } catch (e) {
     throw _dbErr("db/audit-tip-unreadable",
       "FATAL: audit.tip unreadable or schema-invalid at " + tipPath + " — " + e.message +

package/lib/vendor/blamejs/lib/dora.js

@@ -62,12 +62,19 @@ var SIGNIFICANT_INCIDENT_THRESHOLDS = Object.freeze({
   durationCriticalProcessMs:    C.TIME.hours(2),                                 // 2h
 });
 
-// Article 19 — initial report deadline: 24h from "first awareness".
-// Article 19(4) — intermediate update: within 72h of initial.
-// Article 19(6) — final report: within 1 month of initial.
-var INITIAL_REPORT_DEADLINE_MS      = C.TIME.hours(24);
-var INTERMEDIATE_REPORT_DEADLINE_MS = C.TIME.hours(72);
-var FINAL_REPORT_DEADLINE_MS        = C.TIME.days(30);
+// DORA major-incident reporting timeline (Art. 19 + RTS (EU) 2024/1772 Art. 5):
+//   - Initial notification: as early as possible and WITHIN 4 HOURS of
+//     classifying the incident as major (the outer bound is 24h from first
+//     awareness). classify() returns mustReportInitialByMs as a duration FROM
+//     classification, so the operative window encoded here is 4h — the
+//     24h-from-awareness outer bound is enforced separately via
+//     INITIAL_REPORT_OUTER_DEADLINE_MS below.
+//   - Intermediate update: within 72h of the INITIAL notification's submission.
+//   - Final report: within 1 month of the intermediate report's submission.
+var INITIAL_REPORT_DEADLINE_MS       = C.TIME.hours(4);
+var INITIAL_REPORT_OUTER_DEADLINE_MS = C.TIME.hours(24);
+var INTERMEDIATE_REPORT_DEADLINE_MS  = C.TIME.hours(72);
+var FINAL_REPORT_DEADLINE_MS         = C.TIME.days(30);
 
 // Adjacent-regulation incident-reporting deadlines — operators wiring
 // NIS2 / CRA / HIPAA breach notification reach for these constants
@@ -124,14 +131,26 @@ function _classifyImpl(input) {
     reasons.push("severity-high");
   }
 
-  // 2. Affected clients (absolute).
+  // 2. Affected clients — absolute count OR share of the client base. The
+  //    percentile thresholds (RTS 2024/1772 Art. 1(1)(a): >10% major, ESA-
+  //    guideline 1% significant) were declared but never evaluated, so a
+  //    large-share-but-small-absolute incident (e.g. 16% of a 50k client base)
+  //    under-classified. Operators pass clientBase (total clients) to enable
+  //    the percentage criterion; absolute-only behavior is unchanged when it
+  //    is omitted.
   if (typeof input.affectedClients === "number" && input.affectedClients > 0) {
-    if (input.affectedClients >= MAJOR_INCIDENT_THRESHOLDS.affectedClientsAbsolute) {
+    var clientBase = (typeof input.clientBase === "number" && input.clientBase > 0) ? input.clientBase : null;
+    var clientPct = clientBase ? (input.affectedClients / clientBase) : 0;
+    var majorByClients = input.affectedClients >= MAJOR_INCIDENT_THRESHOLDS.affectedClientsAbsolute ||
+      (clientBase !== null && clientPct >= MAJOR_INCIDENT_THRESHOLDS.affectedClientsPercentile);
+    var significantByClients = input.affectedClients >= SIGNIFICANT_INCIDENT_THRESHOLDS.affectedClientsAbsolute ||
+      (clientBase !== null && clientPct >= SIGNIFICANT_INCIDENT_THRESHOLDS.affectedClientsPercentile);
+    if (majorByClients) {
       hitsMajor += 1;
-      reasons.push("clients-major-absolute");
-    } else if (input.affectedClients >= SIGNIFICANT_INCIDENT_THRESHOLDS.affectedClientsAbsolute) {
+      reasons.push("clients-major");
+    } else if (significantByClients) {
       hitsSignificant += 1;
-      reasons.push("clients-significant-absolute");
+      reasons.push("clients-significant");
     }
   }
 
