@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/auth/sd-jwt-vc.js

@@ -119,11 +119,11 @@ function _b64uDecodeBuf(s) {
 }
 
 function _hashDisclosure(disclosureStr, hashAlg) {
-  var nodeAlg = SUPPORTED_HASH_ALGS[hashAlg];
-  if (!nodeAlg) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, hashAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "Unsupported hash algorithm: " + hashAlg);
   }
+  var nodeAlg = SUPPORTED_HASH_ALGS[hashAlg];
   var h = nodeCrypto.createHash(nodeAlg);
   h.update(disclosureStr, "ascii");
   return h.digest().toString("base64url");
@@ -338,12 +338,12 @@ function present(opts) {
   }
   var _sdAlg = (_issuerPayload && typeof _issuerPayload._sd_alg === "string")
     ? _issuerPayload._sd_alg : "sha-256";
-  var _sdNodeHash = SUPPORTED_HASH_ALGS[_sdAlg];
-  if (!_sdNodeHash) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, _sdAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "present: issuer credential declares _sd_alg \"" + _sdAlg +
       "\" which this framework version does not support");
   }
+  var _sdNodeHash = SUPPORTED_HASH_ALGS[_sdAlg];
 
   var disclosedNames = Array.isArray(opts.disclosedClaimNames)
     ? opts.disclosedClaimNames.slice() : [];
@@ -510,6 +510,12 @@ async function verify(presentation, opts) {
       !Buffer.isBuffer(issuerKey) &&
       typeof issuerKey.kty === "string") {
     jwtExternal._assertAlgKtyMatch(alg, issuerKey);
+    // node:crypto.verify cannot consume a bare JWK object — import it to
+    // a KeyObject first, mirroring the holder KB-JWT path below
+    // (bCrypto.importPublicJwk). Without this a resolver that returns a
+    // JWK (the common path per the CVE-2026-22817 note above) rejects a
+    // VALID credential with ERR_INVALID_ARG_TYPE instead of verifying.
+    issuerKey = bCrypto.importPublicJwk(issuerKey);
   }
   var jwtParsed = _verifyJwt(jwt, issuerKey, alg);
   // Post-verify header compare. Pre-verify we parsed the

package/lib/vendor/blamejs/lib/backup/bundle.js

@@ -51,6 +51,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("../atomic-file");
+var safePath = require("../safe-path");
 var bCrypto = require("./crypto");
 var backupManifest = require("./manifest");
 var validateOpts = require("../validate-opts");
@@ -122,11 +123,20 @@ async function create(opts) {
       throw new BackupBundleError("backup-bundle/bad-include",
         "create: files[" + i + "] requires { relativePath: string }");
     }
-    if (entry.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(entry.relativePath)) {
+    if (entry.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(entry.relativePath) ||
+        entry.relativePath.indexOf(":") !== -1) {
+      // A colon anywhere is refused alongside '..' and a leading separator: it
+      // covers both a Windows drive prefix (C:\..., absolute) and an NTFS
+      // alternate-data-stream marker (db.enc:evil). This friendly pre-screen
+      // mirrors b.backupManifest.validate; safePath.resolve below is the
+      // authoritative sink for the residual classes (UNC, reserved name, etc.).
       throw new BackupBundleError("backup-bundle/bad-include",
-        "create: files[" + i + "].relativePath must be a relative path (got '" + entry.relativePath + "')");
+        "create: files[" + i + "].relativePath must be a relative path without '..', a leading separator, or a colon (got '" + entry.relativePath + "')");
     }
-    var srcPath = nodePath.join(dataDir, entry.relativePath);
+    // Resolve the source path THROUGH dataDir with safePath so a relativePath
+    // built from untrusted input can't read a file outside dataDir even if it
+    // slips the first-line check (UNC, reserved name, encoded separator, bidi).
+    var srcPath = safePath.resolve(dataDir, entry.relativePath);
     if (!nodeFs.existsSync(srcPath)) {
       if (entry.required) {
         throw new BackupBundleError("backup-bundle/missing-required",

package/lib/vendor/blamejs/lib/backup/index.js

@@ -55,6 +55,7 @@ var os = require("node:os");
 var nodePath = require("node:path");
 var bCrypto = require("../crypto");
 var atomicFile = require("../atomic-file");
+var safePath = require("../safe-path");
 var C = require("../constants");
 var backupBundle = require("./bundle");
 var frameworkFiles = require("../framework-files");
@@ -2197,13 +2198,23 @@ bundleAdapterStorage.fsAdapter = function (fsOpts) {
   atomicFile.ensureDir(root);
 
