@blamejs/core 0.15.8 → 0.15.10

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.10 (2026-06-13) — **Makes S3 Object-Lock version erasure reachable through the object store, and pins the build toolchain's native binary to a reviewed hash.** The object store gains the versioned-delete surface its S3 Object Lock support always needed for real erasure. An unversioned delete on a versioning-enabled (Object-Lock) bucket only writes a delete-marker — the data version survives — so the framework's own delete could report success while a record protected for compliance, or one a data subject asked to erase, stayed on disk. b.objectStore / b.storage now carry a versionId: put and saveRaw return the version they created, deleteFile(key, { versionId, bypassGovernanceRetention }) targets a specific version (refused — not silently delete-markered — when it is under an active retention), and listVersions enumerates versions and delete-markers so an erasure workflow can find them. Backends with no version surface (the filesystem backend, and the current Azure and GCS adapters) refuse a versioned delete loudly rather than silently dropping the current object. Separately, the build toolchain's native bundler binary is now verified against a reviewed SHA-256 pin so a tampered or drifted binary is caught before it bundles the framework. **Added:** *Versioned object delete + listVersions for S3 Object-Lock erasure* — b.storage.deleteFile and the b.objectStore sigv4 backend now accept opts.versionId to erase a specific object version, and opts.bypassGovernanceRetention to lift a GOVERNANCE-mode retention for callers with the permission (COMPLIANCE stays immutable to everyone). b.storage.saveRaw and the backend put now return the versionId they created on a versioning-enabled bucket, and a new b.storage.listVersions(prefix) / backend listVersions enumerates every version and delete-marker (key, versionId, isLatest, deleteMarker, size, lastModified, etag) so a right-to-erasure or crypto-shred workflow can target prior versions. On a backend with no version surface, listVersions throws VERSIONS_UNSUPPORTED and a versioned delete throws VERSIONID_UNSUPPORTED rather than silently acting on the current object. · *b.localDb.thin reaches SQLite resource-limit parity (limits option)* — b.localDb.thin now opens its node:sqlite handle with the same parse-time statement-size cap as b.db and the CLI — a SQL statement over 1 MiB is rejected at parse time, the SQLITE_LIMIT_LENGTH floor that guards prepare()/exec() of raw SQL against an attacker-influenced megaquery (SQLite's default is 1 GB). The cap is on by default; a new limits option (e.g. { sqlLength: 2 * 1024 * 1024 } or other SQLITE_LIMIT_* keys) lets an operator raise or extend it. Previously the thin opener had no limits plumbing, so a consumer on that path could not reach parity with the rest of the framework's SQLite surface. **Fixed:** *S3 Object-Lock version erasure is reachable through the framework delete path* — On a versioning-enabled (Object-Lock) bucket, an unversioned DELETE only writes a delete-marker — the protected data version survives untouched — yet the framework's delete had no versionId surface, so it issued the unversioned form and reported success while the bytes the lock protects remained. A retention or legal hold could therefore look enforced to the framework caller while the operation WORM actually blocks was unreachable. The delete path now targets the exact version: deleting a version under a COMPLIANCE retention is refused (it throws, even with bypassGovernanceRetention), a no-retention version erases cleanly, and the enforcement is proven end-to-end against MinIO through the framework's own API. · *b.configDrift.verifyVendorIntegrity is now working-directory-independent* — The vendored-dependency integrity check resolved each manifest file path against process.cwd(), so it only worked when run from the application root. Run from anywhere else it read-failed every entry (reporting ok:false), and under a crafted working directory that happened to contain a clean vendor tree it could hash a different tree than the one actually loaded. It now resolves each file under the framework's own vendor directory by default — the tree loaded at runtime — and honors an explicit libVendorDir for verifying a deployed tree elsewhere, so the result no longer depends on where the process was started. **Security:** *Build toolchain native binary pinned to a reviewed hash* — The native bundler binary the build toolchain runs (esbuild's per-platform compiler, a development dependency that never ships in the runtime) is now verified against a SHA-256 pin captured by diffing the published package tarballs and hashing the binary. The build gate fails if the on-disk binary does not match the reviewed hash for its (version, platform); for a version that has not been reviewed it notes the gap and skips rather than trusting an unverified binary. A cross-artifact check keeps the version in agreement across package.json, the CI install step, and the hash map, so the gate can never quietly test a version that was never diffed — closing a real drift where CI had been installing an older patch than package.json declared. The reviewed diff is benign: version strings plus an installer size-bound and error-message hardening, no new install hooks, files, or network paths, and no runtime-dependency impact. **Detectors:** *Object-store erasure guard, esbuild-pin agreement, + structural re-anchoring of the lint detectors* — A new guard locks the object-store delete path to the versioned-erasure contract: b.storage.deleteFile must thread versionId to the backend, so it can never silently revert to the WORM-blind unversioned delete. A second guard enforces that the esbuild build-tool version agrees across package.json, the CI install step, and the binary-hash map, so a future bump can't update one and leave the gate testing an unreviewed version. Separately, the framework's internal codebase-pattern lint detectors were re-anchored from fixed character spans to structural code boundaries, so they keep matching the code they guard as those functions grow rather than aging out of range; reviving them surfaced a few internal validation and transaction sites that now route through shared helpers (a required positive-integer-with-range validator and an async transaction wrapper) instead of hand-rolling the check. No public API change.
