@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/dsr.js

@@ -116,6 +116,7 @@ var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");
+var sql = require("./sql");
 var safeJson = require("./safe-json");
 var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
@@ -124,6 +125,13 @@ var DsrError = defineClass("DsrError", { alwaysPermanent: true });
 
 var audit = lazyRequire(function () { return require("./audit"); });
 var observability = lazyRequire(function () { return require("./observability"); });
+
+// A vaulted store AEAD-seals + base64-encodes the payload before binding it
+// (~4/3 expansion), and the bound cell must fit b.sql's 64 MiB per-value
+// ceiling. Cap the plaintext at an expansion-safe size — leave a KiB for the
+// vault nonce / tag / prefix — so the sealed cell binds through b.sql; a
+// plaintext store keeps the full read ceiling (safeJson.ABSOLUTE_MAX_BYTES).
+var VAULTED_SEAL_SAFE_MAX_BYTES = Math.floor(safeJson.ABSOLUTE_MAX_BYTES * 3 / 4) - C.BYTES.kib(1);
 // cryptoField + vault lazy-required: dbTicketStore seals subject PII + the
 // full ticket payload at rest so a GDPR Art 17 erasure leaves no
 // decryptable copy. Lazy so the module loads in vault-less / test-tooling
@@ -912,8 +920,18 @@ function memoryTicketStore() {
         var t = entry[1];
         if (filter.status && t.status !== filter.status) continue;
         if (filter.subject) {
-          if (filter.subject.email && t.subject.email !== filter.subject.email) continue;
-          if (filter.subject.subjectId && t.subject.subjectId !== filter.subject.subjectId) continue;
+          // Fail closed: a subject filter must match on at least one of the
+          // store's indexable keys (email / subjectId). A subject carrying
+          // none of them — phone-only, alias-only, or an empty object —
+          // matches NOTHING, never every ticket. Fail-open here would make
+          // listBySubject leak other subjects' tickets and the erasure
+          // purge (list-by-subject → delete) destroy them.
+          var subj = filter.subject;
+          var tSubj = t.subject || {};
+          var applied = false;
+          if (subj.email) { applied = true; if (tSubj.email !== subj.email) continue; }
+          if (subj.subjectId) { applied = true; if (tSubj.subjectId !== subj.subjectId) continue; }
+          if (!applied) continue;
         }
         out.push(Object.assign({}, t));
       }
@@ -1027,9 +1045,15 @@ function dbTicketStore(opts) {
   validateOpts.requireMethods(db, ["runSql", "prepare"],
     "dbTicketStore: opts.db (b.db-shaped handle)", DsrError, "dsr/bad-db");
   var tableRaw = opts.table || "dsr_tickets";
+  // b.sql builder opts for the DML below — quoteName quotes the operator-
+  // supplied table name exactly as db.from() does (reserved words, schema-
+  // qualified "schema.table"), so the store composes b.sql instead of
+  // hand-rolling identifier quoting. DDL (CREATE/ALTER) stays hand-rolled —
+  // b.sql is a DML builder, not a schema tool.
+  var SQL_OPTS = { dialect: "sqlite", quoteName: true };
   var qTable, qEmailIdx, qStatusIdx;
   try {
-    qTable     = safeSql.quoteIdentifier(tableRaw, "sqlite");
+    qTable     = safeSql.quoteIdentifier(tableRaw, "sqlite", { allowReserved: true }); // parity with b.db.from() (the _idx names below are suffix-derived — can't be a bare keyword)
     qEmailIdx  = safeSql.quoteIdentifier(tableRaw + "_email_idx", "sqlite");
     qStatusIdx = safeSql.quoteIdentifier(tableRaw + "_status_idx", "sqlite");
   } catch (sqlErr) {
@@ -1109,32 +1133,57 @@ function dbTicketStore(opts) {
     // selected) and cheap (an empty scan) once migrated.
     if (vault().isInitialized()) {
       _ensureDsrSealTable();
-      var legacyRows = db.prepare(
-        "SELECT id, subject_id, subject_email, subject_phone, payload FROM " + qTable +
-        " WHERE (subject_email IS NOT NULL AND subject_email_hash IS NULL)" +
-        " OR (subject_id IS NOT NULL AND subject_id_hash IS NULL)").all({});
