@blamejs/core 0.15.12 → 0.15.14

package/lib/asn1-der.js

@@ -79,13 +79,25 @@ function readNode(buf, offset) {
     // High-tag-number form (multi-byte tag). Walk continuation octets
     // (each top bit set means another follows).
     tag = 0;
+    var tagOctets = 0;
     while (true) {
       if (offset + headerLen >= buf.length) {
         throw new Asn1Error("asn1/short", "tag continuation truncated");
       }
       var byte = buf[offset + headerLen];
+      if (tagOctets === 0 && byte === 0x80) {                                   // leading 0x80 = non-minimal
+        throw new Asn1Error("asn1/tag-non-minimal",
+          "high-tag-number form has a non-minimal leading 0x80 octet");
+      }
       headerLen += 1;
-      tag = (tag << 7) | (byte & 0x7f);                                         // base-128 tag bits
+      tagOctets += 1;
+      // Base-128 multiplication (NOT `tag << 7`, which coerces to 32-bit
+      // signed int and overflows to a negative/wrong tag past 2^28).
+      tag = (tag * 128) + (byte & 0x7f);
+      if (tag > Number.MAX_SAFE_INTEGER) {
+        throw new Asn1Error("asn1/tag-too-large",
+          "high-tag-number exceeds the safe-integer range");
+      }
       if ((byte & 0x80) === 0) break;                                           // continuation bit
     }
   }
@@ -161,29 +173,45 @@ function readOid(node) {
   if (bytes.length === 0) {
     throw new Asn1Error("asn1/oid-empty", "OID value is empty");
   }
-  // First two arcs are encoded as `40*X + Y`.
-  var first = Math.floor(bytes[0] / 40);                                        // OID encoding constant
-  var second = bytes[0] % 40;                                                   // OID encoding constant
-  // Per X.690, when first byte >= 80 the first arc is 2 and second is byte-80.
-  if (first > 2) { first = 2; second = bytes[0] - 80; }                         // OID encoding constant
-  var arcs = [String(first), String(second)];
-
-  var i = 1;
+  // Decode every subidentifier as a full base-128 quantity (X.690 §8.19),
+  // rejecting non-minimal leading-0x80 padding and unterminated/oversized
+  // arcs. The FIRST subidentifier may itself span continuation octets
+  // (§8.19.4); only after decoding it do we split into the first two arcs.
+  var subids = [];
+  var i = 0;
   while (i < bytes.length) {
     var arc = 0;
     var j = i;
+    var done = false;
     while (j < bytes.length) {
       var b = bytes[j];
+      if (j === i && b === 0x80) {                                              // leading 0x80 = non-minimal
+        throw new Asn1Error("asn1/oid-non-minimal",
+          "OID subidentifier has a non-minimal leading 0x80 octet");
+      }
       arc = (arc * 128) + (b & 0x7f);                                           // base-128 OID arc
+      if (arc > Number.MAX_SAFE_INTEGER) {
+        throw new Asn1Error("asn1/oid-overflow",
+          "OID subidentifier exceeds the safe-integer range");
+      }
       j += 1;
-      if ((b & 0x80) === 0) break;                                              // continuation bit
+      if ((b & 0x80) === 0) { done = true; break; }                            // continuation bit
     }
-    if (j === i) {
+    if (!done) {
       throw new Asn1Error("asn1/oid-malformed", "OID arc never terminated");
     }
-    arcs.push(String(arc));
+    subids.push(arc);
     i = j;
   }
+
+  // Split the first subidentifier into the first two arcs (40*X + Y).
+  var firstSubid = subids[0];
+  var first, second;
+  if (firstSubid < 40)      { first = 0; second = firstSubid; }
+  else if (firstSubid < 80) { first = 1; second = firstSubid - 40; }
+  else                      { first = 2; second = firstSubid - 80; }
+  var arcs = [String(first), String(second)];
+  for (var k = 1; k < subids.length; k += 1) arcs.push(String(subids[k]));
   return arcs.join(".");
 }
 
