@blamejs/core 0.15.11 → 0.15.13

package/lib/markup-tokenizer.js

@@ -0,0 +1,54 @@
+"use strict";
+
+// markup-tokenizer — neutral lexing helpers shared by the markup sanitizers
+// (b.guardHtml, b.guardSvg) and the BIMI SVG Tiny PS validator (b.mail.bimi).
+// Each of those keeps its OWN tokenizer loop because their security postures
+// genuinely diverge — guard-html/guard-svg recover leniently from a truncated
+// tag (emit what was scanned, keep going), while the BIMI validator fails
+// closed (throws on any malformation), and each recognizes a different set of
+// declaration forms (`<?`, `<!ENTITY>`, balanced `<!DOCTYPE [...]>`). What they
+// share verbatim is the one quote-aware step below; centralizing it keeps the
+// attribute-quote handling — the part a bypass hides in — identical everywhere.
+
+// scanToTagEnd(s, from, len) — advance from `from` (the index just past the
+// opening "<") to the tag's closing ">", treating a ">" that appears inside a
+// single- or double-quoted attribute value as a literal, not a terminator
+// (e.g. `<a title="a>b">` ends at the SECOND ">"). Returns the index of the
+// terminating ">", or `len` if the tag is unterminated (the caller decides
+// whether that is lenient end-of-input or a hard error).
+function scanToTagEnd(s, from, len) {
+  var p = from;
+  var inQuote = "";
+  while (p < len) {
+    var ch = s.charAt(p);
+    if (inQuote) {
+      if (ch === inQuote) inQuote = "";
+    } else {
+      if (ch === '"' || ch === "'") inQuote = ch;
+      else if (ch === ">") break;
+    }
+    p += 1;
+  }
+  return p;
+}
+
+// splitTagNameAttrs(inner, tagNameRe) — given a start tag's inner text (the
+// bytes between "<" and ">", with any trailing self-closing "/" already
+// stripped by the caller), split it into the lower-cased `tagName` and the raw
+// `attrSrc` remainder. `tagNameRe` is the caller's tag-name grammar (it must
+// capture the name in group 1) — HTML allows `[A-Za-z][A-Za-z0-9:-]*`, while
+// the XML-family grammars (SVG, BIMI SVG Tiny PS) also allow `_`. A tag whose
+// start does not match the grammar yields an empty name + empty attrSrc (the
+// caller treats it as a bogus tag).
+function splitTagNameAttrs(inner, tagNameRe) {
+  var nameMatch = inner.match(tagNameRe);
+  return {
+    tagName: nameMatch ? nameMatch[1].toLowerCase() : "",
+    attrSrc: nameMatch ? inner.slice(nameMatch[0].length) : "",
+  };
+}
+
+module.exports = {
+  scanToTagEnd: scanToTagEnd,
+  splitTagNameAttrs: splitTagNameAttrs,
+};

package/lib/mcp-tool-registry.js

@@ -65,8 +65,8 @@ var validateOpts  = require("./validate-opts");
 var { McpError }  = require("./framework-error");
 
 var bCrypto = lazyRequire(function () { return require("./crypto"); });
-var audit  = lazyRequire(function () { return require("./audit"); });
-var C      = require("./constants");
+var auditEmit = require("./audit-emit");
+var C = require("./constants");
 
 // Shared name-shape regex across mcp.js / mcp-tool-registry.js / a2a-tasks.js
 // — every agent-protocol identifier follows the same RFC-3986-unreserved
@@ -80,15 +80,7 @@ var ALLOWED_ALGS = Object.freeze([
   "slh-dsa-shake-256f",
 ]);
 
-function _emitAudit(action, metadata, outcome) {
-  try {
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome || "success",
-      metadata: metadata,
-    });
-  } catch (_e) { /* best-effort */ }
-}
+var _emitAudit = auditEmit.emit;
 
