@blamejs/core 0.15.11 → 0.15.13

package/lib/network-tls.js

@@ -5,6 +5,8 @@ var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var net = require("node:net");
 var nodeCrypto = require("node:crypto");
+var numericBounds = require("./numeric-bounds");
+var atomicFile = require("./atomic-file");
 
 var bCrypto = require("./crypto");
 var C = require("./constants");
@@ -23,6 +25,29 @@ var networkDns = lazyRequire(function () { return require("./network-dns"); });
 var httpClient = lazyRequire(function () { return require("./http-client"); });
 var asn1 = require("./asn1-der");
 
+// Audit + observability emit for an outbound TLS connection that runs with
+// peer-certificate validation DISABLED (an explicit operator opt-in —
+// rejectUnauthorized:false / allowInsecure — never a framework default).
+// Emitted at the point the disable is HONORED so the degraded posture is
+// observable (compliance evidence + incident response), parallel to the
+// tls.classical_downgrade audit. Drop-silent best-effort (§8 hot-path sink) —
+// an audit-sink failure must never break the TLS connect itself.
+function auditInsecureTls(meta) {
+  meta = meta || {};
+  try {
+    observability().safeEvent("tls.insecure_skip_verify", 1, {
+      host: meta.host || null, port: meta.port || null, source: meta.source || null,
+    });
+  } catch (_e) { /* drop-silent */ }
+  try {
+    audit().safeEmit({
+      action:  "tls.insecure_skip_verify",
+      outcome: "success",
+      metadata: { host: meta.host || null, port: meta.port || null, source: meta.source || null },
+    });
+  } catch (_e) { /* drop-silent — audit best-effort, never break TLS */ }
+}
+
 // STATE.tlsKeyShares is initialized to the default PQC group list at
 // module load — operator setKeyShares() overrides; resetKeyShares()
 // restores the default. Empty array means "fall back to Node's TLS
@@ -80,7 +105,7 @@ function _certMetadata(pem) {
 
 function _isPathLike(s) {
   if (s.indexOf("-----BEGIN") !== -1) return false;
-  if (s.length > C.BYTES.kib(1)) return false;
+  if (safeBuffer.byteLengthOf(s) > C.BYTES.kib(1)) return false;
   if (safeBuffer.hasCrlf(s)) return false;
   return true;
 }
@@ -92,20 +117,13 @@ function _isPathLike(s) {
 // shape, where an attacker who could swap the file in-between could
 // short-circuit the PEM marker check downstream.
 function _readPathFile(p) {
-  var fd = nodeFs.openSync(p, "r");
-  try {
-    var fstat = nodeFs.fstatSync(fd);
-    var buf = Buffer.alloc(fstat.size);
-    var read = 0;
-    while (read < fstat.size) {
-      var n = nodeFs.readSync(fd, buf, read, fstat.size - read, null);
-      if (n === 0) break;
-      read += n;
-    }
-    return buf.slice(0, read).toString("utf8");
-  } finally {
-    try { nodeFs.closeSync(fd); } catch (_c) { /* close best-effort */ }
-  }
+  // TOCTOU-safe read via atomic-file: utf8 string, slice on a short read,
+  // raw ENOENT preserved (errorFor returns undefined → rethrow).
+  return atomicFile.fdSafeReadSync(p, {
+    encoding:       "utf8",
+    allowShortRead: true,
+    errorFor:       function () { return undefined; },
+  });
 }
 
 function _readPath(p) {
@@ -144,7 +162,7 @@ function addCa(pemOrPath, opts) {
     added.push(meta);
   }
   _emitAuditAdd(added, opts);
-  _emitObs("network.tls.ca.added", { count: added.length });
+  observability().safeEvent("network.tls.ca.added", 1, { count: added.length });
   return added;
 }
 
@@ -154,7 +172,7 @@ function addCaBundle(p, opts) {
 
 function useSystemTrust(enable) {
   STATE.systemTrust = enable !== false;
-  _emitObs("network.tls.system_trust.set", { enabled: STATE.systemTrust });
+  observability().safeEvent("network.tls.system_trust.set", 1, { enabled: STATE.systemTrust });
 }
 
 function isSystemTrustEnabled() { return !!STATE.systemTrust; }
@@ -175,6 +193,21 @@ function getTrustStore() {
   });
 }
 