@@ -188,7 +207,11 @@ function _classifyImpl(input) {
   return {
     classification:        classification,
     mustReport:            mustReport,
+    // Operative initial-notification window: 4h from this classification.
     mustReportInitialByMs: mustReport ? INITIAL_REPORT_DEADLINE_MS : null,
+    // Outer bound: no later than 24h from first awareness — surfaced so an
+    // operator scheduling from `detectedAt` can enforce min(class+4h, aware+24h).
+    mustReportInitialOuterByMs: mustReport ? INITIAL_REPORT_OUTER_DEADLINE_MS : null,
     reasons:               reasons,
   };
 }
@@ -343,10 +366,16 @@ function create(opts) {
       // Article 19 deadline — operator-side scheduler uses this.
       nextStageDueAt:    null,
     };
+    // Anchor each downstream deadline on the SUBMISSION time of the report
+    // being filed (record.reportedAt), not on detectedAt: the intermediate is
+    // due 72h after the initial is *submitted*, and the final one month after
+    // the intermediate is *submitted* (DORA RTS 2024/1772 reporting timeline).
+    // Anchoring on detectedAt understates the deadline whenever a report is
+    // filed later than detection.
     if (input.stage === "initial") {
-      record.nextStageDueAt = input.detectedAt + INTERMEDIATE_REPORT_DEADLINE_MS;
+      record.nextStageDueAt = record.reportedAt + INTERMEDIATE_REPORT_DEADLINE_MS;
     } else if (input.stage === "intermediate") {
-      record.nextStageDueAt = input.detectedAt + FINAL_REPORT_DEADLINE_MS;
+      record.nextStageDueAt = record.reportedAt + FINAL_REPORT_DEADLINE_MS;
     }
     _emit("dora.incident.reported", {
       metadata: {
@@ -396,6 +425,7 @@ module.exports = {
   MAJOR_INCIDENT_THRESHOLDS:           MAJOR_INCIDENT_THRESHOLDS,
   SIGNIFICANT_INCIDENT_THRESHOLDS:     SIGNIFICANT_INCIDENT_THRESHOLDS,
   INITIAL_REPORT_DEADLINE_MS:          INITIAL_REPORT_DEADLINE_MS,
+  INITIAL_REPORT_OUTER_DEADLINE_MS:    INITIAL_REPORT_OUTER_DEADLINE_MS,
   INTERMEDIATE_REPORT_DEADLINE_MS:     INTERMEDIATE_REPORT_DEADLINE_MS,
   FINAL_REPORT_DEADLINE_MS:            FINAL_REPORT_DEADLINE_MS,
   DEADLINES_NIS2:                      DEADLINES_NIS2,

package/lib/vendor/blamejs/lib/dr-runbook.js

@@ -275,7 +275,7 @@ async function emit(opts) {
     "drRunbook.emit: outDir", DrRunbookError, "dr-runbook/no-outdir");
   validateOpts.requireNonEmptyString(opts.posture,
     "drRunbook.emit: posture", DrRunbookError, "dr-runbook/no-posture");
-  if (!POSTURE_BLOCKS[opts.posture]) {
+  if (!Object.prototype.hasOwnProperty.call(POSTURE_BLOCKS, opts.posture)) {
     throw new DrRunbookError("dr-runbook/unknown-posture",
       "drRunbook.emit: posture '" + opts.posture + "' not in supported list (" +
       Object.keys(POSTURE_BLOCKS).join(", ") + ")");

package/lib/vendor/blamejs/lib/dsa.js

@@ -36,6 +36,7 @@
 
 var validateOpts = require("./validate-opts");
 var lazyRequire = require("./lazy-require");
+var numericBounds = require("./numeric-bounds");
 var C = require("./constants");
 var { DsaError } = require("./framework-error");
 
@@ -414,7 +415,7 @@ function transparencyReport(opts) {
   METRIC_FIELDS.forEach(function (field) {
     var v = supplied[field];
     if (v === undefined || v === null) { metrics[field] = 0; return; }
-    if (typeof v !== "number" || !isFinite(v) || v < 0 || Math.floor(v) !== v) {
+    if (!numericBounds.isNonNegativeFiniteInt(v)) {
       throw new DsaError("dsa/bad-metric-value",
         "b.dsa.transparencyReport: metrics." + field +
         " must be a non-negative integer, got " +

