@blamejs/core 0.15.10 → 0.15.12

package/lib/notify.js

@@ -408,11 +408,6 @@ function create(opts) {
     channels[n] = registry;
   }
 
-  function _emitObs(name, labels) {
-    try { observability().event(name, 1, labels || {}); }
-    catch (_e) { /* drop-silent — observability sink must not crash send() */ }
-  }
-
   var _emitAudit = validateOpts.makeAuditEmitter(audit);
 
   function _actor(callerOpts) {
@@ -465,7 +460,7 @@ function create(opts) {
     // mechanism — no double-retry inside the breaker or transport).
     async function _oneAttempt(attemptIdx) {
       attemptCount = attemptIdx;
-      _emitObs("notify.send.attempt", { channel: channel, attempt: attemptIdx });
+      observability().safeEvent("notify.send.attempt", 1, { channel: channel, attempt: attemptIdx });
       var sendPromise = entry.transport.send(message, input.sendOpts || null);
       // withTimeout from b.safeAsync — never re-implement timer races.
       var timed = (perCallTimeoutMs > 0)
@@ -478,7 +473,7 @@ function create(opts) {
         // classifies it correctly (operators can still opt OUT by setting
         // err.permanent in their transport).
         if (e && e.code === "async/timeout") {
-          _emitObs("notify.send.timeout", { channel: channel });
+          observability().safeEvent("notify.send.timeout", 1, { channel: channel });
           var te = _err("TIMEOUT",
             "notify.send: '" + channel + "' transport timed out after " + perCallTimeoutMs + "ms");
           // Mark transient via a NETWORK-style code so b.retry.isRetryable
@@ -497,7 +492,7 @@ function create(opts) {
           return await entry.breaker.wrap(function () { return _oneAttempt(attemptIdx); });
         } catch (e) {
           if (e && e.code === "CIRCUIT_OPEN") {
-            _emitObs("notify.send.breaker.open", { channel: channel });
+            observability().safeEvent("notify.send.breaker.open", 1, { channel: channel });
           }
           throw e;
         }
@@ -524,7 +519,7 @@ function create(opts) {
         }, perCallRetry);
 
         var durationMs = clock() - startedAt;
-        _emitObs("notify.send.success", { channel: channel, durationMs: durationMs });
+        observability().safeEvent("notify.send.success", 1, { channel: channel, durationMs: durationMs });
         if (auditSuccess) {
           _emitAudit("notify.send.success", {
             actor:    _actor(input),
@@ -543,7 +538,7 @@ function create(opts) {
           durationMs: durationMs,
         });
       } catch (e) {
-        _emitObs("notify.send.failure", {
+        observability().safeEvent("notify.send.failure", 1, {
           channel: channel,
           reason:  (e && e.code) || "unknown",
         });
@@ -594,7 +589,7 @@ function create(opts) {
       if (results[i] && results[i].isNotifyError) failed++;
       else ok++;
     }
-    _emitObs("notify.batch", { size: inputs.length, ok: ok, failed: failed });
+    observability().safeEvent("notify.batch", 1, { size: inputs.length, ok: ok, failed: failed });
     return results;
   }
 
@@ -626,7 +621,7 @@ function create(opts) {
       } catch (_e) { /* operator may register their own handler */ }
     }
     var jobId = await q.enqueue(queueName, input);
-    _emitObs("notify.queue.enqueued", { channel: input.channel, queueName: queueName });
+    observability().safeEvent("notify.queue.enqueued", 1, { channel: input.channel, queueName: queueName });
     return { jobId: jobId };
   }
 

package/lib/parsers/safe-env.js

@@ -147,7 +147,7 @@ function parse(input, opts) {
     if (eqIdx < 0) {
       throw new SafeEnvError("missing '=' separator", "env/bad-line", lineNumber);
     }
-    var key = trimmed.substring(0, eqIdx).replace(safeBuffer.TRAILING_HSPACE_RE, "");
+    var key = safeBuffer.stripTrailingHspace(trimmed.substring(0, eqIdx));
     var rest = trimmed.substring(eqIdx + 1);
 
