@blamejs/core 0.15.12 → 0.15.14

package/lib/auth/sd-jwt-vc.js

@@ -212,7 +212,7 @@ function issue(opts) {
       "issue: algorithm must be one of " + SUPPORTED_ALGS.join(", "));
   }
   var hashAlg = opts.hashAlg || DEFAULT_HASH_ALG;
-  if (!SUPPORTED_HASH_ALGS[hashAlg]) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, hashAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "issue: hashAlg must be one of " + Object.keys(SUPPORTED_HASH_ALGS).join(", "));
   }
@@ -413,8 +413,8 @@ async function verify(presentation, opts) {
   validateOpts.requireObject(opts, "auth.sdJwtVc.verify", AuthError);
   validateOpts(opts, [
     "issuerKeyResolver", "audience", "nonce",
-    "now", "expectedVct", "maxClockSkewSec",
-    "requireKeyBinding",
+    "now", "expectedVct", "expectedIssuer", "maxClockSkewSec",
+    "requireKeyBinding", "requireExp",
     "keyAttestationVerifier", "requireKeyAttestation",
   ], "auth.sdJwtVc.verify");
 
@@ -528,6 +528,15 @@ async function verify(presentation, opts) {
     throw new AuthError("auth-sd-jwt-vc/iat-future",
       "verify: iat is in the future (clock skew?)");
   }
+  // SD-JWT-VC makes `exp` OPTIONAL, so the default only checks it when present.
+  // Operators with a time-bounded trust expectation (esp. for FOREIGN issuers
+  // resolved via issuerKeyResolver) pass requireExp:true to fail closed on a
+  // missing / non-numeric exp — mirroring jwt-external's unconditional exp
+  // requirement (a credential that never expires is accepted otherwise).
+  if (opts.requireExp === true && typeof jwtParsed.payload.exp !== "number") {
+    throw new AuthError("auth-sd-jwt-vc/missing-exp",
+      "verify: requireExp is set but the credential has no numeric exp claim");
+  }
   if (typeof jwtParsed.payload.exp === "number" && jwtParsed.payload.exp < nowSec - skew) {
     throw new AuthError("auth-sd-jwt-vc/expired",
       "verify: token is expired");
@@ -556,7 +565,7 @@ async function verify(presentation, opts) {
   // to its own DEFAULT_HASH_ALG (`sha3-512`) which broke verification
   // against spec-conformant issuers when `_sd_alg` was omitted.
   var hashAlg = jwtParsed.payload._sd_alg || "sha-256";
-  if (!SUPPORTED_HASH_ALGS[hashAlg]) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_HASH_ALGS, hashAlg)) {
     throw new AuthError("auth-sd-jwt-vc/bad-hash",
       "verify: _sd_alg \"" + hashAlg + "\" not supported");
   }
@@ -636,8 +645,19 @@ async function verify(presentation, opts) {
     // refused with the precise alg-mismatch error rather than handed to
     // node:crypto.verify.
     jwtExternal._assertAlgKtyMatch(kbAlg, holderKey);
-    var holderKeyObj = nodeCrypto.createPublicKey({ key: holderKey, format: "jwk" });
+    var holderKeyObj = bCrypto.importPublicJwk(holderKey);
     var kbParsed = _verifyJwt(maybeKbJwt, holderKeyObj, kbAlg);
+    // A KB-JWT proves holder possession of THIS presentation's bytes (sd_hash),
+    // but binds it to a verifier + a fresh challenge only via aud + nonce. If
+    // the caller processes a KB-JWT without supplying both, the aud/nonce
+    // compares below would silently skip — making the presentation replayable
+    // and acceptable at any verifier. Fail CLOSED: require both (oid4vp always
+    // supplies them). RFC: SD-JWT-VC §KB-JWT / OIDC4VP nonce binding.
+    if (typeof opts.audience !== "string" || opts.audience.length === 0 ||
+        typeof opts.nonce !== "string" || opts.nonce.length === 0) {
+      throw new AuthError("auth-sd-jwt-vc/missing-replay-binding",
+        "verify: a KB-JWT requires opts.audience + opts.nonce to bind the presentation to this verifier and a fresh challenge (replay / audience-redirection defense)");
+    }
     // Constant-time compares: the nonce is a verifier-issued replay-defense
     // value, so a short-circuiting !== leaks a matching-prefix timing oracle.
     // Matches the sd_hash check below (the framework's hash/token discipline).

