blockyard 0.1.0 → 0.1.1

package/scripts/setup.js

@@ -5,10 +5,16 @@
 // monitor -- so a new machine goes from a clone to running and indexing in one sitting.
 //
 //   npm run setup                       # interactive
-//   node scripts/setup.js --yes [--rpc-url URL] [--datadir DIR] [--label L] [--rpc-user U --rpc-password P]
+//   node scripts/setup.js --yes [--rpc-url URL] [--datadir DIR] [--label L]
+//                         [--rpc-user U (--rpc-password-file PATH | --rpc-password - | --rpc-password P)]
 //                         [--host 127.0.0.1] [--port 21000] [--index-dir DIR] [--workers N]
 //                         [--build-here | --build-later] [--start] [--force]
 //
+// The RPC password (2026-09-16, audit L12): --rpc-password-file PATH reads the first line of a
+// file, --rpc-password - reads the first line of stdin; --rpc-password P still works but warns,
+// because P is then visible to every user of the machine in `ps` and stays in shell history.
+// Typed at the prompt, it is not echoed.
+//
 // --yes takes every default without asking (a scripted install); --force replaces an existing
 // config/local.json (a backup is kept either way); --start boots the monitor at the end without
 // asking. The index is built by BlockYard itself, in the background, once it starts (the Overview shows
@@ -16,7 +22,7 @@
 // --build-later writes addressIndexBuild: "manual" so nothing builds until you run index-build.js.
 // The written file is mode 0600: it may carry an RPC password. Nothing here touches the
 // node: every call is a read. (operator, 2026-09-14: "Make this npm installer absolutely beautiful")
-import { existsSync, statSync, writeFileSync, copyFileSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
+import { existsSync, statSync, writeFileSync, chmodSync, mkdirSync, readFileSync, realpathSync } from 'node:fs';
 import os from 'node:os';
 import net from 'node:net';
 import http from 'node:http';
@@ -58,18 +64,94 @@ export function localConfig(a) {
   if (a.indexDir) node.addressIndex = a.indexDir;
   if (a.indexBuild === 'manual') node.addressIndexBuild = 'manual';   // the server builds a missing index on start unless told not to
   if (Number.isInteger(a.workers) && a.workers > 0) node.addressIndexWorkers = a.workers;   // the server's background build uses the same number
+  // What the node told us it can do, from bmcgetcapabilities (scripts/check.js).
+  // A SNAPSHOT, written so the server knows on its first tick without a probe --
+  // not a source of truth. These are live settings on the node: an operator can
+  // enable the journal or the facade tomorrow, so the server re-reads them and
+  // this only saves the first round trip. Absent for a Core node, which is how
+  // the server tells the two apart.
+  if (a.nodeKind && a.nodeKind !== 'core') {
+    node.nodeKind = a.nodeKind;
+    if (a.nodeCapabilities) node.nodeCapabilities = a.nodeCapabilities;
+  }
   return { server: { host: a.host, port: Number(a.port) }, nodes: [node] };
 }
 
