@blamejs/blamejs-shop 0.4.55 → 0.4.57

package/lib/vendor/blamejs/lib/legal-hold.js

@@ -60,7 +60,6 @@
  * on policy denials (already-held / not-held / invalid-citation).
  */
 var bCrypto = require("./crypto");
-var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var sql = require("./sql");
@@ -77,7 +76,7 @@ var { defineClass } = require("./framework-error");
 var HOLD_TABLE = "_blamejs_legal_hold";   // allow:hand-rolled-sql — canonical local table-name; passed to b.sql with quoteName
 var AUDIT_TABLE = "audit_log";
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var LegalHoldError = defineClass("LegalHoldError", { alwaysPermanent: true });
 var _err = LegalHoldError.factory;
@@ -151,19 +150,11 @@ function create(opts) {
   validateOpts.optionalObjectWithMethod(opts.signWith, "sign",
     "create: opts.signWith", LegalHoldError, "BAD_OPT", "b.auditSign-shaped object");
 
-  function _emit(action, info, outcome) {
-    if (!auditOn) return;
-    var sink = auditInstance || audit();
-    try {
-      sink.safeEmit({
-        action:   action,
-        outcome:  outcome,
-        resource: { kind: "legal-hold", id: info && info.subjectId },
-        reason:   (info && info.reason) || null,
-        metadata: info || {},
-      });
-    } catch (_e) { /* best-effort */ }
-  }
+  var _emit = auditEmit.gatedReasonEmitter({
+    audit: auditOn,
+    sink:  auditInstance,
+    extra: function (info) { return { resource: { kind: "legal-hold", id: info && info.subjectId } }; },
+  });
 
   function _ensureSchema() {
     // Idempotent migration. The framework SQLite path installs the

package/lib/vendor/blamejs/lib/log-stream-cloudwatch.js

@@ -198,20 +198,9 @@ function create(config) {
       "ResourceAlreadyExistsException treated as success).");
   }
   var cfg = Object.assign({}, DEFAULTS, config);
-  var onDrop = typeof cfg.onDrop === "function" ? cfg.onDrop : null;
-  var _emitDrop = safeAsync.makeDropCallback(onDrop);
-  var buffer = [];
-  var dropCount = 0;
-  var inFlight = false;
-  var closed = false;
   var sequenceToken = null;
-  // Captures the in-flight drain (the IIFE inside _flush) so close() can await
-  // the actual run before flipping `closed` — otherwise the _flush while-loop's
-  // `&& !closed` bails and buffered records are stranded at shutdown.
-  var inFlightPromise = null;
-  var flushScheduler = safeAsync.makeScheduledFlush(cfg.maxBatchAgeMs, function () { return _flush(); });
 
-  function _takeBatch() {
+  function _takeBatch(buffer) {
     var batch = [];
     var totalBytes = 0;
     while (buffer.length > 0) {
@@ -239,45 +228,25 @@ function create(config) {
     return autoCreatePromise;
   }
 
-  async function _flush() {
-    if (inFlight) return inFlightPromise;
-    if (buffer.length === 0) return;
-    inFlight = true;
-    inFlightPromise = (async function () {
-      try {
-        try { await _ensureAutoCreated(); }
-        catch (acErr) {
-          // autoCreate failure is permanent — every subsequent batch
-          // would hit the same error. Drop the queue with the
-          // operator-supplied onDrop callback so they see exactly which
-          // events were lost AND why, then bail.
-          var allBuffered = buffer.splice(0, buffer.length);
-          dropCount += allBuffered.length;
-          _emitDrop("autocreate-failed", allBuffered, acErr);
-          return;
-        }
-        while (buffer.length > 0 && !closed) {
-          var batch = _takeBatch();
-          if (batch.length === 0) break;
-          try {
-            await retryHelper.withRetry(function () {
-              return _send(batch);
-            }, Object.assign({
-              isPermanent: _isPermanentAwsError,
-            }, cfg.retry || {}));
-          } catch (e) {
-            dropCount += batch.length;
-            _emitDrop("retry-exhausted", batch, e);
-            break;
-          }
-        }
-      } finally {
-        inFlight = false;
-        inFlightPromise = null;
-        if (buffer.length > 0) flushScheduler.schedule();
-      }
-    })();
-    return inFlightPromise;
+  // CloudWatch rejects any single event above its 256 KiB hard cap — drop it
+  // (with a truncated preview) before it can poison a batch; otherwise build
+  // the { timestamp, message } event the API expects.
+  function _prepareRecord(record) {
+    var message = typeof record.message === "string" ? record.message : JSON.stringify(record);
+    var size = _eventByteSize(message);
+    if (size > CW_MAX_EVENT_BYTES) {
+      return {
+        rejected: true,
+        reason:   "event too large",
+        dropKind: "event-too-large",
+        drop: [{
+          timestamp: record.ts || Date.now(),
+          message:   message.slice(0, DROP_PREVIEW_BYTES) + "...[truncated for drop event]",
+        }],
+        error: new Error("event exceeds 256 KiB CloudWatch hard cap (was " + size + " bytes)"),
+      };
+    }
+    return { entry: { timestamp: record.ts || Date.now(), message: message } };
   }
 
   async function _send(batch) {
@@ -306,70 +275,33 @@ function create(config) {
     return res;
   }
 
