@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/daemon.js

@@ -31,8 +31,17 @@
  *   `b.appShutdown.pidLock`, which layers O_EXCL atomic-create +
  *   signal-0 liveness probe + reap-on-stale.
  *
+ *   On Windows a received signal can never reach a JS handler
+ *   (process.kill maps it to TerminateProcess), so `stop` drives a
+ *   cooperative stop-request sentinel (`<pidFile>.stop`) that `start`
+ *   watches and routes into the same orchestrator, escalating to a hard
+ *   TerminateProcess only after the stop timeout. `status` is a read-only
+ *   liveness probe that never mutates the pidfile.
+ *
  *   Audit events: `daemon.started` (pidFile + logFile + commandKind +
- *   pid), `daemon.stopped` (pidFile + signal + waitMs + escalated),
+ *   pid), `daemon.stopped` (pidFile + signal + waitMs + escalated +
+ *   mechanism: signal|cooperative|terminate), `daemon.spawn_failed`
+ *   (pidFile + command) when a detached child fails to launch, and
  *   `daemon.stale_pid_cleaned` (pidFile + stalePid).
  *
  * @card
@@ -43,6 +52,7 @@ var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var numericBounds = require("./numeric-bounds");
 var appShutdown = require("./app-shutdown");
+var pidProbe = require("./pid-probe");
 var processSpawn = require("./process-spawn");
 var safeAsync = require("./safe-async");
 var atomicFile = require("./atomic-file");
@@ -62,27 +72,23 @@ var DEFAULT_STOP_TIMEOUT_MS = C.TIME.seconds(30);
 var DEFAULT_STOP_SIGNAL     = "SIGTERM";
 var DEFAULT_POLL_MS         = 100;
 var DEFAULT_LOG_FILE_MODE   = 0o600;
+// Poll cadence for the Windows cooperative-stop sentinel (a synchronous
+// existsSync on this interval; see _installStopSentinelWatcher for why it is a
+// poll and not a filesystem watch). Runs for a foreground daemon's whole
+// lifetime, so it is coarser than DEFAULT_POLL_MS (which only polls during the
+// brief stop window); 250ms keeps graceful-stop detection sub-second at
+// negligible idle cost.
+var STOP_SENTINEL_POLL_MS   = 250;
 
 function _safeAuditEmit(action, outcome, metadata) {
   auditEmit.emit(action, metadata, outcome);
 }
 
-function _isLivePid(pid) {
-  if (typeof pid !== "number" || !isFinite(pid) || pid <= 0) return false;
-  try { process.kill(pid, 0); return true; }
-  catch (e) { return e && e.code === "EPERM"; }
-}
-
-function _readPidFile(pidFile) {
-  try {
-    // Same fd-safe + capped + symlink-refusing read as app-shutdown's lockfile
-    // reader (one shape): a PID file is never a legit symlink mount, so
-    // refuseSymlink is safe; any throw → null ("nothing live there").
-    var raw = atomicFile.fdSafeReadSync(pidFile, { maxBytes: C.BYTES.kib(1), refuseSymlink: true, encoding: "utf8" });
-    var pid = parseInt(String(raw).trim(), 10);
-    return isFinite(pid) && pid > 0 ? pid : null;
-  } catch (_e) { return null; }
-}
+// Signal-0 liveness probe + fd-safe pidfile reader live in lib/pid-probe.js so
+// b.daemon and b.appShutdown.pidLock share ONE implementation (they carried
+// byte-identical copies). Local aliases keep the call sites terse.
+var _isLivePid  = pidProbe.isLivePid;
+var _readPidFile = pidProbe.readPidFile;
 
 function _validateStartOpts(opts) {
   validateOpts.shape(opts, {
@@ -100,6 +106,8 @@ function _validateStartOpts(opts) {
     },
     command: { rule: "optional-string", code: "daemon/bad-command",
                label: "daemon.start: opts.command (path to executable)" },
+    cwd: { rule: "optional-string", code: "daemon/bad-cwd",
+           label: "daemon.start: opts.cwd (working directory for the detached child)" },
     args: function (value) {
       if (value !== undefined && !Array.isArray(value)) {
         throw new DaemonError("daemon/bad-args",
@@ -130,6 +138,13 @@ function _validateStopOpts(opts) {
   }, "daemon.stop", DaemonError, "daemon/bad-opts");
 }
 
