@blamejs/core 0.15.8 → 0.15.10

package/lib/object-store/local.js

@@ -101,7 +101,17 @@ function create(config) {
     });
   }
 
-  function deleteKey(key) {
+  function deleteKey(key, opts) {
+    opts = opts || {};
+    // A filesystem has no object versions; a versioned-delete request can only
+    // be a caller mistake. Refuse loudly rather than unlink the single on-disk
+    // file and report a version was erased.
+    if (opts.versionId) {
+      throw _err("VERSIONID_UNSUPPORTED",
+        "deleteKey: versioned delete (opts.versionId) is not supported on the " +
+        "filesystem backend — a local file has no version history. Use a sigv4 " +
+        "(S3 Object-Lock) backend for version erasure.", true);
+    }
     cluster.requireLeader();
     var full = _resolveSafe(rootDir, key);
     if (!nodeFs.existsSync(full)) return Promise.resolve(false);

package/lib/object-store/sigv4.js

@@ -499,7 +499,15 @@ function create(config) {
     var headers = _makeSigned("PUT", url, payloadHash, extra);
     return _request("PUT", url, headers, buf, reqOpts).then(function (res) {
       _verifySseResponse(sseRequested, res.headers);
-      return { size: buf.length, etag: res.headers.etag };
+      return {
+        size: buf.length,
+        etag: res.headers.etag,
+        // On a versioning-enabled (Object-Lock) bucket S3/MinIO returns the
+        // version this PUT created. Surface it so callers can target the
+        // exact version for a later versioned delete / erasure — without it
+        // the only way to find the version is a separate listVersions() call.
+        versionId: res.headers && res.headers["x-amz-version-id"] || null,
+      };
     });
   }
 
@@ -601,7 +609,12 @@ function create(config) {
       // response may or may not echo the header depending on vendor;
       // re-verifying here would double-fault on otherwise-fine setups.
       var result = completeDoc.CompleteMultipartUploadResult || {};
-      return { size: totalSize, etag: result.ETag || completeRes.headers.etag, multipart: true };
+      return {
+        size: totalSize,
+        etag: result.ETag || completeRes.headers.etag,
+        multipart: true,
+        versionId: completeRes.headers && completeRes.headers["x-amz-version-id"] || null,
+      };
     } catch (e) {
       // Abort cleans up server-side storage for the partial upload.
       // Failures here are silently swallowed — the caller's original
@@ -639,6 +652,11 @@ function create(config) {
   function getResponse(key, opts) {
     opts = opts || {};
     var url = _keyToUrl(key);
+    // Reading a specific version (opts.versionId) is the read half of the
+    // WORM erasure workflow — verify a protected version is present before /
+    // gone after a versioned delete. Set it before signing so the query
+    // param is in the SigV4 canonical request.
+    if (opts.versionId) url.searchParams.set("versionId", opts.versionId);
     var headers = _makeSigned("GET", url, sha256Hex(Buffer.alloc(0)));
     if (opts.range) {
       headers["Range"] = "bytes=" + opts.range.start + "-" + opts.range.end;
@@ -674,8 +692,10 @@ function create(config) {
     });
   }
 
-  function head(key) {
+  function head(key, opts) {
+    opts = opts || {};
     var url = _keyToUrl(key);
+    if (opts.versionId) url.searchParams.set("versionId", opts.versionId);
     var headers = _makeSigned("HEAD", url, sha256Hex(Buffer.alloc(0)));
     return _request("HEAD", url, headers, null, reqOpts).then(function (res) {
       return {
@@ -696,9 +716,25 @@ function create(config) {
     });
   }
 