 /** Write it, keeping a dated copy of whatever was there. Refuses an existing file unless `force`. */
-export function writeLocalConfig(file, cfg, { force = false, now = new Date() } = {}) {
+export function writeLocalConfig(file, cfg, { force = false, now = new Date(), platform = process.platform } = {}) {
   if (existsSync(file)) {
     if (!force) throw new Error(`${file} exists; pass --force (or answer yes) to replace it`);
     const bak = `${file}.bak-${now.toISOString().replace(/[:.]/g, '').slice(0, 15)}`;
-    copyFileSync(file, bak);
+    // THE BACKUP IS OWNER-ONLY TOO (2026-09-16, audit I5): it holds the same RPC password, and
+    // copyFileSync kept whatever mode the old file had -- 0644 on a config written by hand. It is
+    // written fresh at 0600, and chmod'ed in case a backup of that name was already there.
+    writeFileSync(bak, readFileSync(file), { mode: 0o600 });
+    if (platform !== 'win32') chmodSync(bak, 0o600);
   }
   mkdirSync(path.dirname(file), { recursive: true });
   writeFileSync(file, JSON.stringify(cfg, null, 2) + '\n', { mode: 0o600 });
+  // `mode` above applies only when the file is CREATED (2026-09-16, audit L12): --force over an
+  // existing 0644 local.json kept 0644 while putting a password in it. Windows has no such bits.
+  if (platform !== 'win32') chmodSync(file, 0o600);
+}
+
+/**
+ * WHERE THE RPC PASSWORD COMES FROM ON THE COMMAND LINE (2026-09-16, audit L12). `--rpc-password P`
+ * puts P in `ps` for every user of the machine and in the shell's history, so two ways that do
+ * not: `--rpc-password-file PATH` (the first line of the file) and `--rpc-password -` (the first
+ * line of stdin; needs --yes, since stdin is then not a terminal to ask on). The plain form still
+ * works, with a warning. Returns { password, source, warning } -- password null when none is named.
+ */
+export function rpcPasswordFrom(argv, { readFile = (p) => readFileSync(p, 'utf8'), readStdin = () => readFileSync(0, 'utf8') } = {}) {
+  const val = (name) => { const i = argv.indexOf(`--${name}`); return i >= 0 && argv[i + 1] != null && (argv[i + 1] === '-' || !argv[i + 1].startsWith('--')) ? argv[i + 1] : null; };
+  const firstLine = (text) => String(text).split(/\r?\n/)[0];
+  const file = val('rpc-password-file'), plain = val('rpc-password');
+  if (file != null && plain != null) throw new Error('--rpc-password and --rpc-password-file name the password twice; give one');
+  if (file != null) {
+    let text;
+    try { text = readFile(expand(file)); } catch (err) { throw new Error(`--rpc-password-file ${file}: ${err.code ?? err.message}`); }
+    return { password: firstLine(text), source: 'file', warning: null };
+  }
+  if (plain === '-') return { password: firstLine(readStdin()), source: 'stdin', warning: null };
+  if (plain != null) {
+    return { password: plain, source: 'argv',
+      warning: '--rpc-password on the command line is visible to other users of this machine (ps) and stays in your shell history; use --rpc-password-file PATH, or --rpc-password - to read it from stdin' };
+  }
+  return { password: null, source: null, warning: null };
+}
+
+/**
+ * A PROMPT THAT DOES NOT ECHO (2026-09-16, audit L12): readline's question() shows every character
+ * typed, so the "secret" rpcPassword prompt used to hide only its default. The same approach as
+ * scripts/manage-users.js: raw mode on a terminal, the characters collected by hand, nothing
+ * written back but the newline. Backspace edits, Ctrl-C calls `onInterrupt`. The caller closes
+ * any readline interface on `input` first, so it does not echo the keys itself.
+ */
+export function readHidden(question, { input = stdin, output = stdout, onInterrupt = () => process.exit(130) } = {}) {
+  return new Promise((resolve) => {
+    output.write(question);
+    const raw = Boolean(input.isTTY && input.setRawMode);
+    if (raw) input.setRawMode(true);
+    let buf = '';
+    input.setEncoding?.('utf8');
+    const finish = () => {
+      input.removeListener('data', onData);
+      if (raw) input.setRawMode(false);
+      input.pause();
+      output.write('\n');
+    };
+    // a chunk may hold many characters (a paste, or a pipe), so each is looked at on its own
+    const onData = (chunk) => {
+      for (const ch of String(chunk)) {
+        if (ch === '\n' || ch === '\r') { finish(); resolve(buf); return; }
+        if (ch === '\u007f' || ch === '\b') buf = buf.slice(0, -1);   // DEL is what backspace sends on a tty
+        else if (ch === '\u0003') { finish(); onInterrupt(); return; }
+        else buf += ch;
+      }
+    };
+    input.on('data', onData);
+    input.resume();
+  });
 }
 
