@blamejs/core 0.15.12 → 0.15.14

package/lib/validate-opts.js

@@ -28,6 +28,7 @@
  */
 
 var numericBounds = require("./numeric-bounds");
+var pick = require("./pick");
 
 function _format(primitive, unknownKey, allowedKeys) {
   return primitive + ": unknown option '" + unknownKey + "'. " +
@@ -78,13 +79,18 @@ function auditShape(audit, callerLabel, errorClass, code) {
 // _throw — shared error-emission for the optional* validators. Routes
 // through the caller's framework-error class when supplied, falls back
 // to plain Error so this helper itself stays decoupled from any one
-// error hierarchy.
-function _throw(errorClass, code, msg, defaultCode) {
+// error hierarchy. `permanent` (optional) is forwarded as the framework
+// error's third constructor argument so callers whose config-time failure
+// is non-retryable (a misconfigured dependency never becomes valid on
+// retry) keep that flag when they route through these validators instead
+// of hand-throwing; omitted → undefined → the class default (false), so
+// existing callers are unaffected.
+function _throw(errorClass, code, msg, defaultCode, permanent) {
   if (errorClass && errorClass.factory) {
-    throw errorClass.factory(code || "BAD_OPT", msg);
+    throw errorClass.factory(code || "BAD_OPT", msg, permanent);
   }
   if (typeof errorClass === "function") {
-    throw new errorClass(code || defaultCode, msg);
+    throw new errorClass(code || defaultCode, msg, permanent);
   }
   throw new Error(msg);
 }
@@ -132,6 +138,15 @@ function optionalFiniteNonNegative(value, label, errorClass, code) {
   return value;
 }
 
+function optionalDate(value, label, errorClass, code) {
+  if (value === undefined || value === null) return value;
+  if (!(value instanceof Date) || !isFinite(value.getTime())) {
+    _throw(errorClass, code, (label || "opt") + " must be a valid Date",
+           "validate-opts/bad-date");
+  }
+  return value;
+}
+
 function optionalPositiveFinite(value, label, errorClass, code) {
   if (value === undefined || value === null) return value;
   if (typeof value !== "number" || !isFinite(value) || value <= 0) {
@@ -218,18 +233,25 @@ function requireObject(opts, callerLabel, errorClass, code) {
 // (b.agent.*.reseal stores, b.dsr / b.outbox create() backends, etc.)
 // into one definition. Throws on null / non-object / any missing-or-
 // non-function method; returns obj on success.
-function requireMethods(obj, methods, callerLabel, errorClass, code) {
+//
+// `permanent` (optional) forwards to the framework error's permanent flag
+// — pass true for a config-time dependency check whose failure is not
+// retryable (a backend/store/vault missing its contract never becomes
+// valid on retry). Omitted → the error class default (false), matching
+// the historical bare `new Err(code, msg)` shape, so existing callers are
+// unchanged.
+function requireMethods(obj, methods, callerLabel, errorClass, code, permanent) {
   var label = callerLabel || "dependency";
   if (!obj || typeof obj !== "object") {
     _throw(errorClass, code, label + " must be an object exposing { " +
            methods.join(", ") + " }, got " + (obj === null ? "null" : typeof obj),
-           "validate-opts/bad-methods-object");
+           "validate-opts/bad-methods-object", permanent);
   }
   for (var i = 0; i < methods.length; i += 1) {
     if (typeof obj[methods[i]] !== "function") {
       _throw(errorClass, code, label + " must expose a " + methods[i] +
              "() method (requires { " + methods.join(", ") + " })",
-             "validate-opts/missing-method");
+             "validate-opts/missing-method", permanent);
     }
   }
   return obj;
@@ -331,6 +353,128 @@ function optionalPlainObject(value, label, errorClass, code, description) {
   return value;
 }
 
