@blamejs/blamejs-shop 0.5.4 → 0.5.6

package/lib/vendor/blamejs/test/layer-0-primitives/x509-chain-ca-enforcement.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * X.509 basicConstraints cA enforcement across the framework's cert-chain
@@ -37,6 +39,9 @@ async function _mintChain(opts) {
   opts = opts || {};
   var interCa = opts.interCa === true;          // default cA:FALSE (the attack)
   var leafSan = opts.leafSan || "victim.example";
+  // Default SAN is DNS:<leafSan>; a test can supply explicit entries (e.g. a
+  // hostile URI SAN) to exercise the SAN-vs-domain matcher.
+  var leafSanEntries = opts.leafSanEntries || [{ type: "dns", value: leafSan }];
   var now = new Date();
   var notAfter = new Date(now.getTime() + 365 * 24 * 60 * 60 * 1000);
   var alg = { name: "ECDSA", namedCurve: "P-256" };
@@ -70,21 +75,43 @@ async function _mintChain(opts) {
     extensions: [
       new x509.BasicConstraintsExtension(false, undefined, true),
       new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature, true),
-      new x509.SubjectAlternativeNameExtension([{ type: "dns", value: leafSan }]),
+      new x509.SubjectAlternativeNameExtension(leafSanEntries),
       new x509.ExtendedKeyUsageExtension([BIMI_EKU_OID], false),
     ],
   });
 
+  // Export the leaf's private key so a consumer test can sign a payload that
+  // the forged leaf would verify (e.g. a fido-mds3 BLOB).
+  var leafPkcs8 = await pki.crypto.subtle.exportKey("pkcs8", leafKeys.privateKey);
+  var leafKeyB64 = Buffer.from(leafPkcs8).toString("base64").match(/.{1,64}/g).join("\n");
+  var leafKeyPem = "-----BEGIN PRIVATE KEY-----\n" + leafKeyB64 + "\n-----END PRIVATE KEY-----\n";
+
   return {
     rootPem:  root.toString("pem"),
     interPem: inter.toString("pem"),
     leafPem:  leaf.toString("pem"),
+    leafKeyPem: leafKeyPem,
     root:  new nodeCrypto.X509Certificate(root.toString("pem")),
     inter: new nodeCrypto.X509Certificate(inter.toString("pem")),
     leaf:  new nodeCrypto.X509Certificate(leaf.toString("pem")),
   };
 }
 
+// Build a fido-mds3 JWS BLOB signed by `leafKeyPem` with x5c = the given cert
+// chain (PEMs, leaf-first), so a forged leaf can attempt to authenticate a BLOB.
+function _b64url(buf) { return Buffer.from(buf).toString("base64url"); }
+function _mds3Blob(payload, leafKeyPem, chainPems) {
+  var x5c = chainPems.map(function (pem) {
+    return pem.replace(/-----BEGIN CERTIFICATE-----/g, "")
+              .replace(/-----END CERTIFICATE-----/g, "").replace(/\s+/g, "");
+  });
+  var header = { alg: "ES256", typ: "JWT", x5c: x5c };
+  var signingInput = _b64url(JSON.stringify(header)) + "." + _b64url(JSON.stringify(payload));
+  var sig = nodeCrypto.sign("sha256", Buffer.from(signingInput, "ascii"),
+    { key: leafKeyPem, dsaEncoding: "ieee-p1363" });
+  return signingInput + "." + _b64url(sig);
+}
+
 function _stubHttpClient(body) {
   return {
     request: function () {
@@ -149,6 +176,95 @@ async function run() {
   });
   check("bimi.fetchAndVerifyMark: valid CA chain still verifies", rv.ok === true);
 
+  // ---- 2b. SAN-vs-domain authorization must bind to the cert's actual host.
+  // A CA-chained VMC whose only SAN is a URI the URL parser refuses (here the
+  // real host is attacker.test, with the victim domain placed in the userinfo)
+  // must NOT vouch for the victim domain. The pre-fix matcher fell back to a raw
+  // substring search of the whole SAN string when safeUrl.parse threw, so
+  // "victim.example" appearing anywhere (userinfo / path) wrongly matched.
+  var hostile = await _mintChain({
+    interCa: true,
+    leafSan: "attacker.test",
+    leafSanEntries: [{ type: "url", value: "https://victim.example@attacker.test/" }],
+  });
+  var sanThrew = null;
+  try {
+    await b.mail.bimi.fetchAndVerifyMark({
+      domain:          "victim.example",
+      vmcUrl:          "https://victim.example/cert.pem",
+      trustAnchorsPem: hostile.rootPem,
+      httpClient:      _stubHttpClient(hostile.leafPem + "\n" + hostile.interPem),
+    });
+  } catch (e) { sanThrew = e; }
+  check("bimi.fetchAndVerifyMark: hostile URI-SAN (userinfo) does NOT vouch for the victim domain",
+        sanThrew && sanThrew.code === "bimi/vmc-domain-mismatch");
+
+  // Control: a CA-chained VMC whose URI SAN host genuinely IS the domain verifies.
+  var legit = await _mintChain({
+    interCa: true,
+    leafSan: "good.example",
+    leafSanEntries: [{ type: "url", value: "https://good.example/" }],
+  });
+  var legitRv = await b.mail.bimi.fetchAndVerifyMark({
+    domain:          "good.example",
+    vmcUrl:          "https://good.example/cert.pem",
+    trustAnchorsPem: legit.rootPem,
+    httpClient:      _stubHttpClient(legit.leafPem + "\n" + legit.interPem),
+  });
+  check("bimi.fetchAndVerifyMark: a genuine URI-SAN host still verifies", legitRv.ok === true);
+
+  // domainToASCII truncates at a URL delimiter, so a DNS SAN "victim.example/evil"
+  // would have canonicalized to "victim.example" and matched — must fail closed.
+  var dnsDelim = await _mintChain({
+    interCa: true,
+    leafSan: "attacker.test",
+    leafSanEntries: [{ type: "dns", value: "victim.example/evil" }],
+  });
+  var dnsThrew = null;
+  try {
+    await b.mail.bimi.fetchAndVerifyMark({
+      domain:          "victim.example",
+      vmcUrl:          "https://victim.example/cert.pem",
+      trustAnchorsPem: dnsDelim.rootPem,
+      httpClient:      _stubHttpClient(dnsDelim.leafPem + "\n" + dnsDelim.interPem),
+    });
+  } catch (e) { dnsThrew = e; }
+  check("bimi.fetchAndVerifyMark: a delimiter-bearing DNS SAN does NOT vouch for the prefix domain",
+        dnsThrew && dnsThrew.code === "bimi/vmc-domain-mismatch");
+
+  // ---- 3. Consumer path: b.auth.fidoMds3.fetch must refuse a BLOB whose x5c
+  // chains the leaf through the cA:FALSE intermediate. The forged leaf GENUINELY
+  // signs the BLOB (ES256), so without cA enforcement on the intermediate link a
+  // basicConstraints bypass would accept attacker-forged FIDO metadata.
+  var mds3Payload = {
+    legalHeader: "Test BLOB", no: 1,
+    nextUpdate: new Date(Date.now() + 7 * 86400000).toISOString().slice(0, 10),
+    entries: [{ aaguid: "01234567-89ab-cdef-0123-456789abcdef",
+                metadataStatement: { description: "Test entry" },
+                statusReports: [{ status: "FIDO_CERTIFIED_L2" }] }],
+  };
+  var forgedBlob = _mds3Blob(mds3Payload, c.leafKeyPem, [c.leafPem, c.interPem]);
+  var hcPath = require.resolve("../../lib/http-client");
+  var origHc = require.cache[hcPath].exports;
+  require.cache[hcPath].exports = Object.assign({}, origHc, {
+    request: async function () {
+      return { statusCode: 200, headers: {}, body: Buffer.from(forgedBlob, "ascii") };
+    },
+  });
+  var fmPath = require.resolve("../../lib/auth/fido-mds3");
+  delete require.cache[fmPath];
+  var fm = require(fmPath);
+  var mdsThrew = null;
+  try {
+    await fm.fetch({ url: "https://test.invalid/mds3", caCertificate: c.rootPem, force: true });
+  } catch (e) { mdsThrew = e; }
+  finally {
+    require.cache[hcPath].exports = origHc;
+    delete require.cache[fmPath];
+  }
+  check("fido-mds3.fetch: forged BLOB via cA:FALSE intermediate is REJECTED",
+        mdsThrew && mdsThrew.code === "fido-mds3/chain-broken");
+
   console.log("OK — x509 cA enforcement (" + helpers.getChecks() + " checks)");
 }
 