-  function deleteKey(key) {
+  // deleteKey(key, opts?) — opts.versionId targets a specific version;
+  // opts.bypassGovernanceRetention signs x-amz-bypass-governance-retention so
+  // a GOVERNANCE-mode retention can be lifted by a caller with the permission
+  // (COMPLIANCE mode is immutable to everyone and stays refused).
+  //
+  // WORM-awareness: an UNVERSIONED delete on a versioning-enabled bucket only
+  // writes a delete-marker — the data version survives and the call still
+  // resolves true. To actually erase a version (e.g. crypto-shred / GDPR Art.
+  // 17 on an Object-Lock bucket) pass the versionId from put()/listVersions().
+  // A delete refused by an active retention surfaces as a thrown error (S3 403
+  // / MinIO 400), never a silent success, so the caller learns the version is
+  // still protected.
+  function deleteKey(key, opts) {
+    opts = opts || {};
     var url = _keyToUrl(key);
-    var headers = _makeSigned("DELETE", url, sha256Hex(Buffer.alloc(0)));
+    if (opts.versionId) url.searchParams.set("versionId", opts.versionId);
+    var extra = {};
+    if (opts.bypassGovernanceRetention) extra["x-amz-bypass-governance-retention"] = "true";
+    var headers = _makeSigned("DELETE", url, sha256Hex(Buffer.alloc(0)), extra);
     return _request("DELETE", url, headers, null, reqOpts).then(
       function () { return true; },
       function (e) { if (e.statusCode === 404) return false; throw e; }
@@ -953,6 +989,50 @@ function create(config) {
     });
   }
 
+  // listVersions(prefix, opts?) — enumerate every object VERSION and
+  // delete-marker under prefix (S3 ListObjectVersions / the ?versions
+  // subresource). Plain list() only sees current versions; to erase prior
+  // versions on a versioning / Object-Lock bucket you first need their
+  // versionIds, which only this call surfaces. Each item carries
+  // { key, versionId, isLatest, deleteMarker, size, lastModified, etag };
+  // deleteMarker:true rows are tombstones (no data, size null). Pagination
+  // walks (keyMarker, versionIdMarker) the way list() walks continuationToken.
+  function listVersions(prefix, opts) {
+    opts = opts || {};
+    var params = { versions: "" };
+    if (prefix) params["prefix"] = prefix;
+    if (opts.maxResults) params["max-keys"] = String(opts.maxResults);
+    if (opts.keyMarker) params["key-marker"] = opts.keyMarker;
+    if (opts.versionIdMarker) params["version-id-marker"] = opts.versionIdMarker;
+
+    var url = _bucketUrl(params);
+    var headers = _makeSigned("GET", url, sha256Hex(Buffer.alloc(0)));
+    return _request("GET", url, headers, null, reqOpts).then(function (res) {
+      var doc = safeXml.parse(res.body, LIST_PARSE_OPTS);
+      var result = doc.ListVersionsResult || {};
+      function _mapEntry(e, isDeleteMarker) {
+        return {
+          key:          e.Key,
+          versionId:    e.VersionId != null ? String(e.VersionId) : null,
+          isLatest:     e.IsLatest === "true",
+          deleteMarker: isDeleteMarker,
+          size:         isDeleteMarker ? null : (e.Size != null ? parseInt(e.Size, 10) : null),
+          lastModified: e.LastModified ? Date.parse(e.LastModified) : null,
+          etag:         isDeleteMarker ? null : (e.ETag || null),
+        };
+      }
+      var versions = _arrayify(result.Version).map(function (v) { return _mapEntry(v, false); });
+      var markers = _arrayify(result.DeleteMarker).map(function (m) { return _mapEntry(m, true); });
+      var items = versions.concat(markers).filter(function (it) { return it.key; });
+      return {
+        items:           items,
+        truncated:       result.IsTruncated === "true",
+        keyMarker:       result.NextKeyMarker || null,
+        versionIdMarker: result.NextVersionIdMarker || null,
+      };
+    });
+  }
+
   return {
     protocol:  "sigv4",
     endpoint:  endpoint,
@@ -966,6 +1046,7 @@ function create(config) {
     head:      head,
     delete:    deleteKey,
     list:      list,
+    listVersions: listVersions,
     presignedUploadUrl:    presignedUploadUrl,
     presignedDownloadUrl:  presignedDownloadUrl,
     presignedUploadPolicy: presignedUploadPolicy,

package/lib/restore-rollback.js

@@ -119,7 +119,7 @@ function swap(opts) {
   // Step 1: rename current dataDir → rollback nodePath. Skipped on first
   // restore (no existing dataDir).
   if (hadDataDir) {
-    try { nodeFs.renameSync(opts.dataDir, rollbackPath); }
+    try { atomicFile.renameWithRetry(opts.dataDir, rollbackPath); }
     catch (e) {
       throw new RestoreRollbackError("restore-rollback/rename-existing-failed",
         "swap: could not move existing dataDir to rollback: " + ((e && e.message) || String(e)));
@@ -127,11 +127,11 @@ function swap(opts) {
   }
 