+function _validateStatusOpts(opts) {
+  validateOpts.shape(opts, {
+    pidFile: { rule: "required-string", code: "daemon/bad-pid-file",
+               label: "daemon.status: opts.pidFile" },
+  }, "daemon.status", DaemonError, "daemon/bad-opts");
+}
+
 function _maybeReapStale(pidFile) {
   var existing = _readPidFile(pidFile);
   if (existing === null) return false;
@@ -185,6 +200,85 @@ function _redirectStdio(fd) {
 // start() in the same process don't double-install signals.
 var _foregroundOrchestrators = Object.create(null);
 
+// Sibling-sentinel path a cooperative stop request is written to. Kept beside
+// the pidFile so it inherits the same operator-owned directory + permissions.
+function _stopSentinelPath(pidFile) {
+  return pidFile + ".stop";
+}
+
+// Remove a cooperative stop sentinel (best-effort — it may already be gone, or
+// never have existed on the POSIX path). unlink removes the LINK, not a target.
+function _cleanupSentinel(sentinelPath) {
+  try { nodeFs.unlinkSync(sentinelPath); } catch (_e) { /* best-effort — may not exist */ }
+}
+
+// Install the Windows cooperative-stop watcher for a foreground daemon. Fires
+// the orchestrator's graceful shutdown the first time the sibling <pidFile>.stop
+// sentinel appears — the same orchestrator.shutdown() the POSIX signal path
+// drives, so the exit code is set from the phase result and the event loop
+// drains once the phases release the daemon's resources.
+//
+// Detection is a synchronous existsSync on a plain unref'd interval, NOT a
+// filesystem watch, for two Windows-specific reasons:
+//   - fs.watch (libuv ReadDirectoryChangesW) aborts the whole process — an
+//     uncatchable src/win/fs-event.c assertion, "!_wcsnicmp(filename, dir,
+//     dirlen)" — when the watched directory is reached through an 8.3
+//     short-name path, exactly the shape of a CI runner's temp dir
+//     (C:\Users\RUNNER~1\AppData\Local\Temp\...): GetFinalPathNameByHandle
+//     returns the long form and the prefix check fails. A try/catch cannot
+//     recover from an abort().
+//   - fs.watchFile's StatWatcher stats through the libuv threadpool, which
+//     starves under heavy concurrent filesystem load and delays detection by
+//     seconds; a synchronous existsSync runs inline on the main thread and is
+//     immune.
+// The interval is unref'd so it never itself keeps the process alive; a clean
+// daemon exits on its own once shutdown completes. If the sentinel is never
+// written the poll is a no-op the release phase clears at shutdown. Returns a
+// handle exposing close().
+function _installStopSentinelWatcher(pidFile, orchestrator) {
+  var dir = nodePath.dirname(pidFile);
+  var sentinelName = nodePath.basename(pidFile) + ".stop";
+  var sentinelPath = nodePath.join(dir, sentinelName);
+  var fired = false;
+  var timer = null;
+  function _stopPolling() {
+    if (!timer) return;
+    try { clearInterval(timer); } catch (_e) { /* best-effort */ }
+    timer = null;
+  }
+  function _maybeFire() {
+    if (fired) return;
+    // Synchronous existsSync on the main thread — deliberately not an async
+    // stat, so detection never queues behind a saturated libuv threadpool.
+    if (!nodeFs.existsSync(sentinelPath)) return;
+    fired = true;
+    _stopPolling();
+    log("cooperative stop-request observed (" + sentinelPath + ") — initiating graceful shutdown");
+    // Mirror the POSIX signal path: run the orchestrator's phases, derive the
+    // exit code from the result, then let the loop drain (a foreground daemon's
+    // phases release its server/db so the process exits on its own).
+    Promise.resolve(orchestrator.shutdown()).then(function (result) {
+      if (process.exitCode === undefined || process.exitCode === 0) {
+        process.exitCode = (result && result.ok) ? 0 : 1;
+      }
+    }).catch(function () { process.exitCode = 1; });
+  }
+  try {
+    timer = setInterval(_maybeFire, STOP_SENTINEL_POLL_MS);
+    if (timer && typeof timer.unref === "function") timer.unref();
+  } catch (_e) {
+    // Timer scheduling unavailable — no cooperative channel; daemon.stop()
+    // still hard-stops via TerminateProcess after its timeout.
+    timer = null;
+  }
+  // The sentinel may already exist (stop() raced ahead of this install).
+  _maybeFire();
+  return {
+    close: function () { _stopPolling(); },
+    sentinelPath: sentinelPath,
+  };
+}
+
 /**
  * @primitive b.daemon.start
  * @signature b.daemon.start(opts)
@@ -284,6 +378,33 @@ function start(opts) {
       throw new DaemonError("daemon/spawn-failed",
         "daemon.start: spawn failed: " + ((e && e.message) || String(e)));
     }
+    // A bad command does NOT throw synchronously from spawn — child_process
+    // reports it ASYNC via a 'error' event, with child.pid left undefined. The
+    // sync try/catch above only covers spawn() itself, so without this the old
+    // path wrote "undefined\n" to the pidFile and returned success. Subscribe a
+    // one-shot 'error' handler that reaps the sidecar + audits the failure, then
+    // refuse to proceed for a child that never got a pid.
+    child.on("error", function (err) {
+      try { nodeFs.unlinkSync(pidFile); } catch (_e) { /* best-effort — may not exist */ }
+      _safeAuditEmit("daemon.spawn_failed", "failure", {
+        pidFile: pidFile,
+        command: opts.command,
+        error:   (err && err.message) || String(err),
+      });
+    });
+    // child.pid must be a real, positive PID. A command that failed to launch
+    // leaves it undefined; the same positive-integer front-guard the shared
+    // liveness probe (pidProbe.isLivePid) applies before it will signal a pid —
+    // a non-number / non-finite / non-positive value is never a launched child.
+    // Fail closed BEFORE any pidfile write so no "undefined" sidecar survives
+    // for daemon.stop to misread.
+    if (typeof child.pid !== "number" || !isFinite(child.pid) || child.pid <= 0) {
+      try { if (typeof logFd === "number") nodeFs.closeSync(logFd); }
+      catch (_c) { /* best-effort */ }
+      throw new DaemonError("daemon/spawn-failed",
+        "daemon.start: spawn of '" + opts.command + "' produced no pid (the command " +
+        "failed to launch)");
+    }
     // Write the child's PID via atomic temp+rename so a concurrent
     // observer never sees a half-written pidFile.
     atomicFile.ensureDir(nodePath.dirname(pidFile));
@@ -332,6 +453,15 @@ function start(opts) {
     }
   }
 