+
+- v0.15.9 (2026-06-13) — **Raises the Node floor to 24.16, adds SQLite parse-time resource caps, retries Windows rename locks on every atomic write and download, and ships a one-call secure logout that wipes client-side state.** This release moves the engines floor to the current Node 24 LTS patch level and adds three hardening primitives. node:sqlite handles now construct with SQLITE_LIMIT_* caps: a statement over 1 MiB is rejected at parse time (a DoS floor on the raw-SQL surface, complementary to the existing row-count gate) and ATTACH DATABASE is denied. Every final temp-to-destination rename — the file written by an atomic write, a downloaded file, a sealed vault key, a rotated log, an extracted archive entry — now routes through a single retry that rides out a transient Windows lock (antivirus, the search indexer, or a file-sync client briefly holding the destination), instead of surfacing the lock as a hard failure; the retry, previously hand-rolled and unreachable, is now the reusable b.atomicFile.renameWithRetry. And b.session.logout destroys a session and tells the browser to wipe its client-side state in one call: it emits an RFC 9527 Clear-Site-Data header and expires the session cookie before destroying the row, the secure-default logout that previously had to be assembled by hand. **Added:** *b.session.logout — one-call secure logout* — `b.session.logout(res, token, opts?)` destroys the server-side session AND tells the browser to wipe its client-side state in one call: it emits an RFC 9527 Clear-Site-Data response header (cookies + storage + cache + execution contexts by default) and expires the session cookie, then destroys the session row. `b.session.destroy` alone is a store operation with no response object, so it could not wipe the browser's cached pages, storage, or a stale tab still holding the now-revoked cookie — that wiring previously had to be mounted by hand. Pass `cookieName` to match a non-default cookie and `types` to choose the Clear-Site-Data directives. **Changed:** *Node engines floor raised to >=24.16.0* — The minimum supported Node is now 24.16.0 (the current Node 24 LTS patch level), up from 24.14.1. This is an LTS-currency bump — there are no Node CVE fixes between 24.14.1 and 24.16.0 (24.14.1 already carried the CVE-2026-21713 HMAC fix); it keeps the framework on the latest patched LTS and makes the node:sqlite resource-cap hardening below available everywhere. Pre-1.0, operators upgrade across the floor; Node 26 continues to satisfy it. **Fixed:** *b.watcher canonicalizes its root on Windows* — `b.watcher.create` now resolves its `root` to the real long path before watching. On Windows a root with an 8.3 short-name component (the system temp directory commonly resolves to one) made the native recursive backend deliver long-name event paths that no longer prefix-matched the watched root, which could abort the process under a strict libuv fs-event assertion. The watcher now canonicalizes the root (expanding short names and resolving symlinks), so events match the watched directory on Windows. **Security:** *SQLite parse-time statement-size cap* — Every node:sqlite database the framework opens — the main db handle and the CLI's handle — now constructs with a SQLITE_LIMIT_LENGTH cap: a SQL statement over 1 MiB is rejected at parse time. Because the query builder parameterizes every value, the size cap guards the raw-SQL surface (`b.db.runSql`) against an attacker-influenced megaquery the parser would otherwise process (SQLite's default is 1 GB); it is a parse-time DoS floor complementary to the existing row-count gate. Legitimate framework and operator statements are far under the cap. · *Windows rename-lock retry on every atomic rename and download* — On Windows a freshly-written file's destination is briefly held by antivirus, the search indexer, or a file-sync client (Dropbox, OneDrive), surfacing as a transient EPERM / EACCES / EBUSY on rename even though the temp file is fine. `b.atomicFile.writeSync` already retried this, but `b.httpClient.downloadStream` did not — a download into a cloud-synced or AV-scanned directory could fail hard on the lock. The retry is now the reusable `b.atomicFile.renameWithRetry`, and every final temp-to-destination rename in the framework routes through it: downloads, sealed vault keys, CA key/cert writes, log rotation, archive extraction, config-drift sidecars, the self-update binary swap, and restore/rollback moves. A non-transient error still throws immediately; POSIX renames are unaffected. **Detectors:** *Rename-retry, SQLite-limits, and Clear-Site-Data guards* — Three recurrence detectors ship with the fixes: a bare `nodeFs.renameSync` final rename that doesn't route through `atomicFile.renameWithRetry`; a main `DatabaseSync` handle constructed without the SQLITE_LIMIT_LENGTH `limits`; and a hand-rolled Clear-Site-Data header value that skips the shared RFC 9527 builder.
+
 - v0.15.8 (2026-06-13) — **Redacts OTLP log-sink attributes to close a secret/PII egress the span fix missed, adds EU DSA and China PIPL cross-border compliance record-builders, ships an SSDF producer self-attestation with every release, and makes the published tarball reproducible.** This release closes a telemetry egress hole, adds two compliance record-builder namespaces, and hardens the release supply chain. The OTLP log sinks (HTTP-JSON and gRPC) shipped a log record's meta attributes and the resource attributes to the collector unredacted — a log line carrying a bearer token, password, or API key reached the wire verbatim (CWE-532). The 0.15.4 fix wired the telemetry redactor into the span and metric exporters but the log sinks were missed; both now run record and resource attributes through the same redactor before serialization. New b.dsa builds the EU Digital Services Act (Reg 2022/2065) records an intermediary or platform must keep — Art. 16 notice-and-action, Art. 17 statement of reasons, and the Art. 15 / 24(3) transparency report. New b.pipl builds the China PIPL cross-border transfer records — an Art. 38/40 assessment that determines whether a CAC security assessment is mandatory (CIIO, important data, or the volume / sensitive-PI thresholds), and an Art. 40 security-assessment certificate. On the supply-chain side, every release now ships ssdf-attestation.json, a machine-readable NIST SP 800-218 / OMB M-22-18 producer self-attestation mapping each secure-development practice to its implementing control, and the published tarball is now packed with SOURCE_DATE_EPOCH so an operator can rebuild it byte-for-byte from the release commit. **Added:** *b.dsa — EU Digital Services Act compliance record-builders* — `b.dsa` builds the dated, frozen records the EU Digital Services Act (Regulation (EU) 2022/2065) requires an online intermediary or platform to keep: `b.dsa.noticeAndAction` (Art. 16) records a notice against a piece of content and computes the action-due window; `b.dsa.statementOfReasons` (Art. 17) records a moderation decision with its legal or contractual ground (exactly one is required), the facts, whether it was automated, and the redress routes offered; `b.dsa.transparencyReport` (Art. 15 / 24(3)) aggregates the period counts into a report with the next-due date. The builders perform no network I/O and emit a best-effort audit event; they map to the `dsa` compliance posture. · *b.pipl — China PIPL cross-border transfer record-builders* — `b.pipl.sccFilingAssessment` builds a PIPL Art. 38/40/55 cross-border transfer assessment and determines the lawful mechanism: it forces a CAC security assessment (over a self-selected standard contract or certification) when the exporter is a critical-information-infrastructure operator, exports important data, handles personal information of more than 1,000,000 individuals, or crosses the cumulative volume / sensitive-PI thresholds. `b.pipl.securityAssessmentCertificate` records an Art. 40 security-assessment self-declaration with a 3-year validity clock. Both return frozen dated records and map to the `pipl-cn` posture. · *SSDF producer self-attestation shipped with every release* — Every release now attaches `ssdf-attestation.json` — a machine-readable NIST SP 800-218 (SSDF v1.1) / OMB M-22-18 producer self-attestation. It maps each secure-software-development practice to its implementing control in the tree (SLSA L3 provenance, SSH-signed tags, vendored zero-runtime-dep supply chain, OSV-Scanner gating, coordinated disclosure) and is deterministic from the release commit. Its sha256 is a subject of the SLSA L3 provenance, so verifying the provenance verifies the attestation has not been tampered with. Downstream consumers who require SSDF supplier-compliance evidence can download it from the release page. **Security:** *OTLP log sinks redact record and resource attributes before export* — `b.logStream`'s OTLP log sinks (HTTP-JSON and gRPC) shipped a log record's `meta` attributes and the sink's resource attributes to the collector UNREDACTED, so a log line whose meta carried a bearer token, password, or API key — or a credential placed in a resource attribute — reached the OTLP wire verbatim (CWE-532). The 0.15.4 change baked the telemetry redactor into the span and metric exporters but its detector was anchored on the span/metric encoder function names, leaving the log sinks uncovered. Both log sinks now run record and resource attributes through `b.observability.redactAttrs` before serialization, the same egress contract the span and metric exporters already hold. · *Reproducible published tarball (SOURCE_DATE_EPOCH)* — The release workflow now exports `SOURCE_DATE_EPOCH` (derived from the tagged commit's author date) before `npm pack`, so the mtime stamped into every tar header is deterministic. An operator can re-pack the package from the same commit and match the published tarball's sha256 byte-for-byte, strengthening the source-to-artifact verification path alongside the existing SLSA L3 provenance and PQC signatures. **Detectors:** *otlp-log-sink-encodes-attrs-without-redactor* — Fires when an OTLP log-sink encoder hands a raw `record.meta` or resource-attribute map to serialization without routing it through `observability.redactAttrs` — the class the span/metric detector could not see because the log sinks carry the OTLP-logs schema function names.