@@ -298,24 +326,44 @@ function writeInteger(buf) {
   return writeNode(TAG.INTEGER, buf);
 }
 
+// Append `arc` to `bytes` as a base-128 subidentifier (X.690 §8.19), most-
+// significant octet first, every octet but the last carrying the
+// continuation bit. Uses integer division (not 32-bit `>>> 7`) so arcs
+// beyond 2^31 encode correctly.
+function _writeBase128Subid(arc, bytes) {
+  if (arc === 0) { bytes.push(0); return; }
+  var stack = [];
+  while (arc > 0) {
+    stack.unshift(arc % 128);                                                    // base-128 digit
+    arc = Math.floor(arc / 128);
+  }
+  for (var j = 0; j < stack.length - 1; j += 1) stack[j] |= 0x80;                // continuation bit
+  for (var k = 0; k < stack.length; k += 1) bytes.push(stack[k]);
+}
+
 function writeOid(dotted) {
   // Encode dotted-decimal OID per X.690 §8.19.
   var parts = String(dotted).split(".").map(function (s) { return parseInt(s, 10); });
   if (parts.length < 2) {
     throw new Asn1Error("asn1/oid-too-short", "OID needs at least 2 arcs");
   }
-  var bytes = [parts[0] * 40 + parts[1]];                                        // OID first-arc encoding
-  for (var i = 2; i < parts.length; i += 1) {
-    var arc = parts[i];
-    if (arc === 0) { bytes.push(0); continue; }
-    var stack = [];
-    while (arc > 0) {
-      stack.unshift(arc & 0x7f);                                                 // base-128 mask
-      arc = arc >>> 7;                                                           // base-128 shift
+  for (var p = 0; p < parts.length; p += 1) {
+    if (!Number.isInteger(parts[p]) || parts[p] < 0 || parts[p] > Number.MAX_SAFE_INTEGER) {
+      throw new Asn1Error("asn1/oid-bad-arc", "OID arc " + p + " is not a non-negative integer");
     }
-    for (var j = 0; j < stack.length - 1; j += 1) stack[j] |= 0x80;              // continuation bit
-    for (var k = 0; k < stack.length; k += 1) bytes.push(stack[k]);
   }
+  if (parts[0] > 2) {
+    throw new Asn1Error("asn1/oid-bad-arc", "OID first arc must be 0, 1, or 2");
+  }
+  if (parts[0] < 2 && parts[1] >= 40) {
+    throw new Asn1Error("asn1/oid-bad-arc",
+      "OID second arc must be < 40 when the first arc is 0 or 1");
+  }
+  var bytes = [];
+  // The first two arcs share one subidentifier (40*X + Y), which may itself
+  // need multiple base-128 octets (e.g. 2.999 -> 1079).
+  _writeBase128Subid(parts[0] * 40 + parts[1], bytes);
+  for (var i = 2; i < parts.length; i += 1) _writeBase128Subid(parts[i], bytes);
   return writeNode(TAG.OID, Buffer.from(bytes));
 }
 

package/lib/asyncapi-traits.js

@@ -109,12 +109,8 @@ function _mergeKey(key, base, overlay) {
   if (typeof base === "object" && typeof overlay === "object" &&
       !Array.isArray(base) && !Array.isArray(overlay)) {
     var out = {};
-    for (var k1 in base) {
-      if (Object.prototype.hasOwnProperty.call(base, k1)) out[k1] = base[k1];
-    }
-    for (var k2 in overlay) {
-      if (Object.prototype.hasOwnProperty.call(overlay, k2)) out[k2] = overlay[k2];
-    }
+    validateOpts.assignOwnEnumerable(out, base);
+    validateOpts.assignOwnEnumerable(out, overlay);
     return out;
   }
   return overlay;        // scalar overrides

package/lib/atomic-file.js

@@ -40,6 +40,8 @@
  */
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
+var nodeStream = require("node:stream");
+var streamPromises = require("node:stream/promises");
 var { generateToken, sha3Hash } = require("./crypto");
 var safeJson = require("./safe-json");
 var C = require("./constants");
@@ -81,7 +83,11 @@ class AtomicFileError extends FrameworkError {
 // primitive's standard names; jitterFactor 0.5 reproduces the original
 // `delay * (0.5 + Math.random()/2)` range of [delay/2, delay].
 