package/lib/vendor/blamejs/lib/dsr.js

@@ -210,7 +210,7 @@ var POSTURE_DEADLINE_MS = Object.freeze({
 // + extension). Read-only at module scope.
 function _deadlineForPosture(posture) {
   if (typeof posture !== "string") return POSTURE_DEADLINE_MS["default"];
-  return POSTURE_DEADLINE_MS[posture] || POSTURE_DEADLINE_MS["default"];
+  return Object.prototype.hasOwnProperty.call(POSTURE_DEADLINE_MS, posture) ? POSTURE_DEADLINE_MS[posture] : POSTURE_DEADLINE_MS["default"];
 }
 
 function _now() { return Date.now(); }
@@ -1198,12 +1198,26 @@ function dbTicketStore(opts) {
     SUBJECT_FILTER_SPEC.forEach(function (spec) {
       var supplied = filter.subject[spec.key];
       if (!supplied) return;
-      var column = vaulted ? spec.hashCol : spec.plainCol;
-      var match  = vaulted
-        ? (function () { var d = cryptoField().computeDerived(DSR_SEAL_TABLE, spec.sealField, supplied); return d ? d.value : null; })()
-        : supplied;
-      conds.push(column + " = " + spec.param);
-      params[spec.param] = match;
+      if (!vaulted) {
+        conds.push(spec.plainCol + " = " + spec.param);
+        params[spec.param] = supplied;
+        return;
+      }
+      // Vaulted: match BOTH the active keyed-MAC digest AND the legacy
+      // salted-sha3 digest via the dual-read, so a ticket written before the
+      // keyed-MAC default flip is still FOUND. A single-value equality on the
+      // keyed-MAC digest silently skips those pre-flip rows, so an Art.17
+      // erasure purge (list-by-subject → delete) would leave the subject's
+      // legacy-hashed PII-bearing tickets behind. Mirrors subject.eraseHard.
+      var cand = cryptoField().lookupHashCandidates(DSR_SEAL_TABLE, spec.sealField, supplied);
+      var values = cand && cand.values ? cand.values : [];
+      if (values.length === 0) return;
+      var placeholders = values.map(function (v, i) {
+        var p = spec.param + "_" + i;
+        params[p] = v;
+        return p;
+      });
+      conds.push(spec.hashCol + " IN (" + placeholders.join(", ") + ")");
     });
   }
 
@@ -1455,7 +1469,7 @@ var STATE_RULES = Object.freeze({
 function stateRules(state) {
   if (typeof state !== "string" || state.length === 0) return null;
   // Direct posture-name lookup first
-  if (STATE_RULES[state]) return Object.assign({}, STATE_RULES[state]);
+  if (Object.prototype.hasOwnProperty.call(STATE_RULES, state)) return Object.assign({}, STATE_RULES[state]);
   // 2-letter state abbreviation lookup (case-insensitive)
   var u = state.toUpperCase();
   var keys = Object.keys(STATE_RULES);

package/lib/vendor/blamejs/lib/early-hints.js

@@ -170,6 +170,13 @@ function send(res, opts) {
       throw new EarlyHintsError("early-hints/bad-header-value",
         "earlyHints.send: header '" + name + "' must be a string or string[]", true);
     }
+    var vals = Array.isArray(canonical[name]) ? canonical[name] : [canonical[name]];
+    for (var vi = 0; vi < vals.length; vi += 1) {
+      if (typeof vals[vi] === "string" && _hasHeaderInjection(vals[vi])) {
+        throw new EarlyHintsError("early-hints/bad-header-value",
+          "earlyHints.send: header '" + name + "' value contains a CR/LF/NUL header-injection character", true);
+      }
+    }
     headers[name] = canonical[name];
   }
 
@@ -182,9 +189,21 @@ function send(res, opts) {
   }
 }
 
+// A header value reaching res.writeEarlyHints must carry no CR/LF/NUL — those
+// split the interim response into attacker-chosen headers. Node rejects them
+// too, but screen defensively (matching the cookies / security-headers
+// boundary) so the framework surfaces a typed error, not a raw Node throw.
+function _hasHeaderInjection(s) {
+  return s.indexOf("\r") !== -1 || s.indexOf("\n") !== -1 || s.indexOf("\0") !== -1;
+}
+
 function _validateLink(linkValue, idx) {
   validateOpts.requireNonEmptyString(linkValue, "earlyHints.send.link[" + idx + "]",
     EarlyHintsError, "early-hints/bad-link");
+  if (_hasHeaderInjection(linkValue)) {
+    throw new EarlyHintsError("early-hints/bad-link",
+      "link[" + idx + "] contains a CR/LF/NUL header-injection character");
+  }
   if (linkValue.length > LINK_MAX_BYTES) {
     throw new EarlyHintsError("early-hints/bad-link",
       "link[" + idx + "] exceeds " + LINK_MAX_BYTES + " bytes");