+      // The grouped-OR predicate has no operator input; it is a fixed
+      // structural condition, so it rides through b.sql's whereRaw escape
+      // (allow:hand-rolled-sql — a static, param-free legacy-detection filter
+      // b.sql's structured where() cannot express as one OR-of-ANDs group).
+      var legacySel = sql.select(tableRaw, SQL_OPTS)
+        .columns(["id", "subject_id", "subject_email", "subject_phone", "payload"])
+        .whereRaw("(subject_email IS NOT NULL AND subject_email_hash IS NULL) OR (subject_id IS NOT NULL AND subject_id_hash IS NULL)")
+        .toSql();
+      var legacyStmt = db.prepare(legacySel.sql);
+      var legacyRows = legacyStmt.all.apply(legacyStmt, legacySel.params);
       for (var bi = 0; bi < (legacyRows || []).length; bi++) {
         var lrow = legacyRows[bi];
         var lEmailDerived = cryptoField().computeDerived(DSR_SEAL_TABLE, "subject_email", lrow.subject_email);
         var lIdDerived    = cryptoField().computeDerived(DSR_SEAL_TABLE, "subject_id", lrow.subject_id);
-        var lSealed = cryptoField().sealRow(DSR_SEAL_TABLE, {
+        // A legacy plaintext payload above the expansion-safe cap cannot be
+        // sealed (its sealed form would exceed b.sql's per-value ceiling). The
+        // row must still become findable + erasable, so ALWAYS seal the (small)
+        // subject columns and populate the derived hashes — otherwise, in
+        // vaulted mode, _subjectConds filters only on the hash columns and
+        // list({ subject }) / the erasure purge would never see this prior
+        // ticket, leaving its PII un-erasable. When the payload is over-cap,
+        // keep it plaintext (still ≤ the read ceiling, so it binds; it is
+        // DB-encrypted at rest and removed when the row is erased) and surface
+        // it so the operator can chunk-migrate it.
+        var payloadTooBig = Buffer.byteLength(String(lrow.payload == null ? "" : lrow.payload), "utf8") > VAULTED_SEAL_SAFE_MAX_BYTES;
+        if (payloadTooBig) {
+          try {
+            observability().safeEvent("dsr.backfill.payload_left_plaintext", 1, { table: tableRaw });
+          } catch (_e) { /* drop-silent */ }
+        }
+        // Omit the payload from the seal input when it is over-cap — sealRow
+        // skips absent fields, so only the subject columns are sealed and the
+        // plaintext payload is written back below.
+        var lSealInput = {
           id:            lrow.id,
           subject_id:    lrow.subject_id,
           subject_email: lrow.subject_email,
           subject_phone: lrow.subject_phone,
-          payload:       lrow.payload,
-        });
-        db.prepare("UPDATE " + qTable + " SET subject_id = $sid, subject_email = $email," +
-          " subject_phone = $phone, payload = $payload, subject_email_hash = $emailHash," +
-          " subject_id_hash = $idHash WHERE id = $id").run({
-          $id:        lrow.id,
-          $sid:       lSealed.subject_id,
-          $email:     lSealed.subject_email,
-          $phone:     lSealed.subject_phone,
-          $payload:   lSealed.payload,
-          $emailHash: lEmailDerived ? lEmailDerived.value : null,
-          $idHash:    lIdDerived ? lIdDerived.value : null,
-        });
+        };
+        if (!payloadTooBig) lSealInput.payload = lrow.payload;
+        var lSealed = cryptoField().sealRow(DSR_SEAL_TABLE, lSealInput);
+        var lUpd = sql.update(tableRaw, SQL_OPTS).set({
+          subject_id:         lSealed.subject_id,
+          subject_email:      lSealed.subject_email,
+          subject_phone:      lSealed.subject_phone,
+          payload:            payloadTooBig ? lrow.payload : lSealed.payload,
+          subject_email_hash: lEmailDerived ? lEmailDerived.value : null,
+          subject_id_hash:    lIdDerived ? lIdDerived.value : null,
+        }).where("id", "=", lrow.id).toSql();
+        var lUpdStmt = db.prepare(lUpd.sql);
+        lUpdStmt.run.apply(lUpdStmt, lUpd.params);
       }
     }
   }
@@ -1146,15 +1195,23 @@ function dbTicketStore(opts) {