 function _validateAlg(alg, label) {
   if (alg === undefined || alg === null) return "ml-dsa-87";
@@ -175,20 +167,31 @@ function create(opts) {
     throw new McpError("mcp/bad-registry-opts",
       "toolRegistry.create: opts required (tools + signingKey)", true);
   }
-  if (!Array.isArray(opts.tools)) {
-    throw new McpError("mcp/bad-registry-opts",
-      "toolRegistry.create: opts.tools must be an array", true);
-  }
-  validateOpts.requireNonEmptyString(
-    opts.signingKey, "toolRegistry.create.signingKey", McpError, "mcp/bad-signing-key");
-  validateOpts.optionalNonEmptyString(
-    opts.verifyingKey, "toolRegistry.create.verifyingKey", McpError, "mcp/bad-verifying-key");
+  validateOpts.shape(opts, {
+    tools: function (value) {
+      if (!Array.isArray(value)) {
+        throw new McpError("mcp/bad-registry-opts",
+          "toolRegistry.create: opts.tools must be an array", true);
+      }
+    },
+    signingKey:   { rule: "required-string", code: "mcp/bad-signing-key",   label: "toolRegistry.create.signingKey" },
+    verifyingKey: { rule: "optional-string", code: "mcp/bad-verifying-key", label: "toolRegistry.create.verifyingKey" },
+    alg: function (value) {
+      // undefined → default applied below; any present value is registry-checked.
+      _validateAlg(value, "toolRegistry.create.alg");
+    },
+    ttlMs: function (value) {
+      // undefined → registry default applied below; any present value must be a
+      // finite millisecond count at or above the 1-second floor.
+      if (value === undefined) return;
+      if (typeof value !== "number" || !isFinite(value) || value < 1000) {                         // minimum-ttl threshold (1 second), not bytes
+        throw new McpError("mcp/bad-ttl",
+          "toolRegistry.create.ttlMs must be >= 1000 ms", true);
+      }
+    },
+  }, "toolRegistry.create", McpError, "mcp/bad-registry-opts");
   var alg = _validateAlg(opts.alg, "toolRegistry.create.alg");
   var defaultTtlMs = opts.ttlMs !== undefined ? opts.ttlMs : C.TIME.minutes(5);
-  if (typeof defaultTtlMs !== "number" || !isFinite(defaultTtlMs) || defaultTtlMs < 1000) {        // minimum-ttl threshold (1 second), not bytes
-    throw new McpError("mcp/bad-ttl",
-      "toolRegistry.create.ttlMs must be >= 1000 ms", true);
-  }
 
   var signingKey = opts.signingKey;
   var verifyingKey = opts.verifyingKey || null;

package/lib/mcp.js

@@ -152,7 +152,7 @@ function refuse(res, code, message, id) {
 function _readBearer(req) {
   var h = req.headers && req.headers.authorization;
   if (typeof h !== "string") return null;
-  if (h.length > C.BYTES.kib(8)) return null;
+  if (safeBuffer.byteLengthOf(h) > C.BYTES.kib(8)) return null;
   var m = /^Bearer\s+([A-Za-z0-9._~+/=-]+)$/.exec(h.trim());
   return m ? m[1] : null;
 }

package/lib/mdoc.js

@@ -53,6 +53,7 @@ var C = require("./constants");
 var cbor = require("./cbor");
 var cose = require("./cose");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -65,11 +66,14 @@ var TAG_ENCODED_CBOR = 24;                             // RFC 8949 §3.4.5.1 emb
 var ALLOWED_TAGS = [0, 1, TAG_ENCODED_CBOR, 1004];
 var DIGEST_ALGS = { "SHA-256": "sha256", "SHA-384": "sha384", "SHA-512": "sha512" };
 
-function _bytes(x, what) {
-  if (Buffer.isBuffer(x)) return x;
-  if (x instanceof Uint8Array) return Buffer.from(x);
-  throw new MdocError("mdoc/bad-input", "mdoc: " + what + " must be a Buffer / Uint8Array of CBOR");
-}
+// mdoc inputs are CBOR byte strings, never text (allowString:false).
+var _bytes = safeBuffer.makeByteCoercer({
+  errorClass:    MdocError,
+  typeCode:      "mdoc/bad-input",
+  messagePrefix: "mdoc: ",
+  messageSuffix: " must be a Buffer / Uint8Array of CBOR",
+  allowString:   false,
+});
 