package/lib/vendor/blamejs/lib/eat.js

@@ -205,7 +205,11 @@ async function verify(eat, opts) {
   // Debug status — refuse a token that can't prove debug is disabled.
   if (opts.requireDebugDisabled === true) {
     var ds = raw.get(EAT.dbgstat);
-    if (typeof ds !== "number" || ds < DBGSTAT.disabled) {
+    // Accept ONLY a defined disabled enum value (1..4). `ds < disabled` alone
+    // let any out-of-range value >= 1 (5, 99, non-integers) pass as "disabled"
+    // — a fail-open on an undefined dbgstat (RFC 9711 §3.3 defines 0..4 only).
+    if (typeof ds !== "number" || !Number.isInteger(ds) ||
+        ds < DBGSTAT.disabled || ds > DBGSTAT["disabled-fully-and-permanently"]) {
       throw new EatError("eat/debug-not-disabled",
         "eat.verify: requireDebugDisabled — dbgstat is " +
         (ds === undefined ? "absent" : (DBGSTAT_BY_VALUE[ds] || ds)) + ", not a disabled state");

package/lib/vendor/blamejs/lib/external-db.js

@@ -339,6 +339,50 @@ function _classifyStatement(sql) {
   return _STATEMENT_CLASS_MAP[kw] || "OTHER";
 }
 
+// True when a top-level (paren-depth 0, outside any string / comment / quoted-
+// identifier / dollar-quoted span) RETURNING keyword is present — a DML
+// statement with RETURNING yields rows to the caller. Quote-aware so the literal
+// word inside a value ('see RETURNING docs') is not mistaken for a clause, and
+// depth-aware so a RETURNING buried in a CTE / subquery paren does not count for
+// the OUTER statement. Reuses the shared opaque-span scanner; single linear pass.
+function _hasTopLevelReturning(sql) {
+  var n = sql.length, i = 0, depth = 0;
+  while (i < n) {
+    var skipped = _skipOpaqueSpan(sql, i);
+    if (skipped === -1) return false;            // unterminated span — nothing top-level beyond
+    if (skipped !== i) { i = skipped; continue; }
+    var ch = sql.charAt(i);
+    if (ch === "(") { depth += 1; i += 1; continue; }
+    if (ch === ")") { depth -= 1; i += 1; continue; }
+    if (_isIdentStart(ch)) {
+      var we = i + 1;
+      while (we < n && _isIdentChar(sql.charAt(we))) we += 1;
+      if (depth === 0 && sql.slice(i, we).toUpperCase() === "RETURNING") return true;
+      i = we;
+      continue;
+    }
+    i += 1;
+  }
+  return false;
+}
+
+// Does this statement return a row set to the caller? Distinct from the
+// residency gate's read/write split: an `EXPLAIN ANALYZE INSERT` is a WRITE for
+// the gate yet returns plan rows; a DML `... RETURNING` is a write that yields
+// rows. Consumers (e.g. cluster-storage's local exec choosing .all() vs .run())
+// must use .all() for any row-returning statement, including a WITH (CTE) read
+// that the leading keyword alone would mis-route to .run() and SILENTLY DROP.
+// Statement classes that produce a row set for the caller (SELECT and the
+// READ_INFO family — SHOW / DESCRIBE / PRAGMA). Keyed by class name, mirroring