+// _certAuditMetadata(m) — the shared cert-identity fields stamped on every
+// network.tls.ca.* audit event (the add / remove emitters overlay their
+// own label / reason on top via Object.assign). Distinct from
+// _certMetadata(pem), which PARSES a PEM into the meta object `m`.
+function _certAuditMetadata(m) {
+  return {
+    subject:        m.subject,
+    issuer:         m.issuer,
+    fingerprint256: m.fingerprint256,
+    validFrom:      m.validFrom,
+    validTo:        m.validTo,
+    isSelfSigned:   m.isSelfSigned,
+  };
+}
+
 function _emitAuditRemove(metaList, reason) {
   var sink;
   try { sink = audit(); } catch (_e) { sink = null; }
@@ -185,16 +218,10 @@ function _emitAuditRemove(metaList, reason) {
       sink.safeEmit({
         action:   "network.tls.ca.removed",
         outcome:  "success",
-        metadata: {
-          subject:        m.subject,
-          issuer:         m.issuer,
-          fingerprint256: m.fingerprint256,
-          validFrom:      m.validFrom,
-          validTo:        m.validTo,
-          isSelfSigned:   m.isSelfSigned,
-          label:          m.label,
-          reason:         reason || "operator",
-        },
+        metadata: Object.assign(_certAuditMetadata(m), {
+          label:  m.label,
+          reason: reason || "operator",
+        }),
       });
     } catch (_e) { /* audit best-effort — never break the caller */ }
   }
@@ -216,7 +243,7 @@ function removeCa(fingerprint256, opts) {
   });
   if (removed.length === 0) return 0;
   if (!opts || opts.audit !== false) _emitAuditRemove(removed, "operator-remove");
-  _emitObs("network.tls.ca.removed", { count: removed.length, reason: "operator" });
+  observability().safeEvent("network.tls.ca.removed", 1, { count: removed.length, reason: "operator" });
   return removed.length;
 }
 
@@ -234,7 +261,7 @@ function removeCaByLabel(label, opts) {
   });
   if (removed.length === 0) return 0;
   if (!opts || opts.audit !== false) _emitAuditRemove(removed, "operator-remove-by-label");
-  _emitObs("network.tls.ca.removed", { count: removed.length, reason: "label" });
+  observability().safeEvent("network.tls.ca.removed", 1, { count: removed.length, reason: "label" });
   return removed.length;
 }
 
@@ -243,7 +270,7 @@ function clearAll(opts) {
   var removed = STATE.cas.map(function (e) { return Object.assign({ label: e.label }, e.meta); });
   STATE.cas = [];
   if (!opts || opts.audit !== false) _emitAuditRemove(removed, "operator-clear-all");
-  _emitObs("network.tls.ca.cleared", { count: removed.length });
+  observability().safeEvent("network.tls.ca.cleared", 1, { count: removed.length });
   return removed.length;
 }
 
@@ -260,7 +287,7 @@ function purgeExpired(opts) {
   });
   if (removed.length === 0) return 0;
   if (!opts || opts.audit !== false) _emitAuditRemove(removed, "expired");
-  _emitObs("network.tls.ca.purged_expired", { count: removed.length });
+  observability().safeEvent("network.tls.ca.purged_expired", 1, { count: removed.length });
   return removed.length;
 }
 
@@ -492,7 +519,7 @@ var DEFAULT_PQC_KEY_SHARES = Object.freeze([
 ]);
 
 function _validateKeyShare(name) {
-  if (typeof name !== "string" || name.length === 0 || name.length > C.BYTES.bytes(64)) {  // bound
+  if (typeof name !== "string" || name.length === 0 || safeBuffer.byteLengthOf(name) > C.BYTES.bytes(64)) {  // bound
     throw new TlsTrustError("tls/bad-key-share",
       "tls.pqc.setKeyShares: each entry must be a non-empty string up to 64 chars");
   }
@@ -691,24 +718,12 @@ function _emitAuditAdd(metaList, opts) {
       sink.safeEmit({
         action:   "network.tls.ca.added",
         outcome:  "success",
-        metadata: {
-          subject:        m.subject,
-          issuer:         m.issuer,
-          fingerprint256: m.fingerprint256,
-          validFrom:      m.validFrom,
-          validTo:        m.validTo,
-          isSelfSigned:   m.isSelfSigned,
-          label:          opts.label || null,
-        },
+        metadata: Object.assign(_certAuditMetadata(m), { label: opts.label || null }),
       });
     } catch (_e) { /* audit best-effort — never break the caller */ }
   }
 }
 