 // validityInfo dates are tdate (Tag 0, an RFC 3339 string) or epoch
 // (Tag 1). Returns epoch-ms; fails closed on a malformed value.
@@ -128,13 +132,8 @@ async function verifyIssuerSigned(issuerSigned, opts) {
   if (!Array.isArray(opts.algorithms) || opts.algorithms.length === 0) {
     throw new MdocError("mdoc/algorithms-required", "mdoc.verifyIssuerSigned: opts.algorithms is required");
   }
-  var at = new Date();
-  if (opts.at !== undefined && opts.at !== null) {
-    if (!(opts.at instanceof Date) || !isFinite(opts.at.getTime())) {
-      throw new MdocError("mdoc/bad-at", "mdoc.verifyIssuerSigned: opts.at must be a valid Date");
-    }
-    at = opts.at;
-  }
+  validateOpts.optionalDate(opts.at, "mdoc.verifyIssuerSigned: opts.at", MdocError, "mdoc/bad-at");
+  var at = (opts.at !== undefined && opts.at !== null) ? opts.at : new Date();
   var decodeOpts = { allowedTags: ALLOWED_TAGS, maxBytes: opts.maxBytes, maxDepth: opts.maxDepth };
 
   var top = cbor.decode(_bytes(issuerSigned, "issuerSigned"), decodeOpts);

package/lib/metrics.js

@@ -48,6 +48,7 @@ var numericBounds = require("./numeric-bounds");
 var requestHelpers = require("./request-helpers");
 var { resolveRoute, captureResponseStatus, HTTP_STATUS } = requestHelpers;
 var validateOpts = require("./validate-opts");
+var boundedMap = require("./bounded-map");
 
 var MetricsError = defineClass("MetricsError", { alwaysPermanent: true });
 var log = boot("metrics");
@@ -353,10 +354,10 @@ function create(opts) {
   }
 
   function _registerMetric(metric) {
-    if (metrics.has(metric.name)) {
+    boundedMap.requireAbsent(metrics, metric.name, function () {
       throw new MetricsError("metrics/duplicate",
         "metric '" + metric.name + "' already registered");
-    }
+    });
     metrics.set(metric.name, metric);
     return metric;
   }
@@ -388,19 +389,20 @@ function create(opts) {
         }
         var resolved = _resolveLabels(defaultLabels, labelNames, arg.labels);
         var key = _labelsKey(resolved);
-        var entry = values.get(key);
-        if (!entry) {
-          if (values.size >= cardinalityCap) {
+        var entry = boundedMap.getOrInsert(values, key, function () {
+          return { labels: resolved, value: 0 };
+        }, {
+          maxSize: cardinalityCap,
+          onFull: function () {
             if (!capWarned) {
               log("metric '" + fullName + "' hit labelCardinalityCap (" + cardinalityCap +
                   ") — dropping new label combinations. Reduce label cardinality or raise the cap.");
               capWarned = true;
             }
-            return;
-          }
-          entry = { labels: resolved, value: 0 };
-          values.set(key, entry);
-        }
+            return null;
+          },
+        });
+        if (!entry) return;
         entry.value += arg.value;
       },
       reset: function () { values.clear(); capWarned = false; },
@@ -428,19 +430,18 @@ function create(opts) {
     function _ensure(callLabels) {
       var resolved = _resolveLabels(defaultLabels, labelNames, callLabels);
       var key = _labelsKey(resolved);
-      var entry = values.get(key);
-      if (!entry) {
-        if (values.size >= cardinalityCap) {
+      return boundedMap.getOrInsert(values, key, function () {
+        return { labels: resolved, value: 0 };
+      }, {
+        maxSize: cardinalityCap,
+        onFull: function () {
           if (!capWarned) {
             log("metric '" + fullName + "' hit labelCardinalityCap (" + cardinalityCap + ")");
             capWarned = true;
           }
           return null;
-        }
-        entry = { labels: resolved, value: 0 };
-        values.set(key, entry);
-      }
-      return entry;
+        },
+      });
     }
 
     var instance = {
@@ -524,25 +525,26 @@ function create(opts) {
         }
         var resolved = _resolveLabels(defaultLabels, labelNames, arg.labels);
         var key = _labelsKey(resolved);
-        var entry = values.get(key);
-        if (!entry) {
-          if (values.size >= cardinalityCap) {
-            if (!capWarned) {
-              log("metric '" + fullName + "' hit labelCardinalityCap (" + cardinalityCap + ")");
-              capWarned = true;
-            }
-            return;
-          }
+        var entry = boundedMap.getOrInsert(values, key, function () {
           // counts[i] is the count for the [<=buckets[i]] bucket; counts[buckets.length] is +Inf.
-          entry = {
+          return {
             labels:    resolved,
             counts:    new Array(buckets.length + 1).fill(0),
             sum:       0,
             count:     0,
             exemplars: new Array(buckets.length + 1).fill(null),
           };
-          values.set(key, entry);
-        }
+        }, {
+          maxSize: cardinalityCap,
+          onFull: function () {
+            if (!capWarned) {
+              log("metric '" + fullName + "' hit labelCardinalityCap (" + cardinalityCap + ")");
+              capWarned = true;
+            }
+            return null;
+          },
+        });
+        if (!entry) return;
         for (var i = 0; i < buckets.length; i++) {
           if (arg.value <= buckets[i]) {
             entry.counts[i]++;