 
 - v0.15.7 (2026-06-13) — **Hardens the new URL canonicalizer against an IPv4-mapped allowlist bypass, enforces the OIDC azp authorized-party check, and closes a set of audited correctness gaps in retention, credential rehashing, the scheduler, and SD-JWT key binding.** This release deepens the URL/host canonicalizer shipped in 0.15.6 and clears a batch of audited correctness gaps. The canonicalizer now folds an IPv4-mapped IPv6 address (::ffff:1.2.3.4) to its embedded IPv4 and strips every trailing dot from a host, so a dual-stack peer can no longer slip past an operator's dotted-IPv4 allowlist and host./host.. no longer evade a host comparison. (NAT64 and 6to4 hosts are deliberately kept as IPv6 so canonicalizing then classifying agrees with the SSRF classifier, which treats them as reserved.) On the OIDC side, verifyIdToken now enforces OIDC Core 3.1.3.7: a multi-audience ID token must carry an azp (authorized party) and a present azp must equal the client_id, closing a confused-deputy hole where a token minted for a different client but listing this RP in its audience array verified clean. The rest are audited fixes: retention.complianceFloor now honors the active posture set via applyPosture (the documented inheritance was unimplemented); credentialHash.needsRehash now drives the advertised SHAKE256 length-rotation (raising the output length now triggers a rehash, upgrade-only); the task scheduler no longer lets a run abandoned by its watchdog clobber the next run's state or emit a stale success when its slow promise settles late; and the SD-JWT key-binding JWT compares its audience and nonce in constant time. **Fixed:** *retention.complianceFloor honors the active compliance posture* — `b.retention.complianceFloor` required an explicit posture and never read the active posture set by `applyPosture` (the `b.compliance.set` cascade), so the documented inheritance was unimplemented dead state. It now inherits the active posture when none is passed — `complianceFloor(candidateTtlMs)` uses the active posture, an explicit posture still overrides it — and `applyPosture(null)` now clears the active posture (it was a silent no-op, so `b.compliance.clear` could not reset it). · *credentialHash.needsRehash drives the SHAKE256 length-rotation* — `b.credentialHash.needsRehash` never compared the stored SHAKE256 digest length against the configured length, so raising the output length never triggered a rehash and the advertised length-rotation was a silent no-op. It now flags a digest shorter than the configured/default length for rehash (upgrade-only — a longer-than-target digest is never shortened, matching the Argon2 convention). · *The scheduler no longer lets a watchdog-abandoned run corrupt the next run* — `b.scheduler`'s watchdog force-clears a task's running flag after `maxJobMs` so a hung handler can't lock out future fires, and the next tick re-fires. The original slow promise then settled late and unconditionally overwrote the task's running / lastFinish / lastError state and emitted a `system.scheduler.task.success`|`failure` for a run the watchdog had already given up on — clobbering the new run and double-counting. Each run is now tagged with a generation that the watchdog and every fire bump; a settle whose tag is stale is ignored. **Security:** *The URL canonicalizer folds IPv4-mapped IPv6 addresses to IPv4* — `b.safeUrl.canonicalize` / `b.ssrfGuard.canonicalizeHost` now fold an IPv4-mapped IPv6 address (`::ffff:1.2.3.4`, the `::ffff:0:0/96` block) to its embedded IPv4 dotted form. Previously it canonicalized to an IPv6 string, so a dual-stack peer never unified with an operator's `1.2.3.4` allow/deny entry — an allowlist bypass. Only the IPv4-mapped block folds, because the SSRF classifier maps it to the embedded v4 verdict directly; NAT64 (`64:ff9b::/96`) and 6to4 (`2002::/16`) are deliberately kept as IPv6, since the classifier treats a NAT64 literal as reserved and folding it would turn a blocked verdict into an allowed public IPv4. The host canonicalizer also now strips every trailing dot, so `host`, `host.`, and `host..` collapse to one form. · *verifyIdToken enforces the OIDC azp (authorized party) check* — `b.auth.oauth`'s `verifyIdToken` validated only that its `client_id` was present in the token's `aud`, ignoring `azp`. Per OIDC Core 3.1.3.7, a multi-audience ID token must carry an `azp` and a present `azp` must equal the RP's `client_id`. Without it, a token whose authorized party is a different client — but whose `aud` array also lists this RP — verified clean (a confused-deputy / token-substitution hole). The verifier now rejects a multi-audience token with no `azp` (`auth-oauth/azp-required`) and any token whose `azp` is not the `client_id` (`auth-oauth/azp-mismatch`). A single-audience token with no `azp` (the common case) is unaffected. · *SD-JWT key-binding audience and nonce compare in constant time* — `b.auth.sdJwtVc.verify` compared the key-binding JWT's `aud` and `nonce` with a short-circuiting `!==`, while the adjacent `sd_hash` check already used a constant-time compare. The `nonce` is a verifier-issued replay-defense value, so a non-constant-time compare leaks a matching-prefix timing oracle; both checks now use the constant-time helper.

package/README.md

@@ -52,7 +52,7 @@ var b = require("@blamejs/core");
 })();
 ```
 
-**Requirements:** Node.js 24.14+ (current active LTS, fixes CVE-2026-21713 non-constant-time HMAC compare). Node 26 satisfies the floor and the framework test suite runs cleanly on it today; the floor itself will bump to `>=26.x` when Node 26 promotes to Active LTS. Two Node 26 platform changes operators integrating with blamejs should know about: the new `localStorage` global (the framework's storage backend is `b.backup.diskStorage`; the legacy `b.backup.localStorage` alias was removed in v0.11.20 — update call sites accordingly), and the seed-only ML-KEM / ML-DSA PKCS8 export shape (sealed material from Node 24 re-imports cleanly on Node 26; new material from Node 26 in the seed-only shape). See [SECURITY.md](SECURITY.md#node-26-compatibility) for the details.