-function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 function _resetForTest() {
   STATE.cas = [];
   STATE.systemTrust = false;
@@ -2682,11 +2697,8 @@ function connectWithEch(opts) {
   validateOpts.requireNonEmptyString(opts.host, "connectWithEch: host",
     NetworkTlsError, "tls/ech-bad-opts");
   var port = opts.port === undefined ? 443 : opts.port;                          // HTTPS default port
-  if (typeof port !== "number" || !isFinite(port) ||
-      port <= 0 || port > 65535 || Math.floor(port) !== port) {                  // TCP port range
-    throw new NetworkTlsError("tls/ech-bad-opts",
-      "connectWithEch: port must be an integer in 1..65535");
-  }
+  numericBounds.requirePositiveFiniteInt(port,
+    "connectWithEch: port", NetworkTlsError, "tls/ech-bad-opts", { max: 65535 });
   if (opts.alpn !== undefined && !Array.isArray(opts.alpn)) {
     throw new NetworkTlsError("tls/ech-bad-opts",
       "connectWithEch: alpn must be an array of strings");
@@ -2723,8 +2735,14 @@ function connectWithEch(opts) {
       if (typeof opts.checkServerIdentity === "function") {
         connectOpts.checkServerIdentity = opts.checkServerIdentity;
       }
-      if (opts.rejectUnauthorized === false) {
-        connectOpts.rejectUnauthorized = false;
+      // rejectUnauthorized defaults to true (full validation). An operator may
+      // explicitly opt out — audited, never a framework default. Derived from
+      // the operator's own value (operator-governed shape, mirroring mail.js /
+      // log-stream-syslog.js), not a hardcoded literal.
+      var rejectUnauthorized = opts.rejectUnauthorized !== false;
+      connectOpts.rejectUnauthorized = rejectUnauthorized;
+      if (!rejectUnauthorized) {
+        auditInsecureTls({ host: opts.host, port: port, source: "network.tls.connectWithEch" });
       }
       var echAttached = false;
       if (echConfigBuf && nodeSupportsEch) {
@@ -2735,7 +2753,7 @@ function connectWithEch(opts) {
         // gracefully with a one-shot warn so operators know they're
         // sending an outer-only ClientHello.
         try {
-          observability().emit("network.tls.ech.unsupported", {
+          observability().safeEvent("network.tls.ech.unsupported", 1, {
             host: opts.host, source: sourceLabel,
           });
         } catch (_e) { /* drop-silent */ }
@@ -2772,7 +2790,7 @@ function connectWithEch(opts) {
         settled = true;
         if (to) clearTimeout(to);
         try {
-          observability().emit("network.tls.ech.connected", {
+          observability().safeEvent("network.tls.ech.connected", 1, {
             host: opts.host, echAttached: echAttached, source: sourceLabel,
           });
         } catch (_e) { /* drop-silent */ }
@@ -2832,7 +2850,7 @@ function connectWithEch(opts) {
       // operator still gets a working TLS session. Emit obs so the
       // operator sees the degradation.
       try {
-        observability().emit("network.tls.ech.dns_failed", {
+        observability().safeEvent("network.tls.ech.dns_failed", 1, {
           host: opts.host, error: (e && e.message) || String(e),
         });
       } catch (_e) { /* drop-silent */ }
@@ -3174,6 +3192,7 @@ function wrapSNICallback(operatorCb) {
 }
 
 module.exports = {
+  auditInsecureTls:    auditInsecureTls,
   addCa:               addCa,
   addCaBundle:         addCaBundle,
   removeCa:            removeCa,