package/lib/middleware/age-gate.js

@@ -38,6 +38,7 @@
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var requestHelpers = require("../request-helpers");
 var denyResponse = require("./deny-response").denyResponse;
 
 var audit = lazyRequire(function () { return require("../audit"); });
@@ -106,7 +107,6 @@ function create(opts) {
     ? opts.consentRequired : null;
   var hasParentalConsent = typeof opts.hasParentalConsent === "function" ? opts.hasParentalConsent : null;
   var skipPaths = Array.isArray(opts.skipPaths) ? opts.skipPaths.slice() : [];
-  var auditOn = opts.audit !== false;
   var errorMessage = typeof opts.errorMessage === "string" && opts.errorMessage.length > 0
     ? opts.errorMessage : "service unavailable without parental consent";
   var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
@@ -123,29 +123,9 @@ function create(opts) {
     privacyPostureHeader = "X-Privacy-Posture";
   }
 
-  function _shouldSkip(req) {
-    if (skipPaths.length === 0) return false;
-    var p = req.url || "";
-    var qpos = p.indexOf("?");
-    if (qpos !== -1) p = p.slice(0, qpos);
-    for (var i = 0; i < skipPaths.length; i++) {
-      var s = skipPaths[i];
-      if (typeof s === "string" && (p === s || p.indexOf(s + "/") === 0)) return true;
-      if (s instanceof RegExp && s.test(p)) return true;
-    }
-    return false;
-  }
+  var _shouldSkip = requestHelpers.makeSkipMatcher({ skipPaths: skipPaths }, "middleware.ageGate");
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "middleware.age_gate." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("middleware.age_gate", opts.audit);
 
   return function ageGateMiddleware(req, res, next) {
     if (_shouldSkip(req)) return next();

package/lib/middleware/api-encrypt.js

@@ -98,8 +98,9 @@
 
 var bCrypto = require("../crypto");
 var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
 var lazyRequire = require("../lazy-require");
-var nonceStoreLib = require("../nonce-store");
+var nonceStore = require("../nonce-store");
 var requestHelpers = require("../request-helpers");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
@@ -313,7 +314,7 @@ function create(opts) {
     "apiEncrypt: pruneIntervalMs", ApiEncryptError, "BAD_OPT");
   var pruneIntervalMs = opts.pruneIntervalMs != null
     ? opts.pruneIntervalMs : Math.max(C.TIME.seconds(30), Math.floor(replayWindowMs / 2));
-  var nonceStore     = opts.nonceStore || nonceStoreLib.create({ backend: "memory" });
+  var store          = opts.nonceStore || nonceStore.create({ backend: "memory" });
   var exemptPaths    = Array.isArray(opts.exemptPaths) ? opts.exemptPaths.slice() : [];
   // contentTypes scoping — middleware only operates on requests whose
   // Content-Type is in this list. Default JSON; operators with more
@@ -344,12 +345,9 @@ function create(opts) {
       "apiEncrypt: sessionTtlMs must be a positive finite number (ms), got " +
       JSON.stringify(opts.sessionTtlMs), 500);
   }
-  if (typeof sessionMaxResponses !== "number" || !isFinite(sessionMaxResponses) ||
-      sessionMaxResponses <= 0 || Math.floor(sessionMaxResponses) !== sessionMaxResponses) {
-    throw _err("BAD_OPT",
-      "apiEncrypt: sessionMaxResponses must be a positive finite integer, got " +
-      JSON.stringify(opts.sessionMaxResponses), 500);
-  }
+  numericBounds.requirePositiveFiniteInt(sessionMaxResponses,
+    "apiEncrypt: sessionMaxResponses", ApiEncryptError, "BAD_OPT", null,
+    { permanent: true, statusCode: 500 });
   // sessionStore — duck-typed handle exposing { get, set, delete }. The
   // helper optionalObjectWithMethod only checks one method; here we need
   // three. Inline shape kept; not a generic enough pattern to warrant a
@@ -393,16 +391,7 @@ function create(opts) {
     } catch (_e) { /* audit best-effort */ }
   }
 
