@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/examples/wiki/nginx.conf

@@ -0,0 +1,106 @@
+# nginx config for blamejs.com — reverse-proxy to the wiki container,
+# mirroring examples/wiki/Caddyfile for operators who front the wiki with
+# nginx instead of Caddy.
+#
+# Unlike Caddy, nginx does not issue TLS certificates itself. Obtain and
+# renew them with certbot (https://certbot.eff.org) — the paths below
+# assume the standard certbot layout. Everything else (the TLS floor, the
+# forwarded headers the wiki trusts, the www→apex redirect, and HSTS)
+# matches the Caddy hardening so the wiki emits its own strong security
+# headers rather than a weaker proxy default.
+#
+# Drop this in /etc/nginx/conf.d/blamejs.conf (or include it from the main
+# nginx.conf). Set WIKI_ADMIN_TRUSTED_PROXIES to the CIDR nginx connects
+# from so the wiki trusts the X-Forwarded-* headers below (the prod compose
+# already defaults it to the private ranges).
+
+# The wiki container speaks plain HTTP on the compose network. "wiki" is
+# the compose service name; 3008 is the default WIKI_PORT (override both
+# together if you change it).
+upstream blamejs_wiki {
+    server wiki:3008;
+    keepalive 16;
+}
+
+# Port 80 — ACME HTTP-01 challenge (certbot webroot) plus a permanent
+# redirect of everything else to HTTPS.
+server {
+    listen 80;
+    listen [::]:80;
+    server_name blamejs.com www.blamejs.com;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 308 https://blamejs.com$request_uri;
+    }
+}
+
+# Canonicalize www.blamejs.com → apex over TLS (308 preserves method/body).
+server {
+    # `http2` as a listen parameter works on packaged nginx back to 1.9.5;
+    # the standalone `http2 on;` directive is 1.25.1+ only.
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name www.blamejs.com;
+
+    ssl_certificate     /etc/letsencrypt/live/blamejs.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/blamejs.com/privkey.pem;
+    ssl_protocols       TLSv1.3;
+
+    return 308 https://blamejs.com$request_uri;
+}
+
+# Apex — TLS termination + reverse proxy to the wiki container.
+server {
+    # `http2` as a listen parameter works on packaged nginx back to 1.9.5;
+    # the standalone `http2 on;` directive is 1.25.1+ only.
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name blamejs.com;
+
+    ssl_certificate     /etc/letsencrypt/live/blamejs.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/blamejs.com/privkey.pem;
+
+    # TLS 1.3 floor, matching the Caddyfile.
+    ssl_protocols             TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    ssl_session_timeout       1d;
+    ssl_session_cache         shared:blamejs_tls:10m;
+
+    # HSTS two years, subdomains, preload — matches the wiki's own
+    # production posture so the header is present even on the proxy edge.
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+
+    location / {
+        proxy_pass http://blamejs_wiki;
+        proxy_http_version 1.1;
+
+        # Tell the wiki it is behind TLS so its same-origin / CSRF /
+        # cookie-Secure logic trusts the edge. WIKI_ADMIN_TRUSTED_PROXIES
+        # must include this proxy's address for these to be honored.
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-For   $remote_addr;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header Host              $host;
+
+        # WebSocket / SSE upgrades used by the wiki's live islands.
+        proxy_set_header Connection        $connection_upgrade;
+        proxy_set_header Upgrade           $http_upgrade;
+        proxy_read_timeout 300s;
+    }
+
+    # Docker captures stdout/stderr.
+    access_log /dev/stdout;
+    error_log  /dev/stderr;
+}
+
+# Map for the Connection header on WebSocket upgrades. Place this in the
+# http {} context (it is included here for a self-contained reference; if
+# your main nginx.conf already defines $connection_upgrade, drop this map).
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}

package/lib/vendor/blamejs/examples/wiki/package-lock.json

@@ -16,7 +16,7 @@
       }
     },
     "node_modules/@blamejs/core": {
-      "version": "0.16.3",
+      "version": "0.17.22",
       "resolved": "file:../..",
       "license": "Apache-2.0",
       "bin": {

package/lib/vendor/blamejs/examples/wiki/test/e2e.js

@@ -372,6 +372,98 @@ async function run() {
     assert("POST /login with bad CSRF body mentions mismatch",
            /CSRF token mismatch/i.test(badCsrf.body));
 