   function _keyPath(key) {
-    // Refuse keys with traversal segments — defense in depth even
-    // though the storage layer also checks.
-    if (key.indexOf("..") !== -1 || key.indexOf("\0") !== -1) {
+    // Gate the key under Windows path semantics REGARDLESS of the host, then
+    // resolve the real on-disk path with the host's semantics. An fsAdapter
+    // store is portable — a bundle written on one OS is often read on another —
+    // and win32 splits on both `/` and `\`, so a key like `..\evil` (a harmless
+    // literal filename under POSIX, but a climb out of root when the same key is
+    // later interpreted on Windows) is refused everywhere. The gate is a strict
+    // superset of the host's, also refusing an absolute / drive-letter / UNC
+    // prefix, an NTFS alternate-data-stream marker, a Windows reserved name, and
+    // NUL / control bytes; defense in depth even though the storage layer also
+    // checks. A hand-rolled '..' + NUL substring check (the prior shape) missed
+    // the drive / ADS / reserved-name class the shared primitive handles, and a
+    // host-only resolve missed the cross-platform backslash-traversal class.
+    if (safePath.resolveOrNull(root, key, { platform: "win32" }) === null) {
       throw new BackupError("backup/bad-key",
-        "fsAdapter: key contains invalid characters: " + JSON.stringify(key));
+        "fsAdapter: key contains invalid or unsafe path characters: " + JSON.stringify(key));
     }
-    return nodePath.join(root, key);
+    return safePath.resolve(root, key);
   }
 
   return {

package/lib/vendor/blamejs/lib/backup/manifest.js

@@ -121,14 +121,19 @@ function _validateFileEntry(f, idx, errors) {
   }
   if (typeof f.relativePath !== "string" || f.relativePath.length === 0) {
     errors.push("files[" + idx + "].relativePath: required non-empty string");
-  } else if (f.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(f.relativePath)) {
-    // No traversal — when restored, relativePath joins under dataDir
-    errors.push("files[" + idx + "].relativePath: must be a relative path without '..' or leading separator");
+  } else if (f.relativePath.indexOf("..") !== -1 || /^[/\\]/.test(f.relativePath) || f.relativePath.indexOf(":") !== -1) {
+    // No traversal — when restored, relativePath joins under dataDir. A colon
+    // anywhere is refused alongside '..' and a leading separator: it covers
+    // both a Windows drive prefix (C:\..., absolute — path.resolve would honor
+    // it and escape dataDir) and an NTFS alternate-data-stream marker
+    // (db.enc:evil), so validate() fails closed before restore, matching the
+    // safePath sink b.restoreBundle resolves both paths through.
+    errors.push("files[" + idx + "].relativePath: must be a relative path without '..', a leading separator, or a colon (drive letter / NTFS data-stream marker)");
   }
   if (typeof f.encryptedPath !== "string" || f.encryptedPath.length === 0) {
     errors.push("files[" + idx + "].encryptedPath: required non-empty string");
-  } else if (f.encryptedPath.indexOf("..") !== -1 || /^[/\\]/.test(f.encryptedPath)) {
-    errors.push("files[" + idx + "].encryptedPath: must be a relative path without '..' or leading separator");
+  } else if (f.encryptedPath.indexOf("..") !== -1 || /^[/\\]/.test(f.encryptedPath) || f.encryptedPath.indexOf(":") !== -1) {
+    errors.push("files[" + idx + "].encryptedPath: must be a relative path without '..', a leading separator, or a colon (drive letter / NTFS data-stream marker)");
   }
   if (typeof f.size !== "number" || !Number.isInteger(f.size) || f.size < 0) {
     errors.push("files[" + idx + "].size: required non-negative integer");
@@ -172,6 +177,14 @@ function validate(manifest) {
   }
   if (!Array.isArray(manifest.files)) {
     errors.push("files: required array");
+  } else if (manifest.files.length === 0) {
+    // A backup that describes zero files is never legitimate — the bundle
+    // writer refuses to emit one. Refuse it here too: this is the single
+    // guard the restore path parses an untrusted manifest through, and a
+    // tampered manifest that strips every entry (while keeping a valid
+    // wrapped vault key) would otherwise restore to an empty staging dir
+    // that the swap moves over the live dataDir — a silent destructive wipe.
+    errors.push("files: required non-empty array");
   } else {
     // Detect duplicate relativePath / encryptedPath — would corrupt restore
     var seenRel = Object.create(null);