-var TRANSIENT_FS_ERRNOS = new Set(["EBUSY", "EAGAIN", "ENFILE", "EMFILE", "EPERM"]);
+// EACCES joins the transient set: on Windows a freshly-written file is briefly
+// locked by AV / the search indexer / a file-sync client (Dropbox, OneDrive),
+// surfacing as EACCES (alongside EPERM/EBUSY) on the next open/rename — the same
+// transient contention the sync _renameWithRetry already treats as retryable.
+var TRANSIENT_FS_ERRNOS = new Set(["EBUSY", "EAGAIN", "ENFILE", "EMFILE", "EPERM", "EACCES"]);
 
 function _isFsRetryable(e) {
   return e != null && TRANSIENT_FS_ERRNOS.has(e.code);
@@ -485,6 +491,146 @@ function writeSync(filepath, data, opts) {
   };
 }
 
+/**
+ * @primitive b.atomicFile.writeStream
+ * @signature b.atomicFile.writeStream(filepath, source, opts?)
+ * @since     0.15.14
+ * @status    stable
+ * @related   b.atomicFile.writeSync, b.atomicFile.openNoFollowSync
+ *
+ * Streaming sibling of `writeSync` for payloads too large to buffer in
+ * memory. Pipes a Readable `source` into a sibling temp file opened with
+ * `O_EXCL | O_NOFOLLOW` (the same exclusive, symlink-refusing create
+ * every atomic write uses), fsyncs, then atomically renames over
+ * `filepath` and fsyncs the parent directory. A plain
+ * `fs.createWriteStream(filepath)` instead follows a symlink an attacker
+ * pre-planted at `filepath` (CWE-59 arbitrary write) and leaves a
+ * half-written object at the canonical name if the source aborts
+ * mid-stream — this primitive does neither: the file appears at
+ * `filepath` only after the full stream has landed and synced.
+ *
+ * Enforces a byte ceiling while streaming (`maxBytes`, default 64 MiB) so
+ * an unbounded source cannot fill the disk; the partial temp is removed
+ * on overflow or any pipeline error.
+ *
+ * @opts
+ *   fileMode:  0o600,            // mode applied to the temp file (and thus the renamed final)
+ *   maxBytes:  64 * 1024 * 1024, // refuse + clean up once the source exceeds this many bytes
+ *   signal:    undefined,        // optional AbortSignal forwarded to the pipeline
+ *
+ * @example
+ *   await b.atomicFile.writeStream(
+ *     "/var/lib/blamejs/object",
+ *     incomingRequestStream,
+ *     { fileMode: 0o600, maxBytes: b.C.BYTES.gib(2) }
+ *   );
+ *   // → { bytesWritten: 12345 }
+ */
+async function writeStream(filepath, source, opts) {
+  opts = Object.assign({}, DEFAULTS, opts || {});
+  if (!source || typeof source.pipe !== "function") {
+    throw new AtomicFileError(
+      "writeStream: source must be a Readable stream", "atomic-file/invalid-source");
+  }
+  var maxBytes = opts.maxBytes;
+
+  var dir = nodePath.dirname(filepath);
+  if (!nodeFs.existsSync(dir)) nodeFs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+
+  var tmpPath = filepath + ".tmp-" + generateToken(C.BYTES.bytes(8));
+  var fd = _openExclTemp(tmpPath, opts.fileMode);
+  var fileStream = nodeFs.createWriteStream(null, { fd: fd, autoClose: false });
+  var bytesWritten = 0;
+  var renamed = false;
+
+  // Cap the stream as it flows — an unbounded source must not fill the disk.
+  var counter = new nodeStream.Transform({
+    transform: function (chunk, _enc, cb) {
+      bytesWritten += chunk.length;
+      if (typeof maxBytes === "number" && bytesWritten > maxBytes) {
+        return cb(new AtomicFileError(
+          "writeStream: source exceeds maxBytes " + maxBytes, "atomic-file/too-large"));