package/lib/auth/status-list.js

@@ -69,16 +69,16 @@ var MAX_LIST_BYTES = C.BYTES.mib(1);
 
 function _b64url(buf) { return bCrypto.toBase64Url(buf); }
 
-function _fromB64url(s) {
-  try { return bCrypto.fromBase64Url(s); }
-  catch (_e) {
-    throw new StatusListError("status-list/bad-base64",
-      "status-list segment is not valid base64url");
-  }
-}
+// No typeMessage — a non-string input falls into the decode-failure path,
+// matching this sink's original catch-everything behavior.
+var _fromB64url = bCrypto.makeBase64UrlDecoder({
+  errorClass: StatusListError,
+  code:       "status-list/bad-base64",
+  badMessage: "status-list segment is not valid base64url",
+});
 
 function _validateBits(bits) {
-  if (!SUPPORTED_BIT_SIZES[bits]) {
+  if (!Object.prototype.hasOwnProperty.call(SUPPORTED_BIT_SIZES, bits)) {
     throw new StatusListError("status-list/bad-bits",
       "statusList: bits must be 1, 2, 4, or 8 (draft §6.1.1) — got " + bits);
   }
@@ -249,7 +249,19 @@ async function fromJwt(token, opts) {
     list: {
       size:     size,
       bits:     bits,
-      get:      function (idx) { return _getAt(inflated, bits, idx); },
+      // Bounds-check the relying-party status read, mirroring create().get. An
+      // out-of-range index must FAIL CLOSED (throw): _getAt over-reads the buffer
+      // and returns 0 for an out-of-bounds index, and status 0 = VALID — so a
+      // credential whose status_list index points past the list would otherwise
+      // read as "not revoked", a revocation bypass.
+      get:      function (idx) {
+        if (typeof idx !== "number" || idx < 0 || idx >= size || (idx >> 0) !== idx) {
+          throw new StatusListError("status-list/bad-index",
+            "statusList.fromJwt get: idx out of range — got " + idx + ", size=" + size +
+            " (an out-of-range status index fails closed, never reads as status 0/valid)");
+        }
+        return _getAt(inflated, bits, idx);
+      },
       snapshot: function () { return { size: size, bits: bits, bytes: Buffer.from(inflated) }; },
     },
     claims: claims,

package/lib/auth/step-up.js

@@ -64,6 +64,7 @@ var lazyRequire      = require("../lazy-require");
 var validateOpts     = require("../validate-opts");
 var safeJson         = require("../safe-json");
 var structuredFields = require("../structured-fields");
+var codepointClass   = require("../codepoint-class");
 var C                = require("../constants");
 var { AuthError }    = require("../framework-error");
 
@@ -86,7 +87,7 @@ function _quote(value) {
   // Reject CTLs and quote-injecting characters.
   for (var i = 0; i < value.length; i += 1) {
     var code = value.charCodeAt(i);
-    if (code < 32 || code === 127) {                                    // ASCII control codepoints
+    if (codepointClass.isForbiddenControlChar(code, { forbidTab: true })) {  // ASCII control codepoints
       throw new AuthError("auth-step-up/bad-challenge",
         "challenge value contains control character at index " + i);
     }
@@ -378,22 +379,23 @@ function parseChallenge(headerValue) {
   if (rest.length === 0) return null;
   var out = { error: null, scope: null, acrValues: null, maxAge: null, raw: {} };
   // Split on commas at top level, but respect quoted strings.
-  var tokens = _splitWwwAuth(rest);
-  for (var i = 0; i < tokens.length; i += 1) {
-    var token = tokens[i].trim();
-    var eq = token.indexOf("=");
-    if (eq === -1) continue;
-    var key = token.slice(0, eq).trim().toLowerCase();
-    var val = token.slice(eq + 1).trim();
-    if (val.length >= 2 && val.charAt(0) === '"' && val.charAt(val.length - 1) === '"') {
-      val = val.slice(1, val.length - 1);
-    }
+  var kvps = structuredFields.parseKeyValuePieces(_splitWwwAuth(rest));
+  structuredFields.forEachKeyValue(kvps, function (key, val) {
+    val = structuredFields.stripDoubleQuotes(val);
     out.raw[key] = val;
     if (key === "error")              out.error     = val;
     else if (key === "scope")         out.scope     = val;
     else if (key === "acr_values")    out.acrValues = val.split(/\s+/);
-    else if (key === "max_age")       out.maxAge    = parseInt(val, 10);
-  }
+    else if (key === "max_age") {
+      // Defensive: a malformed max_age (non-numeric / negative) from the
+      // server's challenge must not land as NaN — a downstream `age > maxAge`
+      // comparison against NaN is always false and would silently mis-handle
+      // the freshness requirement. Omit it unless it parses to a non-negative
+      // integer, so callers fall back to their own default.
+      var ma = parseInt(val, 10);
+      if (isFinite(ma) && ma >= 0) out.maxAge = ma;
+    }
+  });
   return out;
 }
 