package/lib/vendor/blamejs/lib/base32.js

@@ -128,6 +128,7 @@ function decode(str, opts) {
   var bytes = [];
   var value = 0, bits = 0;
   var inPad = false;   // once "=" padding starts, only more "=" may follow
+  var dataCount = 0;   // count of data symbols (excludes padding + skipped separators)
   for (var i = 0; i < str.length; i++) {
     var ch = str.charAt(i);
     if (ch === "=") { inPad = true; continue; }             // trailing padding
@@ -140,11 +141,31 @@ function decode(str, opts) {
     if (idx === undefined) throw new Base32Error("base32/bad-char", "base32.decode: invalid Base32 character '" + str.charAt(i) + "' at index " + i);
     value = (value << BITS) | idx;
     bits += BITS;
+    dataCount += 1;
     if (bits >= 8) {                                        // emit a full output byte
       bytes.push((value >>> (bits - 8)) & 0xff);            // eight-bit output byte mask
       bits -= 8;                                            // consumed eight bits
     }
   }
+  // A group of 5 input bytes encodes to 8 symbols; the only valid partial-group
+  // symbol counts are 2, 4, 5, 7 (for 1, 2, 3, 4 trailing bytes). A count of
+  // 1/3/6 (mod 8) cannot represent any whole-byte input, so the OLD decoder
+  // silently returned a truncated/garbage buffer — refuse it.
+  var rem = dataCount % GROUP;
+  if (rem === 1 || rem === 3 || rem === 6) {
+    throw new Base32Error("base32/bad-length",
+      "base32.decode: " + dataCount + " data symbol(s) is not a valid Base32 length " +
+      "(a partial group is 2, 4, 5 or 7 symbols)");
+  }
+  // Non-canonical trailing bits (RFC 4648 §3.5): a conforming encoder zeroes the
+  // final symbol's unused low bits. Non-zero leftover bits mean two distinct
+  // strings decode to the same bytes — decoder malleability. Refuse it so every
+  // byte sequence has exactly one Base32 form (matters where the string is a
+  // key / secret / dedup handle, e.g. TOTP, identifiers).
+  if (bits > 0 && (value & ((1 << bits) - 1)) !== 0) {
+    throw new Base32Error("base32/non-canonical",
+      "base32.decode: non-canonical encoding — the final symbol's unused low bits must be zero");
+  }
   return Buffer.from(bytes);
 }
 

package/lib/vendor/blamejs/lib/break-glass.js

@@ -1431,8 +1431,25 @@ async function unsealRow(grantHandle, table, rowId, opts) {
     .whereOp("expiresAt", ">", Date.now())
     .toSql();
   var updateRes = await clusterStorage.execute(incBuilt.sql, incBuilt.params);
-  // executeAll-style result; some backends return rowsAffected, others a count.
-  // Re-query to confirm the increment landed and get the post-increment counter.
+  // The atomic compare-and-increment IS the claim, and the count of rows it
+  // CHANGED is the only per-caller signal for whether THIS caller won the
+  // slot. `execute` returns rowCount = the rows the UPDATE modified
+  // (info.changes on local sqlite; the driver's affected-row count in cluster
+  // mode), so rowCount >= 1 means this caller's compare-and-increment landed
+  // and rowCount === 0 means it lost — the grant was exhausted / revoked /
+  // expired concurrently between the runtime checks above and this UPDATE.
+  //
+  // Do NOT infer the claim from a re-read of rowsConsumed against this
+  // caller's stale pre-value: a concurrent WINNER's increment is visible to
+  // the LOSER's re-read, so `post !== pre` is true for the loser too and both
+  // proceed — a double-claim that reads two rows under a maxRowsPerGrant:1
+  // grant, defeating row-by-row auth. The affected-row count is unambiguous.
+  if (!updateRes || Number(updateRes.rowCount) < 1) {
+    throw new BreakGlassError("breakglass/grant-exhausted",
+      "unsealRow: grant " + grantHandle.id + " was exhausted by a concurrent read", true);
+  }
+  // Re-query for the post-increment counter — used ONLY for the audit's
+  // rowsRemaining hint below, no longer for the claim decision.
   var postReadBuilt = sql.select("_blamejs_break_glass_grants", _sqlOpts())   // allow:hand-rolled-sql
     .columns(["rowsConsumed", "revokedAt", "expiresAt"])
     .where("_id", grantHandle.id)
@@ -1443,14 +1460,6 @@ async function unsealRow(grantHandle, table, rowId, opts) {
       "unsealRow: grant " + grantHandle.id + " disappeared during unseal", true);
   }
   var postRowsConsumed = Number(postRows[0].rowsConsumed);
-  // If the UPDATE didn't actually increment (race lost — another unseal
-  // exhausted the grant or it was revoked / expired between our check
-  // and the UPDATE), refuse this read.
-  if (postRowsConsumed === Number(grantRow.rowsConsumed)) {
-    throw new BreakGlassError("breakglass/grant-exhausted",
-      "unsealRow: grant " + grantHandle.id + " was exhausted by a concurrent read", true);
-  }
-  void updateRes;
   // policy was fetched above for the pin enforcement; reuse it for the
   // Model-A vs Model-B (cryptographic) unseal dispatch.
   var unsealedRow;