   // Step 2: rename staging → dataDir
-  try { nodeFs.renameSync(opts.stagingDir, opts.dataDir); }
+  try { atomicFile.renameWithRetry(opts.stagingDir, opts.dataDir); }
   catch (e) {
     // Step 2 failed — try to undo step 1 so the operator's dataDir is back
     if (hadDataDir) {
-      try { nodeFs.renameSync(rollbackPath, opts.dataDir); }
+      try { atomicFile.renameWithRetry(rollbackPath, opts.dataDir); }
       catch (_e) { /* dataDir is now in rollbackPath; operator must recover manually */ }
     }
     throw new RestoreRollbackError("restore-rollback/rename-staging-failed",
@@ -220,7 +220,7 @@ async function rollback(opts) {
     atomicFile.ensureDir(rollbackRoot);
     discardedAt = atomicFile.pathTimestamp();
     var discardedPath = nodePath.join(rollbackRoot, "discarded-" + discardedAt);
-    try { nodeFs.renameSync(opts.dataDir, discardedPath); }
+    try { atomicFile.renameWithRetry(opts.dataDir, discardedPath); }
     catch (e) {
       throw new RestoreRollbackError("restore-rollback/rename-existing-failed",
         "rollback: could not move current dataDir aside: " + ((e && e.message) || String(e)));
@@ -229,7 +229,7 @@ async function rollback(opts) {
   }
 
   // Rename the rollback dir back into dataDir's place
-  try { nodeFs.renameSync(opts.rollbackPath, opts.dataDir); }
+  try { atomicFile.renameWithRetry(opts.rollbackPath, opts.dataDir); }
   catch (e) {
     throw new RestoreRollbackError("restore-rollback/rollback-rename-failed",
       "rollback: could not move rollback into dataDir: " + ((e && e.message) || String(e)) +

package/lib/safe-decompress.js

@@ -171,18 +171,9 @@ function safeDecompress(input, opts) {
         JSON.stringify(opts.algorithm));
   }
 
-  // maxOutputBytes — required, positive finite integer. Inline gate
-  // is intentional: it's a REQUIRED opt (not optional), so the
-  // `requirePositiveFiniteIntIfPresent` helper doesn't apply (it skips
-  // when undefined). The numericBounds.requirePositiveFiniteInt helper
-  // would fit, but the existing call surface across the framework
-  // uses the inline shape for required-opt validation.
-  if (!numericBounds.isPositiveFiniteInt(opts.maxOutputBytes)) {                     // allow:inline-numeric-bounds-cascade — required (non-optional) opt; requirePositiveFiniteIntIfPresent skips when undefined
-    throw new SafeDecompressError(
-      "safe-decompress/bad-arg",
-      "safeDecompress: maxOutputBytes must be a positive finite integer; got " +
-        numericBounds.shape(opts.maxOutputBytes));
-  }
+  // maxOutputBytes — required, positive finite integer.
+  numericBounds.requirePositiveFiniteInt(opts.maxOutputBytes,
+    "safeDecompress: maxOutputBytes", SafeDecompressError, "safe-decompress/bad-arg");
 
   // Input shape
   var buf;