   // it stores plaintext (matching the agent-* fallback).
   function _sealColumns(id, ticket) {
     // The payload column is read back through safeJson.parse, whose hard
-    // ceiling (safeJson.ABSOLUTE_MAX_BYTES) caps what any read can accept.
-    // Refuse a ticket whose serialized form exceeds that same ceiling on
-    // write so the store never holds a payload it cannot read back later
-    // (write cap == read cap, measured the same way: UTF-8 byte length).
+    // ceiling (safeJson.ABSOLUTE_MAX_BYTES) caps what any read can accept, so
+    // the plaintext must not exceed it on write either. When a vault is
+    // configured the payload is AEAD-sealed and base64-encoded before it is
+    // bound, which expands it ~4/3; the bound (sealed) cell must still fit the
+    // query builder's per-value binding ceiling (b.sql's MAX_PARAM_BYTES, the
+    // same 64 MiB). Cap the plaintext at an expansion-safe size when vaulted so
+    // an oversized ticket is refused here with the store's own error rather
+    // than a SqlBuilderError deep in the insert — and route large exports to
+    // chunked storage rather than binding one giant sealed cell.
     var serializedPayload = JSON.stringify(ticket);
-    if (Buffer.byteLength(serializedPayload, "utf8") > safeJson.ABSOLUTE_MAX_BYTES) {
+    var vaulted = vault().isInitialized();
+    var maxPlaintextBytes = vaulted ? VAULTED_SEAL_SAFE_MAX_BYTES : safeJson.ABSOLUTE_MAX_BYTES;
+    if (Buffer.byteLength(serializedPayload, "utf8") > maxPlaintextBytes) {
       throw new DsrError("dsr/ticket-too-large",
-        "_sealColumns: ticket " + id + " payload exceeds the " +
-          safeJson.ABSOLUTE_MAX_BYTES + "-byte store limit");
+        "_sealColumns: ticket " + id + " payload exceeds the " + maxPlaintextBytes +
+          "-byte store limit" +
+          (vaulted ? " (sealing expands it; store large exports via chunked storage)" : ""));
     }
     var row = {
       id:            id,
@@ -1205,16 +1262,18 @@ function dbTicketStore(opts) {
     { key: "email",     plainCol: "subject_email", sealField: "subject_email", hashCol: "subject_email_hash", param: "$email" },
     { key: "subjectId", plainCol: "subject_id",    sealField: "subject_id",    hashCol: "subject_id_hash",    param: "$sid" },
   ];
-  function _subjectConds(filter, conds, params) {
+  // AND the subject-match predicate(s) onto a b.sql select builder.
+  function _subjectConds(filter, qb) {
     if (!filter.subject) return;
     var vaulted = vault().isInitialized();
     if (vaulted) _ensureDsrSealTable();
+    var appliedAny = false;
     SUBJECT_FILTER_SPEC.forEach(function (spec) {
       var supplied = filter.subject[spec.key];
       if (!supplied) return;
       if (!vaulted) {
-        conds.push(spec.plainCol + " = " + spec.param);
-        params[spec.param] = supplied;
+        qb.where(spec.plainCol, "=", supplied);
+        appliedAny = true;
         return;
       }
       // Vaulted: match BOTH the active keyed-MAC digest AND the legacy
@@ -1226,111 +1285,107 @@ function dbTicketStore(opts) {
       var cand = cryptoField().lookupHashCandidates(DSR_SEAL_TABLE, spec.sealField, supplied);
       var values = cand && cand.values ? cand.values : [];
       if (values.length === 0) return;
-      var placeholders = values.map(function (v, i) {
-        var p = spec.param + "_" + i;
-        params[p] = v;
-        return p;
-      });
-      conds.push(spec.hashCol + " IN (" + placeholders.join(", ") + ")");
+      qb.whereIn(spec.hashCol, values);
+      appliedAny = true;
     });
+    // Fail closed: a subject filter that produced no usable predicate — a
+    // phone-only / alias-only / empty subject, or a vaulted key with no hash
+    // candidates — must match NOTHING, not every row. Without this, list({
+    // subject }) degrades to a full-table scan and both listBySubject (leak)
+    // and the erasure-completion purge (cross-subject delete) touch every
+    // subject's tickets.
+    if (!appliedAny) qb.whereRaw("1 = 0");
   }
 