package/lib/vendor/blamejs/lib/bundler.js

@@ -276,7 +276,11 @@ function create(opts) {
 
   // Test seam: tests pass a fake watcher so we don't actually nodeFs.watch
   var watchFn = opts._watch || function (dirOrFile, wopts, listener) {
-    return nodeFs.watch(dirOrFile, wopts, listener);
+    // realpathSync.native expands an 8.3 short-name component before the watch;
+    // fs.watch aborts libuv (uncatchable) on a Windows short-name path.
+    var target = dirOrFile;
+    try { target = nodeFs.realpathSync.native(dirOrFile); } catch (_e) { /* keep raw path */ }
+    return nodeFs.watch(target, wopts, listener);
   };
   var setTimeoutFn  = opts._setTimeout  || setTimeout;
   var clearTimeoutFn = opts._clearTimeout || clearTimeout;

package/lib/vendor/blamejs/lib/cache-status.js

@@ -34,6 +34,7 @@
  *   RFC 9211 Cache-Status header — documents which intermediate caches handled a request with structured `hit` / `fwd` / `ttl` parameters so operators diagnose cache-decision chains.
  */
 
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -58,11 +59,6 @@ var BOOLEAN_PARAMS = Object.freeze(["hit", "stored", "collapsed"]);
 // passing other keys get passed-through verbatim as token=value.
 var KNOWN_PARAMS = Object.freeze(["hit", "fwd", "fwd-status", "ttl", "stored", "collapsed", "key", "detail"]);
 
-function _sfStringQuote(s) {
-  // RFC 8941 sf-string — quoted-string with escaping for " and \.
-  // Operator-supplied detail/key strings get the full quote-escape.
-  return "\"" + String(s).replace(/\\/g, "\\\\").replace(/"/g, "\\\"") + "\"";
-}
 
 /**
  * @primitive b.cacheStatus.append
@@ -178,14 +174,14 @@ function entryString(entry) {
       throw new CacheStatusError("cache-status/bad-key",
         "entry.key must be a string when provided");
     }
-    parts.push("key=" + _sfStringQuote(entry.key));
+    parts.push("key=" + safeBuffer.quoteString(entry.key));
   }
   if (entry.detail !== undefined && entry.detail !== null) {
     if (typeof entry.detail !== "string") {
       throw new CacheStatusError("cache-status/bad-detail",
         "entry.detail must be a string when provided");
     }
-    parts.push("detail=" + _sfStringQuote(entry.detail));
+    parts.push("detail=" + safeBuffer.quoteString(entry.detail));
   }
   return parts.join("; ");
 }