 // ------------------------------------------------------------------------- what an answer must be
@@ -201,8 +283,12 @@ export async function portInUse(host, port) {
 
 // ------------------------------------------------------------------------------------ the flow
 async function main() {
-  if (!YES && !stdin.isTTY) { console.error('no terminal to ask on: pass --yes with the --rpc-url/--datadir flags (see the header of scripts/setup.js)'); process.exit(2); }
-  const rl = YES ? null : readline.createInterface({ input: stdin, output: stdout });
+  if (!YES && !stdin.isTTY) { console.error('no terminal to ask on: pass --yes with the --rpc-url/--datadir flags (see the header of scripts/setup.js; --rpc-password - reads stdin only with --yes)'); process.exit(2); }
+  // read once, before anything else touches stdin (2026-09-16, audit L12)
+  let pw;
+  try { pw = rpcPasswordFrom(argv); } catch (err) { console.error(c.bad(err.message)); process.exit(2); }
+  if (pw.warning) console.error(`${c.warn('!')} ${pw.warning}`);
+  let rl = YES ? null : readline.createInterface({ input: stdin, output: stdout });
   const out = (s = '') => stdout.write(`${s}\n`);
   // every line the installer says fits the terminal (operator: 80 columns, "Standard CRT")
   const say = (s) => out(`    ${wrapText(s, cols() - 4, 4)}`);
@@ -215,7 +301,14 @@ async function main() {
       if (YES) raw = def;
       else {
         const shown = def != null && def !== '' && !secret ? ` ${c.dim(`(${def})`)}` : '';
-        raw = (await rl.question(`    ${q} ${label}${shown} ${c.dim('›')} `)).trim();
+        const prompt = `    ${q} ${label}${shown} ${c.dim('›')} `;
+        if (secret) {
+          // not echoed (2026-09-16, audit L12): readline would echo the keys itself, so it is
+          // closed for the one answer and opened again after
+          rl.close();
+          raw = (await readHidden(`${prompt}${c.dim('(not shown) ')}`, { onInterrupt: () => process.emit('SIGINT') })).trim();
+          rl = readline.createInterface({ input: stdin, output: stdout });
+        } else raw = (await rl.question(prompt)).trim();
         if (raw === '') raw = def;
       }
       const r = check ? check(raw ?? '') : { value: raw };
@@ -238,7 +331,7 @@ async function main() {
   let building = null;
   process.on('SIGINT', () => {
     out(); out();
-    if (building) say(c.warn(`stopped. The index in ${building} is unfinished: run the build again (it starts over) before pointing BlockYard at it.`));
+    if (building) say(c.warn(`stopped. The index in ${building} is unfinished: run the build again (it resumes where it stopped) before pointing BlockYard at it.`));
     else say(c.dim('stopped; nothing written.'));
     process.exit(130);
   });
@@ -273,7 +366,7 @@ async function main() {
     const port = conf.values.rpcport ?? RPC_PORT[conf.chain] ?? 8332;
     a.rpcUrl = await ask('RPC URL', arg('rpc-url', `http://${host}:${port}`), validate.rpcUrl);
     a.label = await ask('a label for the node', arg('label', conf.chain === 'main' ? 'Bitcoin Core' : `Bitcoin Core (${conf.chain})`), validate.label);
-    a.rpcUser = arg('rpc-user'); a.rpcPassword = arg('rpc-password');
+    a.rpcUser = arg('rpc-user'); a.rpcPassword = pw.password;
     a.cookieFile = conf.values.rpccookiefile ? (path.isAbsolute(conf.values.rpccookiefile) ? conf.values.rpccookiefile : path.join(a.datadir, conf.values.rpccookiefile)) : null;
     const cookie = resolveCookie({ datadir: a.datadir, chainHint: a.chain, cookieFile: a.cookieFile ?? undefined });
     if (cookie && cookie.source !== 'config') say(`${c.ok('✓')} cookie found: ${c.dim(cookie.source)}`);
@@ -284,7 +377,7 @@ async function main() {
       const who = conf.rpcauthUsers[0] ?? '';
       say(`${c.warn('!')} no .cookie readable under ${a.datadir}${who ? `; ${shortPath(conf.file)} has rpcauth for "${who}", whose password is not in the file` : ': a node authenticating with rpcauth needs a user and password'}`);
       a.rpcUser = await ask('rpcUser', who, null);
-      if (a.rpcUser) a.rpcPassword = await ask('rpcPassword', '', null, { secret: true });
+      if (a.rpcUser && a.rpcPassword == null) a.rpcPassword = await ask('rpcPassword', '', null, { secret: true });
     }
 