+    // ---- Age-gate demo route (b.middleware.ageGate through the wired stack) ----
+    // /age-check derives the age from ?age= via Number(). A value that
+    // fails to parse (Number("unknowable") → NaN) must classify as
+    // "unknown" and carry the child-safety privacy defaults through the
+    // live securityHeaders/compression/rate-limit chain — NOT be
+    // admitted as an adult. These header assertions run on the wired
+    // HTTP response, so a middleware later in the chain clobbering the
+    // gate's headers fails here too.
+    var ageUnknown = await _request({
+      method: "GET", host: "127.0.0.1", port: port, path: "/age-check?age=unknowable",
+      headers: BROWSER_HEADERS,
+    });
+    assert("GET /age-check?age=unknowable → 200", ageUnknown.statusCode === 200);
+    assert("unparseable age (NaN) classified unknown (X-Privacy-Posture: unknown)",
+           ageUnknown.headers["x-privacy-posture"] === "unknown");
+    assert("unparseable age gets Cache-Control: private, no-store",
+           ageUnknown.headers["cache-control"] === "private, no-store");
+    assert("unparseable age gets Referrer-Policy: no-referrer",
+           ageUnknown.headers["referrer-policy"] === "no-referrer");
+    assert("unparseable age body reports unknown classification",
+           /"classification"\s*:\s*"unknown"/.test(ageUnknown.body));
+
+    var ageBelow = await _request({
+      method: "GET", host: "127.0.0.1", port: port, path: "/age-check?age=10",
+      headers: BROWSER_HEADERS,
+    });
+    assert("GET /age-check?age=10 → 200", ageBelow.statusCode === 200);
+    assert("below-threshold age classified below-threshold",
+           ageBelow.headers["x-privacy-posture"] === "below-threshold");
+    assert("below-threshold age gets Cache-Control: private, no-store",
+           ageBelow.headers["cache-control"] === "private, no-store");
+    assert("below-threshold age gets Referrer-Policy: no-referrer",
+           ageBelow.headers["referrer-policy"] === "no-referrer");
+    assert("below-threshold age body reports below-threshold classification",
+           /"classification"\s*:\s*"below-threshold"/.test(ageBelow.body));
+
+    var ageAbove = await _request({
+      method: "GET", host: "127.0.0.1", port: port, path: "/age-check?age=30",
+      headers: BROWSER_HEADERS,
+    });
+    assert("GET /age-check?age=30 → 200", ageAbove.statusCode === 200);
+    assert("above-threshold age carries no X-Privacy-Posture header",
+           ageAbove.headers["x-privacy-posture"] === undefined);
+    assert("above-threshold age is not forced private/no-store",
+           (ageAbove.headers["cache-control"] || "") !== "private, no-store");
+    assert("above-threshold age body reports above-threshold classification",
+           /"classification"\s*:\s*"above-threshold"/.test(ageAbove.body));
+
+    // ---- Host-header path injection through the wired router ----
+    // The dispatched route must be a pure function of the request
+    // target: a path-like Host header (Host: trusted/admin) must not
+    // bleed its "/admin" segment into route matching. A vulnerable
+    // router composes "http://trusted/admin" + "/welcome" and dispatches
+    // "/admin/welcome" — the public page vanishes (404) and path-scoped
+    // admin guards see a path the request line never named. Assert the
+    // PUBLIC page is served unchanged and the admin auth gate never
+    // engages.
+    var hostInject = await _request({
+      method: "GET", host: "127.0.0.1", port: port, path: "/welcome",
+      headers: Object.assign({}, BROWSER_HEADERS, { host: "trusted/admin" }),
+    });
+    assert("GET /welcome with Host: trusted/admin → 200 (public page, not rerouted)",
+           hostInject.statusCode === 200);
+    var hostInjectH1 = hostInject.body.match(/<h1[^>]*>([\s\S]*?)<\/h1>/);
+    assert("path-like Host still serves the public welcome page (h1 Welcome)",
+           hostInjectH1 !== null && /Welcome/.test(hostInjectH1[1]));
+    assert("path-like Host does not engage the admin auth gate (no 401)",
+           hostInject.statusCode !== 401 && !/Sign in/i.test(hostInject.body));
+
+    // X-Forwarded-Host variant — the e2e boot trusts loopback as a
+    // reverse proxy, so a forwarded host is the worst case: even then
+    // the forwarded value must not steer routing.
+    var xfhInject = await _request({
+      method: "GET", host: "127.0.0.1", port: port, path: "/welcome",
+      headers: Object.assign({}, BROWSER_HEADERS, { "x-forwarded-host": "trusted/admin" }),
+    });
+    assert("GET /welcome with X-Forwarded-Host: trusted/admin → 200 (public page)",
+           xfhInject.statusCode === 200);
+    var xfhInjectH1 = xfhInject.body.match(/<h1[^>]*>([\s\S]*?)<\/h1>/);
+    assert("forwarded path-like host still serves the public welcome page",
+           xfhInjectH1 !== null && /Welcome/.test(xfhInjectH1[1]));
+
+    // Control: /admin stays auth-gated under a benign Host — the
+    // injection probes above pass because the Host is ignored for
+    // routing, not because the admin gate went missing.
+    var adminBenignHost = await _request({
+      method: "GET", host: "127.0.0.1", port: port, path: "/admin",
+      headers: Object.assign({}, BROWSER_HEADERS, { host: "trusted" }),
+    });
+    assert("control: GET /admin under a benign Host stays auth-gated (401)",
+           adminBenignHost.statusCode === 401);
+
     // ---- Static asset checks ----
     var prismJs = await _request({
       method: "GET", host: "127.0.0.1", port: port, path: "/vendor/prism.js",