package/lib/vendor/blamejs/test/layer-1-state/api-key.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.apiKey — operator-facing API key registry.

package/lib/vendor/blamejs/test/layer-5-integration/bundler-output.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * bundler-output — verifies the framework survives static-analysis

package/lib/vendor/blamejs/test/layer-5-integration/external-db-residency.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * external-db-residency — per-row residency write gate

package/lib/vendor/blamejs/test/layer-5-integration/guard-host-integration.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * guard-host-integration — adaptive table-driven integration harness

package/lib/vendor/blamejs/test/layer-5-integration/security-chaos.test.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * security-chaos - fault-injection drills covering recovery paths the

package/lib/vendor/blamejs/test/smoke.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Smoke test — orchestrator only.

package/package.json

@@ -1,18 +1,21 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {
     "start": "node server.js",
     "test": "node test/smoke.js",
+    "e2e": "node test/e2e/drive-checkout.js && node test/e2e/drive-account-subscriptions.js",
+    "e2e:checkout": "node test/e2e/drive-checkout.js",
+    "e2e:account": "node test/e2e/drive-account-subscriptions.js",
     "vendor": "bash scripts/vendor-update.sh",
     "sync-assets": "node scripts/sync-r2-assets.js",
     "d1-export": "node scripts/d1-export.js",
     "release": "node scripts/release.js"
   },
   "engines": {
-    "node": ">=24.16.0"
+    "node": ">=24.18.0"
   },
   "files": [
     "lib/",