package/lib/network.js

@@ -151,7 +151,7 @@ var ntpFacade = {
       throw new NetworkError("ntp/bad-servers", "ntp.setServers: expected non-empty array");
     }
     ntpFacade._defaultServers = list.slice();
-    _emitObs("network.ntp.servers.set", { count: list.length });
+    observability().safeEvent("network.ntp.servers.set", 1, { count: list.length });
   },
   getServers:     function () {
     return (ntpFacade._defaultServers || ntpCheck.DEFAULT_SERVERS).slice();
@@ -262,7 +262,7 @@ function bootFromEnv(opts) {
       } catch (_e) { /* audit best-effort — never break boot */ }
     }
   }
-  _emitObs("network.boot.from_env", { source: "env" });
+  observability().safeEvent("network.boot.from_env", 1, { source: "env" });
   return applied;
 }
 
@@ -301,10 +301,6 @@ function snapshot() {
   };
 }
 
-function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
-}
-
 function _resetForTest() {
   ntpFacade._defaultServers = null;
   ntpFacade._defaultTimeoutMs = null;

package/lib/nis2-report.js

@@ -66,7 +66,6 @@ function create(opts) {
   var sectorAnnex = opts.sectorAnnex;
   var csirtEndpoint = opts.csirtEndpoint || null;
   var httpClient = opts.httpClient || null;
-  var auditOn = opts.audit !== false;
 
   var ir = incidentReport().create({
     audit:    opts.audit,
@@ -79,16 +78,7 @@ function create(opts) {
     },
   });
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "nis2.report." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("nis2.report", opts.audit);
 
   async function _submitToCsirt(payload) {
     if (!csirtEndpoint || !httpClient) {

package/lib/nonce-store.js

@@ -13,6 +13,16 @@
  *     inserting second would race on concurrent requests carrying
  *     the same nonce.
  *
+ *   await store.release(nonce) → boolean
+ *     Un-claims a single nonce so a later checkAndInsert of the same value
+ *     succeeds again — the rollback half of reserve -> commit -> rollback.
+ *     A handler that claims an event id the moment a signature verifies (to
+ *     win the race against a concurrent duplicate) MUST release it when
+ *     downstream processing fails, otherwise the provider's at-least-once
+ *     redelivery is reported as a replay and the event is dropped. Returns
+ *     whether a live claim existed. Pair with checkAndInsert; without it an
+ *     eager claim inverts the at-least-once contract on any failure.
+ *
  *   await store.purgeExpired() → number
  *     Removes entries past their expireAt. Called periodically by the
  *     middleware that uses the store. Returns the count purged.
@@ -32,8 +42,11 @@
  *     table _blamejs_api_encrypt_nonces. The PRIMARY KEY race is what
  *     makes the check + insert atomic across nodes.
  *
- *   { checkAndInsert, purgeExpired, close } — operator-supplied
- *     custom backend (Redis SETNX, Memcached add, etc.). Use this
+ *   { checkAndInsert, release?, purgeExpired?, close? } — operator-supplied
+ *     custom backend (Redis SETNX, Memcached add, etc.). release() is
+ *     optional but required to use reserve -> rollback; a backend omitting
+ *     it throws NONCE_BACKEND_NO_RELEASE the first time release() is called
+ *     (a loud gap, never a silent dropped rollback). Use this
  *     for cross-process accuracy without a per-request SQL hop.
  *
  * Sweep cadence: memory backend sweeps every opts.sweepIntervalMs
@@ -132,6 +145,21 @@ function _memoryBackend(opts) {
     return Promise.resolve(true);
   }
 