package/lib/vendor/blamejs/fuzz/asn1-der.fuzz.js

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+
+var asn1     = require("../lib/asn1-der");
+var expected = require("./_expected");
+
+// asn1-der is the DER byte parser under every untrusted-certificate path in the
+// framework -- peer TLS certificates, S/MIME, BIMI VMCs, CMS, ACME and TSA
+// responses. readNode / readSequence take raw adversarial bytes and MUST refuse
+// malformed input with a typed Asn1Error, never crash with an uncaught
+// RangeError / TypeError or blow the stack on deep nesting.
+module.exports.fuzz = function (data) {
+  var node = null;
+  try {
+    node = asn1.readNode(data, 0);
+  } catch (e) {
+    if (!expected.isExpected(e)) throw e;
+  }
+  try { asn1.readSequence(data); }
+  catch (e) { if (!expected.isExpected(e)) throw e; }
+  if (node) {
+    [asn1.readOid, asn1.readOctetString, asn1.readUnsignedInt, asn1.readBitString].forEach(function (rd) {
+      try { rd(node); }
+      catch (e) { if (!expected.isExpected(e)) throw e; }
+    });
+  }
+};

package/lib/vendor/blamejs/fuzz/cms-codec.fuzz.js

@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+
+var b        = require("..");
+var expected = require("./_expected");
+
+// b.cms parses CMS SignedData / EnvelopedData from untrusted DER (S/MIME
+// messages, signed timestamps, enveloped payloads) on top of asn1-der. decode /
+// parseSignedData MUST refuse a malformed structure with a typed cms/* error,
+// never crash with an uncaught RangeError / TypeError.
+module.exports.fuzz = function (data) {
+  try { b.cms.decode(data); }
+  catch (e) { if (!expected.isExpected(e)) throw e; }
+  try { b.cms.parseSignedData(data); }
+  catch (e) { if (!expected.isExpected(e)) throw e; }
+};