package/lib/vendor/blamejs/lib/calendar.js

@@ -804,6 +804,11 @@ function _expandSingleRule(rule, startMs, ctx) {
       throw new CalendarError("calendar/bad-recurrence",
         "b.calendar.expandRecurrence: unsupported frequency '" + freq + "'");
     }
+    // The caller-supplied `interval` is unbounded; a large one drives
+    // _advance's Date arithmetic past the representable range, returning
+    // NaN. No further instances can exist — stop before the NaN reaches
+    // _msToIsoZ on the next iteration, which throws on an invalid Date.
+    if (!isFinite(t)) break;
   }
   return { instances: out, stepBudgetRemaining: ctx.stepBudgetRef.remaining };
 }
@@ -856,6 +861,14 @@ function _expandWithBysetpos(ctx) {
   while (out.length < count && out.length < maxCount && stepBudgetRef.remaining > 0) {
     var period = _periodForIndex(freq, startDate, periodIndex * interval);
     periodIndex += 1;
+    // A non-finite period means the FREQ interval (unbounded and
+    // caller-supplied) drove Date.UTC past the representable ECMAScript
+    // date range. No further instances can exist. This break is also
+    // load-bearing against a hang: a NaN period runs the day-enumeration
+    // loop zero times, so it never decrements the shared step budget,
+    // and the untilMs / toMs comparisons below are NaN no-ops (`NaN > x`
+    // is false) — without stopping here the outer loop spins forever.
+    if (!isFinite(period.startMs) || !isFinite(period.endMs)) break;
     // Out-of-window early exit. Window-uppper applies once the period
     // start crosses toMs; until applies once period-start crosses untilMs.
     if (period.startMs > untilMs) break;
@@ -1116,7 +1129,14 @@ function _firstParamValue(prop, paramName) {
   if (!prop) return null;
   var first = Array.isArray(prop) ? prop[0] : prop;
   if (!first || !first.params) return null;
-  return first.params[paramName] || null;
+  // b.safeIcal exposes each property parameter as a (possibly
+  // multi-valued) array. Consumers here want a scalar — a TZID maps to
+  // the JSCalendar `timeZone` String (RFC 8984 §4.7.1), not an array.
+  // Unwrap to the first element so `timeZone` is a plain string that
+  // round-trips through toIcal's `DTSTART;TZID=<zone>` emission.
+  var v = first.params[paramName];
+  if (v === undefined || v === null) return null;
+  return Array.isArray(v) ? (v.length > 0 ? v[0] : null) : v;
 }
 
 function _icalRruleToJscal(rrule) {

package/lib/vendor/blamejs/lib/cbor.js

@@ -393,7 +393,18 @@ function _decodeItem(state, depth) {
     case 0: return _readArgument(state, ai);                                            // unsigned int
     case 1: {                                                                           // negative int
       var n = _readArgument(state, ai);
-      return (typeof n === "bigint") ? (-1n - n) : (-1 - n);
+      if (typeof n === "bigint") return -1n - n;
+      // The argument n is a safe Number, but a negative CBOR value is
+      // -1 - n, which reaches one below the safe range: n === 2^53-1
+      // yields -2^53, NOT a safe integer. The deterministic encoder's
+      // integer branch is |v| <= 2^53-1, so it would re-emit that value
+      // as a float — breaking round-trip and falsely tripping
+      // requireDeterministic on a canonical integer. Promote to BigInt
+      // when the value isn't a safe integer so encode() re-emits the
+      // integer head (RFC 8949 §3 — a negative-int argument is an
+      // integer, never a float).
+      var neg = -1 - n;
+      return Number.isSafeInteger(neg) ? neg : (-1n - BigInt(n));
     }
     case 2: {                                                                           // byte string
       var blen = _lenOf(_readArgument(state, ai));