+**Requirements:** Node.js 24.16+ (current active LTS line; 24.14.1 fixed CVE-2026-21713 non-constant-time HMAC compare, 24.16 is the current patch level). Node 26 satisfies the floor and the framework test suite runs cleanly on it today; the floor itself will bump to `>=26.x` when Node 26 promotes to Active LTS. Two Node 26 platform changes operators integrating with blamejs should know about: the new `localStorage` global (the framework's storage backend is `b.backup.diskStorage`; the legacy `b.backup.localStorage` alias was removed in v0.11.20 — update call sites accordingly), and the seed-only ML-KEM / ML-DSA PKCS8 export shape (sealed material from Node 24 re-imports cleanly on Node 26; new material from Node 26 in the seed-only shape). See [SECURITY.md](SECURITY.md#node-26-compatibility) for the details.
 
 ## What ships in the box
 
@@ -60,12 +60,12 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 
 ### Data layer
 
-- **SQLite with sealed-by-default columns** — `b.db`, migrations, seeders, atomic-file writes
+- **SQLite with sealed-by-default columns** — `b.db`, migrations, seeders, atomic-file writes; the db handle constructs with a SQLITE_LIMIT_LENGTH parse-time cap (a >1 MiB statement is rejected) as a DoS floor on the raw-SQL surface
 - **Chainable query builder** — atomic `.increment(col, delta)`, closure-form `.whereGroup` / top-level `.orWhere` OR composition, `.search(fields, term)` LIKE-OR with safe `%`/`_` ESCAPE handling, `.paginate(opts)` returning `{ items, total, page, totalPages }`; a column-membership gate (`db.init({ columnGate })`, default reject) fails a query closed when it names a column the table never declared, and `whereRaw` refuses an embedded string literal so values bind through placeholders
 - **Mongo-style document-store facade** — `b.db.collection(name, opts?)` with `$set` / `$inc` / `$unset` / `$eq` / `$ne` / `$gt` / `$gte` / `$lt` / `$lte` / `$in` / `$like`; schemaless-document opts via `overflow: "<col>"` (folds unknown fields into a JSON-text column; rewrites `WHERE` on virtual fields to `JSON_EXTRACT`), `jsonColumns: [...]` (auto-stringify on write + parse via `b.safeJson` on read), `sealedFields: { email: "emailHash" }` (co-locates a `b.cryptoField` sealed-column / derived-hash declaration so plaintext lookups auto-rewrite to hash-column lookups)
 - **DB lifecycle** — in-memory encrypted snapshot via `b.db.snapshot()`; standalone encrypted-DB-file lifecycle (`b.db.fileLifecycle({ dataDir, vault })` — decrypt-to-tmpfs, periodic re-encrypt flush, graceful shutdown — same envelope as `b.db`, no schema/audit-chain coupling); `db.init` opt-outs `frameworkTables: false` / `auditSigning: false` and path overrides `encryptedDbPath` / `encryptedDbName` / `dbKeyPath`
 - **External RDBMS** — bring-your-own Postgres / MySQL with pool tuning + role-aware connect + read-replica routing (`b.externalDb`); declarative role-narrowed views and Postgres row-level-security migrations (`b.db.declareView`, `b.db.declareRowPolicy`); an opt-in `requireTls` transport posture refuses a non-TLS backend at boot, and query / transaction / read traces carry OpenTelemetry `db.*` attributes. The framework's own data layer — the signed audit chain, cluster leadership and lease fencing, sessions, break-glass, and the local queue / cache / scheduler — is composed through the dialect-aware `b.sql` builder (every identifier quoted by construction, every value bound as a placeholder, dialect-correct SQLite / Postgres / MySQL output), so the framework's tables run on a Postgres or MySQL backend, not only local SQLite; `b.guardSql` validates result rows against NUL bytes, quote-jump sequences, and per-column / total-size boundaries
-- **Object store** — S3 / R2 / B2 / GCS / Azure with multipart upload + SSE + bucket-ops (create / delete / list / lifecycle / CORS); S3 Object Lock + per-object retention + legal hold for write-once-read-many compliance workloads (`b.storage`, `b.objectStore`)
+- **Object store** — S3 / R2 / B2 / GCS / Azure with multipart upload + SSE + bucket-ops (create / delete / list / lifecycle / CORS); S3 Object Lock + per-object retention + legal hold for write-once-read-many compliance workloads, with versioned delete + `listVersions` for right-to-erasure / crypto-shred against an Object-Lock bucket (`b.storage`, `b.objectStore`)
 - **Queues + cache** — durable queue with priority + cron + flows on local SQLite, shared Redis, OR AWS SQS via SigV4 + AWSJsonProtocol_1.0 (`b.queue`, `b.jobs`) — the local backend can target an operator-supplied database / table / schema; cluster-shared cache (`b.cache`)
 ### Identity & access
 
@@ -86,6 +86,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
   - Opaque-userId anonymous sessions via `create({ anonymous: true })`
   - Idle / absolute timeouts, fingerprint drift detection + anomaly scoring, brute-force lockout
   - Session-fixation rotation (`b.session.rotate`) re-keys the sid-bound device fingerprint to the new id — pass the same `{ req, fingerprintFields }` used at `create` (a fingerprint-bound session rotated without `req` is refused, so the binding can never silently break or false-drift)
+  - One-call secure logout (`b.session.logout(res, token)`) destroys the session AND wipes client-side state — emits an RFC 9527 Clear-Site-Data header (cookies + storage + cache) and expires the session cookie before deleting the row
 - **Authorization** — RBAC + per-role DB binding + role-spec `requireMfa` + per-route MFA freshness window + ABAC predicate registry (`b.permissions`); API keys with rotation (`b.apiKey`)
 - **Workflow gates** — break-glass column gates with second-factor + audit (`b.breakGlass`); two-person-rule m-of-n approval with cooling-off lock + cancellation (`b.dualControl`)
 - **Financial / Open Banking** — FAPI 2.0 Final composite posture (PAR + PKCE-S256 + DPoP-or-mTLS + RFC 9207); runtime enforcement helpers `b.fapi2.assertCallback` (refuses missing iss + bare-param under message-signing) and `b.fapi2.assertAuthzRequest` (refuses non-JAR); CFPB §1033 / FDX 6.0 consumer-financial-data-sharing wrapper (`b.fdx`)

package/lib/archive-read.js

@@ -42,6 +42,7 @@ var nodeFs = require("node:fs");
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var { defineClass } = require("./framework-error");
+var atomicFile = require("./atomic-file");
 
 var ArchiveReadError = defineClass("ArchiveReadError", { alwaysPermanent: true });
 
@@ -925,7 +926,7 @@ function zip(adapter, opts) {
         // the rename targets a non-existent path.