   return {
     insert: async function (ticket) {
       var cols = _sealColumns(ticket.id, ticket);
-      var stmt = db.prepare("INSERT INTO " + qTable +
-        " (id, type, status, subject_id, subject_email, subject_phone, " +
-        "  subject_email_hash, subject_id_hash, " +
-        "  submitted_at, deadline_at, processed_at, verification_level, posture, payload) " +
-        " VALUES ($id, $type, $status, $sid, $email, $phone, " +
-        "         $emailHash, $idHash, $submittedAt, " +
-        "         $deadlineAt, $processedAt, $verLevel, $posture, $payload)");
-      stmt.run({
-        $id:           ticket.id,
-        $type:         ticket.type,
-        $status:       ticket.status,
-        $sid:          cols.$sid,
-        $email:        cols.$email,
-        $phone:        cols.$phone,
-        $emailHash:    cols.$emailHash,
-        $idHash:       cols.$idHash,
-        $submittedAt:  ticket.submittedAt,
-        $deadlineAt:   ticket.deadlineAt,
-        $processedAt:  ticket.processedAt || null,
-        $verLevel:     ticket.verificationLevel || null,
-        $posture:      ticket.posture || null,
-        $payload:      cols.$payload,
-      });
+      var built = sql.insert(tableRaw, SQL_OPTS).values({
+        id:                 ticket.id,
+        type:               ticket.type,
+        status:             ticket.status,
+        subject_id:         cols.$sid,
+        subject_email:      cols.$email,
+        subject_phone:      cols.$phone,
+        subject_email_hash: cols.$emailHash,
+        subject_id_hash:    cols.$idHash,
+        submitted_at:       ticket.submittedAt,
+        deadline_at:        ticket.deadlineAt,
+        processed_at:       ticket.processedAt || null,
+        verification_level: ticket.verificationLevel || null,
+        posture:            ticket.posture || null,
+        payload:            cols.$payload,
+      }).toSql();
+      var stmt = db.prepare(built.sql);
+      stmt.run.apply(stmt, built.params);
     },
     get: async function (id) {
-      var rows = db.prepare("SELECT id, payload FROM " + qTable + " WHERE id = $id")
-                   .all({ $id: id });
+      var built = sql.select(tableRaw, SQL_OPTS).columns(["id", "payload"]).where("id", "=", id).toSql();
+      var stmt = db.prepare(built.sql);
+      var rows = stmt.all.apply(stmt, built.params);
       if (!rows || rows.length === 0) return null;
       return safeJson.parse(_unsealPayload(rows[0].payload, rows[0].id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES });
     },
     list: async function (filter) {
       filter = filter || {};
-      var sql = "SELECT id, payload FROM " + qTable;
-      var conds = [];
-      var params = {};
-      if (filter.status) {
-        conds.push("status = $status");
-        params.$status = filter.status;
-      }
-      _subjectConds(filter, conds, params);
-      if (conds.length > 0) sql += " WHERE " + conds.join(" AND ");
-      sql += " ORDER BY submitted_at DESC";
-      var rows = db.prepare(sql).all(params);
+      var qb = sql.select(tableRaw, SQL_OPTS).columns(["id", "payload"]);
+      if (filter.status) qb.where("status", "=", filter.status);
+      _subjectConds(filter, qb);
+      qb.orderBy("submitted_at", "DESC");
+      var built = qb.toSql();
+      var stmt = db.prepare(built.sql);
+      var rows = stmt.all.apply(stmt, built.params);
       return rows.map(function (r) { return safeJson.parse(_unsealPayload(r.payload, r.id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES }); });
     },
     update: async function (id, ticket) {
       var cols = _sealColumns(id, ticket);
-      var stmt = db.prepare("UPDATE " + qTable + " SET " +
-        " type = $type, status = $status, subject_id = $sid, " +
-        " subject_email = $email, subject_phone = $phone, " +