package/lib/auth-bot-challenge.js

@@ -40,6 +40,7 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var requestHelpers = require("./request-helpers");
 var validateOpts = require("./validate-opts");
+var numericBounds = require("./numeric-bounds");
 var { AuthBotChallengeError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -67,7 +68,7 @@ function _requireFunction(name, val) {
 }
 
 function _requirePositiveInt(name, val) {
-  if (typeof val !== "number" || !isFinite(val) || val < 1 || Math.floor(val) !== val) {
+  if (!numericBounds.isPositiveFiniteInt(val)) {
     throw new AuthBotChallengeError("auth-bot-challenge/bad-opt",
       name + ": expected positive integer, got " + JSON.stringify(val));
   }
@@ -88,13 +89,8 @@ function _requireKey(key) {
 }
 
 function _requireSessionStore(store) {
-  if (!store || typeof store !== "object" ||
-      typeof store.get !== "function" ||
-      typeof store.set !== "function" ||
-      typeof store.del !== "function") {
-    throw new AuthBotChallengeError("auth-bot-challenge/bad-opt",
-      "sessionStore must be a b.cache-shaped object (get/set/del)");
-  }
+  validateOpts.requireMethods(store, ["get", "set", "del"],
+    "sessionStore (b.cache-shaped)", AuthBotChallengeError, "auth-bot-challenge/bad-opt");
 }
 
 function _requireBotGuard(bg) {
@@ -105,14 +101,8 @@ function _requireBotGuard(bg) {
 }
 
 function _requireLockout(lk) {
-  if (!lk || typeof lk !== "object" ||
-      typeof lk.recordFailure !== "function" ||
-      typeof lk.recordSuccess !== "function" ||
-      typeof lk.check !== "function") {
-    throw new AuthBotChallengeError("auth-bot-challenge/bad-opt",
-      "lockout must be a b.auth.lockout-shaped instance " +
-      "(recordFailure/recordSuccess/check)");
-  }
+  validateOpts.requireMethods(lk, ["recordFailure", "recordSuccess", "check"],
+    "lockout (b.auth.lockout-shaped instance)", AuthBotChallengeError, "auth-bot-challenge/bad-opt");
 }
 
 function _defaultKeyExtractor(req) {
@@ -222,29 +212,9 @@ function create(opts) {
   var obsInst       = opts.observability || null;
   var clock         = opts.clock || Date.now;
 
-  function _emitObs(name, labels) {
-    var sink = obsInst || _safeGlobalObs();
-    if (!sink) return;
-    try { sink.event(name, 1, labels); } catch (_e) { /* drop-silent */ }
-  }
-
-  function _safeGlobalObs() {
-    try { return observability(); } catch (_e) { return null; }
-  }
+  var _emitObs = observability().makeCounterEmitter(obsInst);
 
-  function _emitAudit(action, key, outcome, metadata, req) {
-    if (!auditInst) return;
-    try {
-      var event = {
-        action:   action,
-        outcome:  outcome,
-        resource: { kind: "auth.bot_challenge", id: key },
-        metadata: metadata || {},
-      };
-      if (req) event.actor = requestHelpers.extractActorContext(req);
-      auditInst.safeEmit(event);
-    } catch (_e) { /* audit best-effort */ }
-  }
+  var _emitAudit = requestHelpers.makeResourceAuditEmitter(auditInst, "auth.bot_challenge");
 
   async function _readState(key) {
     try {
@@ -303,7 +273,25 @@ function create(opts) {
 