-  function _isExempt(req) {
-    var p = req.pathname || (req.url || "/").split("?")[0];
-    for (var i = 0; i < exemptPaths.length; i++) {
-      var rule = exemptPaths[i];
-      if (typeof rule === "string" ? p === rule || p.indexOf(rule + "/") === 0 : rule.test(p)) {
-        return true;
-      }
-    }
-    return false;
-  }
+  var _isExempt = requestHelpers.makeSkipMatcher({ skipPaths: exemptPaths }, "middleware.apiEncrypt");
 
   function _matchesContentType(req) {
     if (!contentTypes) return true;  // filtering disabled
@@ -443,7 +432,7 @@ function create(opts) {
     var now = Date.now();
     if (now - lastPruneAt < pruneIntervalMs) return;
     lastPruneAt = now;
-    nonceStore.purgeExpired().catch(function (e) {
+    store.purgeExpired().catch(function (e) {
       try {
         logger().warn("nonce-store prune failed: " + ((e && e.message) || String(e)));
       } catch (_e) { /* logger best-effort */ }
@@ -548,7 +537,7 @@ function create(opts) {
       var nonceHash = bCrypto.sha3Hash(nonce, "hex");
       var expireAt = now + replayWindowMs;
       var freshNonce;
-      try { freshNonce = await nonceStore.checkAndInsert(nonceHash, expireAt); }
+      try { freshNonce = await store.checkAndInsert(nonceHash, expireAt); }
       catch (_e) {
         _emitFailure(req, "nonce-store-error");
         return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "nonce-store-unavailable" });
@@ -682,7 +671,7 @@ function create(opts) {
       // capacity.
       var ctrKey = "ctr:" + sid + ":" + ctr;
       var ctrFresh;
-      try { ctrFresh = await nonceStore.checkAndInsert(ctrKey, session.expiresAt); }
+      try { ctrFresh = await store.checkAndInsert(ctrKey, session.expiresAt); }
       catch (_e) {
         _emitFailure(req, "nonce-store-error");
         return _writeRejection(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, { error: "nonce-store-unavailable" });
@@ -779,7 +768,7 @@ function create(opts) {
 
   middleware.publishPublicKey = publishPublicKey;
   middleware.close = function () {
-    if (typeof nonceStore.close === "function") nonceStore.close();
+    if (typeof store.close === "function") store.close();
     if (sessionStore && typeof sessionStore.close === "function") sessionStore.close();
   };
   // Expose for tests / operator dashboards. Counts are 0 in per-request mode.

package/lib/middleware/assetlinks.js

@@ -28,6 +28,7 @@
 var lazyRequire = require("../lazy-require");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response");
 var { defineClass } = require("../framework-error");
 
 var AssetlinksError = defineClass("AssetlinksError", { alwaysPermanent: true });
@@ -108,13 +109,7 @@ function create(opts) {
     var path = qIdx === -1 ? url : url.slice(0, qIdx);
     if (path !== "/.well-known/assetlinks.json") return next();
     if (req.method !== "GET" && req.method !== "HEAD") {
-      var bodyMsg = "Method Not Allowed";
-      res.writeHead(405, {                                                       // HTTP 405 status
-        "Allow":          "GET, HEAD",
-        "Content-Type":   "text/plain; charset=utf-8",
-        "Content-Length": Buffer.byteLength(bodyMsg),
-      });
-      res.end(bodyMsg);
+      denyResponse.methodNotAllowed(res, "GET, HEAD");
       return;
     }
     res.writeHead(200, {                                                         // HTTP 200 status

package/lib/middleware/bearer-auth.js

@@ -38,6 +38,7 @@ var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 var denyResponse = require("./deny-response").denyResponse;
+var codepointClass = require("../codepoint-class");
 var { AuthError } = require("../framework-error");
 
 var audit = lazyRequire(function () { return require("../audit"); });
@@ -164,7 +165,7 @@ function create(opts) {
     }
     for (var ri = 0; ri < realm.length; ri += 1) {
       var rcode = realm.charCodeAt(ri);
-      if (rcode < 32 || rcode === 127) {                                  // ASCII control codepoints
+      if (codepointClass.isForbiddenControlChar(rcode, { forbidTab: true })) {  // ASCII control codepoints
         throw new AuthError("auth-bearer/bad-realm",
           "realm contains control character at index " + ri);
       }