package/lib/vendor/blamejs/lib/cert.js

@@ -155,14 +155,16 @@ function _createSealedDiskStorage(opts) {
       }
     },
 
-    async writeEscrow(relPath, plaintextKeyPem, recipientPub) {
-      // Encrypt-to-recipient via b.crypto.encryptEnvelope. Recipient is
-      // an X25519 / ML-KEM hybrid pubkey held offline by the operator
-      // for break-glass key recovery.
-      var envelope = bCrypto().encryptEnvelope(Buffer.from(plaintextKeyPem), recipientPub);
+    async writeEscrow(relPath, plaintextKeyPem, recipient) {
+      // Seal the private key to the operator's offline break-glass
+      // recipient via b.crypto.encrypt (ML-KEM-1024 KEM, plus the P-384
+      // hybrid leg when the recipient supplies an ecPublicKey). The
+      // operator recovers it offline with b.crypto.decrypt and the
+      // matching private key(s) — it is never decrypted by the framework.
+      var envelope = bCrypto().encrypt(plaintextKeyPem, recipient);
       var p = nodePath.join(rootDir, relPath);
       _ensureDir(nodePath.dirname(p));
-      atomicFile.writeSync(p, JSON.stringify(envelope) + "\n", { mode: 0o600 });
+      atomicFile.writeSync(p, envelope + "\n", { mode: 0o600 });
     },
   };
 }
@@ -212,7 +214,10 @@ function _createSealedDiskStorage(opts) {
  *       cleanup:   async function (params) { ... },     // required — runs after authorization completes
  *     },
  *     keyEscrow: {                    // optional — break-glass-only key recovery
- *       recipient: Buffer | string,   // X25519 / ML-KEM hybrid public key (b.crypto.encryptEnvelope recipient)
+ *       recipient: string | { publicKey, ecPublicKey },  // ML-KEM-1024 pubkey PEM, or a
+ *                                     //   b.crypto.generateEncryptionKeyPair() hybrid pair; the
+ *                                     //   renewed key is sealed to it via b.crypto.encrypt and
+ *                                     //   recovered offline with b.crypto.decrypt
  *     },
  *   }>,
  *   renew: {
@@ -350,10 +355,23 @@ function create(opts) {
       throw new CertError("cert/bad-key-alg",
         "cert.create.certs[" + i + "].keyAlg must be ecdsa-p256 / ecdsa-p384 / rsa-2048 / rsa-3072 / rsa-4096");
     }
-    if (c.keyEscrow && (!c.keyEscrow.recipient ||
-        (typeof c.keyEscrow.recipient !== "string" && !Buffer.isBuffer(c.keyEscrow.recipient)))) {
-      throw new CertError("cert/bad-key-escrow",
-        "cert.create.certs[" + i + "].keyEscrow.recipient must be a Buffer or PEM/base64 string");
+    if (c.keyEscrow) {
+      var rec = c.keyEscrow.recipient;
+      var okStr = typeof rec === "string" && rec.length > 0;
+      // Object form: publicKey (ML-KEM PEM) is required non-empty, matching the
+      // string path; ecPublicKey (P-384 hybrid leg) is optional, but if present
+      // must itself be a non-empty string — an empty key would otherwise reach
+      // b.crypto.encrypt and either fail deeper or silently drop the hybrid leg.
+      var okObj = rec && typeof rec === "object" &&
+        typeof rec.publicKey === "string" && rec.publicKey.length > 0 &&
+        (rec.ecPublicKey == null ||
+          (typeof rec.ecPublicKey === "string" && rec.ecPublicKey.length > 0));
+      if (!okStr && !okObj) {
+        throw new CertError("cert/bad-key-escrow",
+          "cert.create.certs[" + i + "].keyEscrow.recipient must be an ML-KEM-1024 " +
+          "public-key PEM string, or a { publicKey, ecPublicKey } object from " +
+          "b.crypto.generateEncryptionKeyPair() for the P-384 hybrid path");
+      }
     }
     certsByName[c.name] = {
       name:      c.name,

package/lib/vendor/blamejs/lib/cli.js

@@ -84,7 +84,12 @@ function _writeLine(stream, line) {
 // written flag validation continues to read the same { pos, flags }
 // shape the cli has always exposed.
 function _parseArgs(argv) {
-  return argParser.parseRaw(argv);
+  // `--version` is the global boolean version flag — declare it so it never
+  // swallows a following token as its value. Without this, `--version <cmd>`
+  // (or `<cmd> --version <sub>`) would consume the subcommand and a stray
+  // version flag could no-op the command it accompanies. (`-v` is a
+  // single-dash flag and is already boolean in parseRaw.)
+  return argParser.parseRaw(argv, { booleanNames: ["version"] });
 }
 
 function _resolvePath(p, cwd) {
@@ -93,6 +98,16 @@ function _resolvePath(p, cwd) {
   return nodePath.resolve(cwd || process.cwd(), p);
 }
 
+// A destructive command's --confirm gate is satisfied ONLY by an explicit
+// `true` / "true"; a bare-truthiness check (`!flags.confirm`) would accept
+// `--confirm false` as confirmation, so an operator who typed `--confirm
+// false` — meaning "do NOT proceed" — would still trigger an irreversible
+// operation. Shared by every destructive subcommand so the acknowledgement
+// contract can't drift between them.
+function _isConfirmed(flags) {
+  return flags.confirm === true || flags.confirm === "true";
+}
+
 function _openSqlite(dbPath) {
   // Lazy-required so the CLI doesn't crash on `blamejs version` or
   // `blamejs help` if node:sqlite isn't usable for some reason.
@@ -424,7 +439,7 @@ async function _runDev(args, ctx) {
   }
   var killSignal = args.flags["kill-signal"];
 
-  var d = dev.create({
+  var d = (ctx._dev || dev.create)({
     command:    String(command),
     args:       argList,
     watch:      watchList.length ? watchList : undefined,
@@ -435,31 +450,51 @@ async function _runDev(args, ctx) {
     env:        ctx.env,
   });
 