     out(step(2, STEPS, 'Checking the node'));
@@ -293,6 +386,10 @@ async function main() {
     result = await runChecks(node, { rpc: clientFor(node, defaults) });
     if (result.facts.chain && result.facts.chain !== a.chain) { a.chain = result.facts.chain; node.chainHint = a.chain; result = await runChecks(node, { rpc: clientFor(node, defaults) }); }
     spin.stop();
+    // Carry what the node said about itself into the answers, so localConfig
+    // can record it below. A Core node reports nodeKind 'core' and nothing is
+    // written -- absence is the signal.
+    if (result.facts.nodeKind) { a.nodeKind = result.facts.nodeKind; a.nodeCapabilities = result.facts.nodeCapabilities ?? null; }
     for (const ch of result.checks) out(checkLine(ch.status, ch.name, ch.detail));
     out();
     if (result.ok) { say(c.ok(c.bold('everything this needs is there'))); break; }
@@ -385,6 +482,7 @@ async function main() {
       const manifest = await buildIndex({
         rpc, blocksDir: path.join(node.datadir, 'blocks'), out: a.indexDir, workers: a.workers,
         pace: rpcPacer(rpc, { onChange: (held) => bar.done(held ? c.dim('  paused while the node\'s RPC is slow or failing') : c.dim('  resumed')) }),
+        log: (text) => bar.done(c.dim(`  ${text}`)),
         onProgress: (p) => {
           if (p.phase !== phase) {
             if (phase) bar.done(strip(progressLine({ phase, done: 1, total: 1, elapsed: (Date.now() - phaseStart) / 1000 })));

package/scripts/shots.mjs

@@ -230,6 +230,27 @@ if (doing('tetrust')) {
   } catch (e) { fail('tetrust', e); }
 }
 
+// ------------------------------------------------------------- scorched yard
+// a game against the computer, a nuke on its way in from You (the shot is set up through the
+// screen's currentGame hook so the picture has a blast in it rather than an empty field)
+if (doing('scorched')) {
+  try {
+    await evl(`document.getElementById('navDivBtn')?.click()`);
+    await sleep(700);
+    const ok = await evl(`(() => { const b=document.querySelector('button[data-page="scorched"]'); if(!b) return false; b.click(); return true; })()`);
+    if (!ok) throw new Error('no scorched button behind Diversions');
+    await sleep(2500);
+    await metrics(1000);
+    await evl(`document.getElementById('syResume')?.click()`);
+    await sleep(1500);
+    await evl(`import('/js/scorchedyard.js').then(async (m) => { const g = m.currentGame(); const t = g.tanks[0]; const ai = await import('/js/scorchedai.js'); const target = ai.nearest(g, t); t.inventory.nuke = 1; t.weapon = 'nuke'; const s = ai.spoiler(g, t, () => 0.9, target); t.angle = s.angle; t.power = s.power; })`);
+    await sleep(300);
+    await evl(`document.getElementById('syFire')?.click()`);
+    await sleep(2400);
+    done.push(await shoot('scorched', { settle: 0, height: 1000 }));
+  } catch (e) { fail('scorched', e); }
+}
+
 // -------------------------------------------------- neon: LAST, and it is restored
 if (doing('block-space-neon')) {
   let toggled = false;