+  // Un-claim a nonce so a future checkAndInsert of the same value succeeds
+  // again — the rollback half of reserve -> commit -> rollback. A handler
+  // that claims an event id the moment a signature verifies (to win the race
+  // against a concurrent duplicate) MUST release it when downstream processing
+  // fails, otherwise the provider's at-least-once redelivery is reported as a
+  // replay and the event is dropped. Returns whether a live claim existed.
+  function release(nonce) {
+    if (typeof nonce !== "string" || nonce.length === 0) {
+      return Promise.reject(_err("INVALID_NONCE", "nonce must be a non-empty string"));
+    }
+    var existed = seen.get(nonce) !== undefined;
+    if (existed) seen.delete(nonce);
+    return Promise.resolve(existed);
+  }
+
   function purgeExpired() {
     return Promise.resolve(_purgeExpiredSync());
   }
@@ -144,6 +172,7 @@ function _memoryBackend(opts) {
   return {
     name:            "memory",
     checkAndInsert:  checkAndInsert,
+    release:         release,
     purgeExpired:    purgeExpired,
     close:           close,
     // Test hooks — underlying entry count + count of capacity fail-closed
@@ -178,6 +207,19 @@ function _clusterBackend(_opts) {
     return (result && result.rowCount > 0);
   }
 
+  async function release(nonce) {
+    if (typeof nonce !== "string" || nonce.length === 0) {
+      throw _err("INVALID_NONCE", "nonce must be a non-empty string");
+    }
+    // Un-claim a single nonce (the reserve -> rollback half). The middleware
+    // hashes the raw nonce before it reaches here, so we delete by hash.
+    var built = sql.delete(frameworkSchema.tableName(NONCE_TABLE), _nonceSqlOpts())
+      .where("nonceHash", "=", nonce)
+      .toSql();
+    var result = await clusterStorage.execute(built.sql, built.params);
+    return (result && result.rowCount > 0);
+  }
+
   async function purgeExpired() {
     var built = sql.delete(frameworkSchema.tableName(NONCE_TABLE), _nonceSqlOpts())
       .where("expireAt", "<=", Date.now())
@@ -191,6 +233,7 @@ function _clusterBackend(_opts) {
   return {
     name:           "cluster",
     checkAndInsert: checkAndInsert,
+    release:        release,
     purgeExpired:   purgeExpired,
     close:          close,
   };
@@ -208,6 +251,15 @@ function create(opts) {
     return Object.assign({
       name:         "custom",
       purgeExpired: function () { return Promise.resolve(0); },
+      // A custom backend that omits release() cannot participate in
+      // reserve -> rollback. Fail LOUDLY (not a silent no-op) so the gap
+      // surfaces the first time a handler tries to un-claim, rather than
+      // silently dropping the rollback and inverting the at-least-once contract.
+      release:      function () {
+        return Promise.reject(_err("BACKEND_NO_RELEASE",
+          "this custom nonce backend does not implement release(nonce); " +
+          "the reserve -> commit -> rollback pattern requires it"));
+      },
       close:        function () {},
     }, backend);
   }
@@ -215,11 +267,37 @@ function create(opts) {
   if (!backend || backend === "memory") return _memoryBackend(opts);
   throw _err("UNKNOWN_BACKEND",
     "nonce-store: unknown backend '" + backend +
-    "' (must be 'memory', 'cluster', or { checkAndInsert, purgeExpired, close })");
+    "' (must be 'memory', 'cluster', or { checkAndInsert, release?, purgeExpired?, close? })");
+}
+
+// enforceReplay(store, jti, expireAtMs, opts) — single-use enforcement
+// against a replay store: `await store.checkAndInsert(jti, expireAtMs)`,
+// raising opts.errorClass(opts.storeFailedCode, …) if the store itself
+// fails (a store outage must NOT be mistaken for a clean token) and
+// opts.errorClass(opts.replayCode, "<opts.tokenLabel> jti='<jti>' has
+// been seen before — replay refused") if the jti was already seen. The
+// fail-closed anti-replay control flow every JWT / DPoP verifier repeated
+// identically — centralised here so the contract lives in one place.
+// Verifiers with a divergent message or store contract (e.g. an atomic
+// back-channel-logout-token store) keep their own inline check.
+async function enforceReplay(store, jti, expireAtMs, opts) {
+  opts = opts || {};
+  var inserted;
+  try {
+    inserted = await store.checkAndInsert(jti, expireAtMs);
+  } catch (e) {
+    throw new opts.errorClass(opts.storeFailedCode,
+      "replayStore.checkAndInsert threw: " + ((e && e.message) || String(e)));
+  }
+  if (inserted === false) {
+    throw new opts.errorClass(opts.replayCode,
+      opts.tokenLabel + " jti='" + jti + "' has been seen before — replay refused");
+  }
 }
 