+// _STATEMENT_CLASS_MAP / _RESIDENCY_READ_CLASS.
+var _ROW_RETURNING_CLASS = Object.freeze({ SELECT: true, READ_INFO: true });
+
+function statementReturnsRows(sql) {
+  if (typeof sql !== "string" || sql.length === 0) return false;
+  if (_ROW_RETURNING_CLASS[_classifyStatement(sql)] === true) return true;
+  return _hasTopLevelReturning(sql);
+}
+
 // Statement classes that place no rows on the backend, so the cross-
 // border residency write gate lets them pass without a row tag. Every
 // other class — DML, ROUTINE (CALL / EXECUTE / DO), a COPY ... FROM
@@ -1810,12 +1854,19 @@ async function _readQuery(sql, params, opts) {
   // was explicitly configured allowCrossBorder (which is audited).
   var _readPosture = _activePosture();
   var _tagPresent = opts.rowResidencyTag && typeof opts.rowResidencyTag === "string";
+  // A replica only carries a real residency CONSTRAINT when its tag names a
+  // specific region. "unrestricted" / "global" mean "no constraint" (the tag
+  // defaults to "unrestricted" when none is configured), so such a replica may
+  // serve any region's rows and must NOT require opts.rowResidencyTag — gating
+  // it would over-reject every regulated read to an untagged replica.
+  var _replicaConstrained = replica.residencyTag &&
+    replica.residencyTag !== "unrestricted" && replica.residencyTag !== "global";
   // Fail CLOSED when the row's region is not identified: a regulated read to a
-  // residency-tagged replica without opts.rowResidencyTag would otherwise route
-  // residency-restricted rows to an arbitrary-region replica with no check at
-  // all (symmetric with the write gate's RESIDENCY_GATE_REQUIRED).
+  // residency-CONSTRAINED replica without opts.rowResidencyTag would otherwise
+  // route residency-restricted rows to an arbitrary-region replica with no check
+  // at all (symmetric with the write gate's RESIDENCY_GATE_REQUIRED).
   if (!_tagPresent && _crossBorderRegulated(_readPosture) &&
-      replica.residencyTag && !replica.allowCrossBorder) {
+      _replicaConstrained && !replica.allowCrossBorder) {
     _emit("db.residency.replica.tag_required", "denied", {
       backend: b.name, replicaIdx: replica.index,
       replicaTag: replica.residencyTag, posture: _readPosture,
@@ -2574,6 +2625,11 @@ module.exports = {
   // lock tables live on the externalDb side. See lib/external-db-migrate.js.
   migrate:        externalDbMigrate,
   Pool:           Pool,
+  // Shared SQL statement classifier (CTE / EXPLAIN aware): does the statement
+  // return a row set? Internal — consumed by cluster-storage's local exec to
+  // choose .all() vs .run() so a WITH (CTE) read is not mis-routed and its rows
+  // lost. Underscore-prefixed: framework-internal, not an operator API surface.
+  _statementReturnsRows: statementReturnsRows,
   _resetForTest:  _resetForTest,
   _extractTargetRelation: _extractTargetRelation,
 };