+      }
+      cb(null, chunk);
+    },
+  });
+
+  try {
+    if (opts.signal) {
+      await streamPromises.pipeline(source, counter, fileStream, { signal: opts.signal });
+    } else {
+      await streamPromises.pipeline(source, counter, fileStream);
+    }
+    _fsync(fd);
+    nodeFs.closeSync(fd);
+    fd = -1;
+    _renameWithRetry(tmpPath, filepath);
+    renamed = true;
+    _fsyncDir(dir);
+  } finally {
+    if (fd >= 0) { try { nodeFs.closeSync(fd); } catch (_e) { /* already closed? */ } }
+    if (!renamed) {
+      // Source aborted, overflowed, or the rename failed — remove the temp so
+      // no half-written object survives at the canonical name.
+      try { nodeFs.unlinkSync(tmpPath); } catch (_e) { /* may not exist */ }
+    }
+  }
+
+  return { bytesWritten: bytesWritten };
+}
+
+/**
+ * @primitive b.atomicFile.writeExclSync
+ * @signature b.atomicFile.writeExclSync(filepath, data, opts?)
+ * @since     0.15.14
+ * @status    stable
+ * @related   b.atomicFile.writeSync, b.atomicFile.openNoFollowSync
+ *
+ * Exclusive, symlink-refusing write to `filepath` WITHOUT the atomic
+ * rename — for staged "write → fsync → verify → rename" flows where the
+ * caller must re-read and validate the written bytes before committing them
+ * over the live file (the vault seal/unseal round-trip re-reads the staged
+ * file and confirms it decrypts before renaming it into place). Clears any
+ * stale leftover at `filepath` first (an aborted prior run, or a planted
+ * symlink — `unlink` removes the LINK, never its target), then creates the
+ * file with `O_EXCL | O_NOFOLLOW`, so a symlink re-planted in the race
+ * window fails the open closed instead of being followed (CWE-59 / CWE-377).
+ * fsyncs the data before returning. For an ordinary write-and-replace use
+ * `writeSync`, which renames atomically; reach for this only when a
+ * verify-before-commit step sits between the write and the rename.
+ *
+ * @opts
+ *   fileMode: 0o600,   // mode applied to the created file
+ *
+ * @example
+ *   b.atomicFile.writeExclSync(stagingPath, bytes, { fileMode: 0o600 });
+ *   // re-read + verify stagingPath, then:
+ *   b.atomicFile.renameWithRetry(stagingPath, finalPath);
+ */
+function writeExclSync(filepath, data, opts) {
+  opts = Object.assign({}, DEFAULTS, opts || {});
+  var buf = safeBuffer.toBuffer(data, {
+    errorClass:  AtomicFileError,
+    typeCode:    "atomic-file/invalid-data",
+    typeMessage: "data must be Buffer, Uint8Array, or string",
+  });
+  // Clear any stale leftover so the exclusive create can proceed; unlink
+  // removes a planted symlink itself (not its target), and the O_EXCL open
+  // then fails closed if anything re-appears at the path in the race window.
+  try { nodeFs.unlinkSync(filepath); } catch (_e) { /* nothing to clear */ }
+  var fd = _openExclTemp(filepath, opts.fileMode);
+  try {
+    var pos = 0;
+    while (pos < buf.length) {
+      pos += nodeFs.writeSync(fd, buf, pos, buf.length - pos, null);
+    }
+    _fsync(fd);
+  } finally {
+    try { nodeFs.closeSync(fd); } catch (_e) { /* already closed? */ }
+  }
+  return { bytesWritten: buf.length };
+}
+
 /**
  * @primitive b.atomicFile.cleanOrphans
  * @signature b.atomicFile.cleanOrphans(filepath, opts)
@@ -703,39 +849,94 @@ function _validateMaxBytes(maxBytes) {
   }
 }
 
