@blamejs/core 0.15.9 → 0.15.10

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.10 (2026-06-13) — **Makes S3 Object-Lock version erasure reachable through the object store, and pins the build toolchain's native binary to a reviewed hash.** The object store gains the versioned-delete surface its S3 Object Lock support always needed for real erasure. An unversioned delete on a versioning-enabled (Object-Lock) bucket only writes a delete-marker — the data version survives — so the framework's own delete could report success while a record protected for compliance, or one a data subject asked to erase, stayed on disk. b.objectStore / b.storage now carry a versionId: put and saveRaw return the version they created, deleteFile(key, { versionId, bypassGovernanceRetention }) targets a specific version (refused — not silently delete-markered — when it is under an active retention), and listVersions enumerates versions and delete-markers so an erasure workflow can find them. Backends with no version surface (the filesystem backend, and the current Azure and GCS adapters) refuse a versioned delete loudly rather than silently dropping the current object. Separately, the build toolchain's native bundler binary is now verified against a reviewed SHA-256 pin so a tampered or drifted binary is caught before it bundles the framework. **Added:** *Versioned object delete + listVersions for S3 Object-Lock erasure* — b.storage.deleteFile and the b.objectStore sigv4 backend now accept opts.versionId to erase a specific object version, and opts.bypassGovernanceRetention to lift a GOVERNANCE-mode retention for callers with the permission (COMPLIANCE stays immutable to everyone). b.storage.saveRaw and the backend put now return the versionId they created on a versioning-enabled bucket, and a new b.storage.listVersions(prefix) / backend listVersions enumerates every version and delete-marker (key, versionId, isLatest, deleteMarker, size, lastModified, etag) so a right-to-erasure or crypto-shred workflow can target prior versions. On a backend with no version surface, listVersions throws VERSIONS_UNSUPPORTED and a versioned delete throws VERSIONID_UNSUPPORTED rather than silently acting on the current object. · *b.localDb.thin reaches SQLite resource-limit parity (limits option)* — b.localDb.thin now opens its node:sqlite handle with the same parse-time statement-size cap as b.db and the CLI — a SQL statement over 1 MiB is rejected at parse time, the SQLITE_LIMIT_LENGTH floor that guards prepare()/exec() of raw SQL against an attacker-influenced megaquery (SQLite's default is 1 GB). The cap is on by default; a new limits option (e.g. { sqlLength: 2 * 1024 * 1024 } or other SQLITE_LIMIT_* keys) lets an operator raise or extend it. Previously the thin opener had no limits plumbing, so a consumer on that path could not reach parity with the rest of the framework's SQLite surface. **Fixed:** *S3 Object-Lock version erasure is reachable through the framework delete path* — On a versioning-enabled (Object-Lock) bucket, an unversioned DELETE only writes a delete-marker — the protected data version survives untouched — yet the framework's delete had no versionId surface, so it issued the unversioned form and reported success while the bytes the lock protects remained. A retention or legal hold could therefore look enforced to the framework caller while the operation WORM actually blocks was unreachable. The delete path now targets the exact version: deleting a version under a COMPLIANCE retention is refused (it throws, even with bypassGovernanceRetention), a no-retention version erases cleanly, and the enforcement is proven end-to-end against MinIO through the framework's own API. · *b.configDrift.verifyVendorIntegrity is now working-directory-independent* — The vendored-dependency integrity check resolved each manifest file path against process.cwd(), so it only worked when run from the application root. Run from anywhere else it read-failed every entry (reporting ok:false), and under a crafted working directory that happened to contain a clean vendor tree it could hash a different tree than the one actually loaded. It now resolves each file under the framework's own vendor directory by default — the tree loaded at runtime — and honors an explicit libVendorDir for verifying a deployed tree elsewhere, so the result no longer depends on where the process was started. **Security:** *Build toolchain native binary pinned to a reviewed hash* — The native bundler binary the build toolchain runs (esbuild's per-platform compiler, a development dependency that never ships in the runtime) is now verified against a SHA-256 pin captured by diffing the published package tarballs and hashing the binary. The build gate fails if the on-disk binary does not match the reviewed hash for its (version, platform); for a version that has not been reviewed it notes the gap and skips rather than trusting an unverified binary. A cross-artifact check keeps the version in agreement across package.json, the CI install step, and the hash map, so the gate can never quietly test a version that was never diffed — closing a real drift where CI had been installing an older patch than package.json declared. The reviewed diff is benign: version strings plus an installer size-bound and error-message hardening, no new install hooks, files, or network paths, and no runtime-dependency impact. **Detectors:** *Object-store erasure guard, esbuild-pin agreement, + structural re-anchoring of the lint detectors* — A new guard locks the object-store delete path to the versioned-erasure contract: b.storage.deleteFile must thread versionId to the backend, so it can never silently revert to the WORM-blind unversioned delete. A second guard enforces that the esbuild build-tool version agrees across package.json, the CI install step, and the binary-hash map, so a future bump can't update one and leave the gate testing an unreviewed version. Separately, the framework's internal codebase-pattern lint detectors were re-anchored from fixed character spans to structural code boundaries, so they keep matching the code they guard as those functions grow rather than aging out of range; reviving them surfaced a few internal validation and transaction sites that now route through shared helpers (a required positive-integer-with-range validator and an async transaction wrapper) instead of hand-rolling the check. No public API change.
+
 - v0.15.9 (2026-06-13) — **Raises the Node floor to 24.16, adds SQLite parse-time resource caps, retries Windows rename locks on every atomic write and download, and ships a one-call secure logout that wipes client-side state.** This release moves the engines floor to the current Node 24 LTS patch level and adds three hardening primitives. node:sqlite handles now construct with SQLITE_LIMIT_* caps: a statement over 1 MiB is rejected at parse time (a DoS floor on the raw-SQL surface, complementary to the existing row-count gate) and ATTACH DATABASE is denied. Every final temp-to-destination rename — the file written by an atomic write, a downloaded file, a sealed vault key, a rotated log, an extracted archive entry — now routes through a single retry that rides out a transient Windows lock (antivirus, the search indexer, or a file-sync client briefly holding the destination), instead of surfacing the lock as a hard failure; the retry, previously hand-rolled and unreachable, is now the reusable b.atomicFile.renameWithRetry. And b.session.logout destroys a session and tells the browser to wipe its client-side state in one call: it emits an RFC 9527 Clear-Site-Data header and expires the session cookie before destroying the row, the secure-default logout that previously had to be assembled by hand. **Added:** *b.session.logout — one-call secure logout* — `b.session.logout(res, token, opts?)` destroys the server-side session AND tells the browser to wipe its client-side state in one call: it emits an RFC 9527 Clear-Site-Data response header (cookies + storage + cache + execution contexts by default) and expires the session cookie, then destroys the session row. `b.session.destroy` alone is a store operation with no response object, so it could not wipe the browser's cached pages, storage, or a stale tab still holding the now-revoked cookie — that wiring previously had to be mounted by hand. Pass `cookieName` to match a non-default cookie and `types` to choose the Clear-Site-Data directives. **Changed:** *Node engines floor raised to >=24.16.0* — The minimum supported Node is now 24.16.0 (the current Node 24 LTS patch level), up from 24.14.1. This is an LTS-currency bump — there are no Node CVE fixes between 24.14.1 and 24.16.0 (24.14.1 already carried the CVE-2026-21713 HMAC fix); it keeps the framework on the latest patched LTS and makes the node:sqlite resource-cap hardening below available everywhere. Pre-1.0, operators upgrade across the floor; Node 26 continues to satisfy it. **Fixed:** *b.watcher canonicalizes its root on Windows* — `b.watcher.create` now resolves its `root` to the real long path before watching. On Windows a root with an 8.3 short-name component (the system temp directory commonly resolves to one) made the native recursive backend deliver long-name event paths that no longer prefix-matched the watched root, which could abort the process under a strict libuv fs-event assertion. The watcher now canonicalizes the root (expanding short names and resolving symlinks), so events match the watched directory on Windows. **Security:** *SQLite parse-time statement-size cap* — Every node:sqlite database the framework opens — the main db handle and the CLI's handle — now constructs with a SQLITE_LIMIT_LENGTH cap: a SQL statement over 1 MiB is rejected at parse time. Because the query builder parameterizes every value, the size cap guards the raw-SQL surface (`b.db.runSql`) against an attacker-influenced megaquery the parser would otherwise process (SQLite's default is 1 GB); it is a parse-time DoS floor complementary to the existing row-count gate. Legitimate framework and operator statements are far under the cap. · *Windows rename-lock retry on every atomic rename and download* — On Windows a freshly-written file's destination is briefly held by antivirus, the search indexer, or a file-sync client (Dropbox, OneDrive), surfacing as a transient EPERM / EACCES / EBUSY on rename even though the temp file is fine. `b.atomicFile.writeSync` already retried this, but `b.httpClient.downloadStream` did not — a download into a cloud-synced or AV-scanned directory could fail hard on the lock. The retry is now the reusable `b.atomicFile.renameWithRetry`, and every final temp-to-destination rename in the framework routes through it: downloads, sealed vault keys, CA key/cert writes, log rotation, archive extraction, config-drift sidecars, the self-update binary swap, and restore/rollback moves. A non-transient error still throws immediately; POSIX renames are unaffected. **Detectors:** *Rename-retry, SQLite-limits, and Clear-Site-Data guards* — Three recurrence detectors ship with the fixes: a bare `nodeFs.renameSync` final rename that doesn't route through `atomicFile.renameWithRetry`; a main `DatabaseSync` handle constructed without the SQLITE_LIMIT_LENGTH `limits`; and a hand-rolled Clear-Site-Data header value that skips the shared RFC 9527 builder.
 