-        " subject_email_hash = $emailHash, subject_id_hash = $idHash, " +
-        " submitted_at = $submittedAt, deadline_at = $deadlineAt, " +
-        " processed_at = $processedAt, verification_level = $verLevel, " +
-        " posture = $posture, payload = $payload " +
-        " WHERE id = $id");
-      var info = stmt.run({
-        $id:           id,
-        $type:         ticket.type,
-        $status:       ticket.status,
-        $sid:          cols.$sid,
-        $email:        cols.$email,
-        $phone:        cols.$phone,
-        $emailHash:    cols.$emailHash,
-        $idHash:       cols.$idHash,
-        $submittedAt:  ticket.submittedAt,
-        $deadlineAt:   ticket.deadlineAt,
-        $processedAt:  ticket.processedAt || null,
-        $verLevel:     ticket.verificationLevel || null,
-        $posture:      ticket.posture || null,
-        $payload:      cols.$payload,
-      });
+      var built = sql.update(tableRaw, SQL_OPTS).set({
+        type:               ticket.type,
+        status:             ticket.status,
+        subject_id:         cols.$sid,
+        subject_email:      cols.$email,
+        subject_phone:      cols.$phone,
+        subject_email_hash: cols.$emailHash,
+        subject_id_hash:    cols.$idHash,
+        submitted_at:       ticket.submittedAt,
+        deadline_at:        ticket.deadlineAt,
+        processed_at:       ticket.processedAt || null,
+        verification_level: ticket.verificationLevel || null,
+        posture:            ticket.posture || null,
+        payload:            cols.$payload,
+      }).where("id", "=", id).toSql();
+      var stmt = db.prepare(built.sql);
+      var info = stmt.run.apply(stmt, built.params);
       if (info && info.changes === 0) {
         throw new DsrError("dsr/ticket-not-found",
           "dbTicketStore: ticket " + id + " not found for update");
       }
     },
     delete: async function (id) {
-      var info = db.prepare("DELETE FROM " + qTable + " WHERE id = $id").run({ $id: id });
+      var built = sql.delete(tableRaw, SQL_OPTS).where("id", "=", id).toSql();
+      var stmt = db.prepare(built.sql);
+      var info = stmt.run.apply(stmt, built.params);
       return !!(info && info.changes > 0);
     },
     purgeExpired: async function (asOfMs) {
       // Bulk-delete tickets in terminal states whose retentionUntil
       // is in the past. Returns the number of rows removed.
       var asOf = (typeof asOfMs === "number" && isFinite(asOfMs)) ? asOfMs : Date.now();
-      var rows = db.prepare("SELECT id, payload FROM " + qTable +
-                            " WHERE status IN ('completed','partially_completed','cancelled','rejected','expired')").all({});
+      var selBuilt = sql.select(tableRaw, SQL_OPTS).columns(["id", "payload"])
+        .whereIn("status", ["completed", "partially_completed", "cancelled", "rejected", "expired"])
+        .toSql();
+      var selStmt = db.prepare(selBuilt.sql);
+      var rows = selStmt.all.apply(selStmt, selBuilt.params);
       var purged = 0;
-      var del = db.prepare("DELETE FROM " + qTable + " WHERE id = $id");
       for (var i = 0; i < rows.length; i++) {
         try {
           var t = safeJson.parse(_unsealPayload(rows[i].payload, rows[i].id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES });
           if (t.retentionUntil && t.retentionUntil < asOf) {
-            del.run({ $id: rows[i].id });
+            // The delete SQL string is identical every iteration, so db.prepare
+            // returns the same cached statement — composing per-row is free.
+            var dBuilt = sql.delete(tableRaw, SQL_OPTS).where("id", "=", rows[i].id).toSql();
+            var dStmt = db.prepare(dBuilt.sql);
+            dStmt.run.apply(dStmt, dBuilt.params);
             purged += 1;
           }
         } catch (_e) { /* malformed payload — leave it */ }

