@blamejs/core 0.15.11 → 0.15.13

package/lib/framework-error.js

@@ -144,6 +144,11 @@ var SchedulerError        = defineClass("SchedulerError");
 var SessionError          = defineClass("SessionError");
 var SlugError             = defineClass("SlugError",             { alwaysPermanent: true });
 var WebhookError          = defineClass("WebhookError",          { alwaysPermanent: true });
+// WebhookDispatcherError covers the durable signed-webhook delivery store
+// (b.webhook.dispatcher): endpoint registration, fan-out, retry/backoff, and
+// dead-letter operations. Distinct from WebhookError (the stateless
+// sign/verify surface) so the persistence-layer error codes stay separable.
+var WebhookDispatcherError = defineClass("WebhookDispatcherError", { alwaysPermanent: true });
 var ApiKeyError           = defineClass("ApiKeyError",           { alwaysPermanent: true });
 var PermissionsError      = defineClass("PermissionsError",      { alwaysPermanent: true });
 // CacheError is alwaysPermanent: bad opts / missing key / closed-state
@@ -196,6 +201,11 @@ var GateContractError     = defineClass("GateContractError",     { alwaysPermane
 // validate paths. alwaysPermanent — chunk-shape errors / formula-injection
 // attempts / schema drift are all caller-shape errors.
 var GuardCsvError         = defineClass("GuardCsvError",         { alwaysPermanent: true });
+// GuardTextError covers free-text codepoint-threat violations on the validate /
+// sanitize / gate paths (bidi-override / control / null / zero-width /
+// Unicode-Tags / mixed-script-confusable). alwaysPermanent — every case is a
+// hostile-codepoint detection or a caller-shape opt error.
+var GuardTextError        = defineClass("GuardTextError",        { alwaysPermanent: true });
 // GuardAllError covers parity-check failures, exceptFor opt validation, and
 // override opt validation in the b.guardAll registry. alwaysPermanent — every
 // case is a config-time programming bug, not a transient runtime condition.
@@ -693,6 +703,7 @@ module.exports = {
   SessionError:           SessionError,
   SlugError:              SlugError,
   WebhookError:           WebhookError,
+  WebhookDispatcherError: WebhookDispatcherError,
   ApiKeyError:            ApiKeyError,
   PermissionsError:       PermissionsError,
   CacheError:             CacheError,
@@ -705,6 +716,7 @@ module.exports = {
   StaticServeError:       StaticServeError,
   GateContractError:      GateContractError,
   GuardCsvError:          GuardCsvError,
+  GuardTextError:         GuardTextError,
   GuardAllError:          GuardAllError,
   GuardHtmlError:         GuardHtmlError,
   GuardSvgError:          GuardSvgError,

package/lib/framework-schema.js

@@ -116,6 +116,10 @@ var LOCAL_TO_EXTERNAL = Object.freeze({
   // places — cluster-storage.execute routes the SQL to the right DB
   // based on cluster.isClusterMode().
   _blamejs_sessions:  "_blamejs_sessions",
+  // _blamejs_session_valid_from — per-subject valid-from boundary for
+  // stateless-token revocation (b.session.bump / check / validFrom). Same
+  // dual-storage shape as _blamejs_sessions; identity-mapped.
+  _blamejs_session_valid_from: "_blamejs_session_valid_from",
   // _blamejs_jobs — same dual-storage pattern as sessions. The local-
   // protocol queue (lib/queue-local.js) routes through cluster-storage
   // so writes/reads land in the leader's external-db when cluster
@@ -649,6 +653,20 @@ function _sessionsDDL(dialect) {
   ]);
 }
 
+// _blamejs_session_valid_from — monotonic per-subject valid-from boundary for
+// stateless-token revocation. Mirrors the local-SQLite schema in db.js's
+// FRAMEWORK_SCHEMA so single-node and cluster behavior are identical.
+// subjectHash is the PRIMARY KEY (the plaintext subject id never lands here);
+// validFromEpoch is the monotonic boundary (ms); updatedAt records the bump.
+function _sessionValidFromDDL(dialect) {
+  var t = _types(dialect);
+  return _table(tableName("_blamejs_session_valid_from"), dialect, [
+    { col: "subjectHash",    def: t.KT + " PRIMARY KEY" },
+    { col: "validFromEpoch", def: t.INT + " NOT NULL" },
+    { col: "updatedAt",      def: t.INT + " NOT NULL" },
+  ], []);
+}
+
 // _blamejs_jobs — local-protocol queue jobs. Mirrors db.js's
 // FRAMEWORK_SCHEMA for the same table; sealed columns (payload,
 // lastError) are stored vault-sealed. Indexes target the lease
@@ -824,6 +842,7 @@ function _allDDLs(dialect) {
     _apiEncryptNoncesDDL(dialect),
     _apiKeysDDL(dialect),
     _sessionsDDL(dialect),
+    _sessionValidFromDDL(dialect),
     _jobsDDL(dialect),
     _cacheDDL(dialect),
     _cacheTagsDDL(dialect),

package/lib/fsm.js

@@ -439,18 +439,13 @@ async function _runTransition(instance, name, opts) {
   // drop-silent; the additional try/catch protects against the
   // lazy-loaded audit module throwing at first-access time.
   try {
-    audit().safeEmit({
-      action: "fsm." + instance._def.name + ".transition",
-      actor:  opts.actor ? { id: opts.actor } : { id: "<system>" },
-      outcome: "success",
-      metadata: {
-        from:       fromState,
-        to:         toState,
-        transition: name,
-        machine:    instance._def.name,
-        callerMeta: opts.metadata || null,
-      },
-    });
+    audit().namespaced("fsm")(instance._def.name + ".transition", "success", {
+      from:       fromState,
+      to:         toState,
+      transition: name,
+      machine:    instance._def.name,
+      callerMeta: opts.metadata || null,
+    }, { actor: opts.actor ? { id: opts.actor } : { id: "<system>" } });
   } catch (_e) { /* drop-silent — audit best-effort */ }
   return { from: fromState, to: toState, on: name };
 }