package/lib/vendor/blamejs/release-notes/v0.15.0.json

@@ -1,77 +0,0 @@
-{
-  "$schema": "../scripts/release-notes-schema.json",
-  "version": "0.15.0",
-  "date": "2026-06-08",
-  "headline": "A chainable SQL builder, MySQL as a first-class data backend, and a keyed lookup-hash default — the data layer goes tri-dialect",
-  "summary": "This release makes the framework's data layer dialect-portable. `b.sql` is a new chainable query builder that quotes every identifier by construction, binds every value as a placeholder, and emits dialect-correct SQL for SQLite, Postgres, and MySQL; `b.guardSql` validates result rows against NUL bytes, quote-jump sequences, and per-column / total size boundaries. The entire framework data layer — the signed audit chain, cluster leadership and fencing, sessions, break-glass, the local queue, cache, scheduler, migrations, consent, and mail storage — is rebuilt on `b.sql`, which makes MySQL a supported external-database backend alongside Postgres and SQLite. Running the data layer on a real Postgres server surfaced two latent correctness bugs that only a non-SQLite backend exposes: identifiers were emitted unquoted at DDL time but read back camelCase (Postgres folds unquoted names to lowercase, silently breaking the audit chain, consent chain, cluster fencing, and vault-key consistency), and sealed columns coerced Buffer / object payloads through `String()` before encryption (corrupting non-string ciphertext); both are fixed by quoting every identifier and coercing per the column's declared type. Derived-hash columns — the blind-index lookup columns registered through `registerTable` — now default to a keyed MAC (SHAKE256 under the vault's per-deployment MAC key) instead of an unkeyed salted hash, so an exfiltrated database can no longer be brute-forced or rainbow-tabled to recover the indexed values; existing salted-hash indexes are read through a dual-read path and migrated forward, so the change is non-breaking. Audit-signing key rotation now preserves every historical checkpoint (rotation previously stranded checkpoints signed under the prior key). New cross-border data-residency postures (appi-jp, pdpa-sg, uk-gdpr) enforce a mandatory storage vacuum after erasure. Outbound TLS appends classical X25519 to its key-exchange preference so it can complete a handshake with a peer that advertises no post-quantum hybrid — previously the hybrids-only preference failed those handshakes outright — and emits a `tls.classical_downgrade` audit event whenever a connection lands on a classical group. Outbound HTTP/2 negotiation falls back to HTTP/1.1 against servers that only speak h1, the network heartbeat honors a target's permitted protocols instead of pinning cleartext targets down, a WebSocket connection closes cleanly on a peer's TCP half-close instead of wedging open, and the Azure blob backend encodes object-key path segments correctly.",
-  "sections": [
-    {
-      "heading": "Added",
-      "items": [
-        {
-          "title": "b.sql — a dialect-aware chainable SQL builder",
-          "body": "`b.sql` composes SELECT / INSERT / UPDATE / UPSERT / DELETE / DDL from a fluent chain. Every identifier is validated and quoted by construction (`\"name\"` on SQLite/Postgres, `` `name` `` on MySQL), every value binds as a placeholder rather than interpolating, and the emitted statement is validated as a single balanced, single-statement query before it leaves the builder. Pass `{ dialect: \"postgres\" | \"mysql\" | \"sqlite\" }` (default SQLite) to target a backend; `upsert` emits the dialect-final conflict syntax. It composes `b.safeSql` for the identifier and placeholder primitives, so a SQL string can no longer be assembled by hand inside the framework."
-        },
-        {
-          "title": "b.guardSql — result-row output validation",
-          "body": "`b.guardSql` gates query result rows against embedded NUL bytes, quote-jump sequences, and configurable per-column and total-size boundaries, with the standard guard profiles (strict / balanced / permissive) and compliance postures (hipaa / pci-dss / gdpr / soc2). It is the output-side complement to the input-side `b.safeSql`."
-        },
-        {
-          "title": "MySQL is a first-class data backend",
-          "body": "MySQL joins Postgres and SQLite as a supported external-database backend. The framework's schema reconciler emits MySQL DDL, and the full data layer — signed audit chain (append + verify), cluster leadership and lease fencing, sessions, break-glass, the local queue, cache, scheduler, migrations, and consent — runs against a real MySQL server. Select the backend at `b.cluster.init` / `b.externalDb` configuration via the `dialect` option; `b.clusterStorage.dialect()` exposes the configured backend dialect to composing code."
-        },
-        {
-          "title": "Cross-border erasure postures: appi-jp, pdpa-sg, uk-gdpr",
-          "body": "Three data-residency compliance postures are added (Japan APPI, Singapore PDPA, UK GDPR). Each requires a mandatory storage vacuum after erasure (so deleted rows are reclaimed from the page store, not just tombstoned), a signed audit chain, encrypted backups, and a minimum TLS version. Pin one with `b.compliance.set`."
-        }
-      ]
-    },
-    {
-      "heading": "Security",
-      "items": [
-        {
-          "title": "Lookup-hash columns default to a keyed MAC",
-          "body": "Derived-hash (blind-index) columns registered through `registerTable` now default to `derivedHashMode: \"hmac-shake256\"` — SHAKE256 keyed with the vault's per-deployment MAC key — instead of the previous unkeyed `salted-sha3`. The index value is no longer recomputable from the indexed plaintext alone, so an attacker who exfiltrates the database cannot brute-force or rainbow-table a lookup column (for example a subject-email index) without also holding the vault MAC key (CWE-916 / CWE-759). Existing `salted-sha3` indexes are read through a dual-read path and re-derived on write, so deployments upgrade without re-indexing up front."
-        },
-        {
-          "title": "Postgres identifier casing no longer breaks the audit and cluster chains",
-          "body": "Identifiers were written unquoted in DDL but read back in camelCase. On Postgres (which folds an unquoted identifier to lowercase) this silently desynchronized the signed audit chain, the consent chain, cluster leadership and fencing, and vault-key consistency — each reads a column the server had stored under a lowercased name. Every framework identifier is now quoted at both DDL and query time so the stored and read names match on every dialect (CWE-670). SQLite deployments were unaffected and remain byte-compatible."
-        },
-        {
-          "title": "Sealed columns preserve non-string payloads",
-          "body": "A sealed column coerced its value through `String()` before encryption, corrupting Buffer and object payloads (a Buffer became `\"[object Object]\"`-class garbage, an object its `toString`). Sealed values are now encoded per the column's declared type before the seal, so binary and structured payloads round-trip intact (CWE-704)."
-        },
-        {
-          "title": "Audit-signing key rotation preserves historical checkpoints",
-          "body": "Rotating the audit-signing key stranded every checkpoint signed under the prior key — `verifyCheckpoints` ignored the per-fingerprint history file the rotation writes, so post-rotation verification failed on otherwise-valid historical checkpoints. Verification now resolves each checkpoint's signing key by fingerprint (`getPublicKeyByFingerprint`) across the rotation history, so the full chain verifies after a key rotation."
-        },
-        {
-          "title": "Outbound TLS reaches classical-only peers and audits the downgrade",
-          "body": "The framework's outbound TLS offered only ML-KEM hybrid key-exchange groups, so a handshake with a peer that does not advertise a post-quantum hybrid — most of today's internet — failed outright (`handshake_failure`), leaving outbound connections to webhooks, OAuth providers, ACME directories, object stores, and DoT/DoH/SMTP/Redis-over-TLS unable to complete. Classical X25519 is now appended to the group preference so the hybrid is still negotiated whenever the peer supports it, and the connection completes over classical X25519 when it does not. Every connection that lands on a classical group rather than the post-quantum hybrid emits a `tls.classical_downgrade` audit event (carrying the negotiated group) so operators can observe and alert on which peers are not yet post-quantum-capable."
-        },
-        {
-          "title": "Transport reachability and correctness",
-          "body": "Outbound HTTP/2 negotiation now falls back to HTTP/1.1 when a TLS server offers only h1 (an ALPN protocol_version alert no longer fails the request). The network heartbeat honors a target's permitted protocols instead of dropping non-default ones, so a cleartext `http://` health target is no longer reported permanently down. A WebSocket connection closes cleanly when a peer half-closes its TCP socket (a bare FIN) instead of wedging the connection open. The Azure blob backend percent-encodes each object-key path segment, so a key containing reserved characters can no longer corrupt the request URL."
-        }
-      ]
-    },
-    {
-      "heading": "Fixed",
-      "items": [
-        {
-          "title": "Cross-border erasure performs the mandatory vacuum",
-          "body": "Erasure under the uk-gdpr, appi-jp, and pdpa-sg residency postures now runs the storage vacuum the posture mandates, reclaiming erased rows from the page store rather than leaving them recoverable as free-list tombstones."
-        }
-      ]
-    },
-    {
-      "heading": "Migration",
-      "items": [
-        {
-          "title": "Derived-hash default change is non-breaking; MySQL is opt-in",
-          "body": "Lookup-hash columns default to the keyed MAC on new writes and migrate existing rows on access through the dual-read path — no upfront re-indexing, no operator action required. To pin the previous unkeyed index (for example to keep a column byte-compatible with an external system), pass `derivedHashMode: \"salted-sha3\"` to `registerTable`. MySQL as a data backend is opt-in: existing SQLite and Postgres deployments are unchanged unless you set `dialect: \"mysql\"`. The Postgres identifier-casing and sealed-column-coercion fixes change the emitted DDL and the at-rest encoding of non-string sealed values; a Postgres deployment created before this release reconciles its schema to the quoted identifiers on the next schema-ensure pass."
-        }
-      ]
-    }
-  ]
-}

