@blamejs/core 0.12.22 → 0.12.23

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.12.x
 
+- v0.12.23 (2026-05-24) — **`bundleAdapterStorage.cloneBundle(src, dst, opts?)` — same-storage byte-verbatim bundle clone for pre-rotation snapshots.** `storage.cloneBundle(srcBundleId, dstBundleId, opts?)` copies a bundle's adapter payload (bundle.tar / bundle.tar.gz / every directory key) from src to dst WITHOUT touching the envelope or inner archive. Encrypted bundles are cloned byte-verbatim — the new bundleId carries the same envelope under the same recipient/passphrase. Operators preserving a known-good snapshot before a destructive operation (rewrap, key rotation, schema migration, manual operator-side editing) get a single-call atomic clone instead of a manual readBundle → writeBundle cycle (which would re-encode through the envelope and adapter contracts, breaking byte-identity). **Added:** *`storage.cloneBundle(src, dst, opts?)` — byte-verbatim payload clone* — Reads the source bundle's storage keys + writes them under the destination bundleId without invoking the wrap layer, gunzip path, or tar walker. Encrypted bundles produce byte-identical clones (a tar.gz wrap-recipient envelope cloned via cloneBundle has bit-for-bit equal bytes to the source). Returns `{ srcBundleId, dstBundleId, format, keysCopied, bytesCopied }`. `opts.overwrite` (default false) gates whether to refuse if dstBundleId already exists. Same-id clones refused upfront with `backup/clone-same-id`.
+
 - v0.12.22 (2026-05-24) — **`bundleAdapterStorage.rewrapAllBundles(opts)` — bounded-parallel batch envelope rotation with mixed-storage skip semantics.** Batch wrapper over the v0.12.21 rewrapBundle primitive. `storage.rewrapAllBundles(opts?)` iterates `listBundles()` + rotates each bundle's wrap envelope through a bounded-parallel pool (default 4 workers). Plaintext bundles + directory-format bundles get skipped cleanly (recorded as `status: "skipped"` with a `reason` field); rewrap failures get bucketed into `status: "failed"`. Operators completing a key-rotation event across an entire backup repository now have a single call that handles mixed-strategy storage correctly. `opts.newRecipient` / `opts.newPassphrase` / `opts.oldRecipient` / `opts.oldPassphrase` / `opts.concurrency` / `opts.stopOnFirstFailure` mirror the verifyAllBundles + rewrapBundle surface. **Added:** *`storage.rewrapAllBundles(opts?)` — batch envelope rotation* — Iterates listBundles() + dispatches each bundle through rewrapBundle with the operator-supplied new key. Returns `{ total, rotated, skipped, failed, results }` where the per-bundle results carry `{ status: "rotated" | "skipped" | "failed", oldEnvelopeKind, newEnvelopeKind, reason }`. Bounded-parallel fan-out (default 4) keeps the storage backend under control; opts.stopOnFirstFailure short-circuits on the first rotation that throws an unexpected error (skips don't trip the short-circuit — they're expected for mixed-strategy storage). Plaintext + directory bundles skipped with `reason: "format-not-wrappable"` / `reason: "no-envelope"` rather than reported as failures.
 
 - v0.12.21 (2026-05-24) — **`bundleAdapterStorage.rewrapBundle(bundleId, opts)` — key rotation without restore + rewrite of inner archive bytes.** `storage.rewrapBundle(bundleId, opts?)` rotates a bundle's wrap envelope under a new recipient keypair or passphrase WITHOUT touching the inner tar / tar.gz bytes. Operators rotating a compromised keypair, migrating to a new HSM, or refreshing passphrases on a HIPAA-posture repository previously had to `readBundle` → write to a stage dir → `writeBundle` under the new key — three byte-walks of the bundle payload, two filesystem touches, transient plaintext on disk. rewrapBundle does it as unwrap + rewrap in memory: zero disk plaintext, one round-trip through the wrap layer, the gzipped tar archive bytes inside the envelope are never inflated. Cross-kind rotation (recipient ↔ passphrase) is refused — that's a separate migration the operator configures with explicit cryptoStrategy switch. **Added:** *`storage.rewrapBundle(bundleId, opts?)` — in-place envelope rotation* — Unwraps the bundle under the old key (storage's configured recipient/passphrase OR `opts.oldRecipient` / `opts.oldPassphrase`), re-wraps under the new key (`opts.newRecipient` / `opts.newPassphrase`), writes the rewrapped bytes back to the same storage key. Returns `{ bundleId, oldEnvelopeKind, newEnvelopeKind, bytesRewritten }`. Plaintext bundles refused with `backup/no-envelope-to-rewrap`; cross-kind rotation refused with `backup/no-new-recipient` / `backup/no-new-passphrase`. The inner archive bytes (the gz-compressed tar payload) are never decompressed or re-encoded — rewrap is a wrap-layer-only operation. **Security:** *Zero plaintext on disk during rotation* — The inner tar bytes flow only through memory — old-envelope unwrap → new-envelope wrap → adapter writeFile. Operators previously rotating via readBundle + writeBundle wrote plaintext archive bytes to a temporary stage directory; rewrapBundle removes that exposure window entirely. Matches the operator-side discipline that backup payloads should never land on disk in plaintext form during steady-state operations.