 - v0.15.8 (2026-06-13) — **Redacts OTLP log-sink attributes to close a secret/PII egress the span fix missed, adds EU DSA and China PIPL cross-border compliance record-builders, ships an SSDF producer self-attestation with every release, and makes the published tarball reproducible.** This release closes a telemetry egress hole, adds two compliance record-builder namespaces, and hardens the release supply chain. The OTLP log sinks (HTTP-JSON and gRPC) shipped a log record's meta attributes and the resource attributes to the collector unredacted — a log line carrying a bearer token, password, or API key reached the wire verbatim (CWE-532). The 0.15.4 fix wired the telemetry redactor into the span and metric exporters but the log sinks were missed; both now run record and resource attributes through the same redactor before serialization. New b.dsa builds the EU Digital Services Act (Reg 2022/2065) records an intermediary or platform must keep — Art. 16 notice-and-action, Art. 17 statement of reasons, and the Art. 15 / 24(3) transparency report. New b.pipl builds the China PIPL cross-border transfer records — an Art. 38/40 assessment that determines whether a CAC security assessment is mandatory (CIIO, important data, or the volume / sensitive-PI thresholds), and an Art. 40 security-assessment certificate. On the supply-chain side, every release now ships ssdf-attestation.json, a machine-readable NIST SP 800-218 / OMB M-22-18 producer self-attestation mapping each secure-development practice to its implementing control, and the published tarball is now packed with SOURCE_DATE_EPOCH so an operator can rebuild it byte-for-byte from the release commit. **Added:** *b.dsa — EU Digital Services Act compliance record-builders* — `b.dsa` builds the dated, frozen records the EU Digital Services Act (Regulation (EU) 2022/2065) requires an online intermediary or platform to keep: `b.dsa.noticeAndAction` (Art. 16) records a notice against a piece of content and computes the action-due window; `b.dsa.statementOfReasons` (Art. 17) records a moderation decision with its legal or contractual ground (exactly one is required), the facts, whether it was automated, and the redress routes offered; `b.dsa.transparencyReport` (Art. 15 / 24(3)) aggregates the period counts into a report with the next-due date. The builders perform no network I/O and emit a best-effort audit event; they map to the `dsa` compliance posture. · *b.pipl — China PIPL cross-border transfer record-builders* — `b.pipl.sccFilingAssessment` builds a PIPL Art. 38/40/55 cross-border transfer assessment and determines the lawful mechanism: it forces a CAC security assessment (over a self-selected standard contract or certification) when the exporter is a critical-information-infrastructure operator, exports important data, handles personal information of more than 1,000,000 individuals, or crosses the cumulative volume / sensitive-PI thresholds. `b.pipl.securityAssessmentCertificate` records an Art. 40 security-assessment self-declaration with a 3-year validity clock. Both return frozen dated records and map to the `pipl-cn` posture. · *SSDF producer self-attestation shipped with every release* — Every release now attaches `ssdf-attestation.json` — a machine-readable NIST SP 800-218 (SSDF v1.1) / OMB M-22-18 producer self-attestation. It maps each secure-software-development practice to its implementing control in the tree (SLSA L3 provenance, SSH-signed tags, vendored zero-runtime-dep supply chain, OSV-Scanner gating, coordinated disclosure) and is deterministic from the release commit. Its sha256 is a subject of the SLSA L3 provenance, so verifying the provenance verifies the attestation has not been tampered with. Downstream consumers who require SSDF supplier-compliance evidence can download it from the release page. **Security:** *OTLP log sinks redact record and resource attributes before export* — `b.logStream`'s OTLP log sinks (HTTP-JSON and gRPC) shipped a log record's `meta` attributes and the sink's resource attributes to the collector UNREDACTED, so a log line whose meta carried a bearer token, password, or API key — or a credential placed in a resource attribute — reached the OTLP wire verbatim (CWE-532). The 0.15.4 change baked the telemetry redactor into the span and metric exporters but its detector was anchored on the span/metric encoder function names, leaving the log sinks uncovered. Both log sinks now run record and resource attributes through `b.observability.redactAttrs` before serialization, the same egress contract the span and metric exporters already hold. · *Reproducible published tarball (SOURCE_DATE_EPOCH)* — The release workflow now exports `SOURCE_DATE_EPOCH` (derived from the tagged commit's author date) before `npm pack`, so the mtime stamped into every tar header is deterministic. An operator can re-pack the package from the same commit and match the published tarball's sha256 byte-for-byte, strengthening the source-to-artifact verification path alongside the existing SLSA L3 provenance and PQC signatures. **Detectors:** *otlp-log-sink-encodes-attrs-without-redactor* — Fires when an OTLP log-sink encoder hands a raw `record.meta` or resource-attribute map to serialization without routing it through `observability.redactAttrs` — the class the span/metric detector could not see because the log sinks carry the OTLP-logs schema function names.