package/lib/vendor/blamejs/lib/fda-21cfr11.js

@@ -91,6 +91,18 @@ var DEFAULT_SIGNATURE_MEANINGS = Object.freeze([
 // must carry §11.10(e) shape. Operators add more via opts.gxpNamespaces.
 var DEFAULT_GXP_NAMESPACES = Object.freeze(["subject", "consent", "db", "breakglass"]);
 
+// Non-mutating verb segments. A GxP-namespace event whose final action segment
+// is NOT one of these is treated as a record MODIFICATION and must carry the
+// §11.10(e) before/after/reason shape (fail-closed — an unknown verb is assumed
+// to mutate). hasOwnProperty-guarded lookup (untrusted action key).
+var READ_VERBS = Object.freeze({
+  read: 1, viewed: 1, view: 1, get: 1, got: 1, list: 1, listed: 1, query: 1,
+  queried: 1, access: 1, accessed: 1, export: 1, exported: 1, history: 1,
+  isgranted: 1, check: 1, checked: 1, verify: 1, verified: 1, lookup: 1,
+  search: 1, searched: 1, fetch: 1, fetched: 1, render: 1, rendered: 1,
+  download: 1, downloaded: 1,
+});
+
 // §11.10(e) — every modification audit must carry timestamp, actor,
 // before/after pair, and a reason. The framework's audit row shape
 // already carries `recordedAt` (timestamp) + `actorUserId` + `reason`;
@@ -114,11 +126,15 @@ function _hasRequiredAuditShape(row) {
   if (!row.action || typeof row.action !== "string") {
     return { ok: false, reason: "row missing action verb (§11.10(e))" };
   }
-  // Modification-shaped events (verbs containing "update" / "modif" /
-  // "delete" / "rectif" / "erase" / "set") must carry before/after.
+  // §11.10(e) requires before/after on every record MODIFICATION. Inferring
+  // "is this a modification" from a denylist of mutating verbs silently let
+  // off-list verbs (anonymize / revoke / overwrite / replace / merge /
+  // withdraw / restrict / objection …) bypass the requirement. Fail CLOSED
+  // instead: a GxP-namespace event is treated as a modification UNLESS its
+  // final verb segment is on an explicit non-mutating READ allowlist.
   var verb = row.action.toLowerCase();
-  var modShape = /\.(update|updated|modif|modified|delete|deleted|rectif|rectified|erase|erased|set|setrole|put|patched)\b/.test(verb) ||
-    /\.(update|delete|modif|set|put|patch|rectif|erase)/.test(verb);
+  var lastSeg = verb.indexOf(".") === -1 ? verb : verb.slice(verb.lastIndexOf(".") + 1);
+  var modShape = !Object.prototype.hasOwnProperty.call(READ_VERBS, lastSeg);
   if (modShape) {
     var meta = row.metadata;
     // Audit chain stores metadata as a JSON string when read back —
@@ -263,7 +279,16 @@ function posture(opts) {
       }, "denied");
       return { ok: false, reason: "record-hash-mismatch" };
     }
-    if (verifyWith && signed.signature) {
+    if (verifyWith) {
+      // A configured verifier means a signature is REQUIRED — a null/empty
+      // signature must fail closed (recordHash alone is self-consistency, not
+      // authentication; accepting it is alg:none-style signature stripping).
+      if (!signed.signature) {
+        _emit("fda21cfr11.signature.verified", {
+          printedName: signed.printedName, ok: false, reason: "signature-required",
+        }, "denied");
+        return { ok: false, reason: "signature-required" };
+      }
       var sigBuf = Buffer.from(signed.signature, "base64");
       var payload = JSON.stringify({
         printedName:      signed.printedName,

package/lib/vendor/blamejs/lib/flag-providers.js

@@ -41,6 +41,7 @@ var validateOpts   = require("./validate-opts");
 var lazyRequire    = require("./lazy-require");
 var safeJson       = require("./safe-json");
 var C              = require("./constants");
+var atomicFile     = require("./atomic-file");
 var { defineClass } = require("./framework-error");
 var FlagError = defineClass("FlagError", { alwaysPermanent: true });
 
@@ -128,7 +129,10 @@ function localFile(opts) {
   validateOpts.requireNonEmptyString(opts.path,
     "providers.localFile: path", FlagError, "flag/bad-provider");
   var raw;
-  try { raw = nodeFs.readFileSync(opts.path, "utf8"); }
+  // Capped fd-bound read; the cap precedes the alloc so an oversized flag file
+  // can't OOM boot. refuseSymlink stays OFF: a flag file is commonly a k8s
+  // ConfigMap mount, which is a symlink chain — refusing it would break that.
+  try { raw = atomicFile.fdSafeReadSync(opts.path, { maxBytes: C.BYTES.mib(1), encoding: "utf8" }); }
   catch (e) {
     throw new FlagError("flag/bad-provider",
       "providers.localFile: cannot read file " + JSON.stringify(opts.path) +
@@ -154,7 +158,7 @@ function localFile(opts) {
     try {
       nodeFs.watch(opts.path, { persistent: false }, function () {
         try {
-          var nextRaw = nodeFs.readFileSync(opts.path, "utf8");
+          var nextRaw = atomicFile.fdSafeReadSync(opts.path, { maxBytes: C.BYTES.mib(1), encoding: "utf8" });
           var nextParsed = safeJson.parse(nextRaw, { maxBytes: C.BYTES.mib(1) });
           if (nextParsed && nextParsed.flags) {
             for (var k in nextParsed.flags) {

package/lib/vendor/blamejs/lib/forms.js

@@ -252,7 +252,7 @@ function _renderField(field) {
   var control;
   if (type === "textarea") control = _renderTextarea(field);
   else if (type === "select") control = _renderSelect(field);
-  else if (INPUT_TYPES[type])  control = _renderInput(field);
+  else if (Object.prototype.hasOwnProperty.call(INPUT_TYPES, type))  control = _renderInput(field);
   else throw new Error("forms.render: unsupported field type: " + type);
 