   // ---- Internal staircase advance ----
 
-  async function _advanceFailure(key, req) {
+  // Per-key serialization: the failure staircase is a read→increment→write on
+  // an async store, so concurrent recordFailure calls for the SAME key would
+  // both read N and both write N+1 (lost update), letting an attacker fire
+  // parallel failures to stay under the challenge / lockout thresholds. A
+  // per-key promise chain applies advances for a key sequentially. (Cross-node
+  // atomicity additionally needs an atomic store; this fixes the in-process
+  // race the gate actually depends on.)
+  var _advanceChains = new Map();
+  function _advanceFailure(key, req) {
+    var prev = _advanceChains.get(key) || Promise.resolve();
+    var run = prev.then(function () { return _doAdvanceFailure(key, req); },
+                        function () { return _doAdvanceFailure(key, req); });
+    var tail = run.then(function () {}, function () {});
+    _advanceChains.set(key, tail);
+    tail.then(function () { if (_advanceChains.get(key) === tail) _advanceChains.delete(key); });
+    return run;
+  }
+
+  async function _doAdvanceFailure(key, req) {
     var now = clock();
     var state = await _readState(key) || {
       stage: STATE_NEW, failures: 0, challengedAt: null, passedAt: null,

package/lib/backup/bundle.js

@@ -148,33 +148,30 @@ async function create(opts) {
     // earlier required-vs-skip branch above (existsSync → continue when
     // not entry.required) is honored before we reach this point; the
     // dest path is then computed from entry.relativePath, not srcPath.
-    var plain;
-    var srcFd = nodeFs.openSync(srcPath, "r");
-    try {
-      var srcStat = nodeFs.fstatSync(srcFd);
-      plain = Buffer.alloc(srcStat.size);
-      var read = 0;
-      while (read < srcStat.size) {
-        var n = nodeFs.readSync(srcFd, plain, read, srcStat.size - read, null);
-        if (n === 0) break;
-        read += n;
-      }
-      if (read !== srcStat.size) {
-        throw new BackupBundleError("backup-bundle/short-read",
-          "create: short read on '" + entry.relativePath + "': " + read + " of " + srcStat.size + " bytes");
-      }
-    } finally {
-      try { nodeFs.closeSync(srcFd); } catch (_c) { /* close best-effort */ }
-    }
+    // TOCTOU-safe read via atomic-file; the short-read message keeps the
+    // per-entry relativePath context via errorFor.
+    var plain = atomicFile.fdSafeReadSync(srcPath, {
+      errorFor: function (kind, detail) {
+        if (kind === "short-read") {
+          return new BackupBundleError("backup-bundle/short-read",
+            "create: short read on '" + entry.relativePath + "': " + detail.read + " of " + detail.size + " bytes");
+        }
+        return undefined;
+      },
+    });
     var checksum = bCrypto.checksum(plain);
-    var encResult = await bCrypto.encryptWithFreshSalt(plain, passphrase);
+    // Bind the ciphertext to this blob's canonical relativePath as AEAD
+    // associated data. A blob copied to a different manifest entry (the
+    // restore-corruption / blob-remap attack) then fails the Poly1305 tag on
+    // restore — tamper-evident even on an unsigned bundle (manifest.aadBound).
+    var encResult = await bCrypto.encryptWithFreshSalt(plain, passphrase, entry.relativePath);
     var encPath = _encryptedPathFor(entry.relativePath);
     var destFull = nodePath.join(outDir, encPath);
     atomicFile.ensureDir(nodePath.dirname(destFull));
     atomicFile.writeSync(destFull, encResult.encrypted, { fileMode: 0o600 });
 
     var kind = entry.kind || "raw";
-    if (!backupManifest.VALID_KINDS[kind]) {
+    if (!Object.prototype.hasOwnProperty.call(backupManifest.VALID_KINDS, kind)) {
       throw new BackupBundleError("backup-bundle/bad-kind",
         "create: files[" + i + "].kind must be one of raw, vault-sealed, plaintext (got '" + kind + "')");
     }
@@ -212,6 +209,7 @@ async function create(opts) {
     vaultKeyEnc:  wrappedVk.encrypted.toString("base64"),
     files:        fileEntries,
     metadata:     opts.metadata || undefined,
+    aadBound:     true,   // every blob above was sealed with its relativePath as AEAD AAD
   });
   // Sign the manifest with the audit-sign keypair so a tampered
   // manifest fails verification on restore. The signer is best-

package/lib/backup/crypto.js

@@ -117,7 +117,21 @@ async function deriveKey(passphrase, saltHex, opts) {
   return hash;
 }
 