         var tmpPath = resolvedPath + ".__blamejs-archive-read-tmp__";
         nodeFs.writeFileSync(tmpPath, body);
-        nodeFs.renameSync(tmpPath, resolvedPath);
+        atomicFile.renameWithRetry(tmpPath, resolvedPath);
         written.push({ name: entry.name, bytesWritten: body.length, path: resolvedPath });
         bytesExtracted += body.length;
       }

package/lib/archive-tar-read.js

@@ -14,6 +14,7 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var safeBuffer = require("./safe-buffer");
 var archiveTar = require("./archive-tar");
+var atomicFile = require("./atomic-file");
 
 var TarError = archiveTar.TarError;
 var _parseHeader = archiveTar._parseHeader;
@@ -428,7 +429,7 @@ function tar(adapter, opts) {
         }
         var tmpPath = resolvedPath + ".__blamejs-archive-tar-tmp__";
         nodeFs.writeFileSync(tmpPath, body);
-        nodeFs.renameSync(tmpPath, resolvedPath);
+        atomicFile.renameWithRetry(tmpPath, resolvedPath);
         written.push({ name: entry.name, bytesWritten: body.length, path: resolvedPath });
         bytesExtracted += body.length;
       }

package/lib/atomic-file.js

@@ -1077,6 +1077,11 @@ module.exports = {
   fsync:             fsync,
   fsyncDir:          fsyncDir,
   ensureDir:         ensureDir,
+  // Atomic rename with a bounded retry on Windows-transient lock errors
+  // (EPERM/EACCES/EBUSY from AV / search indexer / Dropbox / OneDrive briefly
+  // holding the destination). Exposed so any final temp->dest rename routes
+  // through the same retry instead of hand-rolling it (or, worse, omitting it).
+  renameWithRetry:   _renameWithRetry,
   copyDirRecursive:  copyDirRecursive,
   pathTimestamp:     pathTimestamp,
   conflictPath:      conflictPath,

package/lib/bundler.js

@@ -266,13 +266,8 @@ function create(opts) {
   var hashOn   = opts.hash !== false;
   var hashLen  = DEFAULT_HASH_LEN;
   if (opts.hashLen !== undefined) {
-    if (!numericBounds.isPositiveFiniteInt(opts.hashLen) ||
-        opts.hashLen < MIN_HASH_LEN || opts.hashLen > MAX_HASH_LEN) {
-      throw new BundlerError("bundler/bad-hash-len",
-        "bundler.create: opts.hashLen must be a positive finite integer " +
-        "between " + MIN_HASH_LEN + " and " + MAX_HASH_LEN +
-        "; got " + numericBounds.shape(opts.hashLen));
-    }
+    numericBounds.requirePositiveFiniteInt(opts.hashLen, "bundler.create: opts.hashLen",
+      BundlerError, "bundler/bad-hash-len", { min: MIN_HASH_LEN, max: MAX_HASH_LEN });
     hashLen = opts.hashLen;
   }
   var log      = opts.log || null;

package/lib/cli.js

@@ -94,7 +94,14 @@ function _openSqlite(dbPath) {
   // Lazy-required so the CLI doesn't crash on `blamejs version` or
   // `blamejs help` if node:sqlite isn't usable for some reason.
   var { DatabaseSync } = require("node:sqlite");
-  return new DatabaseSync(dbPath);
+  // Same SQLITE_LIMIT_ sqlLength cap as db.init's main handle — the CLI opens
+  // the operator's real database for migrate / inspect, so the parse-time DoS
+  // floor applies here too.
+  return new DatabaseSync(dbPath, {
+    limits: {
+      sqlLength: C.BYTES.mib(1),
+    },
+  });
 }
 
 // ---- Subcommand: migrate ----

package/lib/config-drift.js

@@ -44,6 +44,7 @@ var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
+var atomicFile = require("./atomic-file");
 
 var audit = lazyRequire(function () { return require("./audit"); });
 
@@ -201,7 +202,7 @@ function create(opts) {
     };
     var tmp = sidecarPath + ".tmp";
     nodeFs.writeFileSync(tmp, JSON.stringify(payload, null, 2));
-    nodeFs.renameSync(tmp, sidecarPath);
+    atomicFile.renameWithRetry(tmp, sidecarPath);
   }
 
   function _verifySidecar(parsed) {
@@ -349,7 +350,7 @@ function create(opts) {
  * instead of a silent zero-files-checked pass.
  *
  * @opts
- *   libVendorDir: string,  // absolute path to lib/vendor (defaults to cwd-relative)
+ *   libVendorDir: string,  // absolute path to the lib/vendor tree to verify; default: the framework's own (cwd-independent). Per-file manifest paths resolve under this directory.
  *   manifestPath: string,  // absolute path to MANIFEST.json (defaults under libVendorDir)
  *
  * @example
@@ -366,7 +367,14 @@ function create(opts) {
  */
 function verifyVendorIntegrity(opts) {
   opts = opts || {};
-  var libVendorDir  = opts.libVendorDir  || nodePath.join(process.cwd(), "lib", "vendor");
+  // Default to the framework's OWN vendor directory (this module lives in
+  // lib/, so __dirname/vendor is lib/vendor) — the tree actually loaded at
+  // runtime. The previous cwd-relative default made the check cwd-dependent:
+  // run from another directory it read-failed every entry, and under a crafted
+  // cwd that happened to hold a clean vendor tree it could hash a DIFFERENT
+  // tree than the one loaded. Operators verifying a deployed tree elsewhere
+  // pass libVendorDir explicitly; per-file resolution honors it below.
+  var libVendorDir  = opts.libVendorDir  || nodePath.join(__dirname, "vendor");
   var manifestPath  = opts.manifestPath  || nodePath.join(libVendorDir, "MANIFEST.json");
   var raw;
   try { raw = nodeFs.readFileSync(manifestPath, "utf8"); }
@@ -389,7 +397,14 @@ function verifyVendorIntegrity(opts) {
       var rel = files[kind];
       var expected = hashes[kind];
       if (typeof rel !== "string" || typeof expected !== "string") return;
-      var abs = nodePath.isAbsolute(rel) ? rel : nodePath.join(process.cwd(), rel);
+      // Manifest paths are stored repo-root-relative (e.g. "lib/vendor/x.cjs").