-  function emit(record) {
-    if (closed) return Promise.resolve({ accepted: false, reason: "sink closed" });
-    var message;
-    if (typeof record.message === "string") {
-      message = record.message;
-    } else {
-      message = JSON.stringify(record);
-    }
-    var size = _eventByteSize(message);
-    if (size > CW_MAX_EVENT_BYTES) {
-      _emitDrop("event-too-large", [{
-        timestamp: record.ts || Date.now(),
-        message:   message.slice(0, DROP_PREVIEW_BYTES) + "...[truncated for drop event]",
-      }], new Error("event exceeds 256 KiB CloudWatch hard cap (was " + size + " bytes)"));
-      dropCount += 1;
-      return Promise.resolve({ accepted: false, reason: "event too large" });
-    }
-    if (buffer.length >= cfg.bufferLimit) {
-      var dropped = buffer.shift();
-      dropCount += 1;
-      _emitDrop("overflow", [dropped], null);
-    }
-    buffer.push({
-      timestamp: record.ts || Date.now(),
-      message:   message,
-    });
-    if (buffer.length >= cfg.batchSize) {
-      _flush().catch(function () {});
-    } else {
-      flushScheduler.schedule();
-    }
-    return Promise.resolve({ accepted: true, queued: buffer.length });
-  }
-
-  async function close() {
-    // Drain BEFORE flipping closed=true — _flush()'s `while (... && !closed)`
-    // loop bails on !closed, so flipping the flag first strands the records the
-    // operator queued just before shutdown (the b.logStream drain contract).
-    // Stop the timer, await any in-flight drain, drain the remainder, THEN
-    // refuse new enqueues. Mirrors the webhook sink.
-    flushScheduler.cancel();
-    if (inFlightPromise) {
-      try { await inFlightPromise; } catch (_e) { /* surfaced via onDrop */ }
-    }
-    await _flush();
-    closed = true;
-  }
-
-  function stats() {
-    return {
-      queued:        buffer.length,
-      dropped:       dropCount,
-      inFlight:      inFlight,
-      sequenceToken: sequenceToken,
-      endpoint:      _resolveEndpoint(cfg),
-    };
-  }
+  // beforeDrain runs the autoCreate handshake once; its failure is permanent
+  // (every batch would hit the same error) so the whole buffer is dropped under
+  // "autocreate-failed". takeBatch enforces CloudWatch's per-batch byte + count
+  // caps; sendBatch wraps the signed PutLogEvents in retry, treating throttling
+  // / sequence-token errors per _isPermanentAwsError.
+  var sink = safeAsync.makeBatchingSink({
+    batchSize:           cfg.batchSize,
+    bufferLimit:         cfg.bufferLimit,
+    maxBatchAgeMs:       cfg.maxBatchAgeMs,
+    onDrop:              cfg.onDrop,
+    prepareRecord:       _prepareRecord,
+    takeBatch:           _takeBatch,
+    beforeDrain:         _ensureAutoCreated,
+    beforeDrainDropKind: "autocreate-failed",
+    sendBatch:           function (batch) {
+      return retryHelper.withRetry(function () {
+        return _send(batch);
+      }, Object.assign({ isPermanent: _isPermanentAwsError }, cfg.retry || {}));
+    },
+  });
 
   return {
     protocol: "cloudwatch",
-    emit:     emit,
-    close:    close,
-    stats:    stats,
-    flush:    _flush,
+    emit:     sink.emit,
+    close:    sink.close,
+    stats:    function () { return sink.stats({ sequenceToken: sequenceToken, endpoint: _resolveEndpoint(cfg) }); },
+    flush:    sink.flush,
   };
 }
 

package/lib/vendor/blamejs/lib/log-stream-otlp-grpc.js

@@ -223,7 +223,10 @@ function _makeClient(cfg) {
     // (http://, cleartext HTTP/2) there is no certificate to validate and
     // nothing to skip, so neither rejectUnauthorized nor the insecure-TLS
     // audit applies — emitting it there would be a false security event.
-    sessionOpts.rejectUnauthorized = false;
+    // Operator-governed (not a hardcoded literal): cfg.allowInsecure is true in
+    // this branch, so this resolves to false — but derived from the operator's
+    // own flag, audited, and never a framework default.
+    sessionOpts.rejectUnauthorized = !cfg.allowInsecure;
     networkTls().auditInsecureTls({ host: authority, source: "log-stream.otlp-grpc" });
   }
   var session = http2.connect(authority, sessionOpts);
@@ -357,24 +360,24 @@ function create(config) {
     }
   }
 