-async function encryptWithPassphrase(plaintext, passphrase, saltHex) {
+// Normalize optional associated-authenticated-data (AAD) into the
+// Uint8Array the AEAD expects, or undefined when none. AAD is NOT encrypted
+// but IS authenticated: ciphertext sealed under one AAD fails the Poly1305
+// tag when decrypted under a different AAD. Backup file blobs pass their
+// canonical relativePath so a blob remapped to a different manifest entry is
+// cryptographically rejected (the blob-remap / restore-corruption defense).
+function _aadBytes(aad) {
+  if (aad === undefined || aad === null) return undefined;
+  if (Buffer.isBuffer(aad)) return new Uint8Array(aad);
+  if (typeof aad === "string") return new Uint8Array(Buffer.from(aad, "utf8"));
+  throw new BackupCryptoError("backup-crypto/bad-aad",
+    "associated data must be a Buffer or string");
+}
+
+async function encryptWithPassphrase(plaintext, passphrase, saltHex, aad) {
   if (!Buffer.isBuffer(plaintext) && typeof plaintext !== "string") {
     throw new BackupCryptoError("backup-crypto/bad-plaintext",
       "encryptWithPassphrase: plaintext must be a Buffer or string");
@@ -125,11 +139,11 @@ async function encryptWithPassphrase(plaintext, passphrase, saltHex) {
   var plainBuf = Buffer.isBuffer(plaintext) ? plaintext : Buffer.from(plaintext, "utf8");
   var key = await deriveKey(passphrase, saltHex);
   var nonce = nodeCrypto.randomBytes(NONCE_BYTES);
-  var ct = xchacha20poly1305(new Uint8Array(key), nonce).encrypt(new Uint8Array(plainBuf));
+  var ct = xchacha20poly1305(new Uint8Array(key), nonce, _aadBytes(aad)).encrypt(new Uint8Array(plainBuf));
   return Buffer.concat([nonce, Buffer.from(ct)]);
 }
 
-async function decryptWithPassphrase(encrypted, passphrase, saltHex) {
+async function decryptWithPassphrase(encrypted, passphrase, saltHex, aad) {
   if (!Buffer.isBuffer(encrypted)) {
     throw new BackupCryptoError("backup-crypto/bad-input",
       "decryptWithPassphrase: encrypted must be a Buffer");
@@ -143,11 +157,11 @@ async function decryptWithPassphrase(encrypted, passphrase, saltHex) {
   var ct    = encrypted.subarray(NONCE_BYTES);
   var plain;
   try {
-    plain = xchacha20poly1305(new Uint8Array(key), new Uint8Array(nonce))
+    plain = xchacha20poly1305(new Uint8Array(key), new Uint8Array(nonce), _aadBytes(aad))
       .decrypt(new Uint8Array(ct));
   } catch (e) {
     throw new BackupCryptoError("backup-crypto/decrypt-failed",
-      "XChaCha20-Poly1305 decryption failed (wrong passphrase or tampered ciphertext): " +
+      "XChaCha20-Poly1305 decryption failed (wrong passphrase, tampered ciphertext, or blob remapped to a different path): " +
       ((e && e.message) || String(e)));
   }
   return Buffer.from(plain);
@@ -155,11 +169,12 @@ async function decryptWithPassphrase(encrypted, passphrase, saltHex) {
 