+  // Cooperative stop channel (Windows). Node maps process.kill(pid, "SIGTERM")
+  // to TerminateProcess on win32, so a "signal" never reaches a JS handler and
+  // the graceful orchestrator would be unreachable. daemon.stop() writes a
+  // sibling <pidFile>.stop sentinel; a watcher installed below routes it into
+  // the SAME orchestrator.shutdown() the POSIX signal path uses. Assigned after
+  // the orchestrator exists; the release phase (which runs at shutdown) closes
+  // it + removes the sentinel.
+  var stopWatcher = null;
+
   var orchestrator = appShutdown.create({
     signals:               signals,
     installSignalHandlers: true,
@@ -339,16 +469,21 @@ function start(opts) {
       {
         name: "pidLock-release",
         run:  function () {
+          if (stopWatcher) { try { stopWatcher.close(); } catch (_w) { /* best-effort */ } }
           try { lock.release(); } catch (_e) { /* best-effort */ }
           if (logFdForeground !== null) {
             try { nodeFs.closeSync(logFdForeground); } catch (_c) { /* best-effort */ }
           }
+          _cleanupSentinel(_stopSentinelPath(pidFile));
         },
         timeoutMs: C.TIME.seconds(2),
       },
     ],
   });
   _foregroundOrchestrators[pidFile] = orchestrator;
+  if (process.platform === "win32") {
+    stopWatcher = _installStopSentinelWatcher(pidFile, orchestrator);
+  }
 