package/scripts/smoke.sh

@@ -59,8 +59,8 @@ echo "== booting server on :${PORT} (fake node :${FAKE_PORT}) =="
 # choices -- including which addresses to bind -- and inheriting them made this script
 # curl 127.0.0.1 against a server listening elsewhere (54 failures, 2 passes).
 # BLOCKYARD_BIND: pin it explicitly anyway, so a future default cannot repeat that.
-# BLOCKYARD_AUTH=1: accounts are OFF by default now, and this script's bulk is the
-# signed-in contract (sessions, CSRF, per-user audit, RBAC). The open posture gets its
+# BLOCKYARD_AUTH=1: accounts are ON by default (since 2026-09-15); set explicitly anyway, since
+# this script's bulk is the signed-in contract (sessions, CSRF, per-user audit, RBAC). The open posture gets its
 # own instance further down, on its own port, so both are asserted rather than one
 # replacing the other.
 BLOCKYARD_CONFIG=none BLOCKYARD_BIND=127.0.0.1 BLOCKYARD_AUTH=1 BLOCKYARD_TLS=0 \
@@ -282,8 +282,9 @@ check "the breaker names its threshold" "$(echo "$TEL" | grep -c '"threshold":3'
 check "telemetry reports the audit log too" "$(echo "$TEL" | grep -c '"rotationError"')" "1"
 check "the peer identity table has data to draw" "$(curl -s -b "$DIR/ck" "$BASE/api/peers" | grep -c '"identity"')" "1"
 
-echo "== open access: the default posture, no sign-in =="
-# Accounts are OFF by default. A second instance on its own port asserts what that
+echo "== open access: the opt-in posture, no sign-in =="
+# Accounts are ON by default (since 2026-09-15); open access is chosen with BLOCKYARD_AUTH=0,
+# which this second instance sets. On its own port it asserts what that
 # grants (reads, the read-only RPC console, the stream) and, more importantly, what it
 # does NOT: user admin, the audit trail, node writes. Keeping this a separate boot is
 # the point -- the signed-in checks above must not be quietly replaced by open ones.
@@ -291,7 +292,7 @@ OPEN_PORT="${BLOCKYARD_SMOKE_OPEN_PORT:-18199}"
 OPEN_DIR="$(mktemp -d /tmp/blockyard-open.XXXXXX)"
 OPID=""
 # OPID is reaped by the single cleanup trap at the top
-BLOCKYARD_CONFIG=none BLOCKYARD_BIND=127.0.0.1 \
+BLOCKYARD_CONFIG=none BLOCKYARD_BIND=127.0.0.1 BLOCKYARD_AUTH=0 BLOCKYARD_TLS=0 \
 BLOCKYARD_DATA="$OPEN_DIR" BLOCKYARD_FAKE_NODE=1 BLOCKYARD_PORT="$OPEN_PORT" \
 BLOCKYARD_LOG_LEVEL=warn FAKE_PORT="$((FAKE_PORT + 1))" node server/main.js >"$OPEN_DIR/server.log" 2>&1 &
 OPID=$!