package/README.md

@@ -65,7 +65,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **Mongo-style document-store facade** — `b.db.collection(name, opts?)` with `$set` / `$inc` / `$unset` / `$eq` / `$ne` / `$gt` / `$gte` / `$lt` / `$lte` / `$in` / `$like`; schemaless-document opts via `overflow: "<col>"` (folds unknown fields into a JSON-text column; rewrites `WHERE` on virtual fields to `JSON_EXTRACT`), `jsonColumns: [...]` (auto-stringify on write + parse via `b.safeJson` on read), `sealedFields: { email: "emailHash" }` (co-locates a `b.cryptoField` sealed-column / derived-hash declaration so plaintext lookups auto-rewrite to hash-column lookups)
 - **DB lifecycle** — in-memory encrypted snapshot via `b.db.snapshot()`; standalone encrypted-DB-file lifecycle (`b.db.fileLifecycle({ dataDir, vault })` — decrypt-to-tmpfs, periodic re-encrypt flush, graceful shutdown — same envelope as `b.db`, no schema/audit-chain coupling); `db.init` opt-outs `frameworkTables: false` / `auditSigning: false` and path overrides `encryptedDbPath` / `encryptedDbName` / `dbKeyPath`
 - **External RDBMS** — bring-your-own Postgres / MySQL with pool tuning + role-aware connect + read-replica routing (`b.externalDb`); declarative role-narrowed views and Postgres row-level-security migrations (`b.db.declareView`, `b.db.declareRowPolicy`); an opt-in `requireTls` transport posture refuses a non-TLS backend at boot, and query / transaction / read traces carry OpenTelemetry `db.*` attributes. The framework's own data layer — the signed audit chain, cluster leadership and lease fencing, sessions, break-glass, and the local queue / cache / scheduler — is composed through the dialect-aware `b.sql` builder (every identifier quoted by construction, every value bound as a placeholder, dialect-correct SQLite / Postgres / MySQL output), so the framework's tables run on a Postgres or MySQL backend, not only local SQLite; `b.guardSql` validates result rows against NUL bytes, quote-jump sequences, and per-column / total-size boundaries
-- **Object store** — S3 / R2 / B2 / GCS / Azure with multipart upload + SSE + bucket-ops (create / delete / list / lifecycle / CORS); S3 Object Lock + per-object retention + legal hold for write-once-read-many compliance workloads (`b.storage`, `b.objectStore`)
+- **Object store** — S3 / R2 / B2 / GCS / Azure with multipart upload + SSE + bucket-ops (create / delete / list / lifecycle / CORS); S3 Object Lock + per-object retention + legal hold for write-once-read-many compliance workloads, with versioned delete + `listVersions` for right-to-erasure / crypto-shred against an Object-Lock bucket (`b.storage`, `b.objectStore`)
 - **Queues + cache** — durable queue with priority + cron + flows on local SQLite, shared Redis, OR AWS SQS via SigV4 + AWSJsonProtocol_1.0 (`b.queue`, `b.jobs`) — the local backend can target an operator-supplied database / table / schema; cluster-shared cache (`b.cache`)
 ### Identity & access
 

package/lib/bundler.js

@@ -266,13 +266,8 @@ function create(opts) {
   var hashOn   = opts.hash !== false;
   var hashLen  = DEFAULT_HASH_LEN;
   if (opts.hashLen !== undefined) {
-    if (!numericBounds.isPositiveFiniteInt(opts.hashLen) ||
-        opts.hashLen < MIN_HASH_LEN || opts.hashLen > MAX_HASH_LEN) {
-      throw new BundlerError("bundler/bad-hash-len",
-        "bundler.create: opts.hashLen must be a positive finite integer " +
-        "between " + MIN_HASH_LEN + " and " + MAX_HASH_LEN +
-        "; got " + numericBounds.shape(opts.hashLen));
-    }
+    numericBounds.requirePositiveFiniteInt(opts.hashLen, "bundler.create: opts.hashLen",
+      BundlerError, "bundler/bad-hash-len", { min: MIN_HASH_LEN, max: MAX_HASH_LEN });
     hashLen = opts.hashLen;
   }
   var log      = opts.log || null;

package/lib/config-drift.js

@@ -350,7 +350,7 @@ function create(opts) {
  * instead of a silent zero-files-checked pass.
  *
  * @opts
- *   libVendorDir: string,  // absolute path to lib/vendor (defaults to cwd-relative)
+ *   libVendorDir: string,  // absolute path to the lib/vendor tree to verify; default: the framework's own (cwd-independent). Per-file manifest paths resolve under this directory.
  *   manifestPath: string,  // absolute path to MANIFEST.json (defaults under libVendorDir)
  *
  * @example
@@ -367,7 +367,14 @@ function create(opts) {
  */
 function verifyVendorIntegrity(opts) {
   opts = opts || {};
-  var libVendorDir  = opts.libVendorDir  || nodePath.join(process.cwd(), "lib", "vendor");
+  // Default to the framework's OWN vendor directory (this module lives in
+  // lib/, so __dirname/vendor is lib/vendor) — the tree actually loaded at
+  // runtime. The previous cwd-relative default made the check cwd-dependent:
+  // run from another directory it read-failed every entry, and under a crafted
+  // cwd that happened to hold a clean vendor tree it could hash a DIFFERENT
+  // tree than the one loaded. Operators verifying a deployed tree elsewhere
+  // pass libVendorDir explicitly; per-file resolution honors it below.
+  var libVendorDir  = opts.libVendorDir  || nodePath.join(__dirname, "vendor");
   var manifestPath  = opts.manifestPath  || nodePath.join(libVendorDir, "MANIFEST.json");
   var raw;
   try { raw = nodeFs.readFileSync(manifestPath, "utf8"); }
@@ -390,7 +397,14 @@ function verifyVendorIntegrity(opts) {
       var rel = files[kind];
       var expected = hashes[kind];
       if (typeof rel !== "string" || typeof expected !== "string") return;
-      var abs = nodePath.isAbsolute(rel) ? rel : nodePath.join(process.cwd(), rel);
+      // Manifest paths are stored repo-root-relative (e.g. "lib/vendor/x.cjs").
+      // Resolve each one UNDER libVendorDir (the tree being verified), not
+      // process.cwd(), so the check hashes the actual loaded files regardless
+      // of the working directory. Strip the leading lib/vendor/ so the join
+      // doesn't double it; a manifest that already stored a vendor-relative
+      // path resolves the same way.
+      var relInVendor = rel.replace(/^lib[\\/]+vendor[\\/]+/, "");
+      var abs = nodePath.isAbsolute(rel) ? rel : nodePath.join(libVendorDir, relInVendor);
       var actual;
       try {
         var bytes = nodeFs.readFileSync(abs);