+      // Resolve each one UNDER libVendorDir (the tree being verified), not
+      // process.cwd(), so the check hashes the actual loaded files regardless
+      // of the working directory. Strip the leading lib/vendor/ so the join
+      // doesn't double it; a manifest that already stored a vendor-relative
+      // path resolves the same way.
+      var relInVendor = rel.replace(/^lib[\\/]+vendor[\\/]+/, "");
+      var abs = nodePath.isAbsolute(rel) ? rel : nodePath.join(libVendorDir, relInVendor);
       var actual;
       try {
         var bytes = nodeFs.readFileSync(abs);

package/lib/db-schema.js

@@ -98,6 +98,34 @@ function runInTransaction(db, fn, opts) {
   }
 }
 
+// runInTransactionAsync — the async sibling of runInTransaction. SQLite
+// transactions are synchronous at the wire, but the body between BEGIN and
+// COMMIT may await (a seeder's run(), a per-row re-seal that reads off the
+// handle): await fn() before COMMIT so the transaction wraps the whole
+// awaited body, and ROLLBACK on rejection. Same opts.lockMode /
+// opts.onRollbackFail contract as the sync form.
+async function runInTransactionAsync(db, fn, opts) {
+  if (typeof fn !== "function") {
+    throw new TypeError("dbSchema.runInTransactionAsync: fn must be a function");
+  }
+  opts = opts || {};
+  var beginSql = opts.lockMode ? "BEGIN " + opts.lockMode : "BEGIN";
+  runSqlOnHandle(db, beginSql);
+  try {
+    var result = await fn();
+    runSqlOnHandle(db, "COMMIT");
+    return result;
+  } catch (e) {
+    try { runSqlOnHandle(db, "ROLLBACK"); }
+    catch (rollbackErr) {
+      if (typeof opts.onRollbackFail === "function") {
+        try { opts.onRollbackFail(rollbackErr); } catch (_e) { /* nested handler must not bubble */ }
+      }
+    }
+    throw e;
+  }
+}
+
 // ---- Internal migrations table ----
 
 // Logical name; the physical name + configured prefix resolve through
@@ -611,6 +639,7 @@ module.exports = {
   runSql:           runSql,
   runSqlOnHandle:   runSqlOnHandle,
   runInTransaction: runInTransaction,
+  runInTransactionAsync: runInTransactionAsync,
   // Shared data-layer dialect resolution — composed by migrations.js +
   // seeders.js so the handle-dialect / b.sql-opts / key-text-type logic
   // lives in exactly one place.

package/lib/db.js

@@ -1156,8 +1156,21 @@ async function init(opts) {
     encKey = null;
   }
 
-  // Open the database
-  database = new DatabaseSync(dbPath);
+  // Open the database. The node:sqlite `limits` option sets SQLITE_LIMIT_*
+  // caps at construction — a parse-time DoS floor complementary to the
+  // streamLimit row-count gate (one bounds statement size, the other bounds
+  // result cardinality). sqlLength rejects a megaquery (>1 MiB) before the
+  // parser chews CPU/memory on it; the framework never legitimately emits a
+  // statement anywhere near 1 MiB, and a 1 GB attacker-influenced statement
+  // would otherwise be parsed. The limits option is part of node:sqlite from
+  // Node 24.10+, comfortably under the engines floor. (SQLITE_LIMIT_ATTACHED is
+  // left at the SQLite default — the snapshot / backup path relies on the
+  // attach mechanism.)
+  database = new DatabaseSync(dbPath, {
+    limits: {
+      sqlLength: C.BYTES.mib(1),
+    },
+  });
 
   // Performance pragmas
   runSql(database, "PRAGMA journal_mode=WAL");

package/lib/http-client.js

@@ -2000,9 +2000,12 @@ async function downloadStream(opts) {
     }
   }
 
-  // Atomic rename + dir fsync.
+  // Atomic rename + dir fsync. Route the final rename through
+  // atomicFile.renameWithRetry so a Windows-transient lock on the destination
+  // (AV / search indexer / Dropbox / OneDrive) is retried rather than surfaced
+  // as a hard download failure — the same retry b.atomicFile.writeSync applies.
   try {
-    nodeFs.renameSync(tmpPath, dest);
+    atomicFile.renameWithRetry(tmpPath, dest);
     atomicFile.fsyncDir(dir);
   } catch (e) {
     try { nodeFs.unlinkSync(tmpPath); } catch (_u) { /* best-effort cleanup */ }

package/lib/local-db-thin.js

@@ -44,6 +44,7 @@
  *     schemaSql:  string,                // required CREATE TABLE / INDEX script
  *     recovery:   "refuse" | "rename-and-recreate",  // default: "refuse"
  *     pragmas:    object,                // optional extra PRAGMA overrides
+ *     limits:     object,                // node:sqlite SQLITE_LIMIT_* caps; default { sqlLength: 1 MiB } (parity with b.db / CLI)
  *     audit:      boolean,               // default: true
  *   }) -> { db, prepare, run, query, close, file }
  *
@@ -55,10 +56,19 @@
 
 var nodeFs   = require("node:fs");
 var nodePath = require("node:path");
+var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");
 var { LocalDbThinError } = require("./framework-error");
+var atomicFile = require("./atomic-file");
+
+// Default parse-time statement-size cap, matching b.db and the CLI opener
+// (the v0.15.9 node:sqlite SQLITE_LIMIT_LENGTH floor). prepare()/exec() on the
+// thin path parse operator/application SQL, so the same cap guards it against
+// an attacker-influenced megaquery the parser would otherwise chew (SQLite's
+// default is 1 GB). Operators raise/relax it via opts.limits.
+var _DEFAULT_SQL_LENGTH = C.BYTES.mib(1);
 
 var audit = lazyRequire(function () { return require("./audit"); });
 
@@ -98,6 +108,19 @@ function _validateOpts(opts) {
     throw new LocalDbThinError("localdb-thin/bad-pragmas",
       "localDb.thin: pragmas must be an object mapping pragma name -> value");
   }
+  if (opts.limits !== undefined &&
+      (typeof opts.limits !== "object" || opts.limits === null || Array.isArray(opts.limits))) {
+    throw new LocalDbThinError("localdb-thin/bad-limits",
+      "localDb.thin: limits must be an object of node:sqlite SQLITE_LIMIT_* caps " +
+      "(e.g. { sqlLength: 1048576 })");
+  }
+}
+
+// Merge operator-supplied limits over the framework default (sqlLength cap),
+// so the thin path reaches parity with b.db / the CLI opener while letting an
+// operator raise the cap or add SQLITE_LIMIT_* keys (e.g. attach: 0).