package/lib/vendor/blamejs/fuzz/link-header.fuzz.js

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+
+var b        = require("..");
+var expected = require("./_expected");
+
+// b.linkHeader.parse consumes an untrusted HTTP Link response-header string
+// (RFC 8288) -- a server (or an SSRF-reachable origin) fully controls it. It
+// MUST refuse a malformed header with a typed error or a benign return, never
+// crash with an uncaught error or hang.
+module.exports.fuzz = function (data) {
+  var s;
+  try { s = data.toString("latin1"); }
+  catch (_e) { return; }
+  try { b.linkHeader.parse(s); }
+  catch (e) { if (!expected.isExpected(e)) throw e; }
+};

package/lib/vendor/blamejs/index.js

@@ -128,6 +128,7 @@ var sql = require("./lib/sql");
 var chainWriter = require("./lib/chain-writer");
 var codepointClass = require("./lib/codepoint-class");
 var safeBuffer = require("./lib/safe-buffer");
+var safeObject = require("./lib/safe-object");
 var safeDecompress = require("./lib/safe-decompress").safeDecompress;
 var safeMountInfo = require("./lib/safe-mount-info");
 var lazyRequire = require("./lib/lazy-require");
@@ -301,6 +302,10 @@ mail.rbl = require("./lib/mail-rbl");
 mail.serverRegistry = require("./lib/mail-server-registry");
 mail.send = mail.send || {};
 mail.send.deliver = require("./lib/mail-send-deliver").create;
+// Expose the documented `b.mail.send.deliver.create(opts)` factory form
+// (its @signature / @example) alongside the collapsed callable so an
+// operator following the docs reaches the same builder.
+mail.send.deliver.create = require("./lib/mail-send-deliver").create;
 mail.send.deliver.DeliverError = require("./lib/mail-send-deliver").DeliverError;
 mail.greylist = require("./lib/mail-greylist");
 mail.helo = require("./lib/mail-helo");
@@ -535,6 +540,7 @@ module.exports = {
   chainWriter:      chainWriter,
   codepointClass:   codepointClass,
   safeBuffer:       safeBuffer,
+  safeObject:       safeObject,
   safeDecompress:   safeDecompress,
   safeMountInfo:    safeMountInfo,
   lazyRequire:      lazyRequire,

package/lib/vendor/blamejs/lib/a2a.js

@@ -117,7 +117,7 @@ function _validateCardShape(card, errorClass) {
  * `verifyCard` use the same canonicalizer internally.
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   var bytes = b.a2a.canonicalize({
  *     issuer:       "agent.example.com",
  *     agentId:      "ops-bot-1",
@@ -159,7 +159,7 @@ function canonicalize(card) {
  *   }
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   var card = b.a2a.createCard({
  *     issuer:       "agent.example.com",
  *     agentId:      "ops-bot-1",
@@ -209,7 +209,7 @@ function createCard(opts) {
  *   }
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   var card = b.a2a.createCard({
  *     issuer:       "agent.example.com",
  *     agentId:      "ops-bot-1",
@@ -292,7 +292,7 @@ function signCard(card, privateKeyPem, opts) {
  *   }
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   var result = b.a2a.verifyCard(envelope, peerPublicKeyPem, {
  *     expectedIssuer: "agent.example.com"
  *   });