+// _SHAPE_RULES — rule-token → validator dispatch table for `shape`. Each
+// validator has the uniform (value, label, errorClass, code) signature, so the
+// table drives them all from a declarative schema.
+var _SHAPE_RULES = {
+  "required-string":          requireNonEmptyString,
+  "optional-string":          optionalNonEmptyString,
+  "optional-string-array":    optionalNonEmptyStringArray,
+  "optional-boolean":         optionalBoolean,
+  "optional-positive-int":    optionalPositiveInt,
+  "optional-positive-finite": optionalPositiveFinite,
+  "optional-non-negative":    optionalFiniteNonNegative,
+  "optional-date":            optionalDate,
+  "optional-function":        optionalFunction,
+  "optional-plain-object":    optionalPlainObject,
+  "optional-port":            optionalPort,
+  // numeric-bounds finite-int family (rejects Infinity/NaN, unlike the
+  // optional-positive-int sugar) — so byte/count caps declare in the shape
+  // rather than a separate numericBounds call outside it.
+  "optional-positive-finite-int":     numericBounds.requirePositiveFiniteIntIfPresent,
+  "optional-non-negative-finite-int": numericBounds.requireNonNegativeFiniteIntIfPresent,
+  "required-positive-finite-int":     numericBounds.requirePositiveFiniteInt,
+};
+
+// shape — declarative opts validator. Collapses the `requireObject(opts) +
+// requireNonEmptyString(opts.a) + optionalPositiveFinite(opts.b) + ...` preamble
+// that every create()/build() factory re-rolls into one schema-driven call.
+// The schema is expressive enough that a factory never has to contort its
+// validation to fit a fixed vocabulary — each opt's rule is ANY of:
+//
+//   - a rule TOKEN (see _SHAPE_RULES) — sugar for the common per-field checks,
+//     using the call-wide `code`;
+//   - a per-field DESCRIPTOR `{ rule: "<token>", code?, label? }` — keeps a
+//     DISTINCT per-field code (BAD_THIRD_PARTY vs BAD_CONSUMER_REF) or a custom
+//     label, so behavior a per-field test asserts is preserved;
+//   - an injected-DEPENDENCY `{ methods: [...], optional?, code?, label? }` —
+//     validated via requireMethods;
+//   - a NESTED `{ shape: {...}, optional?, code?, label? }` — recurses into a
+//     sub-object field (e.g. opts.authServer.{issuer,jwksUri});
+//   - an arbitrary VALIDATOR FUNCTION `(value, label, errorClass, code, opts)
+//     => void` that throws on invalid — the universal hatch for a bespoke check.
+//     It receives the whole `opts` as the 5th arg, so CROSS-FIELD logic ("field
+//     B required when opts.a === X", a custom message, a numeric-bounds call)
+//     lives IN the shape rather than as a hand-rolled check outside it.
+//
+// Validates `opts` is an object, then dispatches each declared field; returns
+// opts. An unknown rule token throws at call time — a schema typo is the
+// author's bug, surfaced loudly rather than silently skipping a field.
+//
+// The schema is ALWAYS the authoritative, exhaustive opts contract — there is
+// no opt-in: any key present on `opts` that the schema does not declare (nor
+// list in `options.allow`) is rejected. This is mandatory by design, so the
+// "future code adds an opt but forgets to validate it" gap cannot reopen — an
+// undeclared opt can't be silently consumed, because it is refused here;
+// adding it forces declaring its rule in the schema, where it is validated.
+// (A field declared in the schema is always validated; exhaustiveness adds the
+// converse — nothing reaches the body unvalidated.) `options.allow` is the only
+// escape: an explicit list of keys a factory forwards to a sub-component rather
+// than validating locally — there is no "skip the contract" mode.
+function shape(opts, schema, callerLabel, errorClass, code, options) {
+  requireObject(opts, callerLabel, errorClass, code);
+  var fields = Object.keys(schema);
+  for (var i = 0; i < fields.length; i += 1) {
+    var field = fields[i];
+    var rule = schema[field];
+    var fieldCode = code;
+    var label = (callerLabel || "opts") + ": " + field;
+    var value = opts[field];
+    // Arbitrary validator function — the universal hatch. Receives the whole