package/lib/vendor/blamejs/lib/external-db.js

@@ -381,6 +381,18 @@ var _ROW_RETURNING_CLASS = Object.freeze({ SELECT: true, READ_INFO: true });
 
 function statementReturnsRows(sql) {
   if (typeof sql !== "string" || sql.length === 0) return false;
+  // EXPLAIN — with or without ANALYZE, wrapping any inner statement —
+  // always returns a plan row set to the caller: `EXPLAIN ANALYZE INSERT`
+  // executes the write AND yields the plan. That is the row-set question,
+  // orthogonal to the residency gate's read/write class (where a plain
+  // EXPLAIN is a read and EXPLAIN ANALYZE <write> is a write). An EXPLAIN
+  // prefix that does not resolve (no inner statement, unbalanced option
+  // parens, unterminated span) stays fail-closed false so the .all()/.run()
+  // chooser never mis-routes an unparseable statement.
+  var m = _STATEMENT_CLASS_RE.exec(sql);
+  if (m && m[1].toUpperCase() === "EXPLAIN") {
+    return _explainResolve(sql, m.index + m[0].length) !== null;
+  }
   if (_ROW_RETURNING_CLASS[_classifyStatement(sql)] === true) return true;
   return _hasTopLevelReturning(sql);
 }
@@ -637,11 +649,24 @@ class Pool {
   }
 
   _reapIdle() {
+    // Reap idle clients past idleTimeoutMs, but honor `min` as a floor on
+    // idle clients: retain at least `min` warm connections even when they
+    // have all gone idle past the timeout, so a quiet period does not drain
+    // the pool below its configured warm floor. The freshest entries sit at
+    // the end of the idle stack (release() pushes, acquire() pops), so the
+    // stalest expired clients are reaped first and the floor keeps the most
+    // recently used. min:0 opts out of the floor (reap every expired idle).
+    var min = (typeof this.config.min === "number" && isFinite(this.config.min) && this.config.min > 0)
+      ? this.config.min : 0;
+    var reapable = this.idle.length - min;
+    if (reapable <= 0) return;   // at or below the floor — keep every idle client warm
     var now = Date.now();
     var keep = [];
+    var reaped = 0;
     var self = this;
     this.idle.forEach(function (entry) {
-      if ((now - entry.lastUsedAt) >= self.config.idleTimeoutMs) {
+      if (reaped < reapable && (now - entry.lastUsedAt) >= self.config.idleTimeoutMs) {
+        reaped += 1;
         Promise.resolve().then(function () { return self.close(entry.client); }).catch(function () {});
       } else {
         keep.push(entry);
@@ -907,7 +932,21 @@ function init(opts) {
     };
   }
 