+  // Fire-and-forget enqueue: full batch drains immediately (not awaited —
+  // emit is hot-path), partial batch coalesces via the scheduler. Errors
+  // surface through onDrop. No dropCount here — gRPC drop accounting is the
+  // export stream's concern, not the buffer's.
+  var _enqueue = safeAsync.makeBufferedEnqueue(buffer, {
+    batchSize:   cfg.batchSize,
+    bufferLimit: cfg.bufferLimit,
+    flush:       _flush,
+    schedule:    flushScheduler.schedule,
+    onOverflow:  function (dropped) { _emitDrop("overflow", [dropped], null); },
+  });
+
   function emit(record) {
     if (closed) {
       _emitDrop("sink-closed", [record], null);
       return Promise.resolve({ accepted: false, reason: "closed" });
     }
-    if (buffer.length >= cfg.bufferLimit) {
-      var dropped = buffer.shift();
-      _emitDrop("overflow", [dropped], null);
-    }
-    buffer.push(record);
-    if (buffer.length >= cfg.batchSize) {
-      // Drain immediately; don't await — emit is fire-and-forget on the
-      // hot path. Errors surface via onDrop.
-      _flush().catch(function () {});
-    } else if (!closed) {
-      flushScheduler.schedule();
-    }
-    return Promise.resolve({ accepted: true, queued: buffer.length });
+    return _enqueue(record);
   }
 
   async function close() {

package/lib/vendor/blamejs/lib/log-stream-otlp.js

@@ -212,89 +212,25 @@ function create(config) {
     "Content-Type": "application/json",
     "Accept":       "application/json",
   }, _authHeaders(cfg));
-  var onDrop = typeof cfg.onDrop === "function" ? cfg.onDrop : null;
-  var _emitDrop = safeAsync.makeDropCallback(onDrop);
-  var buffer = [];
-  var dropCount = 0;
-  var inFlight = false;
-  var closed = false;
-  // Captures the in-flight drain so close() awaits the real run before flipping
-  // `closed` (the _flush while-loop bails on !closed → flipping first strands
-  // buffered records at shutdown).
-  var inFlightPromise = null;
-  var flushScheduler = safeAsync.makeScheduledFlush(cfg.maxBatchAgeMs, function () { return _flush(); });
-
-  async function _flush() {
-    if (inFlight) return inFlightPromise;
-    if (buffer.length === 0) return;
-    inFlight = true;
-    inFlightPromise = (async function () {
-      try {
-        while (buffer.length > 0 && !closed) {
-          var batch = buffer.splice(0, cfg.batchSize);
-          var body = _serializeBatch(batch, cfg, scopeVersion);
-          try {
-            await retryHelper.withRetry(function () {
-              return _post(resolvedUrl, body, headers, cfg.timeoutMs, cfg.allowedProtocols, cfg.allowInternal);
-            }, cfg.retry);
-          } catch (e) {
-            dropCount += batch.length;
-            _emitDrop("retry-exhausted", batch, e);
-            break;
-          }
-        }
-      } finally {
-        inFlight = false;
-        inFlightPromise = null;
-        if (buffer.length > 0) flushScheduler.schedule();
-      }
-    })();
-    return inFlightPromise;
-  }
-
-  function emit(record) {
-    if (closed) return Promise.resolve({ accepted: false, reason: "sink closed" });
-    if (buffer.length >= cfg.bufferLimit) {
-      var dropped = buffer.shift();
-      dropCount += 1;
-      _emitDrop("overflow", [dropped], null);
-    }
-    buffer.push(record);
-    if (buffer.length >= cfg.batchSize) {
-      _flush().catch(function () {});
-    } else {
-      flushScheduler.schedule();
-    }
-    return Promise.resolve({ accepted: true, queued: buffer.length });
-  }
-
-  async function close() {
-    // Drain BEFORE flipping closed=true (see _flush's `&& !closed` guard) so
-    // records queued just before shutdown reach the wire. Mirrors the webhook
-    // + cloudwatch sinks.
-    flushScheduler.cancel();
-    if (inFlightPromise) {
-      try { await inFlightPromise; } catch (_e) { /* surfaced via onDrop */ }
-    }
-    await _flush();
-    closed = true;
-  }
-
-  function stats() {
-    return {
-      queued:   buffer.length,
-      dropped:  dropCount,
-      inFlight: inFlight,
-      url:      resolvedUrl,
-    };
-  }
+  var sink = safeAsync.makeBatchingSink({
+    batchSize:     cfg.batchSize,
+    bufferLimit:   cfg.bufferLimit,
+    maxBatchAgeMs: cfg.maxBatchAgeMs,
+    onDrop:        cfg.onDrop,
+    sendBatch:     function (batch) {
+      var body = _serializeBatch(batch, cfg, scopeVersion);
+      return retryHelper.withRetry(function () {
+        return _post(resolvedUrl, body, headers, cfg.timeoutMs, cfg.allowedProtocols, cfg.allowInternal);
+      }, cfg.retry);
+    },
+  });
 