package/lib/seeders.js

@@ -546,46 +546,40 @@ function create(opts) {
 
         try {
            
-          await (async function () {
-            // Per-seed transaction: SQLite txns are sync, but the
-            // seed's run() may be async — so we begin/commit around
-            // an awaited body. Failures roll back this seed only.
-            _runSql(db, "BEGIN");
-            try {
-              await mod.run(db, ctx);
-              var nowIso = new Date(clock()).toISOString();
-              var writeBuilt;
-              if (alreadyApplied && mod.rerunnable) {
-                writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
-                  .set({ appliedAt: nowIso, description: mod.description || "",
-                         rerunnable: mod.rerunnable ? 1 : 0 })
-                  .where("env", env).where("name", name).toSql();
-              } else if (alreadyApplied && force) {
-                writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
-                  .set({ appliedAt: nowIso, description: mod.description || "" })
-                  .where("env", env).where("name", name).toSql();
-              } else {
-                writeBuilt = sql.insert(_seedersTable(), _sqlOpts(db))
-                  .values({ env: env, name: name, description: mod.description || "",
-                            appliedAt: nowIso, rerunnable: mod.rerunnable ? 1 : 0 })
-                  .toSql();
-              }
-              var writeStmt = db.prepare(writeBuilt.sql);
-              writeStmt.run.apply(writeStmt, writeBuilt.params);
-              _runSql(db, "COMMIT");
-            } catch (e) {
-              try { _runSql(db, "ROLLBACK"); }
-              catch (rollbackErr) {
-                log.debug("rollback-failed", {
-                  op: "seed-apply",
-                  env: env,
-                  name: name,
-                  error: rollbackErr && rollbackErr.message,
-                });
-              }
-              throw e;
+          // Per-seed transaction: SQLite txns are sync, but the seed's
+          // run() may be async — runInTransactionAsync wraps BEGIN/COMMIT
+          // around the awaited body and rolls back this seed only on failure.
+          await dbSchema.runInTransactionAsync(db, async function () {
+            await mod.run(db, ctx);
+            var nowIso = new Date(clock()).toISOString();
+            var writeBuilt;
+            if (alreadyApplied && mod.rerunnable) {
+              writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
+                .set({ appliedAt: nowIso, description: mod.description || "",
+                       rerunnable: mod.rerunnable ? 1 : 0 })
+                .where("env", env).where("name", name).toSql();
+            } else if (alreadyApplied && force) {
+              writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
+                .set({ appliedAt: nowIso, description: mod.description || "" })
+                .where("env", env).where("name", name).toSql();
+            } else {
+              writeBuilt = sql.insert(_seedersTable(), _sqlOpts(db))
+                .values({ env: env, name: name, description: mod.description || "",
+                          appliedAt: nowIso, rerunnable: mod.rerunnable ? 1 : 0 })
+                .toSql();
             }
-          })();
+            var writeStmt = db.prepare(writeBuilt.sql);
+            writeStmt.run.apply(writeStmt, writeBuilt.params);
+          }, {
+            onRollbackFail: function (rollbackErr) {
+              log.debug("rollback-failed", {
+                op: "seed-apply",
+                env: env,
+                name: name,
+                error: rollbackErr && rollbackErr.message,
+              });
+            },
+          });
           applied.push(name);
           appliedSet.add(name);
 

package/lib/self-update.js

@@ -676,7 +676,7 @@ async function swap(opts) {
   // don't silently lose both binaries (the prior best-effort comment
   // swallowed the rollback exception — SSDF RV.1 violation).
   try {
-    nodeFs.renameSync(from, to);
+    atomicFile.renameWithRetry(from, to);
   } catch (e) {
     if (e && e.code === "EXDEV") {
       // Cross-device — copy + unlink. Use atomicFile.copy for the safety

package/lib/session.js

@@ -65,6 +65,9 @@ var { SessionError } = require("./framework-error");
 // the cookie-side sid so the wire token is ciphertext rather than
 // plaintext (sealed-cookie default since v0.8.61).
 var vault = lazyRequire(function () { return require("./vault"); });
+// Lazy — b.session.logout composes the Clear-Site-Data header builder; keep it
+// out of the boot require graph (no cycle, but session is a low-level primitive).
+var clearSiteData = lazyRequire(function () { return require("./middleware/clear-site-data"); });
 
 // Pluggable session-storage backend. Default uses cluster-storage (which
 // in turn dispatches to the framework's main DB or external DB). An
@@ -705,6 +708,66 @@ async function destroy(token) {
   return await _deleteBySidHash(_hashSid(sid));
 }
 