+function _resolveLimits(opts) {
+  return Object.assign({ sqlLength: _DEFAULT_SQL_LENGTH }, opts.limits || {});
 }
 
 function _runPragmas(database, extra) {
@@ -174,7 +197,7 @@ function thin(opts) {
   var renamedTo = null;
 
   function _attemptOpen() {
-    var db = new DatabaseSync(file);
+    var db = new DatabaseSync(file, { limits: _resolveLimits(opts) });
     _runPragmas(db, opts.pragmas);
     if (!_integrityOk(db)) {
       try { db.close(); } catch (_e) { /* best-effort */ }
@@ -203,7 +226,7 @@ function thin(opts) {
       var lastRenameErr = null;
       for (var attempt = 0; attempt < 20 && !renamed; attempt += 1) {
         try {
-          if (nodeFs.existsSync(file)) nodeFs.renameSync(file, renamedTo);
+          if (nodeFs.existsSync(file)) atomicFile.renameWithRetry(file, renamedTo);
           renamed = true;
         } catch (re) {
           lastRenameErr = re;
@@ -228,7 +251,7 @@ function thin(opts) {
       ["-wal", "-shm"].forEach(function (suffix) {
         var sibling = file + suffix;
         if (nodeFs.existsSync(sibling)) {
-          try { nodeFs.renameSync(sibling, sibling + ".corrupt-" + stamp); }
+          try { atomicFile.renameWithRetry(sibling, sibling + ".corrupt-" + stamp); }
           catch (_se) { /* best-effort */ }
         }
       });

package/lib/log-stream-local.js

@@ -85,7 +85,7 @@ function create(config) {
       var stamp = time.toIso8601NoMs(new Date()).replace(/[-:]/g, "");
       var rotated = nodePath.join(dir, cfg.fileNamePrefix + "-" + stamp + ".log");
       if (nodeFs.existsSync(activePath)) {
-        nodeFs.renameSync(activePath, rotated);
+        atomicFile.renameWithRetry(activePath, rotated);
         if (cfg.compressRotations) {
           var data = nodeFs.readFileSync(rotated);
           var gz = zlib.gzipSync(data);

package/lib/mail-scan.js

@@ -161,11 +161,8 @@ function create(opts) {
 
   validateOpts.requireNonEmptyString(opts.host, "mail.scan.create.host",
     MailScanError, "mail-scan/bad-host");
-  if (!numericBounds.isPositiveFiniteInt(opts.port) || opts.port > 65535) {                        // TCP port-number range cap
-    throw new MailScanError("mail-scan/bad-port",
-      "mail.scan.create.port must be a positive integer in [1,65535]; got " +
-      numericBounds.shape(opts.port));
-  }
+  numericBounds.requirePositiveFiniteInt(opts.port, "mail.scan.create.port",
+    MailScanError, "mail-scan/bad-port", { max: 65535 });   // TCP port-number range cap
   var protocol = opts.protocol || DEFAULT_PROTOCOL;
   if (!ALLOWED_PROTOCOLS[protocol]) {
     throw new MailScanError("mail-scan/bad-protocol",

package/lib/middleware/clear-site-data.js

@@ -87,29 +87,51 @@ var DEFAULT_TYPES = ["cookies", "storage", "cache", "executionContexts"];
  *     },
  *   ]);
  */
-function create(opts) {
-  opts = opts || {};
-  validateOpts(opts, ["types"], "middleware.clearSiteData");
-  var types = opts.types === undefined ? DEFAULT_TYPES : opts.types;
+/**
+ * @primitive b.middleware.clearSiteData.headerValue
+ * @signature b.middleware.clearSiteData.headerValue(types, label?)
+ * @since      0.15.9
+ * @status     stable
+ * @related    b.middleware.clearSiteData, b.session.logout
+ *
+ * Build the RFC 9527 §3 Clear-Site-Data header value from a list of directive
+ * types — a comma-separated list of double-quoted tokens — validating each
+ * against the known set (`cookies`, `storage`, `cache`, `executionContexts`).
+ * The middleware factory and `b.session.logout` both compose it so every
+ * emitter produces the same validated header instead of hand-rolling the
+ * quoting. Throws a `TypeError` on an unknown directive or a non-array input
+ * (config-time / entry-point tier).
+ *
+ * @example
+ *   b.middleware.clearSiteData.headerValue(["cookies", "storage"]);
+ *   // → '"cookies", "storage"'
+ */
+function headerValue(types, label) {
+  label = label || "middleware.clearSiteData";
   if (!Array.isArray(types) || types.length === 0) {
-    throw new TypeError("middleware.clearSiteData: opts.types must be a non-empty array");
+    throw new TypeError(label + ": types must be a non-empty array");
   }
   for (var i = 0; i < types.length; i += 1) {
     var t = types[i];
     if (typeof t !== "string" || !KNOWN_TYPES[t]) {
       throw new TypeError(
-        "middleware.clearSiteData: unknown type '" + t +
+        label + ": unknown type '" + t +
         "' (expected one of: " + Object.keys(KNOWN_TYPES).join(", ") + ")");
     }
   }
-  // Header value is a comma-separated list of double-quoted tokens
-  // per RFC 9527 §3 (Structured Field Value List of Strings). Build
-  // once at construction time — runtime cost is one setHeader call.
-  var headerValue = types.map(function (t) { return '"' + t + '"'; }).join(", ");
+  return types.map(function (t) { return '"' + t + '"'; }).join(", ");
+}
+
+function create(opts) {
+  opts = opts || {};
+  validateOpts(opts, ["types"], "middleware.clearSiteData");
+  var types = opts.types === undefined ? DEFAULT_TYPES : opts.types;
+  // Header value built once at construction; runtime cost is one setHeader.
+  var headerVal = headerValue(types, "middleware.clearSiteData");
 
   return function clearSiteData(req, res, next) {
     if (typeof res.setHeader === "function") {
-      res.setHeader("Clear-Site-Data", headerValue);
+      res.setHeader("Clear-Site-Data", headerVal);
     }
     next();
   };
@@ -117,6 +139,9 @@ function create(opts) {
 
 module.exports = {
   create:        create,
+  // The shared RFC 9527 header-value builder — b.session.logout composes it so
+  // the logout path emits the same validated Clear-Site-Data header.