package/lib/vendor/blamejs/release-notes/v0.15.1.json

@@ -1,22 +0,0 @@
-{
-  "$schema": "../scripts/release-notes-schema.json",
-  "version": "0.15.1",
-  "date": "2026-06-11",
-  "headline": "Sealed-column lookups find rows written before the v0.15.0 hash change, and API-key secrets re-hash to the active algorithm on verify",
-  "summary": "v0.15.0 changed the default derived hash — the blind index a sealed column is looked up by — from an unkeyed salted hash to a keyed MAC, and promised a transparent migration via a dual read. But no lookup path actually performed the dual read, so on a deployment that already held data, a lookup by a sealed column (a session's user id, an API key's owner, an audit actor or resource, a consent or data-subject id, a mail thread) computed only the new keyed digest and missed every row written before the upgrade. This release wires the dual read into every lookup: a sealed-column equality now matches both the active keyed digest and the legacy salted digest, so pre-upgrade rows are found again. That restores two correctness guarantees the gap had quietly broken — revoking all of a user's sessions no longer skips sessions created before the upgrade, and a subject erasure no longer leaves pre-upgrade rows behind. Separately, the framework's API-key store now re-hashes a stored secret to the active hash algorithm on the next successful verify, the transparent rotation the credential-hash primitive documented but the store had never performed.",
-  "sections": [
-    {
-      "heading": "Fixed",
-      "items": [
-        {
-          "title": "Sealed-column lookups match rows written before the v0.15.0 keyed-MAC change",
-          "body": "After v0.15.0 flipped the default derived-hash mode to a keyed MAC, a lookup by a sealed column computed only the new keyed digest, so rows written under the previous salted-hash default were no longer found — a silent index miss on every existing deployment. Every framework lookup path now dual-reads: `b.db.from(...).where(sealedField, value)` and the framework's own api-key, session, audit, consent, data-subject, and mail-thread lookups match the column against both the active keyed digest and the legacy salted digest (`b.db.hashCandidatesFor` exposes the candidate list for operator code). No migration or operator action is required; rows re-hash to the keyed form on read over time and the candidate set collapses back to a single value. Two correctness consequences are restored: revoking all of a user's sessions now also revokes sessions created before the upgrade, and a data-subject erasure now also deletes (and crypto-shreds) the subject's pre-upgrade rows."
-        },
-        {
-          "title": "API-key secret hashes upgrade to the active algorithm on verify",
-          "body": "The framework's API-key store now re-hashes a stored secret to the configured hash algorithm on the next successful verify (leader-gated, best-effort, primary-match only), emitting an `apikey.secret_rehash` audit and observability event. This is the transparent rotation `b.credentialHash` documents — a key stored under an older algorithm or parameter set silently moves to the current one as it is used, with no change to the verify result or the returned record."
-        }
-      ]
-    }
-  ]
-}