   _safeAuditEmit("daemon.started", "success", {
     pidFile:     pidFile,
@@ -421,16 +556,26 @@ async function stop(opts) {
   }
 
   var t0 = Date.now();
-  // First signal — typically SIGTERM. Wait up to timeoutMs for exit.
+
+  // Windows has no cooperative signal: process.kill(pid, "SIGTERM") maps to
+  // TerminateProcess (a hard kill), so the graceful appShutdown orchestration is
+  // only reachable via the cooperative stop-request sentinel start() watches.
+  // Drive that channel first and escalate to the hard kill only on timeout.
+  if (process.platform === "win32") {
+    return await _stopWin32Cooperative(pidFile, pid, signal, timeoutMs, pollMs, t0, opts);
+  }
+
+  // POSIX signal path — first signal (typically SIGTERM), wait up to timeoutMs
+  // for exit, then escalate to SIGKILL. mechanism is always "signal" here.
   try { process.kill(pid, signal); }
   catch (e) {
     if (e && e.code === "ESRCH") {
       // Died between read and kill — cleanup + report.
       try { nodeFs.unlinkSync(pidFile); } catch (_u) { /* best-effort */ }
       _safeAuditEmit("daemon.stopped", "success", {
-        pidFile: pidFile, signal: signal, waitMs: Date.now() - t0, escalated: false,
+        pidFile: pidFile, signal: signal, waitMs: Date.now() - t0, escalated: false, mechanism: "signal",
       });
-      return { stopped: true, pid: pid, signal: signal };
+      return { stopped: true, pid: pid, signal: signal, mechanism: "signal" };
     }
     throw new DaemonError("daemon/kill-failed",
       "daemon.stop: kill(" + pid + ", " + signal + ") failed: " + e.message);
@@ -441,9 +586,9 @@ async function stop(opts) {
     if (!_isLivePid(pid)) {
       try { nodeFs.unlinkSync(pidFile); } catch (_u) { /* best-effort */ }
       _safeAuditEmit("daemon.stopped", "success", {
-        pidFile: pidFile, signal: signal, waitMs: Date.now() - t0, escalated: false,
+        pidFile: pidFile, signal: signal, waitMs: Date.now() - t0, escalated: false, mechanism: "signal",
       });
-      return { stopped: true, pid: pid, signal: signal };
+      return { stopped: true, pid: pid, signal: signal, mechanism: "signal" };
     }
     await safeAsync.sleep(pollMs, { signal: opts.abortSignal });
   }
@@ -464,9 +609,109 @@ async function stop(opts) {
   }
   try { nodeFs.unlinkSync(pidFile); } catch (_u) { /* best-effort */ }
   _safeAuditEmit("daemon.stopped", "success", {
-    pidFile: pidFile, signal: "SIGKILL", waitMs: Date.now() - t0, escalated: true,
+    pidFile: pidFile, signal: "SIGKILL", waitMs: Date.now() - t0, escalated: true, mechanism: "signal",
+  });
+  return { stopped: true, pid: pid, signal: "SIGKILL", escalated: true, mechanism: "signal" };
+}
+
+// Windows cooperative stop. Writes the sibling <pidFile>.stop sentinel the
+// foreground start() watcher routes into the graceful orchestrator, polls for a
+// clean exit up to timeoutMs, and escalates to a hard TerminateProcess (Windows
+// maps any real signal to it) ONLY on timeout — preserving the POSIX
+// graceful-first / forced-on-timeout shape and the same brief post-kill reap
+// wait. mechanism distinguishes the cooperative exit from the forced one; the
+// sentinel is removed on both paths.
+async function _stopWin32Cooperative(pidFile, pid, signal, timeoutMs, pollMs, t0, opts) {
+  var sentinel = _stopSentinelPath(pidFile);
+  // O_NOFOLLOW-staged write (atomicFile.writeSync → _openExclTemp with
+  // O_EXCL | O_NOFOLLOW) so a symlink planted at <pidFile>.stop can't redirect
+  // the request to an attacker-chosen file (CWE-59).
+  try {
+    atomicFile.writeSync(sentinel, String(pid) + "\n", { fileMode: 0o600 });
+  } catch (e) {
+    throw new DaemonError("daemon/stop-request-failed",
+      "daemon.stop: failed to write cooperative stop-request '" + sentinel + "': " +
+      ((e && e.message) || String(e)));
+  }
+
+  // Poll for cooperative exit up to timeoutMs.
+  var deadline = t0 + timeoutMs;
+  while (Date.now() < deadline) {
+    if (!_isLivePid(pid)) {
+      _cleanupSentinel(sentinel);
+      try { nodeFs.unlinkSync(pidFile); } catch (_u) { /* best-effort */ }
+      _safeAuditEmit("daemon.stopped", "success", {
+        pidFile: pidFile, signal: signal, waitMs: Date.now() - t0, escalated: false, mechanism: "cooperative",
+      });
+      return { stopped: true, pid: pid, signal: signal, mechanism: "cooperative" };
+    }
+    await safeAsync.sleep(pollMs, { signal: opts.abortSignal });
+  }
+
+  // Timed out — the daemon ignored the cooperative request. Hard-stop it.
+  try { process.kill(pid, "SIGKILL"); }
+  catch (e) {
+    if (!(e && e.code === "ESRCH")) {
+      _cleanupSentinel(sentinel);
+      throw new DaemonError("daemon/kill-failed",
+        "daemon.stop: TerminateProcess escalation failed for pid " + pid + ": " + e.message);
+    }
+  }
+  var killDeadline = Date.now() + C.TIME.seconds(2);
+  while (Date.now() < killDeadline) {
+    if (!_isLivePid(pid)) break;
+    await safeAsync.sleep(pollMs, { signal: opts.abortSignal });
+  }
+  _cleanupSentinel(sentinel);
+  try { nodeFs.unlinkSync(pidFile); } catch (_u) { /* best-effort */ }
+  _safeAuditEmit("daemon.stopped", "success", {
+    pidFile: pidFile, signal: "SIGKILL", waitMs: Date.now() - t0, escalated: true, mechanism: "terminate",
   });
-  return { stopped: true, pid: pid, signal: "SIGKILL", escalated: true };
+  return { stopped: true, pid: pid, signal: "SIGKILL", escalated: true, mechanism: "terminate" };
+}
+
+/**
+ * @primitive b.daemon.status
+ * @signature b.daemon.status(opts)
+ * @since     0.17.13
+ * @status    stable
+ * @related   b.daemon.start, b.daemon.stop
+ *
+ * Read-only PID-liveness probe. Reads `pidFile` and reports whether the
+ * recorded process is alive, WITHOUT mutating anything — unlike `stop()`,
+ * a stale pidfile is reported but never unlinked, so a health check can't
+ * disturb the daemon's lifecycle state. A missing / malformed / symlinked /
+ * oversized pidfile reports `running: false` with `reason: "no-pidfile"`
+ * rather than throwing (the same fd-safe, symlink-refusing, 1 KiB-capped
+ * read that `start` and `stop` use). Bad opts throw `daemon/bad-pid-file`.
+ *
+ * Returns `{ running, pid, reason? }`. `reason` is `"no-pidfile"` when no
+ * live sidecar was found and `"stale"` when the pidfile pointed at a dead
+ * PID — the file is left in place for the operator to inspect or for `stop`
+ * to reap.
+ *
+ * @opts
+ *   pidFile: string,   // absolute path of the PID sidecar (required)
+ *
+ * @example
+ *   var s = b.daemon.status({ pidFile: "/tmp/blamejs-daemon-demo.pid" });
+ *   s.running; // → false
+ *   s.reason;  // → "no-pidfile"
+ */
+function status(opts) {
+  _validateStatusOpts(opts);
+  var pidFile = opts.pidFile;
+  var pid = _readPidFile(pidFile);
+  if (pid === null) {
+    // Missing / malformed / symlinked / oversized — nothing live to report.
+    // READ-ONLY: never unlink (stop() reaps; status() must not).
+    return { running: false, pid: null, reason: "no-pidfile" };
+  }
+  if (!_isLivePid(pid)) {
+    // Recorded PID is dead. Report it but leave the sidecar in place.
+    return { running: false, pid: pid, reason: "stale" };
+  }
+  return { running: true, pid: pid };
 }
 