package/lib/db-schema.js

@@ -98,6 +98,34 @@ function runInTransaction(db, fn, opts) {
   }
 }
 
+// runInTransactionAsync — the async sibling of runInTransaction. SQLite
+// transactions are synchronous at the wire, but the body between BEGIN and
+// COMMIT may await (a seeder's run(), a per-row re-seal that reads off the
+// handle): await fn() before COMMIT so the transaction wraps the whole
+// awaited body, and ROLLBACK on rejection. Same opts.lockMode /
+// opts.onRollbackFail contract as the sync form.
+async function runInTransactionAsync(db, fn, opts) {
+  if (typeof fn !== "function") {
+    throw new TypeError("dbSchema.runInTransactionAsync: fn must be a function");
+  }
+  opts = opts || {};
+  var beginSql = opts.lockMode ? "BEGIN " + opts.lockMode : "BEGIN";
+  runSqlOnHandle(db, beginSql);
+  try {
+    var result = await fn();
+    runSqlOnHandle(db, "COMMIT");
+    return result;
+  } catch (e) {
+    try { runSqlOnHandle(db, "ROLLBACK"); }
+    catch (rollbackErr) {
+      if (typeof opts.onRollbackFail === "function") {
+        try { opts.onRollbackFail(rollbackErr); } catch (_e) { /* nested handler must not bubble */ }
+      }
+    }
+    throw e;
+  }
+}
+
 // ---- Internal migrations table ----
 
 // Logical name; the physical name + configured prefix resolve through
@@ -611,6 +639,7 @@ module.exports = {
   runSql:           runSql,
   runSqlOnHandle:   runSqlOnHandle,
   runInTransaction: runInTransaction,
+  runInTransactionAsync: runInTransactionAsync,
   // Shared data-layer dialect resolution — composed by migrations.js +
   // seeders.js so the handle-dialect / b.sql-opts / key-text-type logic
   // lives in exactly one place.

package/lib/local-db-thin.js

@@ -44,6 +44,7 @@
  *     schemaSql:  string,                // required CREATE TABLE / INDEX script
  *     recovery:   "refuse" | "rename-and-recreate",  // default: "refuse"
  *     pragmas:    object,                // optional extra PRAGMA overrides
+ *     limits:     object,                // node:sqlite SQLITE_LIMIT_* caps; default { sqlLength: 1 MiB } (parity with b.db / CLI)
  *     audit:      boolean,               // default: true
  *   }) -> { db, prepare, run, query, close, file }
  *
@@ -55,12 +56,20 @@
 
 var nodeFs   = require("node:fs");
 var nodePath = require("node:path");
+var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");
 var { LocalDbThinError } = require("./framework-error");
 var atomicFile = require("./atomic-file");
 
+// Default parse-time statement-size cap, matching b.db and the CLI opener
+// (the v0.15.9 node:sqlite SQLITE_LIMIT_LENGTH floor). prepare()/exec() on the
+// thin path parse operator/application SQL, so the same cap guards it against
+// an attacker-influenced megaquery the parser would otherwise chew (SQLite's
+// default is 1 GB). Operators raise/relax it via opts.limits.
+var _DEFAULT_SQL_LENGTH = C.BYTES.mib(1);
+
 var audit = lazyRequire(function () { return require("./audit"); });
 
 // LRU prepared-statement cache cap — same magnitude as lib/db.js's full
@@ -99,6 +108,19 @@ function _validateOpts(opts) {
     throw new LocalDbThinError("localdb-thin/bad-pragmas",
       "localDb.thin: pragmas must be an object mapping pragma name -> value");
   }
+  if (opts.limits !== undefined &&
+      (typeof opts.limits !== "object" || opts.limits === null || Array.isArray(opts.limits))) {
+    throw new LocalDbThinError("localdb-thin/bad-limits",
+      "localDb.thin: limits must be an object of node:sqlite SQLITE_LIMIT_* caps " +
+      "(e.g. { sqlLength: 1048576 })");
+  }
+}
+
+// Merge operator-supplied limits over the framework default (sqlLength cap),
+// so the thin path reaches parity with b.db / the CLI opener while letting an
+// operator raise the cap or add SQLITE_LIMIT_* keys (e.g. attach: 0).
+function _resolveLimits(opts) {
+  return Object.assign({ sqlLength: _DEFAULT_SQL_LENGTH }, opts.limits || {});
 }
 
 function _runPragmas(database, extra) {
@@ -175,7 +197,7 @@ function thin(opts) {
   var renamedTo = null;
 
   function _attemptOpen() {
-    var db = new DatabaseSync(file);
+    var db = new DatabaseSync(file, { limits: _resolveLimits(opts) });
     _runPragmas(db, opts.pragmas);
     if (!_integrityOk(db)) {
       try { db.close(); } catch (_e) { /* best-effort */ }

package/lib/mail-scan.js

@@ -161,11 +161,8 @@ function create(opts) {
 
   validateOpts.requireNonEmptyString(opts.host, "mail.scan.create.host",
     MailScanError, "mail-scan/bad-host");
-  if (!numericBounds.isPositiveFiniteInt(opts.port) || opts.port > 65535) {                        // TCP port-number range cap
-    throw new MailScanError("mail-scan/bad-port",
-      "mail.scan.create.port must be a positive integer in [1,65535]; got " +
-      numericBounds.shape(opts.port));
-  }
+  numericBounds.requirePositiveFiniteInt(opts.port, "mail.scan.create.port",
+    MailScanError, "mail-scan/bad-port", { max: 65535 });   // TCP port-number range cap
   var protocol = opts.protocol || DEFAULT_PROTOCOL;
   if (!ALLOWED_PROTOCOLS[protocol]) {
     throw new MailScanError("mail-scan/bad-protocol",

package/lib/numeric-bounds.js

@@ -82,6 +82,37 @@ function requireNonNegativeFiniteIntIfPresent(value, label, errorClass, code) {
   return value;
 }
 