package/lib/vendor/blamejs/release-notes/v0.15.10.json

@@ -1,53 +0,0 @@
-{
-  "$schema": "../scripts/release-notes-schema.json",
-  "version": "0.15.10",
-  "date": "2026-06-13",
-  "headline": "Makes S3 Object-Lock version erasure reachable through the object store, and pins the build toolchain's native binary to a reviewed hash",
-  "summary": "The object store gains the versioned-delete surface its S3 Object Lock support always needed for real erasure. An unversioned delete on a versioning-enabled (Object-Lock) bucket only writes a delete-marker — the data version survives — so the framework's own delete could report success while a record protected for compliance, or one a data subject asked to erase, stayed on disk. b.objectStore / b.storage now carry a versionId: put and saveRaw return the version they created, deleteFile(key, { versionId, bypassGovernanceRetention }) targets a specific version (refused — not silently delete-markered — when it is under an active retention), and listVersions enumerates versions and delete-markers so an erasure workflow can find them. Backends with no version surface (the filesystem backend, and the current Azure and GCS adapters) refuse a versioned delete loudly rather than silently dropping the current object. Separately, the build toolchain's native bundler binary is now verified against a reviewed SHA-256 pin so a tampered or drifted binary is caught before it bundles the framework.",
-  "sections": [
-    {
-      "heading": "Added",
-      "items": [
-        {
-          "title": "Versioned object delete + listVersions for S3 Object-Lock erasure",
-          "body": "b.storage.deleteFile and the b.objectStore sigv4 backend now accept opts.versionId to erase a specific object version, and opts.bypassGovernanceRetention to lift a GOVERNANCE-mode retention for callers with the permission (COMPLIANCE stays immutable to everyone). b.storage.saveRaw and the backend put now return the versionId they created on a versioning-enabled bucket, and a new b.storage.listVersions(prefix) / backend listVersions enumerates every version and delete-marker (key, versionId, isLatest, deleteMarker, size, lastModified, etag) so a right-to-erasure or crypto-shred workflow can target prior versions. On a backend with no version surface, listVersions throws VERSIONS_UNSUPPORTED and a versioned delete throws VERSIONID_UNSUPPORTED rather than silently acting on the current object."
-        },
-        {
-          "title": "b.localDb.thin reaches SQLite resource-limit parity (limits option)",
-          "body": "b.localDb.thin now opens its node:sqlite handle with the same parse-time statement-size cap as b.db and the CLI — a SQL statement over 1 MiB is rejected at parse time, the SQLITE_LIMIT_LENGTH floor that guards prepare()/exec() of raw SQL against an attacker-influenced megaquery (SQLite's default is 1 GB). The cap is on by default; a new limits option (e.g. { sqlLength: 2 * 1024 * 1024 } or other SQLITE_LIMIT_* keys) lets an operator raise or extend it. Previously the thin opener had no limits plumbing, so a consumer on that path could not reach parity with the rest of the framework's SQLite surface."
-        }
-      ]
-    },
-    {
-      "heading": "Fixed",
-      "items": [
-        {
-          "title": "S3 Object-Lock version erasure is reachable through the framework delete path",
-          "body": "On a versioning-enabled (Object-Lock) bucket, an unversioned DELETE only writes a delete-marker — the protected data version survives untouched — yet the framework's delete had no versionId surface, so it issued the unversioned form and reported success while the bytes the lock protects remained. A retention or legal hold could therefore look enforced to the framework caller while the operation WORM actually blocks was unreachable. The delete path now targets the exact version: deleting a version under a COMPLIANCE retention is refused (it throws, even with bypassGovernanceRetention), a no-retention version erases cleanly, and the enforcement is proven end-to-end against MinIO through the framework's own API."
-        },
-        {
-          "title": "b.configDrift.verifyVendorIntegrity is now working-directory-independent",
-          "body": "The vendored-dependency integrity check resolved each manifest file path against process.cwd(), so it only worked when run from the application root. Run from anywhere else it read-failed every entry (reporting ok:false), and under a crafted working directory that happened to contain a clean vendor tree it could hash a different tree than the one actually loaded. It now resolves each file under the framework's own vendor directory by default — the tree loaded at runtime — and honors an explicit libVendorDir for verifying a deployed tree elsewhere, so the result no longer depends on where the process was started."
-        }
-      ]
-    },
-    {
-      "heading": "Security",
-      "items": [
-        {
-          "title": "Build toolchain native binary pinned to a reviewed hash",
-          "body": "The native bundler binary the build toolchain runs (esbuild's per-platform compiler, a development dependency that never ships in the runtime) is now verified against a SHA-256 pin captured by diffing the published package tarballs and hashing the binary. The build gate fails if the on-disk binary does not match the reviewed hash for its (version, platform); for a version that has not been reviewed it notes the gap and skips rather than trusting an unverified binary. A cross-artifact check keeps the version in agreement across package.json, the CI install step, and the hash map, so the gate can never quietly test a version that was never diffed — closing a real drift where CI had been installing an older patch than package.json declared. The reviewed diff is benign: version strings plus an installer size-bound and error-message hardening, no new install hooks, files, or network paths, and no runtime-dependency impact."
-        }
-      ]
-    },
-    {
-      "heading": "Detectors",
-      "items": [
-        {
-          "title": "Object-store erasure guard, esbuild-pin agreement, + structural re-anchoring of the lint detectors",
-          "body": "A new guard locks the object-store delete path to the versioned-erasure contract: b.storage.deleteFile must thread versionId to the backend, so it can never silently revert to the WORM-blind unversioned delete. A second guard enforces that the esbuild build-tool version agrees across package.json, the CI install step, and the binary-hash map, so a future bump can't update one and leave the gate testing an unreviewed version. Separately, the framework's internal codebase-pattern lint detectors were re-anchored from fixed character spans to structural code boundaries, so they keep matching the code they guard as those functions grow rather than aging out of range; reviving them surfaced a few internal validation and transaction sites that now route through shared helpers (a required positive-integer-with-range validator and an async transaction wrapper) instead of hand-rolling the check. No public API change."
-        }
-      ]
-    }
-  ]
-}