 // Convenience for the common "encrypt this with a fresh salt" pattern.
 // Returns the salt as hex so callers can store it alongside the
-// ciphertext in the bundle manifest.
-async function encryptWithFreshSalt(plaintext, passphrase) {
+// ciphertext in the bundle manifest. `aad` (optional) is bound as AEAD
+// associated data (see _aadBytes).
+async function encryptWithFreshSalt(plaintext, passphrase, aad) {
   var salt = nodeCrypto.randomBytes(SALT_BYTES);
   var saltHex = salt.toString("hex");
-  var encrypted = await encryptWithPassphrase(plaintext, passphrase, saltHex);
+  var encrypted = await encryptWithPassphrase(plaintext, passphrase, saltHex, aad);
   return { encrypted: encrypted, salt: saltHex };
 }
 

package/lib/backup/index.js

@@ -53,13 +53,16 @@ var os = require("node:os");
 var nodePath = require("node:path");
 var bCrypto = require("../crypto");
 var atomicFile = require("../atomic-file");
+var C = require("../constants");
 var backupBundle = require("./bundle");
 var frameworkFiles = require("../framework-files");
 var backupManifest = require("./manifest");
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
 var numericBounds = require("../numeric-bounds");
+var boundedMap = require("../bounded-map");
 var audit = lazyRequire(function () { return require("../audit"); });
+var auditEmit = require("../audit-emit");
 var compliance = lazyRequire(function () { return require("../compliance"); });
 // lazyRequire ../db so backup stays a leaf module operators can use
 // without the rest of the framework's DB chain loaded in the same
@@ -228,17 +231,9 @@ function diskStorage(opts) {
 // ---- Engine ----
 
 function _validateStorage(storage) {
-  if (!storage || typeof storage !== "object") {
-    throw new BackupError("backup/bad-storage",
-      "storage backend is required (use b.backup.diskStorage or pass a custom one)");
-  }
-  var required = ["writeBundle", "readBundle", "listBundles", "deleteBundle", "hasBundle"];
-  for (var i = 0; i < required.length; i++) {
-    if (typeof storage[required[i]] !== "function") {
-      throw new BackupError("backup/bad-storage",
-        "storage backend missing method '" + required[i] + "'");
-    }
-  }
+  validateOpts.requireMethods(storage,
+    ["writeBundle", "readBundle", "listBundles", "deleteBundle", "hasBundle"],
+    "storage backend", BackupError, "backup/bad-storage");
 }
 
 async function _resolveVaultKeyJson(vaultKeyJsonOpt) {
@@ -488,15 +483,7 @@ function create(opts) {
     } catch (_e) { /* db not available in this module graph — flush is a no-op */ }
   }
 
-  function _emitAudit(action, info, outcome) {
-    if (!auditOn) return;
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome,
-      metadata: info || {},
-      reason:   info && info.reason ? info.reason : null,
-    });
-  }
+  var _emitAudit = auditEmit.gatedReasonEmitter({ audit: auditOn });
 