 // Test-only — drop process-wide foreground orchestrator state so smoke
@@ -483,6 +728,7 @@ function _resetForTest() {
 module.exports = {
   start:                start,
   stop:                 stop,
+  status:               status,
   DaemonError:          DaemonError,
   DEFAULT_STOP_SIGNAL:  DEFAULT_STOP_SIGNAL,
   DEFAULT_STOP_TIMEOUT_MS: DEFAULT_STOP_TIMEOUT_MS,

package/lib/vendor/blamejs/lib/dark-patterns.js

@@ -266,11 +266,14 @@ function assertParity(signup, cancel, opts) {
       "darkPatterns.assertParity: resourceId differs between flows");
   }
   var postureName = opts.posture || "ftc-2024";
-  var posture = POSTURES[postureName];
-  if (!posture) {
+  // Own-property lookup: postureName is operator input, so a bare
+  // `POSTURES[postureName]` with a truthiness guard would let a prototype key
+  // ("constructor") resolve to an inherited member and run under it (fail-open).
+  if (!Object.prototype.hasOwnProperty.call(POSTURES, postureName)) {
     throw errorClass.factory("dark-patterns/bad-posture",
       "darkPatterns.assertParity: unknown posture " + postureName);
   }
+  var posture = POSTURES[postureName];
 