package/lib/vendor/blamejs/release-notes/v0.15.11.json

@@ -1,52 +0,0 @@
-{
-  "$schema": "../scripts/release-notes-schema.json",
-  "version": "0.15.11",
-  "date": "2026-06-14",
-  "headline": "Replaces a family of quadratic-time regexes that hostile input could use to stall a worker with linear scans, refuses a relocatable sealed-cell downgrade on the read side, fails closed when enabling row-level security behind a non-native driver, and scans the vendored crypto for known CVEs on every build",
-  "summary": "Several text-handling primitives stripped trailing whitespace or extracted a mail address with a regex whose backtracking is quadratic in the input length on adversarial strings — a request body, a YAML document, a CSV cell, or a From header crafted as a long run of spaces could pin a worker's CPU. Each is now a linear character scan with identical output. The HTML-content check the MCP tool surface applies gained the vbscript: and data:text/html vectors it was missing. On the data-at-rest side, an AAD-bound (or per-row-key) column now refuses a plain, unbound vault cell on read — a relocatable envelope an attacker with write access could copy in from another row defeats the cross-row binding, so the field is nulled rather than surfaced; operators mid-migration opt back in with registerTable({ allowPlainMigration: true }). declareRowPolicy now treats row-level-security as enabled only on a value that unambiguously means true, so a non-native Postgres driver that returns the string \"f\" can no longer be read as \"already on\" and silently skip the ENABLE that protects the table's rows. Finally, because the framework's crypto is vendored rather than installed, npm audit and Dependabot never see it: every build now matches the vendored versions against the OSV vulnerability database, with a complementary Semgrep pass and workflow-file static analysis alongside.",
-  "sections": [
-    {
-      "heading": "Added",
-      "items": [
-        {
-          "title": "b.safeBuffer.indexAfterOpenTag(html, tagName)",
-          "body": "A linear helper that returns the offset just past a `<tag ...>` opening tag (case-insensitive), or -1 when absent or unterminated — the insertion point a response rewriter uses to splice content after <body> or <head> without a regex. It replaces the O(n^2) html.match(/<body[^>]*>/i) shape and is stricter than it: a real tag boundary is required after the name, so <bodyfoo> is not mistaken for <body>."
-        }
-      ]
-    },
-    {
-      "heading": "Security",
-      "items": [
-        {
-          "title": "Linear-time replacements across a family of quadratic regexes (ReDoS class)",
-          "body": "Several primitives located or stripped text with a regex whose backtracking is quadratic in V8 on adversarial input (CWE-1333): b.safeBuffer and the safe-env / safe-yaml / guard-csv parsers stripped trailing horizontal whitespace with /[ \\t]+$/; b.mail extracted the address from a `Name <addr>` header with /<([^>]+)>/; the bot-disclosure and speculation-rules response middleware found the <body> insertion point with /<body[^>]*>/i; and the BIMI certificate-chain splitter walked PEM blocks with a lazy /BEGIN[\\s\\S]*?END/ scan. A crafted field — a long run of spaces, an unterminated bracket, a body carrying many <body starts with no closing >, a chain of BEGIN markers — could drive a worker's CPU to seconds of work. Each is now a linear scan: a shared b.safeBuffer.stripTrailingHspace (backward char walk), b.safeBuffer.indexAfterOpenTag (forward indexOf walk for the tag insertion point), a forward indexOf for address extraction, and an indexOf walk for the PEM split. Output is byte-identical (the tag-find is stricter — it no longer mistakes <bodyfoo> for <body>), and 400K-character adversarial inputs that took 8–85 seconds now complete in under 2 ms."
-        },
-        {
-          "title": "MCP HTML-content check covers vbscript: and data:text/html",
-          "body": "The dangerous-markup check applied to text/html tool content matched <script>/<iframe>/<object>/<embed> and javascript: URLs but not the vbscript: scheme or data:text/html payloads. Both are now refused; data: URLs carrying non-HTML media (data:image/png and similar) are unaffected."
-        },
-        {
-          "title": "AAD-bound columns refuse a plain sealed cell on read",
-          "body": "b.cryptoField.unsealRow now refuses a plain, unbound vault: envelope found on an AAD-bound (or per-row-key) column and nulls the field instead of returning it. A plain envelope carries no per-cell binding, so a writer who could place one — copied from anywhere under the same vault root — would otherwise relocate a value across rows or columns and defeat the copy-protection the AAD binding advertises. Operators migrating pre-AAD rows up to bound ciphertext opt into a bounded acceptance window with registerTable({ allowPlainMigration: true }) and clear it when migration completes."
-        },
-        {
-          "title": "Row-level-security enablement fails closed on non-native drivers",
-          "body": "b.db.declareRowPolicy read pg_class.relrowsecurity to skip a redundant ENABLE ROW LEVEL SECURITY, but tested it with a bare truthiness check. A native pg driver returns a JS boolean; a proxy or ORM may return the string \"f\" for a disabled table — and \"f\" is truthy, so the check read it as already-enabled and silently skipped the ENABLE, leaving every row in the table unprotected while the migration reported success. RLS now counts as enabled only on a value that unambiguously means true (true, 1, or \"t\"/\"true\"/\"1\"/\"on\"/\"yes\"); every other shape re-issues ENABLE, a harmless no-op on an already-enabled table."
-        },
-        {
-          "title": "Vendored-crypto CVE scanning, complementary SAST, and workflow static analysis in CI",
-          "body": "The framework ships zero npm runtime dependencies — its crypto (the noble suite, the WebAuthn server, the PKI layer) is vendored under lib/vendor/, where npm audit, Dependabot, and Socket cannot see it. Every build now generates a CycloneDX SBOM of the vendored tree (each library carrying an npm purl) and runs it through OSV-Scanner, matching the exact pinned version against the OSV vulnerability database; a published CVE or GHSA affecting a vendored version fails the build so the copy is refreshed before merge. A Semgrep pass (registry security-audit + javascript packs at ERROR severity) runs alongside CodeQL as complementary SAST, and actionlint statically checks the workflow files. All three install the OSS tool from its upstream release, matching the existing secret-scan gate's posture."
-        }
-      ]
-    },
-    {
-      "heading": "Detectors",
-      "items": [
-        {
-          "title": "Quadratic trailing-whitespace and tag-find regex detectors",
-          "body": "Two codebase-pattern detectors refuse reintroduction of the quadratic shapes: the /[ \\t]+$/ trailing-whitespace strip (as .replace, .test, or via the named TRAILING_HSPACE_RE export) outside the linear helper that owns it, and the str.match(/<tag[^>]*>/) document-tag find that the response middleware must route through b.safeBuffer.indexAfterOpenTag. Each is proven to fire on the removed shape and stay silent on the linear replacement, so the ReDoS class cannot creep back into a new parser, guard, or response rewriter."
-        }
-      ]
-    }
-  ]
-}