-  defaultBackend = opts.defaultBackend || Object.keys(backends)[0];
+  // defaultBackend — when supplied it must name a REGISTERED backend, so a
+  // typo surfaces as a typed config-time error at init() rather than as an
+  // opaque TypeError when the first query dereferences a missing pool.
+  // Omitted → the first declared backend (declaration order).
+  if (opts.defaultBackend !== undefined && opts.defaultBackend !== null) {
+    validateOpts.requireNonEmptyString(opts.defaultBackend, "defaultBackend", ExternalDbError, "INVALID_CONFIG");
+    if (!Object.prototype.hasOwnProperty.call(backends, opts.defaultBackend)) {
+      throw _err("INVALID_CONFIG",
+        "defaultBackend: no backend named '" + opts.defaultBackend + "' " +
+        "(declared backends: " + Object.keys(backends).join(", ") + ")", true);
+    }
+    defaultBackend = opts.defaultBackend;
+  } else {
+    defaultBackend = Object.keys(backends)[0];
+  }
 
   // dbRoleBackends — request-time role → backend mapping. Each role name
   // validates as a SQL identifier at init (matches the dbRoleFor

package/lib/vendor/blamejs/lib/file-upload.js

@@ -1191,7 +1191,11 @@ function create(opts) {
         }
       }
       // Run one gate; throws on refuse / gate-error, mutates bodyBuffer on
-      // sanitize so a later gate sees the cleaned bytes.
+      // sanitize so a later gate sees the cleaned bytes. When a gate replaces
+      // the payload, the integrity descriptor (sha3/size) handed to onFinalize
+      // and recorded in the audit must be recomputed over the DELIVERED bytes,
+      // not the pre-sanitize original — flagged here, recomputed after the loop.
+      var contentSanitized = false;
       var _runContentSafetyGate = async function (gate, gateExt) {
         var safetyDecision;
         try {
@@ -1229,6 +1233,7 @@ function create(opts) {
         if (safetyDecision.action === "sanitize" && safetyDecision.sanitized) {
           bodyBuffer = safetyDecision.sanitized;
           bodyStream = null;
+          contentSanitized = true;
         }
       };
       var ranAnyGate = false;
@@ -1271,6 +1276,19 @@ function create(opts) {
                                 verified.totalBytes);
     }
 
+    // A content-safety gate that returned "sanitize" replaced the payload, so
+    // the integrity descriptor handed to onFinalize + recorded in the audit
+    // must describe the bytes actually DELIVERED — an operator storing
+    // info.sha3 as the integrity / dedup key of the stored (sanitized) bytes
+    // would otherwise get a hash that does not match what they store. When no
+    // sanitize ran, the reassembly digest already describes the delivered bytes.
+    var deliveredSha3 = verified.totalHashHex;
+    var deliveredSize = verified.totalBytes;
+    if (contentSanitized && bodyBuffer) {
+      deliveredSha3 = require("node:crypto").createHash("sha3-512").update(bodyBuffer).digest("hex");
+      deliveredSize = bodyBuffer.length;
+    }
+
     // Hand to operator's onFinalize.
     var rv;
     try {
@@ -1279,13 +1297,13 @@ function create(opts) {
           uploadId: uploadId,
           body:     bodyBuffer,
           stream:   bodyStream,
-          sha3:     verified.totalHashHex,
-          size:     verified.totalBytes,
+          sha3:     deliveredSha3,
+          size:     deliveredSize,
           actor:    actor,
           metadata: meta.metadata,
         });
       } else {
-        rv = { ok: true, sha3: verified.totalHashHex, size: verified.totalBytes };
+        rv = { ok: true, sha3: deliveredSha3, size: deliveredSize };
       }
     } catch (e) {
       _emitObs("fileUpload.finalize_failure", 1);
@@ -1294,7 +1312,7 @@ function create(opts) {
         resource: { kind: "fileUpload", id: uploadId },
         outcome:  "failure",
         reason:   "onfinalize-threw",
-        metadata: { size: verified.totalBytes, sha3: verified.totalHashHex,
+        metadata: { size: deliveredSize, sha3: deliveredSha3,
                     error: (e && e.message) || String(e) },
       });
       throw e;
@@ -1305,12 +1323,12 @@ function create(opts) {
     catch (_e) { /* best-effort */ }
 