   var toleranceClicks   = typeof opts.toleranceClicks === "number"
     ? opts.toleranceClicks : posture.toleranceClicks;

package/lib/vendor/blamejs/lib/db-declare-view.js

@@ -359,7 +359,7 @@ function declareView(opts) {
     // Build CREATE VIEW. Each column is independently quoted so a
     // reserved-word column name (e.g. "user", "order") resolves correctly.
     var quotedCols = selectedColumns.map(function (c) {
-      return safeSql.quoteIdentifier(c, "postgres");
+      return safeSql.quoteIdentifier(c, "postgres", { allowReserved: true }); // reserved-word column names (e.g. "user"/"order") — parity with b.db.from()
     }).join(", ");
     var createSql = "CREATE VIEW " + qView + " AS SELECT " + quotedCols +
                     " FROM " + qSource;
@@ -370,7 +370,7 @@ function declareView(opts) {
     // GRANT SELECT — one statement covers all roles.
     if (spec.grantTo.length > 0) {
       var quotedRoles = spec.grantTo.map(function (r) {
-        return safeSql.quoteIdentifier(r, "postgres");
+        return safeSql.quoteIdentifier(r, "postgres", { allowReserved: true }); // parity with b.db.from()
       }).join(", ");
       await xdb.query(
         "GRANT SELECT ON " + qView + " TO " + quotedRoles,

package/lib/vendor/blamejs/lib/db-query.js

@@ -1430,6 +1430,29 @@ function _stripLeadingSqlComments(sql) {
   return s;
 }
 
+// _normalizeForWriteParse — the single parse-copy normalizer the residency
+// write-detection regexes run against. The regexes hand-roll SQL tokenization
+// with `\s+` (whitespace-separated) token boundaries, but SQL lets two tokens
+// abut with NO whitespace whenever a comment or a quoted-identifier boundary
+// separates them — so a real write escaped the whitespace-strict detection
+// entirely (the gate was skipped → a cross-border write landed ungated):
+//
+//   an INSERT whose quoted table name abuts INTO with no space
+//   an INSERT with a slash-star comment wedged between INSERT and INTO
+//   an UPDATE with a slash-star comment wedged between UPDATE and the table
+//
+// All are valid SQLite (the engine tokenizes the comment / quote as a
+// separator), so the executed statement writes rows while `_rawWriteTable`
+// returned null and the gate never engaged (CWE-863; GDPR Art. 44-46 transfer
+// restriction bypass). safeSql.normalizeForScan produces a parse-only copy
+// where every token boundary is real whitespace (comments collapsed to a space,
+// a separating space inserted where a quoted token abuts a word character);
+// leading comments then strip so the ^-anchored regexes see the statement head.
+// The executed SQL is unchanged; this copy only feeds the gate's parse.
+function _normalizeForWriteParse(sql) {
+  return _stripLeadingSqlComments(safeSql.normalizeForScan(sql));
+}
+
 // Non-anchored write-target scan for the writable-CTE / EXPLAIN-prefixed case.
 // A SQLite `WITH c AS (...) INSERT INTO residents ...` / `WITH ... UPDATE residents
 // SET ...` is a real write, but its effective verb is hidden behind the prefix so
@@ -1452,10 +1475,12 @@ function _firstResidencyWriteTarget(s) {
 }
 
 function _rawWriteTable(sql) {
-  // The ^-anchored regexes scan only the statement head (constant-time). Strip
-  // leading comments first so a commented-out head can't hide the write.
+  // The ^-anchored regexes scan only the statement head (constant-time).
+  // Normalize first so a leading OR internal comment, and a quoted table that
+  // abuts the keyword with no whitespace, can't hide the write from the
+  // whitespace-anchored detection (a gate-skip → cross-border-write bypass).
   if (typeof sql !== "string") return null;
-  var s = _stripLeadingSqlComments(sql);
+  var s = _normalizeForWriteParse(sql);
   if (_RAW_WRITE_KEYWORD_RE.test(s)) {  // allow:regex-no-length-cap
     var m = _RAW_TABLE_RE.exec(s);  // allow:regex-no-length-cap
     return m ? _unquoteIdent(m[1] || m[2]) : null;
@@ -1546,11 +1571,13 @@ function _assertRawWriteResidency(sql, boundParams) {
   if (!cryptoField.getPerRowResidency(table) && !cryptoField.getColumnResidency(table)) return;
   boundParams = _flattenRunParams(boundParams);
 