+    // `opts` as a 5th arg so a rule can do CROSS-FIELD validation (e.g. "field B
+    // is required when opts.a === 'material'") without dropping back to inline
+    // checks outside the shape.
+    if (typeof rule === "function") { rule(value, label, errorClass, fieldCode, opts); continue; }
+    if (rule && typeof rule === "object") {
+      if (Array.isArray(rule.methods)) {
+        if (rule.optional && (value === undefined || value === null)) continue;
+        requireMethods(value, rule.methods, rule.label || label, errorClass, rule.code || code, rule.permanent);
+        continue;
+      }
+      // Nested sub-object: validate it is an object, then recurse.
+      if (rule.shape && typeof rule.shape === "object") {
+        if (rule.optional && (value === undefined || value === null)) continue;
+        requireObject(value, rule.label || label, errorClass, rule.code || code);
+        shape(value, rule.shape, rule.label || label, errorClass, rule.code || code);
+        continue;
+      }
+      // Per-field descriptor: { rule, code?, label? }.
+      if (typeof rule.rule === "string") {
+        if (typeof rule.code === "string") fieldCode = rule.code;
+        if (typeof rule.label === "string") label = rule.label;
+        rule = rule.rule;
+      } else {
+        _throw(errorClass, code, (callerLabel || "opts") +
+               ": unsupported shape rule object for field " + field,
+               "validate-opts/bad-shape-rule");
+      }
+    }
+    if (rule === "required-object") { requireObject(value, label, errorClass, fieldCode); continue; }
+    var fn = _SHAPE_RULES[rule];
+    if (typeof fn !== "function") {
+      _throw(errorClass, code, (callerLabel || "opts") +
+             ": unknown shape rule " + JSON.stringify(rule) + " for field " + field,
+             "validate-opts/bad-shape-rule");
+    }
+    fn(value, label, errorClass, fieldCode);
+  }
+  // Exhaustive contract enforcement — always on (the schema is complete).
+  var declared = Object.create(null);
+  for (var d = 0; d < fields.length; d += 1) declared[fields[d]] = true;
+  var allowList = (options && options.allow) || [];
+  for (var a = 0; a < allowList.length; a += 1) declared[allowList[a]] = true;
+  var present = Object.keys(opts);
+  for (var p = 0; p < present.length; p += 1) {
+    if (!declared[present[p]]) {
+      _throw(errorClass, code, (callerLabel || "opts") +
+             ": unknown opt " + JSON.stringify(present[p]) +
+             " (not in the validated shape; add it to the schema or pass options.allow)",
+             "validate-opts/unknown-opt");
+    }
+  }
+  return opts;
+}
+
 // makeAuditEmitter — closure factory parallel to safeAsync.makeDropCallback.
 // Replaces the per-file `function _emit(action, info) { if (!audit) return;
 // try { audit.safeEmit(Object.assign({ action: action }, info || {})); }
@@ -412,7 +556,7 @@ function assignOwnEnumerable(target, source, reservedKeys) {
   var entries = [];
   for (var i = 0; i < keys.length; i += 1) {
     var k = keys[i];
-    if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
+    if (pick.isPoisonedKey(k)) continue;
     if (reserved[k]) continue;
     entries.push([k, source[k]]);
   }
@@ -445,6 +589,7 @@ module.exports.auditShape = auditShape;
 module.exports.optionalBoolean = optionalBoolean;
 module.exports.optionalPositiveInt = optionalPositiveInt;
 module.exports.optionalFiniteNonNegative = optionalFiniteNonNegative;
+module.exports.optionalDate = optionalDate;
 module.exports.optionalPositiveFinite = optionalPositiveFinite;
 module.exports.optionalPort = optionalPort;
 module.exports.optionalFunction = optionalFunction;
@@ -456,6 +601,7 @@ module.exports.requireNonEmptyString = requireNonEmptyString;
 module.exports.observabilityShape = observabilityShape;
 module.exports.requireObject = requireObject;
 module.exports.requireMethods = requireMethods;
+module.exports.shape = shape;
 module.exports.applyDefaults = applyDefaults;
 module.exports.makeAuditEmitter = makeAuditEmitter;
 module.exports.makeNamespacedEmitters = makeNamespacedEmitters;