package/lib/vendor/blamejs/release-notes/v0.15.12.json

@@ -1,47 +0,0 @@
-{
-  "$schema": "../scripts/release-notes-schema.json",
-  "version": "0.15.12",
-  "date": "2026-06-14",
-  "headline": "Hardens a set of defense-in-depth seams: a single-pass structured-field unescape, a constant-time content-digest member match, complete reserved-character stripping, a Trojan-Source escape on the boot logger, generic body-parse error responses, and an audit trail whenever outbound TLS certificate validation is disabled",
-  "summary": "A sweep of low-severity but real hardening items. RFC 8941 structured-field string values (HTTP Message Signatures, Client Hints, Cache-Control) were un-escaped with two chained replaces that mis-decoded an escaped backslash adjacent to another escape; they now use one left-to-right pass that decodes each escape exactly once. The HTTP Message Signature content-digest check dropped a dead identity-replace and now matches the sha3-512 member by an exact, top-level, constant-time comparison instead of an unanchored substring scan. b.guardFilename's reserved-character strip used a non-global regex that left every separator after the first; it now strips all of them. The boot logger's TTY branch wrote raw text, bypassing the Trojan-Source / control-character escape the main logger applies — it now escapes the bidi and C0/newline control classes on every sink. The body parser no longer echoes a caught exception's detail (an fs errno + temp path, or a parse hook's thrown message) to the HTTP client — the client gets a generic status phrase while the full detail stays on the audit chain. And any outbound TLS connection that runs with peer-certificate validation disabled (an explicit operator opt-in, never a default) now emits a tls.insecure_skip_verify audit + observability event so the degraded posture is visible for compliance and incident response.",
-  "sections": [
-    {
-      "heading": "Added",
-      "items": [
-        {
-          "title": "b.structuredFields.unescapeSfStringBody(body)",
-          "body": "A single-pass decode of the RFC 8941 §3.3.3 quoted-string backslash escapes (the bytes between the surrounding quotes). It replaces the chained two-`.replace()` form, which is not equivalent to one decode — whichever pass runs first can rewrite a backslash the other escape sequence owns, so a lone escaped backslash decoded to two. The HTTP Message Signature, Client Hints, and Cache-Control sf-string readers now route through it."
-        },
-        {
-          "title": "tls.insecure_skip_verify audit event",
-          "body": "b.network.tls.auditInsecureTls(meta) emits an audit + observability event at the point an outbound TLS connection honors rejectUnauthorized:false / allowInsecure. The connectWithEch, OTLP-gRPC log stream, syslog-TLS log stream, and SMTP transports all emit it when an operator disables certificate validation — parallel to the existing tls.classical_downgrade audit. No default changes; the framework never disables validation itself."
-        }
-      ]
-    },
-    {
-      "heading": "Security",
-      "items": [
-        {
-          "title": "Single-pass structured-field string unescape",
-          "body": "The RFC 8941 sf-string readers in HTTP Message Signatures (Signature-Input covered-component names), Client Hints, and Cache-Control directive values un-escaped with `.replace(/\\\\\\\\/g,\"\\\\\").replace(/\\\\\"/g,'\"')` — two sequential passes that mis-decode adjacent escapes (a lone escaped backslash became two). All four sites now use the single-pass b.structuredFields.unescapeSfStringBody. It is fail-closed (a mis-decoded covered-component name just fails the signature check, never bypasses it); the fix restores RFC-conformant interop with peers that legitimately escape these values."
-        },
-        {
-          "title": "Constant-time, member-anchored content-digest verification",
-          "body": "b.crypto.httpSig.verify's covered content-digest check dropped a dead no-op replace and now parses the Content-Digest header into its top-level members and matches the sha3-512 member EXACTLY, in constant time (b.crypto.timingSafeEqual), rather than scanning for the digest text as a substring anywhere in the header. The Content-Digest header is already bound by the signature, so the substring form was not reachably exploitable; the change removes the latent ambiguity and the timing channel."
-        },
-        {
-          "title": "Reserved-character filename strip removes every occurrence",
-          "body": "b.guardFilename's reservedCharPolicy:\"strip\" (the permissive profile) used a non-global regex, so only the FIRST reserved character — including path separators — was replaced and the rest leaked through. The strip is now global: every reserved character is removed. Not a traversal bypass (the unconditional security floor still throws on `..`, null bytes, NTFS ADS, UNC, overlong UTF-8), but the strip is now complete and consistent."
-        },
-        {
-          "title": "Boot logger escapes control + bidi characters on every sink",
-          "body": "The boot-time logger's TTY branch wrote the raw message, bypassing the Trojan-Source (bidi) and control-character escapes the main logger applies — a hostile message could forge extra log lines on a terminal (CWE-117) or re-order the visible line (CVE-2021-42574). Both boot branches now escape the bidi and C0/newline control classes, matching the create() path and the logger's advertised guarantee."
-        },
-        {
-          "title": "Body-parser error responses never echo internal detail",
-          "body": "The body-parser's terminal error path surfaced a caught exception's message verbatim to the HTTP client — a multipart filesystem error leaked the errno + temp path, and a parse hook's thrown error (which can carry secrets) was echoed back. The client now gets a curated message only for a framework-classified 4xx error and a generic status phrase otherwise; the parse-hook wrapper carries a fixed message, and full diagnostics stay on the audit chain server-side (CWE-209). The cluster leader-discovery endpoint's error body is generalized the same way."
-        }
-      ]
-    }
-  ]
-}