package/lib/vendor/blamejs/lib/agent-idempotency.js

@@ -249,9 +249,18 @@ async function _putIfAbsent(store, method, actorId, key, putOpts, ttlMs, maxResu
   if (existing.status === "pending") {
     return { alreadyClaimed: true, pending: true, firstAt: existing.firstAt };
   }
-  // Completed cached result.
+  // Completed cached result. Unseal the result blob when a vault is
+  // configured — put() sealed it at rest via b.cryptoField, so parsing the
+  // raw sealed cell as JSON would throw. Mirrors _get's unseal path (same
+  // seal-table, same unseal call-site shape); vault-less / pre-sealing rows
+  // carry plain JSON and pass through unchanged.
+  var unsealed = existing;
+  if (vault().isInitialized()) {
+    _ensureSealTable();
+    unsealed = cryptoField().unsealRow(SEAL_TABLE, existing);
+  }
   var result;
-  try { result = safeJson.parse(existing.resultBlob, { maxBytes: maxResultBytes }); }
+  try { result = safeJson.parse(unsealed.resultBlob, { maxBytes: maxResultBytes }); }
   catch (e) {
     throw new AgentIdempotencyError("agent-idempotency/corrupt-result",
       "putIfAbsent: cached result failed to parse — " + (e && e.message ? e.message : String(e)));
@@ -280,6 +289,13 @@ async function _get(store, method, actorId, key, auditImpl, ttlMs, maxResultByte
       { method: method, actorIdHash: _truncHash(_actorIdHash(actorId)) });
     return null;
   }
+  // A pending row (claimed via putIfAbsent, no result written yet) carries a
+  // null resultBlob — there is no cached result to return. Report absent
+  // rather than feeding null to safeJson.parse, which throws corrupt-result.
+  // get() is a public status-check path and putIfAbsent produces pending rows,
+  // so a concurrent claim must not turn a peer's get() into a spurious throw;
+  // a later put() replaces the pending row with the completed result.
+  if (row.resultBlob === null || row.resultBlob === undefined) return null;
   // Unseal the result blob into a copy (when a vault is configured;
   // vault-less or pre-sealing rows are plain JSON and used as-is). The
   // original sealed `row` is preserved so the replay-count re-put below

package/lib/vendor/blamejs/lib/agent-saga.js

@@ -115,10 +115,15 @@ function create(config) {
   // Interface: { saveStep, loadResumePoint, markCompleted, markFailed }.
   // saveStep({sagaId, stepIndex, stepName, state, status}) commits
   // after each step.run; loadResumePoint(sagaId) returns the resume
-  // shape `{ stepIndex, state }` on restart. Without a stateStore, the
-  // saga still runs end-to-end in-memory but a mid-saga crash loses
-  // progress (operator-acknowledged dev mode; the audit emit
-  // `agent.saga.no_state_store` surfaces the posture per call).
+  // shape `{ stepIndex, state }` on restart — and, for a saga that already
+  // reached a terminal state, SHOULD set `terminal: true` (or return null)
+  // after markFailed / markCompleted so a resume of a failed-and-compensated
+  // (or completed) saga is refused rather than replayed. Compensators MUST be
+  // idempotent: a crash mid-compensation-cascade (before markFailed persists)
+  // can replay a compensation on the next resume, so compensating twice must be
+  // safe. Without a stateStore, the saga still runs end-to-end in-memory but a
+  // mid-saga crash loses progress (operator-acknowledged dev mode; the audit
+  // emit `agent.saga.no_state_store` surfaces the posture per call).
   var stateStore = config.stateStore || null;
   if (stateStore !== null) {
     validateOpts.requireMethods(stateStore, ["saveStep", "loadResumePoint"],
@@ -147,6 +152,21 @@ async function _resume(config, auditImpl, stateStore, sagaId, ctx, opts) {
     throw new AgentSagaError("agent-saga/not-found",
       "resume: no resume point for saga '" + sagaId + "'");
   }
+  // A saga that already reached a terminal state — failed-and-compensated, or
+  // completed — must NOT be resumed. Replaying it re-runs the remaining steps
+  // AND, on a failure, re-invokes the completed steps' compensators (including
+  // the pre-crash steps this run seeds); compensators are not required to be
+  // idempotent, so a second compensation could corrupt external state (a double
+  // refund). A well-behaved stateStore marks the saga terminal via markFailed /
+  // markCompleted and reflects it here (resumePoint.terminal); refuse the resume
+  // when it does. The residual window — a crash after a compensation but before
+  // markFailed — is inherent at-least-once compensation and is why compensators
+  // MUST be idempotent (see the interface note on create()).
+  if (resumePoint.terminal === true) {
+    throw new AgentSagaError("agent-saga/not-resumable",
+      "resume: saga '" + sagaId + "' is terminal and cannot be resumed — " +
+      "replaying a failed/completed saga would re-invoke its compensators");
+  }
   return _runFrom(config, auditImpl, stateStore, ctx,
     resumePoint.state || {}, opts, sagaId, resumePoint.stepIndex);
 }
@@ -158,11 +178,19 @@ async function _run(config, auditImpl, stateStore, ctx, initialState, opts) {
 }
 