     if (key.length === 0) {
@@ -186,10 +186,13 @@ function parse(input, opts) {
       // The comment marker MUST be preceded by whitespace to count
       // (so a value like `KEY=color#red` keeps the literal `#`).
       var commentMatch = rest.match(/^([^\s#]*(?:[ \t]+[^#\s]+)*)\s+#.*$/);
+      // stripTrailingHspace is a linear char-scan; .replace(/[ \t]+$/) is O(n^2)
+      // in V8 and the env parser only caps TOTAL bytes, not per-line, so a
+      // single huge-whitespace value line would otherwise hang the parser.
       if (commentMatch) {
-        value = commentMatch[1].replace(safeBuffer.TRAILING_HSPACE_RE, "");
+        value = safeBuffer.stripTrailingHspace(commentMatch[1]);
       } else {
-        value = rest.replace(safeBuffer.TRAILING_HSPACE_RE, "");
+        value = safeBuffer.stripTrailingHspace(rest);
       }
       // Reject `$VAR` style references — explicit error so operators
       // see the policy rather than silently getting unexpanded text.

package/lib/parsers/safe-yaml.js

@@ -185,7 +185,7 @@ function parse(input, opts) {
     var raw = rawLines[i];
     // Strip trailing whitespace from the line for analysis (block-scalar
     // content paths preserve their own internal spacing separately).
-    var trimmed = raw.replace(safeBuffer.TRAILING_HSPACE_RE, "");
+    var trimmed = safeBuffer.stripTrailingHspace(raw);
     var indent = 0;
     while (indent < raw.length && raw.charAt(indent) === " ") indent += 1;
     if (indent < raw.length && raw.charAt(indent) === "\t") {
@@ -332,7 +332,7 @@ function parse(input, opts) {
     if (raw.charAt(0) === "'") {
       return _decodeSingleQuoted(raw, lineNumber, col);
     }
-    var trimmed = raw.replace(safeBuffer.TRAILING_HSPACE_RE, "");
+    var trimmed = safeBuffer.stripTrailingHspace(raw);
     if (POISONED_KEYS.has(trimmed)) {
       throw new SafeYamlError("forbidden key '" + trimmed + "'",
         "yaml/poisoned-key", lineNumber, col);
@@ -506,7 +506,7 @@ function parse(input, opts) {
       return sq;
     }
     // Plain scalar — strip trailing space, resolve type.
-    return _resolveScalar(t.replace(safeBuffer.TRAILING_HSPACE_RE, ""));
+    return _resolveScalar(safeBuffer.stripTrailingHspace(t));
   }
 
   // For quoted-string termination check on a single-line value.
@@ -622,7 +622,7 @@ function parse(input, opts) {
       if (c === "," || c === "}" || c === "]") break;
       p += 1;
     }
-    var raw = text.substring(start, p).replace(safeBuffer.TRAILING_HSPACE_RE, "");
+    var raw = safeBuffer.stripTrailingHspace(text.substring(start, p));
     return { value: _resolveScalar(raw), nextPos: p };
   }
 
@@ -645,7 +645,7 @@ function parse(input, opts) {
       if (c === ":" || c === "," || c === "}" || c === "]") break;
       p += 1;
     }
-    return { key: text.substring(start, p).replace(safeBuffer.TRAILING_HSPACE_RE, ""), nextPos: p };
+    return { key: safeBuffer.stripTrailingHspace(text.substring(start, p)), nextPos: p };
   }
 
   function _findMatchingBracket(text, start, open, close, lineNumber, col) {
@@ -772,7 +772,7 @@ function parse(input, opts) {
   function _stripEolComment(text) {
     // Strip ` #...` comments (must be preceded by whitespace) at end of line.
     var match = text.match(/^(.*?)(\s+#.*)?$/);
-    return (match && match[1] != null ? match[1] : text).replace(safeBuffer.TRAILING_HSPACE_RE, "");
+    return safeBuffer.stripTrailingHspace(match && match[1] != null ? match[1] : text);
   }
 