package/lib/vault/index.js

@@ -681,6 +681,11 @@ module.exports = {
   init:                  init,
   seal:                  seal,
   unseal:                unseal,
+  // The default sealed-storage Store: a { seal, unseal } pair backed by the
+  // in-process vault key. b.cert.create (and other sealed-disk consumers)
+  // resolve `opts.vault || getDefaultStore()`; documented in their @opts.
+  getDefaultStore:       function () { return { seal: seal, unseal: unseal }; },
+  Store:                 { seal: seal, unseal: unseal },
   getDerivedHashSalt:    getDerivedHashSalt,
   getDerivedHashMacKey:  getDerivedHashMacKey,
   _zeroizeAndReplace:    _zeroizeAndReplace,

package/lib/vault/passphrase-ops.js

@@ -38,6 +38,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("../atomic-file");
+var C = require("../constants");
 var frameworkFiles = require("../framework-files");
 var vaultWrap = require("./wrap");
 var { defineClass } = require("../framework-error");
@@ -75,17 +76,6 @@ function _requirePassphrase(opts, fieldName) {
   }
 }
 
-// fsync-by-path semantic: open then sync then close. atomicFile.fsync
-// expects an already-open fd; this wrapper opens the file we just
-// wrote, flushes its contents, and closes — the right shape when we
-// don't have the original write fd around.
-function _fsyncPath(p) {
-  try {
-    var fd = nodeFs.openSync(p, "r+");
-    try { atomicFile.fsync(fd); } finally { nodeFs.closeSync(fd); }
-  } catch (_e) { /* best-effort across filesystems */ }
-}
-
 // ---- Pre-flight checks (no side effects) ----
 
 function preflightSealable(opts) {
@@ -142,16 +132,18 @@ async function seal(opts) {
   var p = _paths(opts.dataDir);
   var keepPlaintext = !!opts.keepPlaintext;
 
-  var plainBytes = nodeFs.readFileSync(p.plaintext);
+  var plainBytes = atomicFile.fdSafeReadSync(p.plaintext, { maxBytes: C.BYTES.kib(64) });
   var sealedBytes = await vaultWrap.wrap(plainBytes, opts.passphrase);
 
-  // Step 1: write sealed.tmp + fsync
-  nodeFs.writeFileSync(p.sealedTmp, sealedBytes, { mode: 0o600 });
-  _fsyncPath(p.sealedTmp);
+  // Step 1: write sealed.tmp (exclusive + no-follow create, fsynced) — a
+  // bare writeFileSync to this PREDICTABLE temp name would follow a symlink
+  // pre-planted at sealed.tmp (CWE-59); writeExclSync clears any stale entry
+  // then creates with O_EXCL | O_NOFOLLOW and fsyncs the bytes.
+  atomicFile.writeExclSync(p.sealedTmp, sealedBytes, { fileMode: 0o600 });
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 2: round-trip verify the .tmp before committing the rename
-  var verifyBytes = nodeFs.readFileSync(p.sealedTmp);
+  var verifyBytes = atomicFile.fdSafeReadSync(p.sealedTmp, { maxBytes: C.BYTES.kib(64) });
   var unwrapped;
   try {
     unwrapped = await vaultWrap.unwrap(verifyBytes, opts.passphrase);
@@ -195,7 +187,7 @@ async function unseal(opts) {
   }
   var p = _paths(opts.dataDir);
 
-  var sealedBytes = nodeFs.readFileSync(p.sealed);
+  var sealedBytes = atomicFile.fdSafeReadSync(p.sealed, { maxBytes: C.BYTES.kib(64) });
   var plainBytes;
   try {
     plainBytes = await vaultWrap.unwrap(sealedBytes, opts.passphrase);
@@ -205,13 +197,15 @@ async function unseal(opts) {
       " — " + SEALED_NAME + " is UNCHANGED");
   }
 
-  // Step 1: write plaintext.tmp + fsync
-  nodeFs.writeFileSync(p.plaintextTmp, plainBytes, { mode: 0o600 });
-  _fsyncPath(p.plaintextTmp);
+  // Step 1: write plaintext.tmp (exclusive + no-follow create, fsynced) — a
+  // bare writeFileSync to this PREDICTABLE temp name would follow a symlink
+  // pre-planted at plaintext.tmp (CWE-59); writeExclSync clears any stale
+  // entry then creates with O_EXCL | O_NOFOLLOW and fsyncs the bytes.
+  atomicFile.writeExclSync(p.plaintextTmp, plainBytes, { fileMode: 0o600 });
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 2: round-trip sanity — re-read tmp and verify
-  var verifyBytes = nodeFs.readFileSync(p.plaintextTmp);
+  var verifyBytes = atomicFile.fdSafeReadSync(p.plaintextTmp, { maxBytes: C.BYTES.kib(64) });
   if (Buffer.compare(verifyBytes, plainBytes) !== 0) {
     try { nodeFs.unlinkSync(p.plaintextTmp); } catch (_e) { /* cleanup */ }
     throw new VaultPassphraseError("vault-passphrase/verify-mismatch",
@@ -246,7 +240,7 @@ async function rotate(opts) {
   }
   var p = _paths(opts.dataDir);
 