package/lib/vendor/blamejs/release-notes/v0.15.13.json

@@ -1,81 +0,0 @@
-{
-  "$schema": "../scripts/release-notes-schema.json",
-  "version": "0.15.13",
-  "date": "2026-06-19",
-  "headline": "Consolidates a large set of duplicated, security-sensitive code paths — injected-dependency validation, positive-integer option caps, TOCTOU-safe file reads, markup escaping, audit emission, structured-field parsing, and untrusted-JWK import — onto shared hardened primitives, so a fix or guard now applies everywhere at once; adds a TOCTOU-safe file reader; and makes several configuration errors throw typed framework errors instead of a bare Error",
-  "summary": "Across the framework, logic that had been hand-rolled in many places (and had quietly drifted between copies) is now single-sourced through shared primitives. The practical effect for operators is consistency: the strongest available guard is applied everywhere a given operation happens, rather than in whichever copy happened to have it. Injected dependencies (stores, backends, vaults, db handles, query objects) are validated through one contract; operator-tunable positive-integer options (pool sizes, byte caps, timeouts, stream limits) validate through one bounds primitive that forwards the caller's non-retryable / HTTP-status flags; the open-fd → fstat → read-fully pattern that several call sites used to defend file reads against a swap-after-stat race (CWE-367) is now the b.atomicFile.fdSafeReadSync primitive, with symlink refusal, inode-equality, a byte cap, and an integrity hash available as options and each caller's exact typed error preserved; and the XML/HTML markup escapers (including the b.guardHtml / b.guardSvg sanitizer output) route through one b.markupEscape so the base & < > \" chain can't drift between them. A few configuration-validation paths that threw a bare Error (httpClient.configurePool, b.db stream-limit validation) now throw the module's typed framework error. No security defaults change; this release tightens and unifies existing protections rather than adding opt-ins.",
-  "sections": [
-    {
-      "heading": "Added",
-      "items": [
-        {
-          "title": "b.atomicFile.fdSafeReadSync(filepath, opts?)",
-          "body": "A TOCTOU-safe synchronous file read (CWE-367 / js/file-system-race): it opens the path read-only, then binds the size, content, and integrity measurement to the inode the fd holds open, so a swap between stat and read can't change which bytes are returned. Optional guards layer on top — maxBytes (refuse an over-cap file), refuseSymlink + inodeCheck (refuse a symlink source and any inode swap, the strongest posture for operator-writable paths), expectedHash (SHA3-512), encoding (return a string), allowShortRead — and an errorFor(kind, detail) callback lets each caller keep its own typed error. The framework's own file reads (atomic-file, the TLS certificate-path loader, the sealed-PEM source reader, the backup bundle reader) all route through it."
-        },
-        {
-          "title": "Shared substrate primitives for previously-duplicated logic",
-          "body": "A set of shared primitives now back call sites that had each re-implemented the same logic: validateOpts.requireMethods (gains a `permanent` flag) for injected-dependency contract checks; numericBounds positive-finite-int validators (gain an errorOpts { permanent, statusCode }) for tunable integer options; b.markupEscape for the & < > \" markup chain; structured-field parsing helpers (parseTagList, forEachKeyValue, splitUnquoted, stripDoubleQuotes, unfoldHeaderContinuations); crypto.importPublicJwk and crypto.makeBase64UrlDecoder; safeSql.toPositional; safeBuffer.makeByteCoercer; nonceStore.enforceReplay; and the audit/observability namespaced emitters. These are mostly invisible substrate — the operator-visible benefit is that a guard or fix added to one of them now covers every caller."
-        }
-      ]
-    },
-    {
-      "heading": "Changed",
-      "items": [
-        {
-          "title": "Configuration errors throw typed framework errors",
-          "body": "Two configuration-validation paths that threw a bare `Error` now throw the module's typed framework error: httpClient.configurePool (bad maxSockets / maxFreeSockets / keepAliveMsecs → HttpClientError, code httpclient/bad-opts) and the b.db stream-limit validation (Query.stream → DbQueryError). The thrown error remains an Error subclass, so existing `instanceof Error` / try-catch handling is unaffected; code that matched the old free-text message should match the typed error's `code` instead. Several routed validators also report a slightly more precise message (\"positive finite integer\" instead of \"positive integer\")."
-        }
-      ]
-    },
-    {
-      "heading": "Security",
-      "items": [
-        {
-          "title": "TOCTOU-safe file reads applied uniformly",
-          "body": "The open-fd → fstat → read pattern that anchors a file read to one inode against a swap-after-stat race is now centralized in b.atomicFile.fdSafeReadSync, and every framework file read routes through it. The sealed-PEM source reader keeps the strongest posture (symlink refusal + inode-equality + byte cap), and those guards are now available as options to any caller — a re-introduced hand-rolled read-loop is flagged by a codebase-pattern detector."
-        },
-        {
-          "title": "Injected-dependency and integer-option validation can't silently drift",
-          "body": "Injected stores / backends / vaults / db handles / query objects are validated through one contract (validateOpts.requireMethods), and operator-tunable positive-integer options through one bounds primitive (numericBounds), both forwarding the caller's non-retryable / HTTP-status error flags so a config error stays permanent / carries its 4xx. Inverse detectors flag any re-introduced inline check, so the validation can no longer be partially copied or weakened in one place."
-        },
-        {
-          "title": "Single markup-escape chain for the HTML/SVG sanitizers",
-          "body": "The b.guardHtml and b.guardSvg sanitizer output escapers, the AI-Act transparency and mail HTML escapers, and the XML report escapers now share one b.markupEscape for the base & < > \" chain (apostrophe form as a parameter; each caller keeps its own input coercion and any extra escapes such as guardHtml.escapeAttr's backtick / = IE-attribute-injection hardening). Byte-for-byte parity with the prior escapers was verified across an XSS-vector corpus, so the consolidation cannot have introduced an escaping gap; a re-inlined & < > \" chain anywhere else is flagged by a detector."
-        },
-        {
-          "title": "One hardening point for untrusted public-JWK import",
-          "body": "The createPublicKey-from-JWK call that imports attacker-controlled key material (DID publicKeyJwk, DNSKEY, COSE_Key, DPoP / OAuth / OIDC / DBSC proof JWKs) is centralized in b.crypto.importPublicJwk, so the untrusted-key import has a single audited home; each caller keeps its own kty/crv pre-validation and typed error."
-        },
-        {
-          "title": "Linear-time Content-Security-Policy header parsing",
-          "body": "The CSP response-header parser split directives on a `/\\s*,\\s*/` regex that ran in O(n^2) on a long comma-less run of whitespace, letting a crafted header stall a worker (js/polynomial-redos). It now splits on the literal comma and trims each item, which is linear and byte-for-byte equivalent."
-        },
-        {
-          "title": "Parsed INI and OpenAPI path maps can't reach Object.prototype",
-          "body": "The INI parser already refuses a `__proto__` / `constructor` / `prototype` section or key (it throws before any write); as defense-in-depth, every parsed node — and the OpenAPI paths map keyed by URL pattern — is now a null-prototype object, so even a future gap could only ever set an own property, never mutate Object.prototype (CWE-1321)."
-        }
-      ]
-    },
-    {
-      "heading": "Fixed",
-      "items": [
-        {
-          "title": "Webhook deliveries retry transient transport failures instead of dead-lettering them",
-          "body": "A delivery that failed with a transient transport error (connection reset, timeout, 5xx) was recorded as permanently failed and dead-lettered rather than retried. The destination-safety check (SSRF / blocked-host guard) now runs in its own step and is the only permanent failure; a transport failure backs off and retries up to the configured limit."
-        },
-        {
-          "title": "Webhook deliveries table creates on MySQL",
-          "body": "The pending-delivery index used a partial-index (WHERE) clause that MySQL does not support, so the deliveries table failed to create on a MySQL backend. The index is now dialect-aware — partial on PostgreSQL / SQLite, plain on MySQL."
-        },
-        {
-          "title": "Inline webhook delivery can't be double-sent by concurrent retry processing",
-          "body": "An inline delivery is now claimed (status set to in-flight with a claim timestamp) before the POST, so a concurrent retry pass can't pick up and re-send the same delivery; a row left in-flight by a crash is reclaimed after the stale-claim window."
-        },
-        {
-          "title": "Audit checkpoint can never be anchored against a replaced database",
-          "body": "close() fires a best-effort final checkpoint as the database shuts down. In a narrow close-then-reopen window that checkpoint's write could resume after a fresh database had opened and anchor the prior database's chain tip into it. checkpoint() now binds to the database it read the tip from and refuses to write (returns null, fail-closed) if that handle has since been closed or replaced — so a checkpoint is only ever written against the database it measured."
-        }
-      ]
-    }
-  ]
-}