     _emitObs("fileUpload.finalize_success", 1);
-    _emitObs("fileUpload.finalize_bytes", verified.totalBytes);
+    _emitObs("fileUpload.finalize_bytes", deliveredSize);
     _emitAudit("fileUpload.finalize", {
       actor:    requestHelpers.extractActorContext(actor),
       resource: { kind: "fileUpload", id: uploadId },
       outcome:  "success",
-      metadata: { size: verified.totalBytes, sha3: verified.totalHashHex,
+      metadata: { size: deliveredSize, sha3: deliveredSha3,
                   mode: useStream ? "stream" : "buffer" },
     });
 

package/lib/vendor/blamejs/lib/flag-providers.js

@@ -127,7 +127,7 @@ function memory(opts) {
 
 function localFile(opts) {
   opts = opts || {};
-  validateOpts(opts, ["path", "watch"], "flag.providers.localFile");
+  validateOpts(opts, ["path", "watch", "_watch"], "flag.providers.localFile");
   validateOpts.requireNonEmptyString(opts.path,
     "providers.localFile: path", FlagError, "flag/bad-provider");
   var raw;
@@ -157,22 +157,34 @@ function localFile(opts) {
   var provider = _makeProvider("local-file", parsed.flags);
   provider._path = opts.path;
   if (opts.watch === true) {
-    try {
-      nodeFs.watch(opts.path, { persistent: false }, function () {
-        try {
-          var nextRaw = atomicFile.fdSafeReadSync(opts.path, { maxBytes: C.BYTES.mib(1), encoding: "utf8" });
-          var nextParsed = safeJson.parse(nextRaw, { maxBytes: C.BYTES.mib(1) });
-          if (nextParsed && nextParsed.flags) {
-            for (var k in nextParsed.flags) {
-              if (Object.prototype.hasOwnProperty.call(nextParsed.flags, k)) {
-                _validateFlagSpec(k, nextParsed.flags[k]);
-              }
+    // Re-read the flags from disk on a file change. Drop-silent on the hot
+    // path: a mid-write / transiently-invalid file must not throw out of the
+    // watcher callback.
+    var reload = function () {
+      try {
+        var nextRaw = atomicFile.fdSafeReadSync(opts.path, { maxBytes: C.BYTES.mib(1), encoding: "utf8" });
+        var nextParsed = safeJson.parse(nextRaw, { maxBytes: C.BYTES.mib(1) });
+        if (nextParsed && nextParsed.flags) {
+          for (var k in nextParsed.flags) {
+            if (Object.prototype.hasOwnProperty.call(nextParsed.flags, k)) {
+              _validateFlagSpec(k, nextParsed.flags[k]);
             }
-            provider._replace(nextParsed.flags);
           }
-        } catch (_e) { /* drop-silent on hot-path reload */ }
-      });
-    } catch (_w) { /* watch unavailable - non-fatal */ }
+          provider._replace(nextParsed.flags);
+        }
+      } catch (_e) { /* drop-silent on hot-path reload */ }
+    };
+    // Test seam: a fake watcher (opts._watch) lets a test drive reload
+    // deterministically. The default STAT-POLLS the file (StatWatcher), NOT
+    // fs.watch: fs.watch aborts libuv — an uncatchable src/win/fs-event.c
+    // assertion — when opts.path resolves through a Windows 8.3 short-name
+    // component (e.g. a path under C:\Users\SOMEUS~1\...). StatWatcher never
+    // opens a directory-change handle, so it is immune to the path form; a ~1s
+    // poll is ample latency for a feature-flag hot reload.
+    var watchFn = opts._watch || function (p, onChange) {
+      nodeFs.watchFile(p, { persistent: false, interval: C.TIME.seconds(1) }, function () { onChange(); });
+    };
+    try { watchFn(opts.path, reload); } catch (_w) { /* watch unavailable - non-fatal */ }
   }
   return provider;
 }