-  var sealedBytes = nodeFs.readFileSync(p.sealed);
+  var sealedBytes = atomicFile.fdSafeReadSync(p.sealed, { maxBytes: C.BYTES.kib(64) });
   var plainBytes;
   try {
     plainBytes = await vaultWrap.unwrap(sealedBytes, opts.oldPassphrase);
@@ -257,14 +251,16 @@ async function rotate(opts) {
   }
   var newSealedBytes = await vaultWrap.wrap(plainBytes, opts.newPassphrase);
 
-  // Step 1: write new sealed.tmp + fsync
-  nodeFs.writeFileSync(p.sealedTmp, newSealedBytes, { mode: 0o600 });
-  _fsyncPath(p.sealedTmp);
+  // Step 1: write new sealed.tmp (exclusive + no-follow create, fsynced) — a
+  // bare writeFileSync to this PREDICTABLE temp name would follow a symlink
+  // pre-planted at sealed.tmp (CWE-59); writeExclSync clears any stale entry
+  // then creates with O_EXCL | O_NOFOLLOW and fsyncs the bytes.
+  atomicFile.writeExclSync(p.sealedTmp, newSealedBytes, { fileMode: 0o600 });
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 2: round-trip verify with NEW passphrase, AND assert unwrap
   // with the OLD passphrase fails — otherwise the rotation didn't take.
-  var verifyBytes = nodeFs.readFileSync(p.sealedTmp);
+  var verifyBytes = atomicFile.fdSafeReadSync(p.sealedTmp, { maxBytes: C.BYTES.kib(64) });
   var verifyPlain;
   try { verifyPlain = await vaultWrap.unwrap(verifyBytes, opts.newPassphrase); }
   catch (e) {

package/lib/vault/passphrase-source.js

@@ -23,10 +23,10 @@
  * exposure to later env-dump surfaces. This doesn't zero the memory
  * (JavaScript can't) but does remove the env-object reference.
  */
-var nodeFs = require("node:fs");
 var readline = require("node:readline");
 var safeEnv = require("../parsers/safe-env");
 var safeBuffer = require("../safe-buffer");
+var atomicFile = require("../atomic-file");
 
 var MAX_PASSPHRASE_BYTES = 4096;
 
@@ -83,9 +83,14 @@ async function fromFile(filePath, opts) {
   }
   var raw;
   try {
-    raw = nodeFs.readFileSync(filePath);
+    // Cap the passphrase-file read at MAX_PASSPHRASE_BYTES at READ time (was only
+    // checked AFTER the whole file was in memory), so a swapped multi-GiB target
+    // can't OOM boot before validatePassphraseBuffer. NO refuseSymlink: the
+    // BLAMEJS_VAULT_PASSPHRASE_FILE is frequently a k8s projected-secret mount,
+    // which is a symlink chain — following it is correct.
+    raw = atomicFile.fdSafeReadSync(filePath, { maxBytes: MAX_PASSPHRASE_BYTES });
   } catch (e) {
-    throw new Error("failed to read " + envVars.file + " (" + filePath + "): " + e.code);
+    throw new Error("failed to read " + envVars.file + " (" + filePath + "): " + (e.code || e.message));
   }
   var buf = trimTrailingNewlines(raw);
   validatePassphraseBuffer(buf, "file source (" + filePath + ")");

package/lib/vault/rotate.js

@@ -493,16 +493,11 @@ function _emit(cb, ev) {
 // staging dir is already 0o700 owner-only, so this is defense in depth
 // against a same-user pre-plant / symlink swap (CWE-377 / CWE-379 / CWE-59).
 function _writeStagedFileExclusive(p, data) {
-  try { nodeFs.unlinkSync(p); } catch (_e) { /* no stale entry to clear */ }
-  var fd = nodeFs.openSync(p,
-    nodeFs.constants.O_WRONLY | nodeFs.constants.O_CREAT |
-      nodeFs.constants.O_EXCL | (nodeFs.constants.O_NOFOLLOW || 0), 0o600);
-  try {
-    nodeFs.writeFileSync(fd, data);
-    nodeFs.fsyncSync(fd);
-  } finally {
-    nodeFs.closeSync(fd);
-  }
+  // The clear-stale + O_EXCL|O_NOFOLLOW create + write + fsync sequence now
+  // lives in the atomic-file primitive (also used by the vault passphrase
+  // seal/unseal staging writes) so every staged exclusive write shares one
+  // implementation.
+  atomicFile.writeExclSync(p, data, { fileMode: 0o600 });
 }
 