   return {
     protocol: "otlp",
-    emit:     emit,
-    close:    close,
-    stats:    stats,
-    flush:    _flush,
+    emit:     sink.emit,
+    close:    sink.close,
+    stats:    function () { return sink.stats({ url: resolvedUrl }); },
+    flush:    sink.flush,
   };
 }
 

package/lib/vendor/blamejs/lib/log-stream-webhook.js

@@ -98,101 +98,29 @@ function create(config) {
     errorClass:       LogStreamError,
   });
   var headers = Object.assign({ "Content-Type": cfg.contentType }, _authHeaders(cfg));
-  // onDrop callback: invoked when a batch is dropped, either by buffer
-  // overflow ("overflow") or by retry exhaustion ("retry-exhausted").
-  // Operator wiring this directly (without the framework's dispatcher
-  // wrapping) needs visibility into permanent-drop events; the
-  // dispatcher path emits its own audit, but a sink used in isolation
-  // would otherwise lose drops silently. The callback is invoked
-  // best-effort — a throw inside it is swallowed.
-  var onDrop = typeof cfg.onDrop === "function" ? cfg.onDrop : null;
-  var _emitDrop = safeAsync.makeDropCallback(onDrop);
-  var buffer = [];
-  var dropCount = 0;
-  var inFlight = false;
-  var closed = false;
-  var flushScheduler = safeAsync.makeScheduledFlush(cfg.maxBatchAgeMs, function () { return _flush(); });
-
-  // Track the in-flight flush as a promise so close() can await it.
-  // Without this, a record arriving mid-flush gets buffered, the
-  // emit-time _flush() early-returns on `if (inFlight) return`, and
-  // the buffered record is stranded if shutdown fires before
-  // flushScheduler.schedule() drains it.
-  var inFlightPromise = null;
-  async function _flush() {
-    if (inFlight) return inFlightPromise;
-    if (buffer.length === 0) return;
-    inFlight = true;
-    inFlightPromise = (async function () {
-      try {
-        while (buffer.length > 0 && !closed) {
-          var batch = buffer.splice(0, cfg.batchSize);
-          var body = _serializeBatch(batch, cfg.bodyShape);
-          try {
-            await retryHelper.withRetry(function () {
-              return _post(cfg.url, body, headers, cfg.timeoutMs, cfg.allowedProtocols, cfg.allowInternal);
-            }, cfg.retry);
-          } catch (e) {
-            // Batch permanently rejected — surface via dropCount AND the
-            // operator-supplied onDrop callback. The dispatcher path
-            // wraps its own audit hook around emit(); operators using
-            // this sink directly rely on dropCount + onDrop.
-            dropCount += batch.length;
-            _emitDrop("retry-exhausted", batch, e);
-            break;
-          }
-        }
-      } finally {
-        inFlight = false;
-        inFlightPromise = null;
-        if (buffer.length > 0) flushScheduler.schedule();
-      }
-    })();
-    return inFlightPromise;
-  }
-
-  function emit(record) {
-    if (closed) return Promise.resolve({ accepted: false, reason: "sink closed" });
-    if (buffer.length >= cfg.bufferLimit) {
-      var dropped = buffer.shift();   // drop oldest
-      dropCount += 1;
-      _emitDrop("overflow", [dropped], null);
-    }
-    buffer.push(record);
-    if (buffer.length >= cfg.batchSize) {
-      // Don't await — non-blocking flush. Caller's emit returns immediately.
-      _flush().catch(function () {});
-    } else {
-      flushScheduler.schedule();
-    }
-    return Promise.resolve({ accepted: true, queued: buffer.length });
-  }
-
-  async function close() {
-    // Drain BEFORE flipping closed=true. _flush()'s while loop bails on
-    // !closed, so flipping the flag first leaves any buffered records
-    // stranded — the very records the operator queued just before
-    // calling shutdown(). Order: stop the timer, await any in-flight
-    // flush so its records POST before we touch the buffer, drain
-    // anything still queued, THEN refuse new enqueues.
-    flushScheduler.cancel();
-    if (inFlightPromise) {
-      try { await inFlightPromise; } catch (_e) { /* surfaced via onDrop */ }
-    }
-    await _flush();
-    closed = true;
-  }
-
-  function stats() {
-    return { queued: buffer.length, dropped: dropCount, inFlight: inFlight };
-  }
+  // A batch permanently rejected by retry surfaces via dropCount AND the
+  // operator-supplied onDrop — the dispatcher wraps its own audit around
+  // emit(), but a sink wired directly (or by buffer overflow) would otherwise
+  // lose drops silently. onDrop is best-effort; a throw inside it is swallowed.
+  var sink = safeAsync.makeBatchingSink({
+    batchSize:     cfg.batchSize,
+    bufferLimit:   cfg.bufferLimit,
+    maxBatchAgeMs: cfg.maxBatchAgeMs,
+    onDrop:        cfg.onDrop,
+    sendBatch:     function (batch) {
+      var body = _serializeBatch(batch, cfg.bodyShape);
+      return retryHelper.withRetry(function () {
+        return _post(cfg.url, body, headers, cfg.timeoutMs, cfg.allowedProtocols, cfg.allowInternal);
+      }, cfg.retry);
+    },
+  });
 