package/scripts/ui.js

@@ -143,12 +143,14 @@ const G = (n) => (n >= 1e9 ? `${(n / 1e9).toFixed(2)} B` : n >= 1e6 ? `${(n / 1e
  * One line of a progress bar: `phase ████░░ done/total · rows · rate · ETA`. `elapsed` in seconds
  * since the phase began; the ETA assumes the rate so far holds. Pure, so it is tested.
  */
-export function progressLine({ phase, done, total, rows = null, elapsed = 0 }, width = cols()) {
+// `from` is where the phase started this run: a resumed build begins part way, and its rate (and so
+// the time left) is what this run has done, not what an earlier run did
+export function progressLine({ phase, done, total, from = 0, rows = null, elapsed = 0 }, width = cols()) {
   const frac = total > 0 ? Math.min(1, done / total) : 0;
   const barW = Math.max(10, Math.min(30, width - 62));
   const filled = Math.round(frac * barW);
   const bar = c.accent('█'.repeat(filled)) + c.dim('░'.repeat(barW - filled));
-  const rate = elapsed > 0 && done > 0 ? done / elapsed : 0;
+  const rate = elapsed > 0 && done > from ? (done - from) / elapsed : 0;
   const eta = rate > 0 && total > done ? HMS((total - done) / rate) : null;
   const bits = [`${String(done).padStart(String(total).length)}/${total}`, `${Math.round(frac * 100)}%`];
   if (rows != null) bits.push(`${G(rows)} rows`);

package/server/auth/sessions.js

@@ -140,9 +140,18 @@ export class RateLimiter {
   }
 }
 
-// Failed-login tracking, keyed on BOTH username and address: a spray across many
-// usernames from one host and a grind on one username from many hosts are
-// different attacks and both need to be visible.
+// Failed-login tracking. Two attacks need to be visible: a grind on one account, and a spray across
+// many accounts from one host.
+//
+// THE LOCK IS PER (USERNAME, ADDRESS) PAIR, NOT PER USERNAME (audit 2026-09-16, L14). The first cut
+// locked the username itself after 8 failures from anywhere, and the address after 8 failures for
+// any account: so one person behind a shared NAT or proxy could lock every account for everyone
+// behind it, and anyone who knew a username could lock its owner out from any address. Now:
+//   * 8 failures for one username from one address lock that pair;
+//   * 5x that from one address, across every username, lock the address (a spray);
+//   * 10x that for one username, across every address, lock the username (a distributed grind) --
+//     a threshold only a real attack reaches, where locking the account is the right trade.
+// The per-address throttle in front of the KDF (main.js loginLimiter) still paces all of it.
 export class LoginGuard {
   constructor({ maxAttempts = 8, windowMs = 300000, lockoutMs = 600000 } = {}) {
     this.maxAttempts = maxAttempts;
@@ -159,24 +168,35 @@ export class LoginGuard {
     return e;
   }
 
+  _keys(username, ip) {
+    return [
+      [`p:${username}\u0000${ip}`, this.maxAttempts],
+      [`i:${ip}`, this.maxAttempts * 5],
+      [`u:${username}`, this.maxAttempts * 10],
+    ];
+  }
+
   status(username, ip) {
-    const a = this._entry(`u:${username}`);
-    const b = this._entry(`i:${ip}`);
-    const locked = Math.max(a.lockedUntil, b.lockedUntil);
+    let locked = 0, remaining = Infinity, worst = 0;
+    for (const [key, max] of this._keys(username, ip)) {
+      const e = this._entry(key);
+      locked = Math.max(locked, e.lockedUntil);
+      worst = Math.max(worst, e.hits.length);
+      remaining = Math.min(remaining, Math.max(0, max - e.hits.length));
+    }
     if (locked > Date.now()) return { blocked: true, retryAfterMs: locked - Date.now() };
-    const worst = Math.max(a.hits.length, b.hits.length);
-    return { blocked: false, attempts: worst, remaining: Math.max(0, this.maxAttempts - worst) };
+    return { blocked: false, attempts: worst, remaining };
   }
 
   noteFailure(username, ip) {
     const out = [];
-    for (const key of [`u:${username}`, `i:${ip}`]) {
+    for (const [key, max] of this._keys(username, ip)) {
       const e = this._entry(key);
       e.hits.push(Date.now());
-      if (e.hits.length >= this.maxAttempts) {
+      if (e.hits.length >= max) {
         e.lockedUntil = Date.now() + this.lockoutMs;
         e.hits = [];
-        out.push(key);
+        out.push(key.startsWith('p:') ? `u:${username}@i:${ip}` : key);
       }
       this.attempts.set(key, e);
     }
@@ -184,8 +204,8 @@ export class LoginGuard {
   }
 