 function _reSealValue(sealedValue, oldKeys, newKeys) {
@@ -759,7 +754,7 @@ async function rotate(opts) {
     // Stage via the exclusive-create + fsync helper rather than a plain copy,
     // so the verbatim file is durable at write time (no later by-path fsync)
     // and a pre-planted file/symlink at the staging path hard-fails.
-    _writeStagedFileExclusive(dest, nodeFs.readFileSync(src));
+    _writeStagedFileExclusive(dest, atomicFile.fdSafeReadSync(src, { maxBytes: C.BYTES.mib(64) }));
   }
   for (var vd = 0; vd < paths.verbatimDirs.length; vd++) {
     var dent = paths.verbatimDirs[vd];
@@ -797,7 +792,7 @@ async function rotate(opts) {
   var dbKeySealedPath = nodePath.join(dataDir, paths.dbKeySealed);
   var dbKey = null;
   if (nodeFs.existsSync(dbKeySealedPath)) {
-    var sealedKey = nodeFs.readFileSync(dbKeySealedPath, "utf8").trim();
+    var sealedKey = atomicFile.fdSafeReadSync(dbKeySealedPath, { maxBytes: C.BYTES.kib(64), encoding: "utf8" }).trim();
     if (vaultAad.isAadSealed(sealedKey)) {
       // AAD-bound db.key.enc (db.js since v0.14.7): unseal under the OLD
       // root with the deployment-context AAD, then re-emit under the NEW
@@ -832,7 +827,7 @@ async function rotate(opts) {
       }
       continue;
     }
-    var current = nodeFs.readFileSync(asSrc, "utf8").trim();
+    var current = atomicFile.fdSafeReadSync(asSrc, { maxBytes: C.BYTES.mib(1), encoding: "utf8" }).trim();
     if (current.indexOf(C.VAULT_PREFIX) !== 0) {
       throw new VaultRotateError("vault-rotate/bad-sealed",
         "rotate: sealed file does not start with the vault prefix: " + ase.relativePath);
@@ -854,11 +849,11 @@ async function rotate(opts) {
     // Stage via the exclusive-create + fsync helper (not a plain copy) so the
     // salt is durable at write time and no later by-path fsync is needed.
     _writeStagedFileExclusive(nodePath.join(stagingDir, "vault.derived-hash-salt"),
-      nodeFs.readFileSync(saltSrc));
+      atomicFile.fdSafeReadSync(saltSrc, { maxBytes: C.BYTES.kib(4) }));
   }
   var macSrc = nodePath.join(dataDir, "vault.derived-hash-mac.sealed");
   if (nodeFs.existsSync(macSrc)) {
-    var macCurrent = nodeFs.readFileSync(macSrc, "utf8").trim();
+    var macCurrent = atomicFile.fdSafeReadSync(macSrc, { maxBytes: C.BYTES.kib(64), encoding: "utf8" }).trim();
     if (macCurrent.indexOf(C.VAULT_PREFIX) === 0) {
       _writeStagedFileExclusive(nodePath.join(stagingDir, "vault.derived-hash-mac.sealed"),
         _reSealValue(macCurrent, oldKeys, newKeys));
@@ -873,7 +868,7 @@ async function rotate(opts) {
   var verifyResult = null;
 
   if (nodeFs.existsSync(encDbPath) && dbKey) {
-    var packed = nodeFs.readFileSync(encDbPath);
+    var packed = atomicFile.fdSafeReadSync(encDbPath, { maxBytes: C.BYTES.gib(2) });
     // db.enc is XChaCha20-Poly1305-sealed AAD-bound to its dataDir
     // (db.js _dbEncAad). Read with the dataDir AAD; retry without AAD for
     // pre-AAD envelopes (mirrors db.js:765-768). The in-place swap keeps
@@ -945,7 +940,7 @@ async function rotate(opts) {
     // _writeStagedFileExclusive — exclusive + no-follow create, owner-only
     // 0o600 — so a same-user pre-plant or symlink swap is a hard failure
     // rather than a followed write, and the bytes never inherit a wider mode.
-    var rotatedBytes = nodeFs.readFileSync(tmpDbPath);
+    var rotatedBytes = atomicFile.fdSafeReadSync(tmpDbPath, { maxBytes: C.BYTES.gib(2) });
     // Re-encrypt under the SAME dataDir AAD so db.init's AAD-first open
     // succeeds after the staged dir is swapped over dataDir in place.
     _writeStagedFileExclusive(nodePath.join(stagingDir, paths.encryptedDb),
@@ -956,7 +951,7 @@ async function rotate(opts) {
     _emit(progress, { phase: "verify" });
     var verifyTmp = nodePath.join(stagingDir, "_blamejs_verify.tmp.db");
     _writeStagedFileExclusive(verifyTmp,
-      bCrypto.decryptPacked(nodeFs.readFileSync(nodePath.join(stagingDir, paths.encryptedDb)), dbKey, dbEncAad));
+      bCrypto.decryptPacked(atomicFile.fdSafeReadSync(nodePath.join(stagingDir, paths.encryptedDb), { maxBytes: C.BYTES.gib(2) }), dbKey, dbEncAad));
     var vdb = new DatabaseSync(verifyTmp);
     try {
       verifyResult = verify({ keys: newKeys, db: vdb, oldKeys: oldKeys });