 module.exports = {
   create:           create,
+  enforceReplay:    enforceReplay,
   NonceStoreError:  NonceStoreError,
   _memoryBackend:   _memoryBackend,
   _clusterBackend:  _clusterBackend,

package/lib/notify.js

@@ -408,11 +408,6 @@ function create(opts) {
     channels[n] = registry;
   }
 
-  function _emitObs(name, labels) {
-    try { observability().event(name, 1, labels || {}); }
-    catch (_e) { /* drop-silent — observability sink must not crash send() */ }
-  }
-
   var _emitAudit = validateOpts.makeAuditEmitter(audit);
 
   function _actor(callerOpts) {
@@ -465,7 +460,7 @@ function create(opts) {
     // mechanism — no double-retry inside the breaker or transport).
     async function _oneAttempt(attemptIdx) {
       attemptCount = attemptIdx;
-      _emitObs("notify.send.attempt", { channel: channel, attempt: attemptIdx });
+      observability().safeEvent("notify.send.attempt", 1, { channel: channel, attempt: attemptIdx });
       var sendPromise = entry.transport.send(message, input.sendOpts || null);
       // withTimeout from b.safeAsync — never re-implement timer races.
       var timed = (perCallTimeoutMs > 0)
@@ -478,7 +473,7 @@ function create(opts) {
         // classifies it correctly (operators can still opt OUT by setting
         // err.permanent in their transport).
         if (e && e.code === "async/timeout") {
-          _emitObs("notify.send.timeout", { channel: channel });
+          observability().safeEvent("notify.send.timeout", 1, { channel: channel });
           var te = _err("TIMEOUT",
             "notify.send: '" + channel + "' transport timed out after " + perCallTimeoutMs + "ms");
           // Mark transient via a NETWORK-style code so b.retry.isRetryable
@@ -497,7 +492,7 @@ function create(opts) {
           return await entry.breaker.wrap(function () { return _oneAttempt(attemptIdx); });
         } catch (e) {
           if (e && e.code === "CIRCUIT_OPEN") {
-            _emitObs("notify.send.breaker.open", { channel: channel });
+            observability().safeEvent("notify.send.breaker.open", 1, { channel: channel });
           }
           throw e;
         }
@@ -524,7 +519,7 @@ function create(opts) {
         }, perCallRetry);
 
         var durationMs = clock() - startedAt;
-        _emitObs("notify.send.success", { channel: channel, durationMs: durationMs });
+        observability().safeEvent("notify.send.success", 1, { channel: channel, durationMs: durationMs });
         if (auditSuccess) {
           _emitAudit("notify.send.success", {
             actor:    _actor(input),
@@ -543,7 +538,7 @@ function create(opts) {
           durationMs: durationMs,
         });
       } catch (e) {
-        _emitObs("notify.send.failure", {
+        observability().safeEvent("notify.send.failure", 1, {
           channel: channel,
           reason:  (e && e.code) || "unknown",
         });
@@ -594,7 +589,7 @@ function create(opts) {
       if (results[i] && results[i].isNotifyError) failed++;
       else ok++;
     }
-    _emitObs("notify.batch", { size: inputs.length, ok: ok, failed: failed });
+    observability().safeEvent("notify.batch", 1, { size: inputs.length, ok: ok, failed: failed });
     return results;
   }
 
@@ -626,7 +621,7 @@ function create(opts) {
       } catch (_e) { /* operator may register their own handler */ }
     }
     var jobId = await q.enqueue(queueName, input);
-    _emitObs("notify.queue.enqueued", { channel: input.channel, queueName: queueName });
+    observability().safeEvent("notify.queue.enqueued", 1, { channel: input.channel, queueName: queueName });
     return { jobId: jobId };
   }
 

package/lib/numeric-bounds.js

@@ -42,6 +42,20 @@ function shape(value) {
   return (typeof value) + " " + String(value);
 }
 