-function _readSyncCore(filepath, opts) {
-  _validateMaxBytes(opts.maxBytes);
-  // CodeQL js/file-system-race defense — TOCTOU-safe-read scaffold.
-  // Open the fd first, then fstat the same fd (so size + content
-  // measurement bind to the inode the fd holds open). An attacker
-  // can't swap the file between size-check and read because the fd
-  // is anchored to the original inode. ENOENT surfaces from open()
-  // rather than the previous existsSync() pre-check.
-  //
-  // The third argument pins an owner-only mode (0o600). The flag is
-  // read-only ("r" → O_RDONLY, no O_CREAT) so the mode is inert on
-  // disk, but specifying it keeps this open out of the insecure-temp-
-  // file class (CWE-377): the read can never create a world/group-
-  // accessible file even when `filepath` is rooted under a temp dir.
+/**
+ * @primitive b.atomicFile.fdSafeReadSync
+ * @signature b.atomicFile.fdSafeReadSync(filepath, opts?)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.atomicFile.readSync, b.atomicFile.read
+ *
+ * TOCTOU-safe synchronous file read (CWE-367 / js/file-system-race). Opens
+ * the path read-only, then binds every subsequent measurement — size,
+ * content, integrity — to the inode the fd holds open, so an attacker who
+ * swaps the file between stat and read can't change which bytes come back.
+ * The optional guards layer on top of that core: a byte cap (`maxBytes`),
+ * symlink refusal + inode-equality (`refuseSymlink` / `inodeCheck` — the
+ * strongest defense, for operator-writable source paths), an integrity
+ * hash (`expectedHash`, SHA3-512), and a short-read policy (throw, or
+ * slice when `allowShortRead`). Each caller maps a failure KIND to its own
+ * typed error via `errorFor`, so the message / code / audit posture stays
+ * per-domain; the default raises an `AtomicFileError`.
+ *
+ * @opts
+ *   mode:           number,    // open mode (default 0o600; inert under O_RDONLY)
+ *   maxBytes:       number,    // refuse a file larger than this (default: no cap)
+ *   refuseSymlink:  boolean,   // lstat + refuse a symlink source (default: false)
+ *   inodeCheck:     boolean,   // refuse if the fd inode != the lstat inode (needs refuseSymlink)
+ *   expectedHash:   string,    // SHA3-512 the content must match (default: none)
+ *   encoding:       string,    // decode to a string (default: return a Buffer)
+ *   allowShortRead: boolean,   // slice to the bytes read instead of throwing (default: false)
+ *   withStat:       boolean,   // return { bytes, stat } — stat of the bound fd (mode/uid/gid/size/ino/nlink/mtimeMs), TOCTOU-free
+ *   errorFor:       Function,  // (kind, detail) => Error|undefined; kinds: enoent / symlink / too-large / toctou / short-read / integrity
+ *
+ * @example
+ *   var cfg = b.atomicFile.fdSafeReadSync("/etc/app/config.json", {
+ *     maxBytes: b.constants.BYTES.mib(1),
+ *     encoding: "utf8",
+ *   });
+ *
+ *   // Assert mode + owner on the exact inode the bytes came from (no re-stat):
+ *   var r = b.atomicFile.fdSafeReadSync("/etc/app/secret", { withStat: true });
+ *   if ((r.stat.mode & 0o077) !== 0) throw new Error("secret is group/other-readable");
+ *   // r.bytes is the Buffer (or string under `encoding`)
+ */
+function fdSafeReadSync(filepath, opts) {
+  opts = opts || {};
+  var errorFor = opts.errorFor || function (kind, detail) {
+    return new AtomicFileError((detail && detail.message) || ("atomic-file: " + kind), "atomic-file/" + kind);
+  };
+  if (opts.maxBytes !== undefined) _validateMaxBytes(opts.maxBytes);
+  var mode = opts.mode === undefined ? 0o600 : opts.mode;
+  // refuseSymlink: lstat the path first and refuse a symlink source —
+  // the strongest TOCTOU posture (open() would follow the link). The
+  // fd's inode is re-checked against this lstat's inode below.
+  var lstat = null;
+  if (opts.refuseSymlink) {
+    lstat = nodeFs.lstatSync(filepath);
+    if (lstat.isSymbolicLink()) throw errorFor("symlink", { path: filepath });
+    if (opts.maxBytes !== undefined && lstat.size > opts.maxBytes) {
+      throw errorFor("too-large", { size: lstat.size, max: opts.maxBytes });
+    }
+  }
+  // The third argument pins an owner-only mode (0o600 default). The flag
+  // is read-only ("r" → O_RDONLY, no O_CREAT) so the mode is inert on
+  // disk, but specifying it keeps this open out of the insecure-temp-file
+  // class (CWE-377). ENOENT surfaces from open() rather than a pre-check;
+  // a caller's errorFor("enoent") may translate it, else it rethrows raw.