-  // Parse the comment-stripped head: a leading "/* x */" / "-- x" comment must
-  // not hide the INSERT/UPDATE body from the ^-anchored regexes below (that would
-  // let a residency-restricted write through the gate). The executed SQL is
+  // Normalize the parse copy the same way engagement did: a leading OR internal
+  // comment, and a quoted table/column that abuts the keyword with no whitespace,
+  // must not hide the INSERT/UPDATE body from the whitespace-anchored regexes
+  // below (that would let a residency-restricted write parse as unmodelled and,
+  // for the value it can't read, skip the tag check). The executed SQL is
   // unchanged; this normalized copy is only for residency parsing.
-  var norm = _stripLeadingSqlComments(sql);
+  var norm = _normalizeForWriteParse(sql);
 
   // The INSERT/UPDATE body regexes below scan with [\s\S]+; bound the input
   // first and fail CLOSED on an over-long statement - a residency write the

package/lib/vendor/blamejs/lib/db.js

@@ -1877,15 +1877,19 @@ function stream(sql) {
     objectMode: true,
     read: function () {
       try {
+        var step = iter.next();
+        if (step.done) { this.push(null); return; }
+        // Enforce the cap AFTER pulling the row + the done-check: a result set of
+        // EXACTLY streamLimit rows completes cleanly; only a row BEYOND the cap
+        // (the streamLimit+1'th) trips the guard (the top-of-read `>=` form errored
+        // at == limit, turning a valid complete export into a stream error).
         if (emitted >= perCallLimit) {
           this.destroy(new DbError("db/stream-limit-exceeded",
-            "db.stream: emitted " + emitted + " rows, exceeding streamLimit " +
-            perCallLimit + ". Pass opts.streamLimit higher OR raise via " +
+            "db.stream: result set exceeds streamLimit " + perCallLimit +
+            " (reached row " + (emitted + 1) + "). Pass opts.streamLimit higher OR raise via " +
             "db.init({ streamLimit }) after auditing the export path."));
           return;
         }
-        var step = iter.next();
-        if (step.done) { this.push(null); return; }
         emitted += 1;
         var row = step.value;
         this.push(unseal ? unseal.unsealRow(table, row) : row);
@@ -2207,7 +2211,10 @@ function exportCsv(opts) {
   validateOpts.requireNonEmptyString(opts.table, "exportCsv: opts.table", DbError, "db/bad-export-table");
   // Quote-validate the table identifier — refuses anything with embedded
   // quotes, schema-qualified names valid via dot-separated parts.
-  safeSql.quoteIdentifier(opts.table);
+  // allowReserved: parity with b.db.from() — a schema-valid operator table
+  // whose name is a SQL keyword must validate here too (still fails closed on
+  // shape/length/null-byte/sqlite_ prefix; the keyword is safe once quoted).
+  safeSql.quoteIdentifier(opts.table, undefined, { allowReserved: true });
   var meta = tableMetadata[opts.table];
   if (!meta) {
     throw new DbError("db/unknown-table",
@@ -2251,7 +2258,12 @@ function exportCsv(opts) {
       var col = columns[cj];
       var v = src[col];
       if (timestampFields.indexOf(col) !== -1 && typeof v === "number" && isFinite(v)) {
-        out[cj] = new Date(v).toISOString();
+        // A finite ms value outside ±8.64e15 (JS Date's representable range)
+        // yields an Invalid Date whose toISOString() throws RangeError. Degrade
+        // to the raw numeric string so one garbage timestamp value can't crash
+        // the whole export.
+        var ts = new Date(v);
+        out[cj] = isNaN(ts.getTime()) ? String(v) : ts.toISOString();
       } else if (Buffer.isBuffer(v)) {
         out[cj] = v.toString("base64");
       } else if (v === null || v === undefined) {

package/lib/vendor/blamejs/lib/dbsc.js

@@ -47,6 +47,15 @@ var DbscError = defineClass("DbscError", { alwaysPermanent: true });
 
 var DEFAULT_CHALLENGE_TTL_MS = C.TIME.minutes(5);
 