-  // Forward parent SIGINT/SIGTERM to the child via stop()
+  // Forward parent SIGINT/SIGTERM to the child via stop(). The supervisor
+  // resolves ONLY after stop() has fully completed (SIGTERM → SIGKILL
+  // escalation → watchers disarmed), so main() never returns — and the bin
+  // shim never process.exit()s — while a child kill is still in flight and
+  // could be abandoned, orphaning the app child.
   var stopped = false;
+  var onStopComplete;
+  var stopComplete = new Promise(function (resolve) { onStopComplete = resolve; });
   function shutdown() {
     if (stopped) return;
     stopped = true;
-    d.stop().then(function () { /* exit naturally */ });
+    Promise.resolve(d.stop()).then(onStopComplete, onStopComplete);
   }
   process.once("SIGINT",  shutdown);
   process.once("SIGTERM", shutdown);
+  function _clearSignalHandlers() {
+    process.removeListener("SIGINT",  shutdown);
+    process.removeListener("SIGTERM", shutdown);
+  }
 
   try {
     await d.start();
   } catch (e) {
     _writeLine(ctx.stderr, "blamejs dev: " + ((e && e.message) || String(e)));
+    _clearSignalHandlers();
     return 1;
   }
-  // The dev loop runs until the operator interrupts. Resolve a
-  // never-settling promise so main() awaits forever; the SIGINT handler
-  // above flips stopped+resolves on Ctrl-C.
-  await new Promise(function (resolve) {
-    var iv = setInterval(function () {
-      if (stopped) { clearInterval(iv); resolve(); }
-    }, 250);
-    if (typeof iv.unref === "function") iv.unref();
-  });
+  // The dev loop runs until the operator interrupts. A REF'd heartbeat holds
+  // the event loop open so a watched-child CRASH does not drain it and exit
+  // the supervisor — dev's crash-resilience contract is to stay up and
+  // hot-restart on the next file change, but an unref'd keep-alive let a
+  // child's exit terminate the parent with a false code 0. Cleared once
+  // stop() has completed on SIGINT/SIGTERM. Unref'ing would drain the loop on
+  // a child crash and reintroduce the exit-on-crash bug this heartbeat fixes.
+  // allow:timer-no-unref-process-pinning — supervisor must stay pinned.
+  var heartbeat = setInterval(function () {}, C.TIME.minutes(1));
+  // Hand the shutdown trigger to a test seam (no-op in production) so a test
+  // can drive the signal path deterministically instead of raising SIGINT.
+  if (typeof ctx._onDevRunning === "function") ctx._onDevRunning(shutdown);
+  try {
+    await stopComplete;
+  } finally {
+    clearInterval(heartbeat);
+    _clearSignalHandlers();
+  }
   return 0;
 }
 
@@ -713,7 +748,14 @@ async function _runAudit(args, ctx) {
     var tableV = args.flags.table ? String(args.flags.table) : "audit_log";
     var maxRows = args.flags["max-rows"];
     var maxRowsN = maxRows === undefined ? undefined : Number(maxRows);
-    if (maxRowsN !== undefined && (!Number.isFinite(maxRowsN) || maxRowsN < 1)) {
+    // Positive-INTEGER validation, mirroring `migrate down --steps`: reject
+    // NaN/Infinity, < 1, AND any fractional value. The message promises "a
+    // positive integer", so a value like 2.5 must be refused here at the
+    // entry point rather than passed to verifyChain, where a fractional
+    // maxRows truncates the walk mid-chain and reports a nonsensical
+    // fractional rowsVerified (Math.min(rows.length, 2.5)).
+    if (maxRowsN !== undefined &&
+        (!Number.isFinite(maxRowsN) || maxRowsN < 1 || Math.floor(maxRowsN) !== maxRowsN)) {
       _writeLine(ctx.stderr, "blamejs audit verify-chain: --max-rows must be a positive integer");
       return 2;
     }
@@ -759,7 +801,7 @@ async function _runAudit(args, ctx) {
       _writeLine(ctx.stderr, "blamejs audit purge: --archive (path to verified archive bundle) is required");
       return 2;
     }
-    if (args.flags.confirm !== true && args.flags.confirm !== "true") {
+    if (!_isConfirmed(args.flags)) {
       _writeLine(ctx.stderr, "blamejs audit purge: --confirm is REQUIRED — destructive operation");
       return 2;
     }
@@ -1044,9 +1086,14 @@ async function _runRestore(args, ctx) {
       report.write("rollback points at " + rollbackRootL + ": " + pts.length);
       for (var p = 0; p < pts.length; p++) {
         var pt = pts[p];
+        // restoreRollback.list() returns { rollbackPath, swappedAt, marker },
+        // and operator metadata (bundleId / reason) rides on marker.operator --
+        // not a top-level recordedAt/bundleId, so those never rendered.
+        var ptOp = pt.marker && pt.marker.operator;
         report.write("  " + (pt.rollbackPath || pt) +
-          (pt.recordedAt ? "  recordedAt=" + pt.recordedAt : "") +
-          (pt.bundleId ? "  bundleId=" + pt.bundleId : ""));
+          (pt.swappedAt ? "  swappedAt=" + pt.swappedAt : "") +
+          (ptOp && ptOp.bundleId ? "  bundleId=" + ptOp.bundleId : "") +
+          (ptOp && ptOp.reason ? "  reason=" + ptOp.reason : ""));
       }
       return report.ok();
     } catch (e) {
@@ -1605,10 +1652,21 @@ async function _runVault(args, ctx) {
   var dataDir = _resolvePath(String(args.flags["data-dir"] || "./data"), ctx.cwd);
 