+/**
+ * @primitive b.session.logout
+ * @signature b.session.logout(res, token, opts?)
+ * @since     0.15.9
+ * @status    stable
+ * @related   b.session.destroy, b.middleware.clearSiteData
+ *
+ * Secure logout in one call: destroy the server-side session AND tell the
+ * browser to wipe its client-side state. It emits an RFC 9527 Clear-Site-Data
+ * response header (cookies + storage + cache + executionContexts by default)
+ * and expires the session cookie, then destroys the session row. `destroy()`
+ * alone is a store operation with no `res`, so it cannot wipe the browser's
+ * cached pages / storage / any stale tab still holding the now-revoked cookie;
+ * this composes the secure-default logout the middleware otherwise had to be
+ * mounted by hand. Returns whether a session was destroyed. Leader-only.
+ *
+ * @opts
+ *   cookieName: string,    // default: "sid" — the session cookie to expire
+ *   types:      string[],  // default: the RFC 9527 Clear-Site-Data directive set
+ *
+ * @example
+ *   app.post("/logout", async function (req, res) {
+ *     await b.session.logout(res, req.cookies.sid);
+ *     res.end("logged out");
+ *   });
+ *   // → emits Clear-Site-Data + expires the sid cookie + destroys the session
+ */
+async function logout(res, token, opts) {
+  if (!res || typeof res.setHeader !== "function") {
+    throw new SessionError("session/bad-res",
+      "b.session.logout: res must be an HTTP response with setHeader()");
+  }
+  opts = opts || {};
+  var cookieName = opts.cookieName === undefined ? "sid" : opts.cookieName;
+  if (typeof cookieName !== "string" || cookieName.length === 0) {
+    throw new SessionError("session/bad-cookie-name",
+      "b.session.logout: opts.cookieName must be a non-empty string");
+  }
+  var csd = clearSiteData();
+  var types = opts.types === undefined ? csd.DEFAULT_TYPES : opts.types;
+  // Build (and validate) the RFC 9527 header BEFORE any side effect — an
+  // unknown directive throws here, queuing nothing.
+  var clearSiteDataValue = csd.headerValue(types, "b.session.logout");
+
+  // Revoke the server-side session FIRST. If destroy() throws (a follower
+  // failing cluster.requireLeader(), or a store/DB error), no client-wipe
+  // headers have been queued — an error response can't then expire the
+  // browser cookie + Clear-Site-Data while the session row is still live,
+  // which would leave a copied token usable server-side.
+  var destroyed = await destroy(token);
+
+  // Now wipe the client-side state: RFC 9527 Clear-Site-Data (cookies /
+  // storage / cache) + expire the session cookie (belt-and-suspenders with the
+  // "cookies" directive, and effective even if the client ignores the header).
+  res.setHeader("Clear-Site-Data", clearSiteDataValue);
+  res.setHeader("Set-Cookie",
+    cookieName + "=; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=0");
+  return destroyed;
+}
+
 async function _deleteBySidHash(sidHash) {
   var built = sql.delete(_sessionSqlTable(), _sessionSqlOpts())
     .where("sidHash", sidHash)
@@ -1245,6 +1308,7 @@ module.exports = {
   create:               create,
   verify:               verify,
   destroy:              destroy,
+  logout:               logout,
   destroyAllForUser:    destroyAllForUser,
   touch:                touch,
   rotate:               rotate,

package/lib/storage.js

@@ -425,7 +425,7 @@ async function getFileStream(key, sealedKey, opts) {
  * @example
  *   b.storage.init({ backend: "local", uploadDir: "./data/uploads" });
  *   var saved = await b.storage.saveRaw(Buffer.from("public-bytes"), "logo.png");
- *   // → { storedPath: "logo.png", backend: "default" }
+ *   // → { storedPath: "logo.png", backend: "default", versionId: null }
  */
 async function saveRaw(buffer, key, opts) {
   _requireInit();
@@ -443,7 +443,9 @@ async function saveRaw(buffer, key, opts) {
       raw:            true,
     },
   });
-  return { storedPath: key, backend: picked.backend.name };
+  // versionId is non-null only on a versioning-enabled (S3 Object-Lock)
+  // backend; capture it to target the exact version for later erasure.
+  return { storedPath: key, backend: picked.backend.name, versionId: result.versionId || null };
 }
 