+// Clock-skew allowance for a forward-dated `iat`. An assertion whose iat
+// sits further ahead than this is refused: without an upper bound a future
+// iat makes the stale check (Date.now() - iat*1000 > maxAge) permanently
+// false, so the assertion never expires and the maxAge replay window is
+// defeated. Mirrors the future-iat bound in b.auth.jwt.verifyExternal
+// (iat-future) and dpop's ±window; sized to tolerate ordinary client clock
+// drift without admitting a far-future token.
+var IAT_FUTURE_SKEW_MS = C.TIME.minutes(1);
+
 /**
  * @primitive b.dbsc.challenge
  * @signature b.dbsc.challenge(opts)
@@ -243,6 +252,14 @@ function verifyBindingAssertion(assertion, opts) {
     throw new DbscError("dbsc/stale",
       "verifyBindingAssertion: iat is more than " + opts.maxAgeSec + "s old");
   }
+  // Upper-bound iat: a forward-dated assertion (beyond IAT_FUTURE_SKEW_MS)
+  // is refused. A future iat makes the stale check above never fire, so the
+  // assertion would stay "fresh" indefinitely — a freshness fail-open on an
+  // attacker-chosen iat that defeats the maxAge replay bound.
+  if (typeof payloadJson.iat === "number" && payloadJson.iat * 1000 - Date.now() > IAT_FUTURE_SKEW_MS) {   // allow:raw-time-literal — sec→ms
+    throw new DbscError("dbsc/iat-future",
+      "verifyBindingAssertion: iat is more than " + (IAT_FUTURE_SKEW_MS / C.TIME.seconds(1)) + "s in the future");
+  }
   // Re-verify any embedded challenge if the assertion claims one.
   if (payloadJson.challenge) {
     verifyChallenge(payloadJson.challenge, { secretKey: opts.secretKey });

package/lib/vendor/blamejs/lib/dev.js

@@ -200,7 +200,11 @@ function create(opts) {
     return childProcess().spawn(cmd, sargs, sopts);
   };
   var watchFn = opts._watch || function (dir, wopts, listener) {
-    return nodeFs.watch(dir, wopts, listener);
+    // realpathSync.native expands an 8.3 short-name component before the watch;
+    // fs.watch aborts libuv (uncatchable) on a Windows short-name path.
+    var target = dir;
+    try { target = nodeFs.realpathSync.native(dir); } catch (_e) { /* keep raw path */ }
+    return nodeFs.watch(target, wopts, listener);
   };
   var setTimeoutFn  = opts._setTimeout  || setTimeout;
   var clearTimeoutFn = opts._clearTimeout || clearTimeout;
@@ -251,14 +255,29 @@ function create(opts) {
         if (killTimer) { try { clearTimeoutFn(killTimer); } catch (_e) { /* timer already cleared */ } killTimer = null; }
         resolve();
       }
+      // 'exit' is the only event that reliably means the process is gone, so
+      // it is the only one that completes shutdown. A child that FAILED TO
+      // SPAWN has no pid and never emits 'exit' — it is settled by the
+      // no-process check below, NOT by listening for 'error'/'close', which
+      // can also fire for a LIVE child (a rejected kill emits 'error' while
+      // the process keeps running) and must not complete shutdown then.
       c.once("exit", done);
-      try { c.kill(killSignal); }
+      var sent;
+      try { sent = c.kill(killSignal); }
       catch (e) {
         _logVia(log, "warn", "kill threw, child may already be gone",
           { error: (e && e.message) || String(e) });
         done();
         return;
       }
+      // kill() returning false means the signal was NOT delivered — which can
+      // be either "no process exists" (a child that failed to spawn has no
+      // pid; no 'exit' will ever arrive, so settle now) OR "a live process
+      // rejected the signal" (e.g. EPERM after the child changed credentials;
+      // pid is set). Only the no-process case completes shutdown here; a live
+      // child keeps the SIGKILL escalation + awaits exit/close, so stop()
+      // never falsely reports termination while the process is still running.
+      if (!sent && !c.pid) { done(); return; }
       // Hard-kill if the child ignores SIGTERM
       killTimer = setTimeoutFn(function () {
         if (settled) return;