+  headerValue:   headerValue,
   KNOWN_TYPES:   Object.keys(KNOWN_TYPES),
   DEFAULT_TYPES: DEFAULT_TYPES,
 };

package/lib/mtls-ca.js

@@ -336,8 +336,8 @@ function create(opts) {
         _writeExclusive(keyTmp, opts2.caKeyPem, 0o600);
       }
       _writeExclusive(certTmp, opts2.caCertPem, 0o644);
-      nodeFs.renameSync(keyTmp, keyDest);
-      nodeFs.renameSync(certTmp, paths.caCert);
+      atomicFile.renameWithRetry(keyTmp, keyDest);
+      atomicFile.renameWithRetry(certTmp, paths.caCert);
     } catch (e) {
       // Best-effort cleanup of half-written tmp files; the original
       // commit error is what we re-raise. Log cleanup failures at debug

package/lib/numeric-bounds.js

@@ -82,6 +82,37 @@ function requireNonNegativeFiniteIntIfPresent(value, label, errorClass, code) {
   return value;
 }
 
+// requirePositiveFiniteInt — REQUIRED-shape gate (the non-optional sibling
+// of requirePositiveFiniteIntIfPresent): throws when the value is absent OR
+// not a positive finite integer, and — when range bounds are supplied —
+// when it falls outside them. Replaces the per-file
+// `if (!nb.isPositiveFiniteInt(opts.X) || opts.X < MIN || opts.X > MAX) throw`
+// cascade that bundler / mail-scan / safe-decompress rolled by hand for
+// REQUIRED numeric opts (the IfPresent helper can't be used there — it
+// skips when undefined, so a missing required opt would pass).
+//
+//   nb.requirePositiveFiniteInt(opts.maxOutputBytes,
+//     "safeDecompress: maxOutputBytes", SafeDecompressError, "safe-decompress/bad-arg");
+//   nb.requirePositiveFiniteInt(opts.hashLen, "bundler.create: opts.hashLen",
+//     BundlerError, "bundler/bad-hash-len", { min: MIN_HASH_LEN, max: MAX_HASH_LEN });
+function _rangeSuffix(range) {
+  if (!range) return "";
+  if (range.min != null && range.max != null) return " in [" + range.min + ", " + range.max + "]";
+  if (range.max != null) return " <= " + range.max;
+  if (range.min != null) return " >= " + range.min;
+  return "";
+}
+function requirePositiveFiniteInt(value, label, errorClass, code, range) {
+  var inRange = !range ||
+    ((range.min == null || value >= range.min) && (range.max == null || value <= range.max));
+  if (!isPositiveFiniteInt(value) || !inRange) {
+    throw new errorClass(code,
+      (label || "value") + " must be a positive finite integer" +
+      _rangeSuffix(range) + "; got " + shape(value));
+  }
+  return value;
+}
+
 // requireAllPositiveFiniteIntIfPresent — batch validator. Walk each
 // opt-name in the list; for any that is present in opts, require it to
 // be a positive finite integer (otherwise throw via errorClass with the
@@ -105,6 +136,7 @@ module.exports = {
   shape:                                  shape,
   isPositiveFiniteInt:                    isPositiveFiniteInt,
   isNonNegativeFiniteInt:                 isNonNegativeFiniteInt,
+  requirePositiveFiniteInt:               requirePositiveFiniteInt,
   requirePositiveFiniteIntIfPresent:      requirePositiveFiniteIntIfPresent,
   requireNonNegativeFiniteIntIfPresent:   requireNonNegativeFiniteIntIfPresent,
   requireAllPositiveFiniteIntIfPresent:   requireAllPositiveFiniteIntIfPresent,

package/lib/object-store/azure-blob.js

@@ -356,7 +356,18 @@ function create(config) {
     });
   }
 
-  function deleteKey(key) {
+  function deleteKey(key, opts) {
+    opts = opts || {};
+    // Versioned erasure (opts.versionId) is the S3 Object-Lock workflow and is
+    // sigv4-only today. Refuse loudly rather than silently delete the current
+    // blob — a silent drop on an erasure path would let a caller believe a
+    // specific version was shredded when it was not.
+    if (opts.versionId) {
+      throw _err("VERSIONID_UNSUPPORTED",
+        "deleteKey: versioned delete (opts.versionId) is S3/sigv4-only; the Azure " +
+        "Blob backend has no version surface here. Use a sigv4 backend for " +
+        "Object-Lock version erasure.", true);
+    }
     var url = _blobUrl(key);
     var headers = _signed("DELETE", url, {});
     return _httpRequest("DELETE", url, headers, null, reqOpts).then(

package/lib/object-store/gcs.js

@@ -281,7 +281,18 @@ function create(config) {
     };
   }
 
-  async function deleteKey(key) {
+  async function deleteKey(key, opts) {
+    opts = opts || {};
+    // Versioned erasure (opts.versionId) is the S3 Object-Lock workflow and is
+    // sigv4-only today. Refuse loudly rather than silently delete the live
+    // object — a silent drop on an erasure path would let a caller believe a
+    // specific version was shredded when it was not.
+    if (opts.versionId) {
+      throw _err("VERSIONID_UNSUPPORTED",
+        "deleteKey: versioned delete (opts.versionId) is S3/sigv4-only; the GCS " +
+        "backend has no version surface here. Use a sigv4 backend for Object-Lock " +
+        "version erasure.", true);
+    }
     var token = await _ensureToken();
     var url = _objectUrl(key);
     try {

package/lib/object-store/http-put.js

@@ -110,7 +110,17 @@ function create(config) {
     });
   }
 
-  function deleteKey(key) {
+  function deleteKey(key, opts) {
+    opts = opts || {};
+    // Versioned erasure (opts.versionId) is the S3 Object-Lock workflow and is
+    // sigv4-only. A bare PUT target has no version surface, so refuse loudly
+    // rather than issue a plain DELETE and report a specific version erased —
+    // a silent drop on an erasure path is the footgun.
+    if (opts.versionId) {
+      throw _err("VERSIONID_UNSUPPORTED",
+        "deleteKey: versioned delete (opts.versionId) is S3/sigv4-only; the http-put " +
+        "backend has no version surface. Use a sigv4 backend for Object-Lock version erasure.", true);
+    }
     var url = _keyToUrl(baseUrl, key);
     return _request("DELETE", url, null, headers, reqOpts).then(
       function () { return true; },

package/lib/object-store/index.js

@@ -122,6 +122,10 @@ function buildBackend(config) {
     head:            wrap("head"),
     delete:          wrap("delete"),
     list:            wrap("list"),
+    // listVersions is S3/sigv4-only (the ?versions subresource backs the
+    // WORM erasure workflow). Backends without it expose null so callers can
+    // feature-detect rather than hit a "wrap of undefined" at boot.
+    listVersions:    typeof raw.listVersions === "function" ? wrap("listVersions") : null,
     // presigned*Url are sync URL-builders (no network call), so they
     // bypass retry + circuit-breaker — propagate any throw directly.
     presignedUploadUrl: typeof raw.presignedUploadUrl === "function"