 /**
@@ -486,14 +488,24 @@ async function getRawBuffer(key, opts) {
  * Remove `key` from the routed backend. Returns `true` when the
  * object existed and was removed, `false` when it was already
  * absent. Emits `system.storage.delete` with `{ backend, key,
- * existed }` so the audit chain records GDPR right-to-erasure
+ * existed, versionId }` so the audit chain records GDPR right-to-erasure
  * flows. The sealed encryption key the caller persisted alongside
  * the row should be discarded by the caller after a successful
  * delete — without the bytes, the key has no recovery value.
  *
+ * On a versioning-enabled (S3 Object-Lock) backend an unversioned
+ * delete only writes a delete-marker — the data version survives. To
+ * erase a specific version pass `versionId` (from `saveRaw`'s return or
+ * `listVersions`); a version under an active retention is refused (the
+ * call throws), and `bypassGovernanceRetention` lifts a GOVERNANCE-mode
+ * retention for callers with the permission (COMPLIANCE stays immutable).
+ * `versionId` is S3/sigv4-only and is refused on other backends.
+ *
  * @opts
  *   classification:  string,    // route to a backend serving this classification
  *   backend:         string,    // explicit backend by name
+ *   versionId:       string,    // erase a specific object version (S3 Object-Lock)
+ *   bypassGovernanceRetention: boolean, // lift GOVERNANCE retention (not COMPLIANCE)
  *
  * @example
  *   b.storage.init({ backend: "local", uploadDir: "./data/uploads" });
@@ -507,12 +519,16 @@ async function deleteFile(key, opts) {
   _requireInit();
   opts = opts || {};
   var picked = _pickBackend(opts);
-  var result = await picked.backend.delete(key);
+  var result = await picked.backend.delete(key, {
+    versionId:                 opts.versionId,
+    bypassGovernanceRetention: opts.bypassGovernanceRetention,
+  });
   _emit("system.storage.delete", {
     metadata: {
-      backend: picked.backend.name,
-      key:     key,
-      existed: result,
+      backend:   picked.backend.name,
+      key:       key,
+      existed:   result,
+      versionId: opts.versionId || null,
     },
   });
   return result;
@@ -556,6 +572,53 @@ async function exists(key, opts) {
   }
 }
 
+/**
+ * @primitive b.storage.listVersions
+ * @signature b.storage.listVersions(prefix, opts?)
+ * @since     0.15.10
+ * @status    stable
+ * @compliance gdpr, sox-404, soc2
+ * @related   b.storage.deleteFile, b.storage.saveRaw, b.worm.create
+ *
+ * Enumerate every object VERSION and delete-marker under `prefix` on a
+ * versioning-enabled (S3 Object-Lock) backend. Plain reads only see the
+ * current version; right-to-erasure / crypto-shred on an Object-Lock
+ * bucket must target prior versions by `versionId`, which only this call
+ * surfaces. Each item is `{ key, versionId, isLatest, deleteMarker, size,
+ * lastModified, etag }`; `deleteMarker: true` rows are tombstones with no
+ * data. Pair with `deleteFile(key, { versionId })` to erase a version.
+ *
+ * Versioning is an S3/sigv4 feature — a backend without a version surface
+ * (filesystem, and the current Azure/GCS adapters) throws
+ * `VERSIONS_UNSUPPORTED` rather than silently returning the current view,
+ * so an erasure workflow can never mistake a single-version backend for a
+ * fully-enumerated one.
+ *
+ * @opts
+ *   classification:   string,   // route to a backend serving this classification
+ *   backend:          string,   // explicit backend by name
+ *   maxResults:       number,   // page size
+ *   keyMarker:        string,   // pagination cursor (from a prior page)
+ *   versionIdMarker:  string,   // pagination cursor (from a prior page)
+ *
+ * @example
+ *   var page = await b.storage.listVersions("filings/2026/");
+ *   for (var v of page.items) {
+ *     if (!v.isLatest) await b.storage.deleteFile(v.key, { versionId: v.versionId });
+ *   }
+ */
+async function listVersions(prefix, opts) {
+  _requireInit();
+  opts = opts || {};
+  var picked = _pickBackend(opts);
+  if (typeof picked.backend.listVersions !== "function") {
+    throw _err("VERSIONS_UNSUPPORTED",
+      "listVersions: backend '" + picked.backend.name + "' has no version surface " +
+      "(S3/sigv4 only). A filesystem / single-version backend cannot enumerate versions.", true);
+  }
+  return picked.backend.listVersions(prefix, opts);
+}
+
 /**
  * @primitive b.storage.listBackends
  * @signature b.storage.listBackends()
@@ -1266,6 +1329,7 @@ module.exports = {
   getRawBuffer:   getRawBuffer,
   deleteFile:     deleteFile,
   exists:         exists,
+  listVersions:   listVersions,
   presignedUploadUrl:    presignedUploadUrl,
   presignedDownloadUrl:  presignedDownloadUrl,
   presignedUploadPolicy: presignedUploadPolicy,

package/lib/vault/passphrase-ops.js

@@ -169,7 +169,7 @@ async function seal(opts) {
   }
 
   // Step 3: atomic rename sealed.tmp → sealed
-  nodeFs.renameSync(p.sealedTmp, p.sealed);
+  atomicFile.renameWithRetry(p.sealedTmp, p.sealed);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 4: delete plaintext (unless keepPlaintext)
@@ -220,7 +220,7 @@ async function unseal(opts) {
   }
 