package/lib/backup/index.js

@@ -1541,6 +1541,80 @@ function bundleAdapterStorage(opts) {
     // bytesRewritten }`. Refuses cross-kind rotation (recipient ↔
     // passphrase) — that's a separate migration the operator
     // configures explicitly.
+    // cloneBundle(srcBundleId, dstBundleId, opts?) — v0.12.23
+    // same-storage bundle clone. Copies the bundle's adapter
+    // payload (bundle.tar / bundle.tar.gz / every directory key)
+    // from src to dst WITHOUT touching the envelope or inner
+    // archive. Useful before destructive operations (rewrap, key
+    // rotation, schema migration) to preserve a known-good
+    // snapshot under a distinct bundleId. opts.overwrite (default
+    // false) gates whether to refuse if dstBundleId already
+    // exists in storage.
+    //
+    // Returns `{ srcBundleId, dstBundleId, format, keysCopied,
+    // bytesCopied }`.
+    async cloneBundle(srcBundleId, dstBundleId, cloneOpts) {
+      cloneOpts = cloneOpts || {};
+      _ensureBundleId(srcBundleId);
+      _ensureBundleId(dstBundleId);
+      if (srcBundleId === dstBundleId) {
+        throw new BackupError("backup/clone-same-id",
+          "cloneBundle: srcBundleId === dstBundleId — refusing same-id clone");
+      }
+      var info = await this.bundleInfo(srcBundleId);
+      var dstAlreadyExists = await this.hasBundle(dstBundleId);
+      if (cloneOpts.overwrite !== true && dstAlreadyExists) {
+        throw new BackupError("backup/clone-dst-exists",
+          "cloneBundle: dstBundleId '" + dstBundleId + "' already exists; " +
+          "pass opts.overwrite=true to replace");
+      }
+      // Codex P1 on v0.12.23 PR #174 — when overwrite=true, the
+      // existence guard was the only protection but it didn't
+      // delete the destination's existing keys before writing
+      // the source keys. Stale-format bundles (dst=tar, src=
+      // directory) ended up with BOTH the old tar key and the
+      // new directory keys present — bundleInfo / readBundle
+      // would resolve to the (still-existing) tar payload,
+      // disagreeing with the reported clone result. Same applies
+      // for directory→directory clones where the destination
+      // had extra files not in source.
+      //
+      // Fix: when overwrite is enabled + the destination
+      // already exists, call deleteBundle(dst) first to purge
+      // every key under the destination's prefix so clone
+      // semantics are actually replace-bytes.
+      if (dstAlreadyExists && cloneOpts.overwrite === true) {
+        await this.deleteBundle(dstBundleId);
+      }
+      var keysCopied = 0;
+      var bytesCopied = 0;
+      if (info.format === "tar" || info.format === "tar.gz") {
+        var suffix = info.format === "tar.gz" ? TAR_GZ_KEY_SUFFIX : TAR_KEY_SUFFIX;
+        var payload = await adapter.readFile(srcBundleId + suffix);
+        await adapter.writeFile(dstBundleId + suffix, payload);
+        keysCopied += 1;
+        bytesCopied += payload.length;
+      } else {
+        // Directory format — walk every key under the source
+        // bundleId + replicate under the destination prefix.
+        var srcKeys = await adapter.listKeys(srcBundleId + "/");
+        for (var ki = 0; ki < srcKeys.length; ki += 1) {
+          var srcKey = srcKeys[ki];
+          var rel = srcKey.slice((srcBundleId + "/").length);
+          var keyBytes = await adapter.readFile(srcKey);
+          await adapter.writeFile(dstBundleId + "/" + rel, keyBytes);
+          keysCopied += 1;
+          bytesCopied += keyBytes.length;
+        }
+      }
+      return {
+        srcBundleId:  srcBundleId,
+        dstBundleId:  dstBundleId,
+        format:       info.format,
+        keysCopied:   keysCopied,
+        bytesCopied:  bytesCopied,
+      };
+    },
     async rewrapBundle(bundleId, rwOpts) {
       rwOpts = rwOpts || {};
       _ensureBundleId(bundleId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.12.22",
+  "version": "0.12.23",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:aa0703c8-0954-482c-af7e-d813018096cf",
+  "serialNumber": "urn:uuid:913ec1d4-c11d-49fe-922b-3738c93f2aad",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-24T08:01:37.093Z",
+    "timestamp": "2026-05-24T08:56:20.519Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.12.22",
+      "bom-ref": "@blamejs/core@0.12.23",
       "type": "application",
       "name": "blamejs",
-      "version": "0.12.22",
+      "version": "0.12.23",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.12.22",
+      "purl": "pkg:npm/%40blamejs/core@0.12.23",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.12.22",
+      "ref": "@blamejs/core@0.12.23",
       "dependsOn": []
     }
   ]