   if (sub === "status") {
-    var pre = vaultPassphraseOps.preflightSealable({ dataDir: dataDir });
-    var unsealable = vaultPassphraseOps.preflightUnsealable
-      ? vaultPassphraseOps.preflightUnsealable({ dataDir: dataDir })
-      : null;
+    // A missing / unreadable data-dir must surface as the standard clean
+    // reporter error (exit 1), not an uncaught throw: preflightSealable /
+    // preflightUnsealable raise VaultPassphraseError when the dir doesn't
+    // exist, and without this catch that rejection propagates out of main()
+    // — the bin shim would print a stack trace instead of the one-line
+    // "data-dir does not exist" the sibling seal / unseal / rotate paths give.
+    var pre, unsealable;
+    try {
+      pre = vaultPassphraseOps.preflightSealable({ dataDir: dataDir });
+      unsealable = vaultPassphraseOps.preflightUnsealable
+        ? vaultPassphraseOps.preflightUnsealable({ dataDir: dataDir })
+        : null;
+    } catch (e) {
+      return report.error((e && e.message) || String(e));
+    }
     report.write("data-dir: " + dataDir);
     report.write("vault.key (plaintext):    " +
       (pre.ok ? "present (sealable)" : "absent — " + (pre.reason || "n/a")));
@@ -2058,7 +2116,7 @@ async function _runErase(args, ctx) {
   var rowId = args.flags["row-id"];
   if (!table || table === true)  return report.error("--table <name> is required", 2);
   if (!rowId || rowId === true)  return report.error("--row-id <id> is required", 2);
-  if (!args.flags.confirm) {
+  if (!_isConfirmed(args.flags)) {
     return report.error("--confirm is required (this operation is irreversible)", 2);
   }
   var dataDirFlag = args.flags["data-dir"];
@@ -2294,12 +2352,24 @@ async function main(argv, opts) {
     stderr: opts.stderr || process.stderr,
     env:    opts.env    || process.env,
     cwd:    opts.cwd    || process.cwd(),
+    // Test seams (undefined in production): _dev injects the dev-supervisor
+    // factory; _onDevRunning receives the shutdown fn once `dev` is live, so
+    // a test can drive graceful teardown without raising a real OS signal.
+    _dev:          opts._dev,
+    _onDevRunning: opts._onDevRunning,
   };
   if (!Array.isArray(argv)) argv = [];
   var args = _parseArgs(argv);
 
-  // Top-level flags handled before subcommand dispatch
-  if (args.flags.version || args.flags.v) {
+  // Version is honored only as the WHOLE invocation — a bare `-v` /
+  // `--version` with no subcommand. `_parseArgs` declares `--version`
+  // boolean, so a stray version flag never swallows a token: it works in any
+  // order (leading, trailing, or between a command and its subcommand) and
+  // leaves the positional list intact, so the command dispatches instead of
+  // a silent version no-op returning a false 0. A `-v` used as another
+  // option's value stays that value, and a version token after the `--`
+  // terminator stays a literal positional.
+  if ((args.flags.version || args.flags.v) && args.pos.length === 0) {
     _writeLine(ctx.stdout, C.version);
     return 0;
   }