   // Step 3: atomic rename plaintext.tmp → plaintext
-  nodeFs.renameSync(p.plaintextTmp, p.plaintext);
+  atomicFile.renameWithRetry(p.plaintextTmp, p.plaintext);
   atomicFile.fsyncDir(opts.dataDir);
 
   // Step 4: delete sealed file
@@ -293,7 +293,7 @@ async function rotate(opts) {
   }
 
   // Step 3: atomic rename — swap in the new sealed file
-  nodeFs.renameSync(p.sealedTmp, p.sealed);
+  atomicFile.renameWithRetry(p.sealedTmp, p.sealed);
   atomicFile.fsyncDir(opts.dataDir);
 
   return { sealedPath: p.sealed };

package/lib/vault/rotate.js

@@ -544,12 +544,6 @@ function _walkAndReSeal(node, oldKeys, newKeys) {
   return { value: node, changed: false };
 }
 
-// Transaction-control statements only (BEGIN / COMMIT / ROLLBACK) - fixed
-// keywords, no identifier / value, so they stay verbatim rather than route
-// through b.sql (the builder has no transaction-control verb). The param is
-// named `stmtText` so it does not shadow the module-level `sql` builder.
-function _runStmt(db, stmtText) { db.prepare(stmtText).run(); }
-
 function _rotateColumn(db, table, column, schema, roots, batchSize, progress) {
   // Every statement composes through b.sql (sqlite dialect, quoteName so
   // the concrete handle's table is quoted, not left bare for a cluster
@@ -655,8 +649,9 @@ function _rotateOverflow(db, table, oldKeys, newKeys, batchSize, progress, warni
     var rows = sel.all(lastId);
     if (rows.length === 0) break;
 
-    _runStmt(db, "BEGIN");
-    try {
+    // One transaction per page via the shared wrapper — the rotate worker
+    // no longer hand-rolls the BEGIN/COMMIT/ROLLBACK skeleton.
+    dbSchema.runInTransaction(db, function () {
       for (var i = 0; i < rows.length; i++) {
         var row = rows[i];
         var doc;
@@ -671,11 +666,7 @@ function _rotateOverflow(db, table, oldKeys, newKeys, batchSize, progress, warni
         var rv = _walkAndReSeal(doc, oldKeys, newKeys);
         if (rv.changed) upd.run(JSON.stringify(rv.value), row._id);
       }
-      _runStmt(db, "COMMIT");
-    } catch (e) {
-      _runStmt(db, "ROLLBACK");
-      throw e;
-    }
+    });
     processed += rows.length;
     lastId = rows[rows.length - 1]._id;
     _emit(progress, { phase: "rotate_overflow", table: table, rowsProcessed: processed, rowsTotal: total });

package/lib/watcher.js

@@ -316,6 +316,14 @@ function create(opts) {
   _validateOpts(opts);
 
   var root        = nodePath.resolve(opts.root);
+  // Canonicalize to the real long path. On Windows a path with an 8.3
+  // short-name component (os.tmpdir() commonly resolves to C:\Users\RUNNER~1\…)
+  // makes the native recursive backend (ReadDirectoryChangesW) deliver
+  // long-name event paths that no longer prefix-match the watched root, which
+  // trips a libuv fs-event assertion and aborts the process on some Node builds.
+  // realpathSync.native expands short names and resolves symlinks; guarded so a
+  // non-existent root still falls through to the watcher's own not-found error.
+  try { root = nodeFs.realpathSync.native(root); } catch (_e) { /* keep resolved path */ }
   var debounceMs  = (opts.debounceMs !== undefined) ? opts.debounceMs : DEFAULT_DEBOUNCE_MS;
   var maxPending  = (opts.maxPending !== undefined) ? opts.maxPending : DEFAULT_MAX_PENDING;
   var requestedMode = opts.mode || "fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.8",
+  "version": "0.15.10",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -54,7 +54,7 @@
     "owns-its-stack"
   ],
   "engines": {
-    "node": ">=24.14.1"
+    "node": ">=24.16.0"
   },
   "files": [
     "index.js",