   // Hidden + submit fields don't need a label wrapper

package/lib/vendor/blamejs/lib/gate-contract.js

@@ -1095,13 +1095,49 @@ function makeProfileBuilder(profiles) {
  *   posture.piiPolicy;                                   // → "redact"
  */
 function lookupCompliancePosture(name, postures, errorFactory, codePrefix) {
-  if (!postures || !postures[name]) {
+  // hasOwnProperty: `name` is caller input; a bracket lookup would let a
+  // prototype key like "constructor" pass the presence check and reach
+  // Object.assign (proto shadowing).
+  if (!postures || !Object.prototype.hasOwnProperty.call(postures, name)) {
     throw errorFactory(codePrefix + ".bad-posture",
       "unknown compliancePosture " + JSON.stringify(name));
   }
   return Object.assign({}, postures[name]);
 }
 
+/**
+ * @primitive  b.gateContract.makePostureAccessor
+ * @signature  b.gateContract.makePostureAccessor(postures, opts?)
+ * @since      0.15.14
+ * @status     stable
+ * @related    b.gateContract.lookupCompliancePosture, b.gateContract.resolveProfileName
+ *
+ * Build the public `compliancePosture(name)` accessor a guard exposes — maps a
+ * compliance-posture name through the guard's own `postures` table to the
+ * profile it selects, returning `opts.fallback` (default `null`) for an
+ * unknown name. Folds the one-line lookup the mail-scanner / content-detect
+ * factories each redefined verbatim (`return POSTURES[name] || null`) into one
+ * proto-shadow-safe helper: the membership test is `hasOwnProperty.call` so a
+ * prototype key (constructor / __proto__ / toString) resolves to the fallback
+ * rather than an inherited Function. Unlike `lookupCompliancePosture` it does
+ * NOT throw and returns the raw mapped value (a profile name string), not an
+ * object copy.
+ *
+ * @opts
+ *   fallback: any,   // value returned for an unknown / proto-key name (default null)
+ *
+ * @example
+ *   var compliancePosture = b.gateContract.makePostureAccessor(COMPLIANCE_POSTURES);
+ *   compliancePosture("hipaa");        // → "strict"
+ *   compliancePosture("constructor");  // → null  (proto key, not an own posture)
+ */
+function makePostureAccessor(postures, opts) {
+  var fallback = (opts && Object.prototype.hasOwnProperty.call(opts, "fallback")) ? opts.fallback : null;
+  return function (name) {
+    return Object.prototype.hasOwnProperty.call(postures, name) ? postures[name] : fallback;
+  };
+}
+
 // "GuardCidrError" -> "guardCidr" — the guard's audit/message identity, derived
 // once from its error class name. Used for the default gate's audit/metric
 // prefix AND the profile resolver's error message, so neither re-cases the name.
@@ -1199,9 +1235,13 @@ function makeProfileResolver(cfg) {
  */
 function resolveProfileName(opts, postures, defaultProfile) {
   opts = opts || {};
-  return opts.profile ||
-    (opts.posture && postures && postures[opts.posture]) ||
-    defaultProfile;
+  // hasOwnProperty: opts.posture is caller/operator input; a bracket lookup
+  // would let a prototype key like "constructor" resolve to an inherited
+  // truthy value and become the profile name (proto shadowing).
+  var postureProfile = (opts.posture && postures &&
+    Object.prototype.hasOwnProperty.call(postures, opts.posture))
+    ? postures[opts.posture] : null;
+  return opts.profile || postureProfile || defaultProfile;
 }
 
 /**
@@ -2072,7 +2112,7 @@ Object.freeze(INPUT_CONTRACTS);
 
 function resolveInputContract(contract) {
   if (typeof contract === "function") return contract;
-  return INPUT_CONTRACTS[contract] || INPUT_CONTRACTS.text;
+  return Object.prototype.hasOwnProperty.call(INPUT_CONTRACTS, contract) ? INPUT_CONTRACTS[contract] : INPUT_CONTRACTS.text;
 }
 
 /**
@@ -3125,6 +3165,7 @@ module.exports = {
   charThreatDisposition: charThreatDisposition,
   extractBytesAsText: extractBytesAsText,
   lookupCompliancePosture: lookupCompliancePosture,
+  makePostureAccessor: makePostureAccessor,
   ALL_STRICT_POSTURES: ALL_STRICT_POSTURES,
   CHAR_THREATS_REJECT_ALL: CHAR_THREATS_REJECT_ALL,
   DANGEROUS_URL_SCHEMES: DANGEROUS_URL_SCHEMES,