   var fd;
   try {
-    fd = nodeFs.openSync(filepath, "r", 0o600);
+    fd = nodeFs.openSync(filepath, "r", mode);
   } catch (openErr) {
     if (openErr && openErr.code === "ENOENT") {
-      var e = new AtomicFileError("file not found: " + filepath, "atomic-file/not-found");
-      e.code = "ENOENT";
-      throw e;
+      var typed = errorFor("enoent", { path: filepath, cause: openErr });
+      if (typed) throw typed;
     }
     throw openErr;
   }
   var buf;
   try {
     var fstat = nodeFs.fstatSync(fd);
-    if (fstat.size > opts.maxBytes) {
-      throw new AtomicFileError(
-        "file size " + fstat.size + " > maxBytes " + opts.maxBytes,
-        "atomic-file/too-large"
-      );
+    // inodeCheck: the fd must point at the same inode lstat saw — any
+    // swap between lstat and open is a TOCTOU and is refused. A file that
+    // GREW past the cap between lstat and open is the same class of swap,
+    // so under inodeCheck a post-open over-cap is reported as toctou; a
+    // plain (no-inodeCheck) reader reports an over-cap as too-large.
+    if (lstat && opts.inodeCheck) {
+      if (fstat.ino !== lstat.ino || (opts.maxBytes !== undefined && fstat.size > opts.maxBytes)) {
+        throw errorFor("toctou", { path: filepath });
+      }
+    } else if (opts.maxBytes !== undefined && fstat.size > opts.maxBytes) {
+      throw errorFor("too-large", { size: fstat.size, max: opts.maxBytes });
     }
     buf = Buffer.alloc(fstat.size);
     var read = 0;
@@ -745,10 +946,8 @@ function _readSyncCore(filepath, opts) {
       read += n;
     }
     if (read !== fstat.size) {
-      throw new AtomicFileError(
-        "short read: " + read + " of " + fstat.size + " bytes",
-        "atomic-file/short-read"
-      );
+      if (opts.allowShortRead) { buf = buf.slice(0, read); }
+      else { throw errorFor("short-read", { read: read, size: fstat.size }); }
     }
   } finally {
     try { nodeFs.closeSync(fd); } catch (_c) { /* close best-effort */ }
@@ -756,13 +955,61 @@ function _readSyncCore(filepath, opts) {
   if (opts.expectedHash) {
     var actual = sha3Hash(buf);
     if (actual !== opts.expectedHash) {
-      throw new AtomicFileError(
-        "integrity check failed: expected " + opts.expectedHash + " got " + actual,
-        "atomic-file/integrity"
-      );
+      throw errorFor("integrity", { expected: opts.expectedHash, actual: actual });
     }
   }
-  return opts.encoding ? buf.toString(opts.encoding) : buf;
+  var content = opts.encoding ? buf.toString(opts.encoding) : buf;
+  // withStat: return the fstat of the SAME bound fd alongside the bytes, so a
+  // caller that needs the mode / owner (e.g. to assert 0o600 + owned-by-me on a
+  // secrets file) reads it TOCTOU-free — the stat describes the exact inode the
+  // bytes came from, not a re-stat that an attacker could swap underneath.
+  if (opts.withStat) {
+    return {
+      bytes: content,
+      stat: {
+        mode:    fstat.mode,
+        uid:     fstat.uid,
+        gid:     fstat.gid,
+        size:    fstat.size,
+        ino:     fstat.ino,
+        nlink:   fstat.nlink,
+        mtimeMs: fstat.mtimeMs,
+      },
+    };
+  }
+  return content;
+}
+
+// Atomic-file's own reads route through fdSafeReadSync with an errorFor
+// that reproduces this module's exact codes + messages (a pure refactor).
+function _readSyncCore(filepath, opts) {
+  return fdSafeReadSync(filepath, {
+    mode:         0o600,
+    maxBytes:     opts.maxBytes,
+    expectedHash: opts.expectedHash,
+    encoding:     opts.encoding,
+    errorFor: function (kind, detail) {
+      if (kind === "enoent") {
+        var e = new AtomicFileError("file not found: " + filepath, "atomic-file/not-found");
+        e.code = "ENOENT";
+        return e;
+      }
+      if (kind === "too-large") {
+        return new AtomicFileError(
+          "file size " + detail.size + " > maxBytes " + detail.max, "atomic-file/too-large");
+      }
+      if (kind === "short-read") {
+        return new AtomicFileError(
+          "short read: " + detail.read + " of " + detail.size + " bytes", "atomic-file/short-read");
+      }
+      if (kind === "integrity") {
+        return new AtomicFileError(
+          "integrity check failed: expected " + detail.expected + " got " + detail.actual,
+          "atomic-file/integrity");
+      }
+      return new AtomicFileError("atomic-file: " + kind, "atomic-file/" + kind);
+    },
+  });
 }
 