   async function run(runOpts) {
     runOpts = runOpts || {};
@@ -735,11 +722,16 @@ function create(opts) {
         try {
           await storage.readBundle(bundleId, stagingDir);
           manifestPath = nodePath.join(stagingDir, "manifest.json");
-          if (!nodeFs.existsSync(manifestPath)) {
-            throw new BackupError("backup/test-no-manifest",
-              "manifest.json missing under restored bundle " + bundleId);
-          }
-          manifest = backupManifest.parse(nodeFs.readFileSync(manifestPath, "utf8"));
+          // Capped fd-bound read inside the scheduled restore-drill tick: an
+          // oversized manifest must not OOM the scheduler worker.
+          manifest = backupManifest.parse(atomicFile.fdSafeReadSync(manifestPath, {
+            maxBytes: C.BYTES.mib(4), encoding: "utf8",
+            errorFor: function (kind) {
+              if (kind === "enoent") return new BackupError("backup/test-no-manifest", "manifest.json missing under restored bundle " + bundleId);
+              if (kind === "too-large") return new BackupError("backup/test-bad-manifest", "manifest.json too large under restored bundle " + bundleId);
+              return new BackupError("backup/test-no-manifest", "manifest.json unreadable under restored bundle " + bundleId + ": " + kind);
+            },
+          }));
           // Verify the manifest signature so a tampered backup test
           // surfaces here, not as a regulator finding later.
           sigVerification = backupManifest.verifySignature(manifest, {
@@ -851,11 +843,17 @@ function verifyManifestSignature(target, opts) {
   var manifest;
   if (typeof target === "string") {
     var manifestPath = nodePath.join(target, "manifest.json");
-    if (!nodeFs.existsSync(manifestPath)) {
-      throw new BackupError("backup/no-manifest",
-        "verifyManifestSignature: manifest.json missing at " + manifestPath);
-    }
-    try { manifest = backupManifest.parse(nodeFs.readFileSync(manifestPath, "utf8")); }
+    // Capped fd-bound read OUTSIDE the parse try (so a missing/oversized manifest
+    // surfaces backup/no-manifest|bad-manifest, not a generic parse error).
+    var manifestRaw = atomicFile.fdSafeReadSync(manifestPath, {
+      maxBytes: C.BYTES.mib(4), encoding: "utf8",
+      errorFor: function (kind) {
+        if (kind === "enoent") return new BackupError("backup/no-manifest", "verifyManifestSignature: manifest.json missing at " + manifestPath);
+        if (kind === "too-large") return new BackupError("backup/bad-manifest", "verifyManifestSignature: manifest.json too large");
+        return new BackupError("backup/bad-manifest", "verifyManifestSignature: unreadable: " + kind);
+      },
+    });
+    try { manifest = backupManifest.parse(manifestRaw); }
     catch (e) {
       throw new BackupError("backup/bad-manifest",
         "verifyManifestSignature: parse failed: " + ((e && e.message) || String(e)));
@@ -1091,18 +1089,10 @@ module.exports = {
  */
 function bundleAdapterStorage(opts) {
   opts = opts || {};
-  if (!opts.adapter || typeof opts.adapter !== "object") {
-    throw new BackupError("backup/bad-adapter",
-      "bundleAdapterStorage: opts.adapter is required (an object with writeFile/readFile/listKeys/deleteKey/hasKey)");
-  }
+  validateOpts.requireMethods(opts.adapter,
+    ["writeFile", "readFile", "listKeys", "deleteKey", "hasKey"],
+    "bundleAdapterStorage: opts.adapter", BackupError, "backup/bad-adapter");
   var adapter = opts.adapter;
-  var required = ["writeFile", "readFile", "listKeys", "deleteKey", "hasKey"];
-  for (var i = 0; i < required.length; i += 1) {
-    if (typeof adapter[required[i]] !== "function") {
-      throw new BackupError("backup/bad-adapter",
-        "bundleAdapterStorage: adapter missing method '" + required[i] + "'");
-    }
-  }
   // v0.12.8 — `format: "tar"` becomes the default for new bundles.
   // `format: "directory"` opts back into the v0.12.7 file-by-file
   // layout for operators with existing bundles. The format is
@@ -1435,11 +1425,9 @@ function bundleAdapterStorage(opts) {
         if (slash <= 0) continue;
         var bid = key.slice(0, slash);
         if (!_isValidBundleId(bid)) continue;
-        var stats = byBundle.get(bid);
-        if (!stats) {
-          stats = { count: 0, hasTar: false, hasTarGz: false, hasOther: false };
-          byBundle.set(bid, stats);
-        }
+        var stats = boundedMap.getOrInsert(byBundle, bid, function () {
+          return { count: 0, hasTar: false, hasTarGz: false, hasOther: false };
+        });
         stats.count += 1;
         var rest = key.slice(slash + 1);
         if (rest === "bundle.tar")         stats.hasTar = true;
@@ -2211,19 +2199,28 @@ bundleAdapterStorage.fsAdapter = function (fsOpts) {
       // mode 0o600 matches the v0.12.9 directory-format readback
       // discipline — backup payloads carry operator-owned bytes
       // (potentially PHI / PCI / GDPR-scoped); owner-only is the
-      // strict posture. wx is not set here because writeFile is
-      // the storage primitive (operators legitimately rewrite the
-      // same key, e.g. resuming a multipart upload); upper layers
-      // (writeBundle's `bundle-exists` check) enforce no-overwrite
-      // at the bundle level.
-      nodeFs.writeFileSync(path, bytes, { mode: 0o600 });
+      // strict posture. Overwrite of an existing key stays allowed
+      // (operators legitimately rewrite the same key, e.g. resuming a
+      // multipart upload); upper layers (writeBundle's `bundle-exists`
+      // check) enforce no-overwrite at the bundle level. writeSync's
+      // atomic rename preserves that overwrite semantic while refusing a
+      // symlink pre-planted at `path` (CWE-59) and never leaving a torn
+      // payload — a bare writeFileSync did both.
+      atomicFile.writeSync(path, bytes, { fileMode: 0o600 });
     },
     async readFile(key) {
       var path = _keyPath(key);
-      if (!nodeFs.existsSync(path)) {
-        throw new BackupError("backup/no-key", "fsAdapter: key not found: " + JSON.stringify(key));
-      }
-      return nodeFs.readFileSync(path);
+      // Capped fd-bound read (no existsSync check-then-read window): fetches a
+      // whole bundle payload, so an oversize/swapped file is an OOM lever. 8 GiB
+      // matches the writeBundle maxBundleBytes ceiling.
+      return atomicFile.fdSafeReadSync(path, {
+        maxBytes: C.BYTES.gib(8),
+        errorFor: function (kind) {
+          if (kind === "enoent") return new BackupError("backup/no-key", "fsAdapter: key not found: " + JSON.stringify(key));
+          if (kind === "too-large") return new BackupError("backup/key-too-large", "fsAdapter: payload for key " + JSON.stringify(key) + " exceeds the read cap");
+          return new BackupError("backup/no-key", "fsAdapter: key " + JSON.stringify(key) + " unreadable: " + kind);
+        },
+      });
     },
     async listKeys(prefix) {
       var out = [];
@@ -2341,17 +2338,8 @@ bundleAdapterStorage.fsAdapter = function (fsOpts) {
  *   // path composes through unwrap + read.gz + read.tar.
  */
 bundleAdapterStorage.objectStoreAdapter = function (client, osOpts) {
-  if (!client || typeof client !== "object") {
-    throw new BackupError("backup/bad-adapter",
-      "objectStoreAdapter: client is required (a b.objectStore-shaped object with put / get / head / delete / list)");
-  }
-  var required = ["put", "get", "head", "delete", "list"];
-  for (var i = 0; i < required.length; i += 1) {
-    if (typeof client[required[i]] !== "function") {
-      throw new BackupError("backup/bad-adapter",
-        "objectStoreAdapter: client missing method '" + required[i] + "'");
-    }
-  }
+  validateOpts.requireMethods(client, ["put", "get", "head", "delete", "list"],
+    "objectStoreAdapter: client", BackupError, "backup/bad-adapter");
   osOpts = osOpts || {};
   var prefix = "";
   if (osOpts.prefix !== undefined && osOpts.prefix !== null) {