+// requirePositiveFiniteInt — REQUIRED-shape gate (the non-optional sibling
+// of requirePositiveFiniteIntIfPresent): throws when the value is absent OR
+// not a positive finite integer, and — when range bounds are supplied —
+// when it falls outside them. Replaces the per-file
+// `if (!nb.isPositiveFiniteInt(opts.X) || opts.X < MIN || opts.X > MAX) throw`
+// cascade that bundler / mail-scan / safe-decompress rolled by hand for
+// REQUIRED numeric opts (the IfPresent helper can't be used there — it
+// skips when undefined, so a missing required opt would pass).
+//
+//   nb.requirePositiveFiniteInt(opts.maxOutputBytes,
+//     "safeDecompress: maxOutputBytes", SafeDecompressError, "safe-decompress/bad-arg");
+//   nb.requirePositiveFiniteInt(opts.hashLen, "bundler.create: opts.hashLen",
+//     BundlerError, "bundler/bad-hash-len", { min: MIN_HASH_LEN, max: MAX_HASH_LEN });
+function _rangeSuffix(range) {
+  if (!range) return "";
+  if (range.min != null && range.max != null) return " in [" + range.min + ", " + range.max + "]";
+  if (range.max != null) return " <= " + range.max;
+  if (range.min != null) return " >= " + range.min;
+  return "";
+}
+function requirePositiveFiniteInt(value, label, errorClass, code, range) {
+  var inRange = !range ||
+    ((range.min == null || value >= range.min) && (range.max == null || value <= range.max));
+  if (!isPositiveFiniteInt(value) || !inRange) {
+    throw new errorClass(code,
+      (label || "value") + " must be a positive finite integer" +
+      _rangeSuffix(range) + "; got " + shape(value));
+  }
+  return value;
+}
+
 // requireAllPositiveFiniteIntIfPresent — batch validator. Walk each
 // opt-name in the list; for any that is present in opts, require it to
 // be a positive finite integer (otherwise throw via errorClass with the
@@ -105,6 +136,7 @@ module.exports = {
   shape:                                  shape,
   isPositiveFiniteInt:                    isPositiveFiniteInt,
   isNonNegativeFiniteInt:                 isNonNegativeFiniteInt,
+  requirePositiveFiniteInt:               requirePositiveFiniteInt,
   requirePositiveFiniteIntIfPresent:      requirePositiveFiniteIntIfPresent,
   requireNonNegativeFiniteIntIfPresent:   requireNonNegativeFiniteIntIfPresent,
   requireAllPositiveFiniteIntIfPresent:   requireAllPositiveFiniteIntIfPresent,

package/lib/object-store/azure-blob.js

@@ -356,7 +356,18 @@ function create(config) {
     });
   }
 
-  function deleteKey(key) {
+  function deleteKey(key, opts) {
+    opts = opts || {};
+    // Versioned erasure (opts.versionId) is the S3 Object-Lock workflow and is
+    // sigv4-only today. Refuse loudly rather than silently delete the current
+    // blob — a silent drop on an erasure path would let a caller believe a
+    // specific version was shredded when it was not.
+    if (opts.versionId) {
+      throw _err("VERSIONID_UNSUPPORTED",
+        "deleteKey: versioned delete (opts.versionId) is S3/sigv4-only; the Azure " +
+        "Blob backend has no version surface here. Use a sigv4 backend for " +
+        "Object-Lock version erasure.", true);
+    }
     var url = _blobUrl(key);
     var headers = _signed("DELETE", url, {});
     return _httpRequest("DELETE", url, headers, null, reqOpts).then(

package/lib/object-store/gcs.js

@@ -281,7 +281,18 @@ function create(config) {
     };
   }
 
-  async function deleteKey(key) {
+  async function deleteKey(key, opts) {
+    opts = opts || {};
+    // Versioned erasure (opts.versionId) is the S3 Object-Lock workflow and is
+    // sigv4-only today. Refuse loudly rather than silently delete the live
+    // object — a silent drop on an erasure path would let a caller believe a
+    // specific version was shredded when it was not.
+    if (opts.versionId) {
+      throw _err("VERSIONID_UNSUPPORTED",
+        "deleteKey: versioned delete (opts.versionId) is S3/sigv4-only; the GCS " +
+        "backend has no version surface here. Use a sigv4 backend for Object-Lock " +
+        "version erasure.", true);
+    }
     var token = await _ensureToken();
     var url = _objectUrl(key);
     try {

package/lib/object-store/http-put.js

@@ -110,7 +110,17 @@ function create(config) {
     });
   }
 
-  function deleteKey(key) {
+  function deleteKey(key, opts) {
+    opts = opts || {};
+    // Versioned erasure (opts.versionId) is the S3 Object-Lock workflow and is
+    // sigv4-only. A bare PUT target has no version surface, so refuse loudly
+    // rather than issue a plain DELETE and report a specific version erased —
+    // a silent drop on an erasure path is the footgun.
+    if (opts.versionId) {
+      throw _err("VERSIONID_UNSUPPORTED",
+        "deleteKey: versioned delete (opts.versionId) is S3/sigv4-only; the http-put " +
+        "backend has no version surface. Use a sigv4 backend for Object-Lock version erasure.", true);
+    }
     var url = _keyToUrl(baseUrl, key);
     return _request("DELETE", url, null, headers, reqOpts).then(
       function () { return true; },

package/lib/object-store/index.js

@@ -122,6 +122,10 @@ function buildBackend(config) {
     head:            wrap("head"),
     delete:          wrap("delete"),
     list:            wrap("list"),
+    // listVersions is S3/sigv4-only (the ?versions subresource backs the
+    // WORM erasure workflow). Backends without it expose null so callers can
+    // feature-detect rather than hit a "wrap of undefined" at boot.
+    listVersions:    typeof raw.listVersions === "function" ? wrap("listVersions") : null,
     // presigned*Url are sync URL-builders (no network call), so they
     // bypass retry + circuit-breaker — propagate any throw directly.
     presignedUploadUrl: typeof raw.presignedUploadUrl === "function"

package/lib/object-store/local.js

@@ -101,7 +101,17 @@ function create(config) {
     });
   }
 
-  function deleteKey(key) {
+  function deleteKey(key, opts) {
+    opts = opts || {};
+    // A filesystem has no object versions; a versioned-delete request can only
+    // be a caller mistake. Refuse loudly rather than unlink the single on-disk
+    // file and report a version was erased.
+    if (opts.versionId) {
+      throw _err("VERSIONID_UNSUPPORTED",
+        "deleteKey: versioned delete (opts.versionId) is not supported on the " +
+        "filesystem backend — a local file has no version history. Use a sigv4 " +
+        "(S3 Object-Lock) backend for version erasure.", true);
+    }
     cluster.requireLeader();
     var full = _resolveSafe(rootDir, key);
     if (!nodeFs.existsSync(full)) return Promise.resolve(false);

package/lib/object-store/sigv4.js

@@ -499,7 +499,15 @@ function create(config) {
     var headers = _makeSigned("PUT", url, payloadHash, extra);
     return _request("PUT", url, headers, buf, reqOpts).then(function (res) {
       _verifySseResponse(sseRequested, res.headers);
-      return { size: buf.length, etag: res.headers.etag };
+      return {
+        size: buf.length,
+        etag: res.headers.etag,
+        // On a versioning-enabled (Object-Lock) bucket S3/MinIO returns the
+        // version this PUT created. Surface it so callers can target the
+        // exact version for a later versioned delete / erasure — without it
+        // the only way to find the version is a separate listVersions() call.
+        versionId: res.headers && res.headers["x-amz-version-id"] || null,
+      };
     });
   }
 