package/lib/vault/seal-pem-file.js

@@ -185,7 +185,6 @@ function sealPemFile(opts) {
   // optionalPositiveFinite above already threw on a bad-shaped opts.pollInterval;
   // here only undefined / null / valid-positive-finite remain.
   var pollInterval  = opts.pollInterval || DEFAULT_POLL_MS;
-  var auditOn       = opts.audit !== false;
   var onResealed    = typeof opts.onResealed === "function" ? opts.onResealed : null;
   var onError       = typeof opts.onError === "function" ? opts.onError : null;
   validateOpts.optionalPositiveFinite(opts.maxSourceBytes,
@@ -200,16 +199,7 @@ function sealPemFile(opts) {
   var resealing        = false;
   var pendingMtime     = null;
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "vault.seal_pem_file." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("vault.seal_pem_file", opts.audit);
 
   function _writeSealed(plaintextBytes) {
     // atomicFile.writeSync already does the .tmp + fsync + rename +
@@ -242,7 +232,10 @@ function sealPemFile(opts) {
       }
     }
     var sealed = vault().seal(plaintextBytes);
-    nodeFs.writeFileSync(markerPath, String(Date.now()), { mode: 0o600 });   // POSIX file mode
+    // Atomic, symlink-refusing marker write (matches the destination write
+    // just below) — a bare writeFileSync would follow a symlink planted at
+    // markerPath (CWE-59).
+    atomicFile.writeSync(markerPath, String(Date.now()), { fileMode: 0o600 });   // POSIX file mode
     try {
       atomicFile.writeSync(destination, sealed, { fileMode: 0o600 });    // POSIX file mode
     } catch (e) {
@@ -274,43 +267,35 @@ function sealPemFile(opts) {
       // source isn't a symlink we don't expect, then read via fd so
       // a swap-after-stat doesn't change which bytes we read.
       try {
-        var lstat = nodeFs.lstatSync(source);
-        if (lstat.isSymbolicLink()) {
-          throw new SealPemFileError("seal-pem-file/symlink-refused",
-            "source is a symlink (refused; follow + re-stat opens TOCTOU)");
-        }
-        if (lstat.size > maxSourceBytes) {
-          throw new SealPemFileError("seal-pem-file/source-too-large",
-            "source size " + lstat.size + " exceeds maxSourceBytes " + maxSourceBytes);
-        }
-        // CodeQL js/file-system-race: the open-fd + fstat + inode-equality
-        // check (this block and the next) IS the TOCTOU defense. lstat ran
-        // above, then we open(O_NOFOLLOW-equivalent via the symlink refusal
-        // above) and rebind every subsequent measurement to the fd's inode.
-        // Any swap between lstat and open is detected by the fstat.ino !==
-        // lstat.ino branch below and refused as toctou-detected.
-        var fd = nodeFs.openSync(source, "r");
-        try {
-          var fstat = nodeFs.fstatSync(fd);
-          // H6 #3 — confirm the fd points at the same inode lstat saw.
-          if (fstat.ino !== lstat.ino || fstat.size > maxSourceBytes) {
-            throw new SealPemFileError("seal-pem-file/toctou-detected",
-              "source mutated between lstat and open (TOCTOU defense)");
-          }
-          plaintext = Buffer.alloc(fstat.size);
-          var read = 0;
-          while (read < fstat.size) {
-            var n = nodeFs.readSync(fd, plaintext, read, fstat.size - read, null);
-            if (n === 0) break;
-            read += n;
-          }
-          if (read !== fstat.size) {
-            throw new SealPemFileError("seal-pem-file/short-read",
-              "short read: " + read + " of " + fstat.size + " bytes");
-          }
-        } finally {
-          try { nodeFs.closeSync(fd); } catch (_e) { /* close best-effort */ }
-        }
+        // TOCTOU-safe read via atomic-file with the strongest guards:
+        // symlink refusal + inode-equality + a byte cap. The bespoke
+        // SealPemFileError codes/messages are preserved via errorFor; this
+        // call sits inside the outer try/catch that wraps any failure into
+        // seal-pem-file/source-read-failed + audit + the onError callback.
+        plaintext = atomicFile.fdSafeReadSync(source, {
+          refuseSymlink: true,
+          inodeCheck:    true,
+          maxBytes:      maxSourceBytes,
+          errorFor: function (kind, detail) {
+            if (kind === "symlink") {
+              return new SealPemFileError("seal-pem-file/symlink-refused",
+                "source is a symlink (refused; follow + re-stat opens TOCTOU)");
+            }
+            if (kind === "too-large") {
+              return new SealPemFileError("seal-pem-file/source-too-large",
+                "source size " + detail.size + " exceeds maxSourceBytes " + maxSourceBytes);
+            }
+            if (kind === "toctou") {
+              return new SealPemFileError("seal-pem-file/toctou-detected",
+                "source mutated between lstat and open (TOCTOU defense)");
+            }
+            if (kind === "short-read") {
+              return new SealPemFileError("seal-pem-file/short-read",
+                "short read: " + detail.read + " of " + detail.size + " bytes");
+            }
+            return undefined;
+          },
+        });
       }
       catch (e) {
         var err = new SealPemFileError("seal-pem-file/source-read-failed",