package/lib/backup/manifest.js

@@ -140,7 +140,7 @@ function _validateFileEntry(f, idx, errors) {
   if (!_isHex(f.salt, true)) {
     errors.push("files[" + idx + "].salt: required hex string");
   }
-  if (typeof f.kind !== "string" || !VALID_KINDS[f.kind]) {
+  if (typeof f.kind !== "string" || !Object.prototype.hasOwnProperty.call(VALID_KINDS, f.kind)) {
     errors.push("files[" + idx + "].kind: must be one of raw, vault-sealed, plaintext");
   }
 }
@@ -239,6 +239,11 @@ function create(opts) {
   if (opts.metadata && typeof opts.metadata === "object" && !Array.isArray(opts.metadata)) {
     manifest.metadata = Object.assign({}, opts.metadata);
   }
+  // Marks that every file blob was sealed with its relativePath as AEAD
+  // associated data (the blob-remap defense). Set on all bundles this version
+  // writes; absent on legacy bundles, which restore decrypts without AAD.
+  // Carried into the signed payload so it cannot be flipped on a signed bundle.
+  if (opts.aadBound === true) manifest.aadBound = true;
   var v = validate(manifest);
   if (!v.ok) {
     throw new BackupManifestError("backup-manifest/invalid",
@@ -271,6 +276,7 @@ function _canonical(manifest, includeSignature) {
     }),
   };
   if (manifest.metadata) canonical.metadata = manifest.metadata;
+  if (manifest.aadBound === true) canonical.aadBound = true;
   // Signature block lives alongside the rest of the manifest fields
   // and is itself stable-ordered. Sign-time canonicalization (the
   // bytes the audit-sign keypair signs) excludes the signature field