 async function _runFrom(config, auditImpl, stateStore, ctx, state, opts, sagaId, startIndex) {
-  // completedSteps captures index + step reference. On resume we
-  // start mid-saga; prior steps are already committed and don't need
-  // compensation on a failure in this run (compensation cascades
-  // walked persistent state to find the prior completed set).
+  // completedSteps captures index + step reference for the reverse-order
+  // compensation cascade. On resume (startIndex > 0) the steps before
+  // startIndex were completed and committed BEFORE the crash; a failure in
+  // this run must still compensate them, or a saga that resumes and then
+  // fails leaves its pre-crash work uncompensated (a broken distributed-
+  // transaction guarantee — e.g. a charge committed pre-crash is never
+  // refunded when a later step fails). Seed those prior steps so the cascade
+  // unwinds the FULL completed set, not only this run's steps. Compensation
+  // runs against the resumed state, which already reflects their effects.
   var completedSteps = [];
+  for (var pre = 0; pre < startIndex; pre += 1) {
+    completedSteps.push({ step: config.steps[pre], index: pre });
+  }
 
   if (startIndex === 0) {
     agentAudit.safeAudit(auditImpl, "agent.saga.started", opts.actor, {

package/lib/vendor/blamejs/lib/agent-snapshot.js

@@ -457,9 +457,12 @@ async function _persist(ctx, snap) {
   snap.sigPubKey = (typeof signer.getPublicKey === "function" && signer.getPublicKey()) || null;
 