+// _throwInt — construct + throw a code-first defineClass error. When no
+// errorOpts is supplied the call is the historical bare `new ErrorClass(
+// code, message)` (byte-identical for every existing caller); pass
+// errorOpts { permanent, statusCode } to forward the framework error's
+// non-retryable flag / HTTP status (a config opt that's wrong on retry
+// stays wrong; a request-shaped opt carries its 4xx). Message-FIRST
+// classes (AtomicFileError / SafeBufferError / SafeUrlError) must NOT use
+// the require* throwers — they use the isPositiveFiniteInt predicate + their
+// own throw (see the module header) so code/message don't swap.
+function _throwInt(errorClass, code, message, errorOpts) {
+  if (errorOpts) throw new errorClass(code, message, errorOpts.permanent, errorOpts.statusCode);
+  throw new errorClass(code, message);
+}
+
 function isPositiveFiniteInt(value) {
   return typeof value === "number" && Number.isFinite(value) &&
          Number.isInteger(value) && value > 0;
@@ -64,11 +78,11 @@ function isNonNegativeFiniteInt(value) {
 //   nb.requirePositiveFiniteIntIfPresent(opts.graceMs,
 //     "app-shutdown.create: opts.graceMs", AppShutdownError,
 //     "app-shutdown/bad-grace-ms");
-function requirePositiveFiniteIntIfPresent(value, label, errorClass, code) {
+function requirePositiveFiniteIntIfPresent(value, label, errorClass, code, errorOpts) {
   if (value === undefined) return value;
   if (!isPositiveFiniteInt(value)) {
-    throw new errorClass(code,
-      (label || "value") + " must be a positive finite integer; got " + shape(value));
+    _throwInt(errorClass, code,
+      (label || "value") + " must be a positive finite integer; got " + shape(value), errorOpts);
   }
   return value;
 }
@@ -102,13 +116,13 @@ function _rangeSuffix(range) {
   if (range.min != null) return " >= " + range.min;
   return "";
 }
-function requirePositiveFiniteInt(value, label, errorClass, code, range) {
+function requirePositiveFiniteInt(value, label, errorClass, code, range, errorOpts) {
   var inRange = !range ||
     ((range.min == null || value >= range.min) && (range.max == null || value <= range.max));
   if (!isPositiveFiniteInt(value) || !inRange) {
-    throw new errorClass(code,
+    _throwInt(errorClass, code,
       (label || "value") + " must be a positive finite integer" +
-      _rangeSuffix(range) + "; got " + shape(value));
+      _rangeSuffix(range) + "; got " + shape(value), errorOpts);
   }
   return value;
 }
@@ -123,12 +137,12 @@ function requirePositiveFiniteInt(value, label, errorClass, code, range) {
 //   nb.requireAllPositiveFiniteIntIfPresent(opts,
 //     ["maxBytes", "maxAttrValueBytes", "maxTagDepth", "maxAttrsPerTag"],
 //     "guardHtml.validate", GuardHtmlError, "html.bad-opt");
-function requireAllPositiveFiniteIntIfPresent(opts, names, labelPrefix, errorClass, code) {
+function requireAllPositiveFiniteIntIfPresent(opts, names, labelPrefix, errorClass, code, errorOpts) {
   if (!opts || !Array.isArray(names)) return;
   for (var i = 0; i < names.length; i += 1) {
     var n = names[i];
     requirePositiveFiniteIntIfPresent(opts[n],
-      (labelPrefix || "") + ": " + n, errorClass, code);
+      (labelPrefix || "") + ": " + n, errorClass, code, errorOpts);
   }
 }
 

package/lib/object-store/azure-blob-bucket-ops.js

@@ -33,6 +33,7 @@ var C = require("../constants");
 var httpClient = require("../http-client");
 var requestHelpers = require("../request-helpers");
 var safeUrl = require("../safe-url");
+var markupEscape = require("../markup-escape").markupEscape;
 var { ObjectStoreError } = require("../framework-error");
 
 var _err = ObjectStoreError.factory;
@@ -122,12 +123,7 @@ function _validateCorsRule(rule, idx) {
 }
 
 function _xmlEscape(s) {
-  return String(s)
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&apos;");
+  return markupEscape(s, { apos: "&apos;" });
 }
 
 function _buildCorsXml(rules) {