 /**
@@ -1061,11 +1308,43 @@ function listDir(dir, opts) {
   return out;
 }
 
+/**
+ * @primitive b.atomicFile.openNoFollowSync
+ * @signature b.atomicFile.openNoFollowSync(filepath, mode?)
+ * @since      0.15.14
+ * @status     stable
+ * @related    b.atomicFile.fdSafeReadSync, b.atomicFile.readSync
+ *
+ * Open a path read-only with `O_NOFOLLOW` so a symlink at the final path
+ * component is refused (`ELOOP`) instead of followed — the streaming-read
+ * counterpart to `fdSafeReadSync` for callers that must `fs.createReadStream`
+ * (range serving, SRI/ETag hashing, large-object download) and cannot buffer
+ * the whole file. Stream from the returned fd: `fs.createReadStream(path, { fd
+ * })`. Defends a post-confinement symlink swap (CWE-22 / CWE-367) on
+ * request-reachable static-serve and object-store read paths, where a lexical
+ * `_assertInsideRoot` check alone leaves a swap window between the check and the
+ * open. `O_NOFOLLOW` is POSIX-only; on platforms without it the flag is 0 (a
+ * plain `O_RDONLY` open) — Windows symlink semantics differ and are out of
+ * scope. Throws the raw `openSync` error (caller maps `ELOOP` / `ENOENT`).
+ *
+ * @example
+ *   var fd = b.atomicFile.openNoFollowSync(absPath);
+ *   var stream = fs.createReadStream(absPath, { fd: fd });   // autoClose closes fd
+ */
+function openNoFollowSync(filepath, mode) {
+  var flags = nodeFs.constants.O_RDONLY | (nodeFs.constants.O_NOFOLLOW || 0);
+  return nodeFs.openSync(filepath, flags, mode === undefined ? 0o600 : mode);
+}
+
 module.exports = {
   write:             write,
   writeSync:         writeSync,
+  writeStream:       writeStream,
+  writeExclSync:     writeExclSync,
   read:              read,
   readSync:          readSync,
+  fdSafeReadSync:    fdSafeReadSync,
+  openNoFollowSync:  openNoFollowSync,
   writeJson:         writeJson,
   readJson:          readJson,
   copy:              copy,