@blamejs/core 0.12.62 → 0.12.64

package/lib/jtd.js

@@ -29,6 +29,7 @@
  */
 
 var { defineClass } = require("./framework-error");
+var rfc3339 = require("./rfc3339");
 
 var JtdError = defineClass("JtdError", { alwaysPermanent: true });
 
@@ -48,21 +49,9 @@ var SHARED_KEYWORDS = { definitions: 1, nullable: 1, metadata: 1 };
 function _isPlainObject(v) { return v !== null && typeof v === "object" && !Array.isArray(v); }
 function _isInteger(v) { return typeof v === "number" && isFinite(v) && Math.floor(v) === v; }
 
-// RFC 3339 date-time (the JTD "timestamp" type).
-var RFC3339 = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
-function _validTimestamp(s) {
-  var m = RFC3339.exec(s);
-  if (!m) return false;
-  var mo = +m[2], d = +m[3], h = +m[4], mi = +m[5], se = +m[6];
-  if (mo < 1 || mo > 12 || d < 1 || d > 31 || h > 23 || mi > 59 || se > 60) return false;   // allow:raw-time-literal — RFC 3339 field ranges (60 = leap second)
-  var days = [31, ((+m[1] % 4 === 0 && +m[1] % 100 !== 0) || +m[1] % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];   // allow:raw-time-literal — days per month
-  if (d > days[mo - 1]) return false;
-  var tz = m[8];
-  if (tz !== "Z" && tz !== "z") {                            // numeric offset must be in range
-    if (+tz.slice(1, 3) > 23 || +tz.slice(4, 6) > 59) return false;   // allow:raw-time-literal — RFC 3339 offset hour/minute ranges
-  }
-  return true;
-}
+// RFC 3339 date-time (the JTD "timestamp" type) — strict form shared with
+// the other spec-driven consumers via lib/rfc3339.js.
+var _validTimestamp = rfc3339.isValidDateTime;
 
 // --- compile-time well-formedness (RFC 8927 section 2.2) ---
 function _checkSchema(schema, root, isRoot) {

package/lib/rfc3339.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * rfc3339 — strict RFC 3339 date-time validation, shared by the primitives
+ * whose specs require the full "internet date/time" form (a mandatory
+ * "T"/"t" separator and a mandatory "Z" or numeric UTC offset). b.jtd's
+ * `timestamp` type and b.cloudevents' `time` attribute both point at
+ * RFC 3339, so the field-range + leap-year + offset-range checks live here
+ * once instead of drifting between them.
+ *
+ * This is intentionally NOT the lenient validator b.guardTime ships: that
+ * one accepts a space separator and an absent offset by design (a content-
+ * safety guard tuned per profile), whereas these consumers must reject
+ * anything the spec disallows.
+ *
+ *   var rfc3339 = require("./rfc3339");
+ *   rfc3339.isValidDateTime("2018-04-05T17:31:00Z");   // → true
+ */
+
+// "T" separator required; offset ("Z"/"z" or ±HH:MM) required.
+var RFC3339_RE = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
+
+function isValidDateTime(s) {
+  if (typeof s !== "string") return false;
+  var m = RFC3339_RE.exec(s);
+  if (!m) return false;
+  var mo = +m[2], d = +m[3], h = +m[4], mi = +m[5], se = +m[6];
+  if (mo < 1 || mo > 12 || d < 1 || d > 31 || h > 23 || mi > 59 || se > 60) return false;   // allow:raw-time-literal — RFC 3339 field ranges (60 = leap second)
+  var days = [31, ((+m[1] % 4 === 0 && +m[1] % 100 !== 0) || +m[1] % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];   // allow:raw-time-literal — days per month (Gregorian)
+  if (d > days[mo - 1]) return false;
+  var tz = m[8];
+  if (tz !== "Z" && tz !== "z") {
+    if (+tz.slice(1, 3) > 23 || +tz.slice(4, 6) > 59) return false;   // allow:raw-time-literal — RFC 3339 offset hour/minute ranges
+  }
+  return true;
+}
+
+module.exports = { isValidDateTime: isValidDateTime, RFC3339_RE: RFC3339_RE };

package/lib/safe-buffer.js

@@ -372,6 +372,13 @@ var HEX_RE = /^[0-9a-fA-F]+$/;
 // is length-agnostic — callers cap length per protocol contract.
 var BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
 
+// BASE64_RE matches standard base64 (RFC 4648 §4) with the `+` / `/`
+// alphabet and canonical 0-2 chars of `=` padding (empty string allowed).
+// Shared by callers that validate padded base64 fields (backup manifest
+// digests, CloudEvents data_base64) so the alphabet check isn't reinvented.
+// Length-agnostic — callers cap length per their own contract / maxBytes.
+var BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+
 // Fixed-length hex predicates used by trace-context primitives (W3C
 // trace-id is 16 bytes = 32 hex chars; span-id / parent-id is 8
 // bytes = 16 hex chars). Extracted to keep callers length-bounded
@@ -552,6 +559,7 @@ module.exports = {
   stripTrailingHspace:   stripTrailingHspace,
   HEX_RE:                HEX_RE,
   BASE64URL_RE:          BASE64URL_RE,
+  BASE64_RE:             BASE64_RE,
   IPV6_HEXTET_RE:        IPV6_HEXTET_RE,
   TRACE_ID_HEX_RE:       TRACE_ID_HEX_RE,
   SPAN_ID_HEX_RE:        SPAN_ID_HEX_RE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.12.62",
+  "version": "0.12.64",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f56710ee-2e4e-4c8e-af88-80f79561870e",
+  "serialNumber": "urn:uuid:35a8fec8-fa70-4913-a315-c839ce432741",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-26T03:54:31.896Z",
+    "timestamp": "2026-05-26T07:36:53.769Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.12.62",
+      "bom-ref": "@blamejs/core@0.12.64",
       "type": "application",
       "name": "blamejs",
-      "version": "0.12.62",
+      "version": "0.12.64",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.12.62",
+      "purl": "pkg:npm/%40blamejs/core@0.12.64",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.12.62",
+      "ref": "@blamejs/core@0.12.64",
       "dependsOn": []
     }
   ]