@@ -601,7 +609,12 @@ function create(config) {
       // response may or may not echo the header depending on vendor;
       // re-verifying here would double-fault on otherwise-fine setups.
       var result = completeDoc.CompleteMultipartUploadResult || {};
-      return { size: totalSize, etag: result.ETag || completeRes.headers.etag, multipart: true };
+      return {
+        size: totalSize,
+        etag: result.ETag || completeRes.headers.etag,
+        multipart: true,
+        versionId: completeRes.headers && completeRes.headers["x-amz-version-id"] || null,
+      };
     } catch (e) {
       // Abort cleans up server-side storage for the partial upload.
       // Failures here are silently swallowed — the caller's original
@@ -639,6 +652,11 @@ function create(config) {
   function getResponse(key, opts) {
     opts = opts || {};
     var url = _keyToUrl(key);
+    // Reading a specific version (opts.versionId) is the read half of the
+    // WORM erasure workflow — verify a protected version is present before /
+    // gone after a versioned delete. Set it before signing so the query
+    // param is in the SigV4 canonical request.
+    if (opts.versionId) url.searchParams.set("versionId", opts.versionId);
     var headers = _makeSigned("GET", url, sha256Hex(Buffer.alloc(0)));
     if (opts.range) {
       headers["Range"] = "bytes=" + opts.range.start + "-" + opts.range.end;
@@ -674,8 +692,10 @@ function create(config) {
     });
   }
 
-  function head(key) {
+  function head(key, opts) {
+    opts = opts || {};
     var url = _keyToUrl(key);
+    if (opts.versionId) url.searchParams.set("versionId", opts.versionId);
     var headers = _makeSigned("HEAD", url, sha256Hex(Buffer.alloc(0)));
     return _request("HEAD", url, headers, null, reqOpts).then(function (res) {
       return {
@@ -696,9 +716,25 @@ function create(config) {
     });
   }
 
-  function deleteKey(key) {
+  // deleteKey(key, opts?) — opts.versionId targets a specific version;
+  // opts.bypassGovernanceRetention signs x-amz-bypass-governance-retention so
+  // a GOVERNANCE-mode retention can be lifted by a caller with the permission
+  // (COMPLIANCE mode is immutable to everyone and stays refused).
+  //
+  // WORM-awareness: an UNVERSIONED delete on a versioning-enabled bucket only
+  // writes a delete-marker — the data version survives and the call still
+  // resolves true. To actually erase a version (e.g. crypto-shred / GDPR Art.
+  // 17 on an Object-Lock bucket) pass the versionId from put()/listVersions().
+  // A delete refused by an active retention surfaces as a thrown error (S3 403
+  // / MinIO 400), never a silent success, so the caller learns the version is
+  // still protected.
+  function deleteKey(key, opts) {
+    opts = opts || {};
     var url = _keyToUrl(key);
-    var headers = _makeSigned("DELETE", url, sha256Hex(Buffer.alloc(0)));
+    if (opts.versionId) url.searchParams.set("versionId", opts.versionId);
+    var extra = {};
+    if (opts.bypassGovernanceRetention) extra["x-amz-bypass-governance-retention"] = "true";
+    var headers = _makeSigned("DELETE", url, sha256Hex(Buffer.alloc(0)), extra);
     return _request("DELETE", url, headers, null, reqOpts).then(
       function () { return true; },
       function (e) { if (e.statusCode === 404) return false; throw e; }
@@ -953,6 +989,50 @@ function create(config) {
     });
   }
 
+  // listVersions(prefix, opts?) — enumerate every object VERSION and
+  // delete-marker under prefix (S3 ListObjectVersions / the ?versions
+  // subresource). Plain list() only sees current versions; to erase prior
+  // versions on a versioning / Object-Lock bucket you first need their
+  // versionIds, which only this call surfaces. Each item carries
+  // { key, versionId, isLatest, deleteMarker, size, lastModified, etag };
+  // deleteMarker:true rows are tombstones (no data, size null). Pagination
+  // walks (keyMarker, versionIdMarker) the way list() walks continuationToken.
+  function listVersions(prefix, opts) {
+    opts = opts || {};
+    var params = { versions: "" };
+    if (prefix) params["prefix"] = prefix;
+    if (opts.maxResults) params["max-keys"] = String(opts.maxResults);
+    if (opts.keyMarker) params["key-marker"] = opts.keyMarker;
+    if (opts.versionIdMarker) params["version-id-marker"] = opts.versionIdMarker;
+
+    var url = _bucketUrl(params);
+    var headers = _makeSigned("GET", url, sha256Hex(Buffer.alloc(0)));
+    return _request("GET", url, headers, null, reqOpts).then(function (res) {
+      var doc = safeXml.parse(res.body, LIST_PARSE_OPTS);
+      var result = doc.ListVersionsResult || {};
+      function _mapEntry(e, isDeleteMarker) {
+        return {
+          key:          e.Key,
+          versionId:    e.VersionId != null ? String(e.VersionId) : null,
+          isLatest:     e.IsLatest === "true",
+          deleteMarker: isDeleteMarker,
+          size:         isDeleteMarker ? null : (e.Size != null ? parseInt(e.Size, 10) : null),
+          lastModified: e.LastModified ? Date.parse(e.LastModified) : null,
+          etag:         isDeleteMarker ? null : (e.ETag || null),
+        };
+      }
+      var versions = _arrayify(result.Version).map(function (v) { return _mapEntry(v, false); });
+      var markers = _arrayify(result.DeleteMarker).map(function (m) { return _mapEntry(m, true); });
+      var items = versions.concat(markers).filter(function (it) { return it.key; });
+      return {
+        items:           items,
+        truncated:       result.IsTruncated === "true",
+        keyMarker:       result.NextKeyMarker || null,
+        versionIdMarker: result.NextVersionIdMarker || null,
+      };
+    });
+  }
+
   return {
     protocol:  "sigv4",
     endpoint:  endpoint,
@@ -966,6 +1046,7 @@ function create(config) {
     head:      head,
     delete:    deleteKey,
     list:      list,
+    listVersions: listVersions,
     presignedUploadUrl:    presignedUploadUrl,
     presignedDownloadUrl:  presignedDownloadUrl,
     presignedUploadPolicy: presignedUploadPolicy,

package/lib/safe-decompress.js

@@ -171,18 +171,9 @@ function safeDecompress(input, opts) {
         JSON.stringify(opts.algorithm));
   }
 