   noteSuccess(username, ip) {
-    this.attempts.delete(`u:${username}`);
-    this.attempts.delete(`i:${ip}`);
+    // success clears this pair only: it proves nothing about other addresses guessing this account
+    this.attempts.delete(`p:${username}\u0000${ip}`);
   }
 }
 

package/server/chain/blockfile.js

@@ -77,15 +77,49 @@ export function* records(buf, magic = MAGIC.main, trailer = 0, key = null) {
 
 // --- undo data -----------------------------------------------------------
 // Core's VARINT (serialize.h), which is NOT CompactSize: MSB base-128 with an offset per byte.
-function readVarInt(buf, st) {
+// Core reads each field at a fixed width and throws "ReadVarInt(): size too large" past it. The
+// height code, the version placeholder and the script size are uint32, so a longer run of
+// continuation bytes is corruption, not a large number -- and refusing it keeps every value an exact
+// double (a flipped byte used to hand back heights and amounts past 2^53, rounded).
+function readVarInt(buf, st, max = 0xffffffff) {
+  const limit = Math.floor(max / 128);
   let n = 0;
   for (;;) {
     const b = buf[st.pos++];
     if (b === undefined) throw new RangeError('truncated VARINT');
+    if (n > limit) throw new RangeError('VARINT too large');
+    n = n * 128 + (b & 0x7f);
+    if (b & 0x80) { if (n === max) throw new RangeError('VARINT too large'); n += 1; } else return n;
+  }
+}
+// THE AMOUNT IS A uint64 VARINT, AND IT CAN PASS 2^53 FOR A LEGAL AMOUNT. CompressAmount makes an
+// amount that does not end in a zero about 9x larger, so from ~1e15 satoshis (10M BTC in one output,
+// never seen, but in range) the compressed value no longer fits a double: 2,099,999,999,999,999 sat
+// compresses to 18,899,999,999,999,991, which rounds to ...992, and came back as 209,999,999,999,999,940
+// -- a hundred times too much, because the rounding moved the exponent digit
+// (test/chain-decode-property.test.js). Every real amount stays on the number path; past 2^46,
+// where one more byte could round, the rest is read in BigInt, to Core's uint64 limit.
+const U64 = 0xffffffffffffffffn;
+function readAmountVarInt(buf, st) {
+  let n = 0;
+  for (;;) {
+    const b = buf[st.pos];
+    if (b === undefined) throw new RangeError('truncated VARINT');
+    if (n > 0x3fffffffffff) return readBigVarInt(buf, st, BigInt(n));
+    st.pos++;
     n = n * 128 + (b & 0x7f);
     if (b & 0x80) n += 1; else return n;
   }
 }
+function readBigVarInt(buf, st, n) {
+  for (;;) {
+    const b = buf[st.pos++];
+    if (b === undefined) throw new RangeError('truncated VARINT');
+    if (n > U64 >> 7n) throw new RangeError('VARINT too large');
+    n = (n << 7n) | BigInt(b & 0x7f);
+    if (b & 0x80) { if (n === U64) throw new RangeError('VARINT too large'); n += 1n; } else return n;
+  }
+}
 function readCompactSize(buf, st) {
   const b = buf[st.pos++];
   if (b < 0xfd) return b;
@@ -94,8 +128,21 @@ function readCompactSize(buf, st) {
   const v = Number(buf.readBigUInt64LE(st.pos)); st.pos += 8; return v;
 }
 