package/lib/vault-aad.js

@@ -48,6 +48,7 @@
 
 var lazyRequire     = require("./lazy-require");
 var validateOpts    = require("./validate-opts");
+var pick            = require("./pick");
 var C               = require("./constants");
 var { defineClass } = require("./framework-error");
 var VaultAadError = defineClass("VaultAadError", { alwaysPermanent: true });
@@ -80,7 +81,7 @@ function _canonicalize(parts) {
   chunks.push(Buffer.from([AAD_VERSION]));
   for (var i = 0; i < keys.length; i += 1) {
     var key = keys[i];
-    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+    if (pick.isPoisonedKey(key)) {
       throw new VaultAadError("vault-aad/bad-aad",
         "AAD field name " + JSON.stringify(key) + " is forbidden (poisoned key)");
     }
@@ -130,7 +131,7 @@ function buildContextAad(parts) {
   var out = {};
   for (var k in parts) {
     if (!Object.prototype.hasOwnProperty.call(parts, k)) continue;
-    if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
+    if (pick.isPoisonedKey(k)) continue;
     if (parts[k] == null) continue;
     out[k] = parts[k];
   }

package/lib/vc.js

@@ -226,7 +226,7 @@ function _verifyJose(token, opts, expectedTyp) {
     throw new VcError("vc/crit-unsupported",
       "vc.verify: JWS 'crit' header lists extensions this verifier does not support (RFC 7515 §4.1.11)");
   }
-  if (header.alg === "none" || !JOSE_ALGS[header.alg]) {
+  if (header.alg === "none" || !Object.prototype.hasOwnProperty.call(JOSE_ALGS, header.alg)) {
     throw new VcError("vc/bad-alg", "vc.verify: unsupported or unsecured JWS alg '" + header.alg + "'");
   }
   if (opts.algorithms.indexOf(header.alg) === -1) {
@@ -316,13 +316,8 @@ async function verify(secured, opts) {
   if (!opts.publicKey && typeof opts.keyResolver !== "function") {
     throw new VcError("vc/no-key", "vc.verify: pass publicKey or keyResolver");
   }
-  var at = new Date();
-  if (opts.at !== undefined && opts.at !== null) {
-    if (!(opts.at instanceof Date) || !isFinite(opts.at.getTime())) {
-      throw new VcError("vc/bad-at", "vc.verify: opts.at must be a valid Date");
-    }
-    at = opts.at;
-  }
+  validateOpts.optionalDate(opts.at, "vc.verify: opts.at", VcError, "vc/bad-at");
+  var at = (opts.at !== undefined && opts.at !== null) ? opts.at : new Date();
 
   var result = await _verifySecured(secured, opts, JOSE_TYP, COSE_TYP);