-  // maxOutputBytes — required, positive finite integer. Inline gate
-  // is intentional: it's a REQUIRED opt (not optional), so the
-  // `requirePositiveFiniteIntIfPresent` helper doesn't apply (it skips
-  // when undefined). The numericBounds.requirePositiveFiniteInt helper
-  // would fit, but the existing call surface across the framework
-  // uses the inline shape for required-opt validation.
-  if (!numericBounds.isPositiveFiniteInt(opts.maxOutputBytes)) {                     // allow:inline-numeric-bounds-cascade — required (non-optional) opt; requirePositiveFiniteIntIfPresent skips when undefined
-    throw new SafeDecompressError(
-      "safe-decompress/bad-arg",
-      "safeDecompress: maxOutputBytes must be a positive finite integer; got " +
-        numericBounds.shape(opts.maxOutputBytes));
-  }
+  // maxOutputBytes — required, positive finite integer.
+  numericBounds.requirePositiveFiniteInt(opts.maxOutputBytes,
+    "safeDecompress: maxOutputBytes", SafeDecompressError, "safe-decompress/bad-arg");
 
   // Input shape
   var buf;

package/lib/seeders.js

@@ -546,46 +546,40 @@ function create(opts) {
 
         try {
            
-          await (async function () {
-            // Per-seed transaction: SQLite txns are sync, but the
-            // seed's run() may be async — so we begin/commit around
-            // an awaited body. Failures roll back this seed only.
-            _runSql(db, "BEGIN");
-            try {
-              await mod.run(db, ctx);
-              var nowIso = new Date(clock()).toISOString();
-              var writeBuilt;
-              if (alreadyApplied && mod.rerunnable) {
-                writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
-                  .set({ appliedAt: nowIso, description: mod.description || "",
-                         rerunnable: mod.rerunnable ? 1 : 0 })
-                  .where("env", env).where("name", name).toSql();
-              } else if (alreadyApplied && force) {
-                writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
-                  .set({ appliedAt: nowIso, description: mod.description || "" })
-                  .where("env", env).where("name", name).toSql();
-              } else {
-                writeBuilt = sql.insert(_seedersTable(), _sqlOpts(db))
-                  .values({ env: env, name: name, description: mod.description || "",
-                            appliedAt: nowIso, rerunnable: mod.rerunnable ? 1 : 0 })
-                  .toSql();
-              }
-              var writeStmt = db.prepare(writeBuilt.sql);
-              writeStmt.run.apply(writeStmt, writeBuilt.params);
-              _runSql(db, "COMMIT");
-            } catch (e) {
-              try { _runSql(db, "ROLLBACK"); }
-              catch (rollbackErr) {
-                log.debug("rollback-failed", {
-                  op: "seed-apply",
-                  env: env,
-                  name: name,
-                  error: rollbackErr && rollbackErr.message,
-                });
-              }
-              throw e;
+          // Per-seed transaction: SQLite txns are sync, but the seed's
+          // run() may be async — runInTransactionAsync wraps BEGIN/COMMIT
+          // around the awaited body and rolls back this seed only on failure.
+          await dbSchema.runInTransactionAsync(db, async function () {
+            await mod.run(db, ctx);
+            var nowIso = new Date(clock()).toISOString();
+            var writeBuilt;
+            if (alreadyApplied && mod.rerunnable) {
+              writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
+                .set({ appliedAt: nowIso, description: mod.description || "",
+                       rerunnable: mod.rerunnable ? 1 : 0 })
+                .where("env", env).where("name", name).toSql();
+            } else if (alreadyApplied && force) {
+              writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
+                .set({ appliedAt: nowIso, description: mod.description || "" })
+                .where("env", env).where("name", name).toSql();
+            } else {
+              writeBuilt = sql.insert(_seedersTable(), _sqlOpts(db))
+                .values({ env: env, name: name, description: mod.description || "",
+                          appliedAt: nowIso, rerunnable: mod.rerunnable ? 1 : 0 })
+                .toSql();
             }
-          })();
+            var writeStmt = db.prepare(writeBuilt.sql);
+            writeStmt.run.apply(writeStmt, writeBuilt.params);
+          }, {
+            onRollbackFail: function (rollbackErr) {
+              log.debug("rollback-failed", {
+                op: "seed-apply",
+                env: env,
+                name: name,
+                error: rollbackErr && rollbackErr.message,
+              });
+            },
+          });
           applied.push(name);
           appliedSet.add(name);
 

package/lib/storage.js

@@ -425,7 +425,7 @@ async function getFileStream(key, sealedKey, opts) {
  * @example
  *   b.storage.init({ backend: "local", uploadDir: "./data/uploads" });
  *   var saved = await b.storage.saveRaw(Buffer.from("public-bytes"), "logo.png");
- *   // → { storedPath: "logo.png", backend: "default" }
+ *   // → { storedPath: "logo.png", backend: "default", versionId: null }
  */
 async function saveRaw(buffer, key, opts) {
   _requireInit();
@@ -443,7 +443,9 @@ async function saveRaw(buffer, key, opts) {
       raw:            true,
     },
   });
-  return { storedPath: key, backend: picked.backend.name };
+  // versionId is non-null only on a versioning-enabled (S3 Object-Lock)
+  // backend; capture it to target the exact version for later erasure.
+  return { storedPath: key, backend: picked.backend.name, versionId: result.versionId || null };
 }
 