   // ---- Block scalars (| literal, > folded) ----

package/lib/safe-buffer.js

@@ -494,7 +494,74 @@ var TRAILING_HSPACE_RE = /[ \t]+$/;
  */
 function stripTrailingHspace(s) {
   if (typeof s !== "string") return s;
-  return s.replace(TRAILING_HSPACE_RE, "");
+  // Linear backward scan over trailing spaces/tabs — NOT s.replace(/[ \t]+$/).
+  // The `$`-after-greedy-`[ \t]+` regex is O(n^2) in V8 on adversarial input
+  // (a long run of spaces followed by a non-space: the engine retries the
+  // greedy match from every offset). normalizeText callers cap TOTAL bytes but
+  // not per-line, so a single ~500K-space value hangs (~85s). The char-scan is
+  // O(trailing-whitespace) and byte-identical to the regex on every input
+  // (JS `$` without /m matches only the absolute end, so a trailing \n is not
+  // stripped — the scan stops at it too).
+  var e = s.length;
+  while (e > 0) {
+    var c = s.charCodeAt(e - 1);
+    if (c === 0x20 || c === 0x09) { e -= 1; } else { break; }
+  }
+  return e === s.length ? s : s.slice(0, e);
+}
+
+/**
+ * @primitive b.safeBuffer.indexAfterOpenTag
+ * @signature b.safeBuffer.indexAfterOpenTag(html, tagName)
+ * @since     0.15.11
+ * @related   b.safeBuffer.stripTrailingHspace
+ *
+ * Find the offset in `html` just past the first `<tagName ...>` opening
+ * tag (case-insensitive), or `-1` when the tag is absent or unterminated.
+ * The insertion point a response rewriter uses to splice content right
+ * after `<body>` / `<head>` without a regex.
+ *
+ * This replaces the `html.match(/<body[^>]*>/i)` shape, which is O(n^2)
+ * in V8: a body carrying many `<body` starts with no closing `>` (e.g.
+ * rendered user content) makes the engine retry the greedy `[^>]*` from
+ * every offset — a `<body`-repeated 200K-char body benchmarks in
+ * seconds. This is a single forward `indexOf` walk: linear in the input,
+ * and stricter than the regex — it requires a real tag boundary after
+ * the name (whitespace, `>`, or `/`), so `<bodyfoo>` is not mistaken for
+ * `<body>`. Non-string input returns `-1`.
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   b.safeBuffer.indexAfterOpenTag("<html><body class=x>hi", "body");
+ *   // → 19  (just past the '>' of <body class=x>)
+ *
+ *   b.safeBuffer.indexAfterOpenTag("<p>no body here</p>", "body");
+ *   // → -1
+ */
+function indexAfterOpenTag(html, tagName) {
+  if (typeof html !== "string" || typeof tagName !== "string" || tagName.length === 0) return -1;
+  var needle = "<" + tagName.toLowerCase();
+  var nlen = needle.length;
+  // One O(n) lowercase pass keeps the case-insensitive search linear; the
+  // forward indexOf walk below never re-scans a region it has passed.
+  var lower = html.toLowerCase();
+  var from = 0;
+  for (;;) {
+    var lt = lower.indexOf(needle, from);
+    if (lt === -1) return -1;
+    var after = lt + nlen;
+    var boundary = after < html.length ? html.charCodeAt(after) : -1;
+    // The char after "<tag" must end the tag name — '>' (0x3e), '/' (0x2f),
+    // or ASCII whitespace — else this is a longer name like "<bodyfoo".
+    if (boundary === 0x3e || boundary === 0x2f ||
+        boundary === 0x20 || boundary === 0x09 ||
+        boundary === 0x0a || boundary === 0x0d || boundary === 0x0c) {
+      var gt = html.indexOf(">", after);
+      if (gt === -1) return -1;   // unterminated opening tag — no insertion point
+      return gt + 1;
+    }
+    from = lt + 1;
+  }
 }
 
 /**
@@ -612,6 +679,7 @@ module.exports = {
   hasCrlf:               hasCrlf,
   stripCrlf:             stripCrlf,
   stripTrailingHspace:   stripTrailingHspace,
+  indexAfterOpenTag:     indexAfterOpenTag,
   HEX_RE:                HEX_RE,
   BASE64URL_RE:          BASE64URL_RE,
   BASE64_RE:             BASE64_RE,

package/lib/seeders.js

@@ -438,11 +438,6 @@ function create(opts) {
   var audit = opts.audit || null;
   var clock = opts.clock || function () { return Date.now(); };
 
-  function _emitObs(name, labels) {
-    try { observability().event(name, 1, labels || {}); }
-    catch (_e) { /* drop-silent — observability sink must not crash seeders */ }
-  }
-
   var _emitAudit = validateOpts.makeAuditEmitter(audit);
 
   function _actor(callerOpts) {
@@ -512,7 +507,7 @@ function create(opts) {
     }
 
     var startedAt = clock();
-    _emitObs("seeders.run.start", { env: env, count: loaded.ordered.length });
+    observability().safeEvent("seeders.run.start", 1, { env: env, count: loaded.ordered.length });
 
     var holder = _acquireLock(db, lockStaleAfterMs, clock);
     try {
@@ -538,7 +533,7 @@ function create(opts) {
 
         if (!shouldRun) {
           skipped.push(name);
-          _emitObs("seeders.skipped", { env: env, name: name, reason: "already-applied" });
+          observability().safeEvent("seeders.skipped", 1, { env: env, name: name, reason: "already-applied" });
           continue;
         }
 