   // Seal the entire envelope under AAD that pins
-  // snapshotId + schemaVersion + tenantId. AAD mismatch on unseal (a
+  // table + snapshotId + schemaVersion. AAD mismatch on unseal (a
   // copy-paste attack from one snapshotId's row into another) fails
-  // the Poly1305 tag check; tampered bytes also fail. The sealed
+  // the Poly1305 tag check; tampered bytes also fail. The tenantId is
+  // authenticated by the signature (it is a signed field) and the
+  // wrapper's decorative tenantId is cross-checked against the signed
+  // body at load, so it is not additionally bound in the AAD. The sealed
   // string is what reaches durable storage.
   var sealer = _resolveSealer(ctx);
   var serialized = safeJson.stringify(snap);
@@ -475,7 +478,9 @@ async function _persist(ctx, snap) {
     // implementation needs to filter by tenantId / takenAt without
     // having to unseal every row. Sealed-blob carries the full
     // envelope; the metadata is decorative + may be tamper-fuzzed by
-    // a hostile backend (the AEAD tag still binds via AAD on unseal).
+    // a hostile backend. snapshotId is bound by the AAD (unseal fails on
+    // a swap) and tenantId is cross-checked against the signed body at
+    // load, so a relabelled wrapper is refused rather than trusted.
     stored = {
       snapshotId: snap.snapshotId,
       takenAt:    snap.takenAt,
@@ -547,6 +552,31 @@ async function _unwrapAndVerify(ctx, raw, expectedId) {
     throw new AgentSnapshotError("agent-snapshot/snapshot-id-mismatch",
       "load: wrapper snapshotId='" + expectedId + "' does not match envelope='" + snap.snapshotId + "'");
   }
+  // The wrapper's decorative tenantId is what the backend's list() /
+  // loadLatest tenant filter selects on, but it is NOT bound by the seal's
+  // AAD (which pins table + snapshotId + schemaVersion). A hostile backend
+  // can therefore relabel a sealed row's wrapper tenantId while the
+  // Poly1305 tag still verifies — so loadLatest({ tenantId }) would return
+  // a DIFFERENT tenant's authentic snapshot (cross-tenant restore).
+  // Cross-check the untrusted wrapper tenantId against the signed body's
+  // tenantId and refuse the mismatch, mirroring the snapshotId gate above;
+  // the inner value is the authentic one (covered by the signature).
+  if ((raw.tenantId || null) !== (snap.tenantId || null)) {
+    throw new AgentSnapshotError("agent-snapshot/tenant-id-mismatch",
+      "load: wrapper tenantId='" + (raw.tenantId || null) +
+      "' does not match envelope tenantId='" + (snap.tenantId || null) + "'");
+  }
+  // Same class as the tenantId/snapshotId gates: the wrapper takenAt is the
+  // field loadLatest sorts on to pick "latest", but it is not AAD-bound, so a
+  // hostile backend could relabel a returned row's age (misrepresenting when
+  // the restored state was captured — an audit-integrity / rollback signal).
+  // takenAt is a signed body field, so cross-check the untrusted wrapper value
+  // against it and refuse a divergence; the inner value is the authentic one.
+  if ((raw.takenAt || null) !== (snap.takenAt || null)) {
+    throw new AgentSnapshotError("agent-snapshot/taken-at-mismatch",
+      "load: wrapper takenAt='" + (raw.takenAt || null) +
+      "' does not match envelope takenAt='" + (snap.takenAt || null) + "'");
+  }
   // Verify the signature before returning the envelope
   // to the caller. Restore-side trust derives from this gate. The
   // allowPlaintext escape hatch (operator-acknowledged dev mode)
@@ -595,9 +625,36 @@ async function _loadLatest(ctx, loadOpts) {
   });
   if (filtered.length === 0) return null;
   filtered.sort(function (a, b) { return (b.takenAt || 0) - (a.takenAt || 0); });
-  var latestId = filtered[0].snapshotId;
-  var raw = await ctx.backend.get(latestId);
-  return await _unwrapAndVerify(ctx, raw, latestId);
+  var selected = filtered[0];
+  var raw = await ctx.backend.get(selected.snapshotId);
+  var snap = await _unwrapAndVerify(ctx, raw, selected.snapshotId);
+  // list() and get() are independently-tamperable untrusted backend surfaces.
+  // _unwrapAndVerify only proves the get() wrapper agrees with the signed body;
+  // it does NOT prove the list() metadata used to FILTER and SELECT this row is
+  // honest. A backend that relabels tenant A's list() entry as tenant B while
+  // leaving A's get() row untouched would pass that wrapper/body check yet
+  // still surface A's authentic snapshot for a tenant-B query. So bind the
+  // REQUESTED selection criteria to the authenticated body: the loaded signed
+  // tenantId must equal the requested tenantId.
+  if (loadOpts.tenantId && (snap.tenantId || null) !== loadOpts.tenantId) {
+    throw new AgentSnapshotError("agent-snapshot/tenant-id-mismatch",
+      "loadLatest: requested tenantId='" + loadOpts.tenantId +
+      "' does not match the loaded snapshot's authenticated tenantId='" +
+      (snap.tenantId || null) + "'");
+  }
+  // The list() sort key that selected this row must match its authenticated
+  // takenAt, so a backend cannot inflate a row's list() age to win the "latest"
+  // sort while get() returns the honest (older) body. A backend can still
+  // withhold or reorder rows it never reveals -- an inherent freshness limit of
+  // an untrusted store -- but every RETURNED snapshot is authentic, tenant-
+  // bound, and carries its own authenticated capture time.
+  if ((selected.takenAt || null) !== (snap.takenAt || null)) {
+    throw new AgentSnapshotError("agent-snapshot/taken-at-mismatch",
+      "loadLatest: list() takenAt='" + (selected.takenAt || null) +
+      "' for the selected snapshot does not match its authenticated takenAt='" +
+      (snap.takenAt || null) + "'");
+  }
+  return snap;
 }
 
 async function _loadById(ctx, snapshotId) {

package/lib/vendor/blamejs/lib/app-shutdown.js

@@ -45,6 +45,7 @@
 
 var safeAsync = require("./safe-async");
 var numericBounds = require("./numeric-bounds");
+var pidProbe = require("./pid-probe");
 var validateOpts = require("./validate-opts");
 var tracing = null;
 try { tracing = require("./tracing"); } catch (_e) { /* tracing optional */ }
@@ -547,35 +548,37 @@ function pidLock(lockPath) {
   var fd = null;
   var ownsLock = false;
 