 /**
@@ -486,14 +488,24 @@ async function getRawBuffer(key, opts) {
  * Remove `key` from the routed backend. Returns `true` when the
  * object existed and was removed, `false` when it was already
  * absent. Emits `system.storage.delete` with `{ backend, key,
- * existed }` so the audit chain records GDPR right-to-erasure
+ * existed, versionId }` so the audit chain records GDPR right-to-erasure
  * flows. The sealed encryption key the caller persisted alongside
  * the row should be discarded by the caller after a successful
  * delete — without the bytes, the key has no recovery value.
  *
+ * On a versioning-enabled (S3 Object-Lock) backend an unversioned
+ * delete only writes a delete-marker — the data version survives. To
+ * erase a specific version pass `versionId` (from `saveRaw`'s return or
+ * `listVersions`); a version under an active retention is refused (the
+ * call throws), and `bypassGovernanceRetention` lifts a GOVERNANCE-mode
+ * retention for callers with the permission (COMPLIANCE stays immutable).
+ * `versionId` is S3/sigv4-only and is refused on other backends.
+ *
  * @opts
  *   classification:  string,    // route to a backend serving this classification
  *   backend:         string,    // explicit backend by name
+ *   versionId:       string,    // erase a specific object version (S3 Object-Lock)
+ *   bypassGovernanceRetention: boolean, // lift GOVERNANCE retention (not COMPLIANCE)
  *
  * @example
  *   b.storage.init({ backend: "local", uploadDir: "./data/uploads" });
@@ -507,12 +519,16 @@ async function deleteFile(key, opts) {
   _requireInit();
   opts = opts || {};
   var picked = _pickBackend(opts);
-  var result = await picked.backend.delete(key);
+  var result = await picked.backend.delete(key, {
+    versionId:                 opts.versionId,
+    bypassGovernanceRetention: opts.bypassGovernanceRetention,
+  });
   _emit("system.storage.delete", {
     metadata: {
-      backend: picked.backend.name,
-      key:     key,
-      existed: result,
+      backend:   picked.backend.name,
+      key:       key,
+      existed:   result,
+      versionId: opts.versionId || null,
     },
   });
   return result;
@@ -556,6 +572,53 @@ async function exists(key, opts) {
   }
 }
 
+/**
+ * @primitive b.storage.listVersions
+ * @signature b.storage.listVersions(prefix, opts?)
+ * @since     0.15.10
+ * @status    stable
+ * @compliance gdpr, sox-404, soc2
+ * @related   b.storage.deleteFile, b.storage.saveRaw, b.worm.create
+ *
+ * Enumerate every object VERSION and delete-marker under `prefix` on a
+ * versioning-enabled (S3 Object-Lock) backend. Plain reads only see the
+ * current version; right-to-erasure / crypto-shred on an Object-Lock
+ * bucket must target prior versions by `versionId`, which only this call
+ * surfaces. Each item is `{ key, versionId, isLatest, deleteMarker, size,
+ * lastModified, etag }`; `deleteMarker: true` rows are tombstones with no
+ * data. Pair with `deleteFile(key, { versionId })` to erase a version.
+ *
+ * Versioning is an S3/sigv4 feature — a backend without a version surface
+ * (filesystem, and the current Azure/GCS adapters) throws
+ * `VERSIONS_UNSUPPORTED` rather than silently returning the current view,
+ * so an erasure workflow can never mistake a single-version backend for a
+ * fully-enumerated one.
+ *
+ * @opts
+ *   classification:   string,   // route to a backend serving this classification
+ *   backend:          string,   // explicit backend by name
+ *   maxResults:       number,   // page size
+ *   keyMarker:        string,   // pagination cursor (from a prior page)
+ *   versionIdMarker:  string,   // pagination cursor (from a prior page)
+ *
+ * @example
+ *   var page = await b.storage.listVersions("filings/2026/");
+ *   for (var v of page.items) {
+ *     if (!v.isLatest) await b.storage.deleteFile(v.key, { versionId: v.versionId });
+ *   }
+ */
+async function listVersions(prefix, opts) {
+  _requireInit();
+  opts = opts || {};
+  var picked = _pickBackend(opts);
+  if (typeof picked.backend.listVersions !== "function") {
+    throw _err("VERSIONS_UNSUPPORTED",
+      "listVersions: backend '" + picked.backend.name + "' has no version surface " +
+      "(S3/sigv4 only). A filesystem / single-version backend cannot enumerate versions.", true);
+  }
+  return picked.backend.listVersions(prefix, opts);
+}
+
 /**
  * @primitive b.storage.listBackends
  * @signature b.storage.listBackends()
@@ -1266,6 +1329,7 @@ module.exports = {
   getRawBuffer:   getRawBuffer,
   deleteFile:     deleteFile,
   exists:         exists,
+  listVersions:   listVersions,
   presignedUploadUrl:    presignedUploadUrl,
   presignedDownloadUrl:  presignedDownloadUrl,
   presignedUploadPolicy: presignedUploadPolicy,

package/lib/vault/rotate.js

@@ -544,12 +544,6 @@ function _walkAndReSeal(node, oldKeys, newKeys) {
   return { value: node, changed: false };
 }
 
-// Transaction-control statements only (BEGIN / COMMIT / ROLLBACK) - fixed
-// keywords, no identifier / value, so they stay verbatim rather than route
-// through b.sql (the builder has no transaction-control verb). The param is
-// named `stmtText` so it does not shadow the module-level `sql` builder.
-function _runStmt(db, stmtText) { db.prepare(stmtText).run(); }
-
 function _rotateColumn(db, table, column, schema, roots, batchSize, progress) {
   // Every statement composes through b.sql (sqlite dialect, quoteName so
   // the concrete handle's table is quoted, not left bare for a cluster
@@ -655,8 +649,9 @@ function _rotateOverflow(db, table, oldKeys, newKeys, batchSize, progress, warni
     var rows = sel.all(lastId);
     if (rows.length === 0) break;
 
-    _runStmt(db, "BEGIN");
-    try {
+    // One transaction per page via the shared wrapper — the rotate worker
+    // no longer hand-rolls the BEGIN/COMMIT/ROLLBACK skeleton.
+    dbSchema.runInTransaction(db, function () {
       for (var i = 0; i < rows.length; i++) {
         var row = rows[i];
         var doc;
@@ -671,11 +666,7 @@ function _rotateOverflow(db, table, oldKeys, newKeys, batchSize, progress, warni
         var rv = _walkAndReSeal(doc, oldKeys, newKeys);
         if (rv.changed) upd.run(JSON.stringify(rv.value), row._id);
       }
-      _runStmt(db, "COMMIT");
-    } catch (e) {
-      _runStmt(db, "ROLLBACK");
-      throw e;
-    }
+    });
     processed += rows.length;
     lastId = rows[rows.length - 1]._id;
     _emit(progress, { phase: "rotate_overflow", table: table, rowsProcessed: processed, rowsTotal: total });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.9",
+  "version": "0.15.10",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:19fb1b2e-d7b6-4169-b9c6-f60726097293",
+  "serialNumber": "urn:uuid:67b3105d-f49c-44bd-bf4e-afbb994d35e2",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-14T00:18:26.195Z",
+    "timestamp": "2026-06-14T03:47:28.687Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.9",
+      "bom-ref": "@blamejs/core@0.15.10",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.9",
+      "version": "0.15.10",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.9",
+      "purl": "pkg:npm/%40blamejs/core@0.15.10",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.9",
+      "ref": "@blamejs/core@0.15.10",
       "dependsOn": []
     }
   ]