   return {
     protocol:  "webhook",
-    emit:      emit,
-    close:     close,
-    stats:     stats,
-    flush:     _flush,
+    emit:      sink.emit,
+    close:     sink.close,
+    stats:     sink.stats,
+    flush:     sink.flush,
   };
 }
 

package/lib/vendor/blamejs/lib/mail-arc-sign.js

@@ -103,9 +103,9 @@ function _parseHeaderBlock(headerBlock) {
 }
 
 function _canonRelaxedHeader(name, value) {
-  var unfolded = String(value).replace(/\r?\n[ \t]+/g, " ");                // allow:duplicate-regex — DKIM/ARC RFC 6376 §3.4.2 unfolding
-  var trimmed = unfolded.replace(/[ \t]+/g, " ").replace(/^[ \t]+|[ \t]+$/g, "");  // allow:duplicate-regex — DKIM/ARC RFC 6376 §3.4.2 WSP collapse
-  return name.toLowerCase() + ":" + trimmed + "\r\n";
+  // RFC 6376 §3.4.2 relaxed header canon — shared with the DKIM signer/verifier
+  // so an ARC chain produces a byte-identical canon (RFC 8617 §5.1.1).
+  return dkim.canonHeaderRelaxed(name, value);
 }
 
 // RFC 8617 §5.1.1 references RFC 6376 §3.4.4 for body canonicalization.
@@ -414,4 +414,9 @@ module.exports = {
   ALLOWED_ALGORITHMS: ALLOWED_ALGORITHMS,
   DEFAULT_HEADERS: DEFAULT_HEADERS,
   MailAuthError:  MailAuthError,
+  // The canon-source header parser, exposed so a golden-vector test can pin its
+  // byte-exact extraction. Like DKIM's, a sign->verify round-trip cannot catch
+  // a byte-error here (self-consistent); the AMS/AS signatures fed to a real
+  // ARC verifier would silently fail instead.
+  _parseHeaderBlockForTest: _parseHeaderBlock,
 };

package/lib/vendor/blamejs/lib/mail-arf.js

@@ -40,6 +40,7 @@
 var lazyRequire   = require("./lazy-require");
 var mimeParse     = require("./mime-parse");
 var C             = require("./constants");
+var safeBuffer    = require("./safe-buffer");
 var { MailArfError } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
@@ -138,10 +139,10 @@ function parse(rawMessage, opts) {
     ? rawMessage.toString("utf8")
     : rawMessage;
 
-  if (asString.length > maxBytes) {
+  if (safeBuffer.byteLengthOf(asString) > maxBytes) {
     _emitMalformed(auditOn, "report exceeds maxBytes");
     throw new MailArfError("mailarf/parse-failed",
-      "mailArf.parse: report exceeds " + maxBytes + " bytes (got " + asString.length + ")");
+      "mailArf.parse: report exceeds " + maxBytes + " bytes (got " + safeBuffer.byteLengthOf(asString) + ")");
   }
 
   // 1. Bisect headers / body, parse Content-Type for boundary.