-// compressor.cpp DecompressAmount
+// compressor.cpp DecompressAmount. `x` is a number, or a BigInt when its VARINT ran past 2^46 (see
+// readAmountVarInt). The result is an exact number of satoshis, or a RangeError past 2^53 -- far
+// beyond 21M BTC, so only corrupt data gets there, and Reader.u64 refuses such an amount the same way.
 export function decompressAmount(x) {
+  if (typeof x === 'bigint') {
+    if (x === 0n) return 0;
+    x -= 1n;
+    let e = x % 10n, n;
+    x /= 10n;
+    if (e < 9n) { const d = (x % 9n) + 1n; x /= 9n; n = x * 10n + d; } else { n = x + 1n; }
+    while (e > 0n) { n *= 10n; e--; }
+    if (n > BigInt(Number.MAX_SAFE_INTEGER)) throw new RangeError(`amount ${n} is past the safe integer range`);
+    return Number(n);
+  }
+  if (x > Number.MAX_SAFE_INTEGER) return decompressAmount(BigInt(x));
   if (x === 0) return 0;
   x -= 1;
   let e = x % 10;
@@ -103,6 +150,7 @@ export function decompressAmount(x) {
   let n;
   if (e < 9) { const d = (x % 9) + 1; x = Math.floor(x / 9); n = x * 10 + d; } else { n = x + 1; }
   while (e > 0) { n *= 10; e--; }
+  if (n > Number.MAX_SAFE_INTEGER) throw new RangeError(`amount ${n} is past the safe integer range`);
   return n;
 }
 
@@ -119,7 +167,12 @@ function decompressPubkey(prefix, x32) {
 // compressor.cpp: sizes 0-5 are special script templates, 6+ a raw script of (size - 6) bytes
 function readCompressedScript(buf, st) {
   const size = readVarInt(buf, st);
-  const take = (n) => { const v = buf.subarray(st.pos, st.pos + n); st.pos += n; return v; };
+  // bounds-checked: a slice past the end used to come back short and silently, the record failing
+  // only later with a nonsense "-N bytes left" (or, for templates 4 and 5, a key rebuilt from a short x)
+  const take = (n) => {
+    if (st.pos + n > buf.length) throw new RangeError(`truncated script: need ${n} bytes at ${st.pos} of ${buf.length}`);
+    const v = buf.subarray(st.pos, st.pos + n); st.pos += n; return v;
+  };
   switch (size) {
     case 0: return Buffer.concat([Buffer.from([0x76, 0xa9, 0x14]), take(20), Buffer.from([0x88, 0xac])]);
     case 1: return Buffer.concat([Buffer.from([0xa9, 0x14]), take(20), Buffer.from([0x87])]);
@@ -144,7 +197,7 @@ export function decodeBlockUndo(body) {
       const code = readVarInt(body, st);
       const height = Math.floor(code / 2);
       if (height > 0) readVarInt(body, st);                  // the legacy nVersion placeholder, always 0
-      const value_sat = decompressAmount(readVarInt(body, st));
+      const value_sat = decompressAmount(readAmountVarInt(body, st));
       const script = readCompressedScript(body, st);
       coins[j] = { height, coinbase: (code & 1) === 1, value_sat, script };
     }
@@ -165,11 +218,17 @@ export function undoShape(body) {
     for (let j = 0; j < nin; j++) {
       const height = Math.floor(readVarInt(body, st) / 2);
       if (height > 0) readVarInt(body, st);
-      readVarInt(body, st);
+      readAmountVarInt(body, st);
       const size = readVarInt(body, st);
       st.pos += size === 0 || size === 1 ? 20 : size < 6 ? 32 : size - 6;
     }
   }
+  // SKIPPING IS NOT READING: script bytes are stepped over, never touched, so a record cut in the
+  // middle of its last script returned the full counts as if whole (found by truncating random
+  // records at every offset). pairBlocksWithUndo matches on this shape, so the end is checked here
+  // exactly as decodeBlockUndo checks it.
+  if (st.pos > body.length) throw new RangeError(`truncated undo record: need ${st.pos} bytes, have ${body.length}`);
+  if (st.pos !== body.length) throw new RangeError(`${body.length - st.pos} bytes left after the undo record`);
   return counts;
 }