@@ -585,7 +580,7 @@ function create(opts) {
 
           var auditAction = (alreadyApplied && force) ? "seeders.force_applied" : "seeders.applied";
           var auditEvt = { env: env, name: name };
-          _emitObs(auditAction, auditEvt);
+          observability().safeEvent(auditAction, 1, auditEvt);
           if (auditApplied) {
             _emitAudit(auditAction, {
               actor:    _actor(callerOpts),
@@ -598,7 +593,7 @@ function create(opts) {
           failed = name;
           var msg = (e && e.message) || String(e);
           var code = (e && e.code) || "RUN_FAILED";
-          _emitObs("seeders.failed", { env: env, name: name });
+          observability().safeEvent("seeders.failed", 1, { env: env, name: name });
           if (auditFailures) {
             _emitAudit("seeders.failed", {
               actor:    _actor(callerOpts),
@@ -622,7 +617,7 @@ function create(opts) {
         failed:     failed,
         durationMs: clock() - startedAt,
       };
-      _emitObs("seeders.run.completed", {
+      observability().safeEvent("seeders.run.completed", 1, {
         env:        env,
         applied:    applied.length,
         skipped:    skipped.length,

package/lib/structured-fields.js

@@ -204,7 +204,43 @@ function unquoteSfString(s) {
   if (t.length === 0) return "";
   if (t.charAt(0) !== "\"") return t;
   if (t.length < 2 || t.charAt(t.length - 1) !== "\"") return null;
-  return t.slice(1, -1).replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
+  return unescapeSfStringBody(t.slice(1, -1));
+}
+
+/**
+ * @primitive b.structuredFields.unescapeSfStringBody
+ * @signature b.structuredFields.unescapeSfStringBody(body)
+ * @since      0.15.12
+ * @related    b.structuredFields.unquoteSfString
+ *
+ * Undo the RFC 8941 §3.3.3 quoted-string backslash-escapes from the BODY of
+ * an sf-string (the bytes BETWEEN the surrounding double quotes). Only `\\\\`
+ * and `\\"` are legal escapes; every other backslash is literal.
+ *
+ * This is a single left-to-right scan, NOT two chained `.replace()` passes.
+ * The two-pass form (`.replace(/\\\\/g,"\\").replace(/\\"/g,'"')`, in either
+ * order) is not equivalent to a single decode: whichever pass runs first can
+ * rewrite a backslash the other escape sequence legitimately owns, so a lone
+ * escaped backslash (`\\\\`) decodes to two backslashes instead of one. The
+ * single pass consumes each escape exactly once. Non-string input passes
+ * through unchanged.
+ *
+ * @example
+ *   b.structuredFields.unescapeSfStringBody('a\\"b\\\\c');
+ *   // → 'a"b\c'
+ */
+function unescapeSfStringBody(body) {
+  if (typeof body !== "string") return body;
+  var out = "";
+  for (var i = 0; i < body.length; i++) {
+    var c = body.charAt(i);
+    if (c === "\\" && i + 1 < body.length) {
+      var n = body.charAt(i + 1);
+      if (n === "\\" || n === "\"") { out += n; i += 1; continue; }
+    }
+    out += c;
+  }
+  return out;
 }
 
 /**
@@ -674,6 +710,7 @@ module.exports = {
   refuseControlBytes:   refuseControlBytes,
   containsControlBytes: containsControlBytes,
   unquoteSfString:      unquoteSfString,
+  unescapeSfStringBody: unescapeSfStringBody,
   parse:                parse,
   serialize:            serialize,
   Token:                SfToken,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.10",
+  "version": "0.15.12",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:67b3105d-f49c-44bd-bf4e-afbb994d35e2",
+  "serialNumber": "urn:uuid:caf34b84-1358-4d28-a517-e360819dc35a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-14T03:47:28.687Z",
+    "timestamp": "2026-06-14T16:52:10.733Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.10",
+      "bom-ref": "@blamejs/core@0.15.12",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.10",
+      "version": "0.15.12",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.10",
+      "purl": "pkg:npm/%40blamejs/core@0.15.12",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.10",
+      "ref": "@blamejs/core@0.15.12",
       "dependsOn": []
     }
   ]