-  function _isLivePid(pid) {
-    if (!pid || pid <= 0) return false;
-    try { process.kill(pid, 0); return true; }                                            // signal 0 = existence-check
-    catch (e) { return e.code === "EPERM"; }                                              // EPERM means process exists, just no rights
-  }
-
-  function _readExisting() {
-    try {
-      // fd-safe + capped + symlink-refusing read: a PID lockfile is never a
-      // legitimate symlink (unlike a k8s/certbot secret mount), so refuseSymlink
-      // is safe here and stops a planted symlink/oversized file from redirecting
-      // or OOM-ing the read. Any throw (symlink/too-large/enoent) → null, the
-      // existing "no live lock" semantic.
-      var raw = atomicFile.fdSafeReadSync(lockPath, { maxBytes: C.BYTES.kib(1), refuseSymlink: true, encoding: "utf8" });
-      var pid = parseInt(String(raw).trim(), 10);
-      return isFinite(pid) && pid > 0 ? pid : null;
-    } catch (_e) { return null; }
-  }
+  // Signal-0 liveness probe + fd-safe pidfile reader are the shared
+  // lib/pid-probe primitive (b.daemon carried a byte-identical copy).
+  function _readExisting() { return pidProbe.readPidFile(lockPath); }
 
   function acquire() {
     if (ownsLock) return;
     nodeFs.mkdirSync(nodePath.dirname(lockPath), { recursive: true });
     var existing = _readExisting();
-    if (existing && _isLivePid(existing) && existing !== process.pid) {
+    if (existing && pidProbe.isLivePid(existing) && existing !== process.pid) {
       throw new AppShutdownError("app-shutdown/pidlock-held",
         "pidLock: '" + lockPath + "' already held by live PID " + existing);
     }
+    if (existing === process.pid) {
+      // The lockfile already records OUR PID — a parent wrote it and handed off,
+      // or start() re-acquires after leaving its own live pidfile. ADOPT the
+      // existing inode in place: the reap path below would unlink + O_EXCL-
+      // recreate, opening a no-pidfile window a concurrent daemon.stop misreads
+      // as "no-pidfile". openNoFollowSync holds the inode (a symlink at lockPath
+      // is refused with ELOOP) so we own the lock without ever removing the
+      // file. release() closes this fd + unlinks as usual.
+      try {
+        fd = atomicFile.openNoFollowSync(lockPath);
+      } catch (e) {
+        throw new AppShutdownError("app-shutdown/pidlock-open-failed",
+          "pidLock: failed to adopt self-held '" + lockPath + "': " + e.message);
+      }
+      ownsLock = true;
+      return;
+    }
     if (existing) {
-      // Stale lock — owner is dead. Reap.
+      // Stale lock — owner is dead (foreign PID that is no longer live). Reap.
       try { nodeFs.unlinkSync(lockPath); } catch (_e) { /* race: someone else reaped it */ }
     }
     try {

package/lib/vendor/blamejs/lib/archive-read.js

@@ -606,6 +606,14 @@ async function _decompressEntry(adapter, entry, dataStart, bombPolicy) {
       algorithm:          "deflate-raw",
       maxOutputBytes:     maxOutput,
       maxCompressedBytes: entry.compressedSize,
+      // Honor the reader's own expansion-ratio cap. Without this, the
+      // composition inherits safeDecompress's DEFAULT_MAX_RATIO (50),
+      // which silently overrides bombPolicy.maxExpansionRatio and refuses
+      // every entry compressing better than 50:1 even when the operator's
+      // policy (default 100) permits it. The declared-size ratio was
+      // already validated in _enforceBombPolicy; this re-check on the
+      // actual inflated bytes uses the SAME configured cap.
+      maxRatio:           bombPolicy.maxExpansionRatio,
     });
     if (decompressed.length !== entry.uncompressedSize) {
       throw new ArchiveReadError("archive-read/inflate-size-mismatch",