@blamejs/core 0.15.12 → 0.15.14

package/lib/file-upload.js

@@ -259,73 +259,87 @@ function _validateUploadId(id) {
 }
 
 function _validateCreateOpts(opts) {
-  validateOpts.requireObject(opts, "fileUpload.create", FileUploadError);
-  validateOpts.requireNonEmptyString(opts.stagingDir, "fileUpload.create: stagingDir", FileUploadError);
-  if (!nodePath.isAbsolute(opts.stagingDir)) {
-    throw _err("BAD_OPT", "fileUpload.create: stagingDir must be an absolute path, got " +
-      JSON.stringify(opts.stagingDir));
-  }
-  validateOpts.optionalFunction(opts.onFinalize, "fileUpload.create: onFinalize", FileUploadError);
-  validateOpts.optionalFunction(opts.onChunk, "fileUpload.create: onChunk", FileUploadError);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxFileBytes", "maxChunkBytes", "maxStreamReassemblyBytes",
-     "maxStagingBytes", "maxActiveUploadsPerActor"],
-    "fileUpload.create", FileUploadError, "BAD_OPT");
-  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.incompleteTtlMs,
-    "fileUpload.create: incompleteTtlMs", FileUploadError, "BAD_OPT");
-  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.maxIdleMs,
-    "fileUpload.create: maxIdleMs", FileUploadError, "BAD_OPT");
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxChunks,
-    "fileUpload.create: maxChunks", FileUploadError, "BAD_OPT");
-  validateOpts.auditShape(opts.audit, "fileUpload.create", FileUploadError);
-  validateOpts.observabilityShape(opts.observability, "fileUpload.create", FileUploadError);
-  validateOpts.optionalFunction(opts.clock, "fileUpload.create: clock", FileUploadError);
-  // allowedFileTypes — operator's MIME allowlist. Empty / undefined
-  // disables the gate. Setting it without wiring a fileType primitive
-  // is a misconfig — the gate would have nothing to enforce against.
-  validateOpts.optionalNonEmptyStringArray(opts.allowedFileTypes,
-    "fileUpload.create: allowedFileTypes", FileUploadError, "BAD_OPT");
-  if (Array.isArray(opts.allowedFileTypes) && opts.allowedFileTypes.length > 0 &&
-      (!opts.fileType || typeof opts.fileType.detect !== "function")) {
-    throw _err("BAD_OPT",
-      "fileUpload.create: allowedFileTypes is set but fileType primitive is not wired " +
-      "(pass fileType: b.fileType so the framework can sniff magic bytes at finalize)");
-  }
-  // permissions — when set, must expose check(actor, scope) → boolean.
-  validateOpts.optionalObjectWithMethod(opts.permissions, "check",
-    "fileUpload.create: permissions", FileUploadError, "BAD_OPT",
-    "must be a b.permissions instance (check fn)");
-  // contentSafety — extension-keyed gate map for per-extension content
-  // validation. Default behaviour: when undefined, the framework wires
-  // b.guardAll.byExtension({ profile: "strict" }) automatically so every
-  // shipped guard is ON by default. Explicit opt-out: contentSafety:
-  // null (audited at create() time so a security review can reconstruct
-  // which deploys disabled the default-on protection).
-  // Example: contentSafety: { ".csv": b.guardCsv.gate({ profile: "strict" }) }
-  if (opts.contentSafety !== undefined && opts.contentSafety !== null) {
-    validateOpts.optionalPlainObject(opts.contentSafety,
-      "fileUpload.create: contentSafety", FileUploadError, "BAD_OPT",
-      "must be a plain { ext: gate } object, null to opt out, or " +
-      "undefined for the default-on b.guardAll wiring");
-    var safetyKeys = Object.keys(opts.contentSafety);
-    for (var sk = 0; sk < safetyKeys.length; sk++) {
-      var ext = safetyKeys[sk];
-      var g = opts.contentSafety[ext];
-      if (!g || typeof g.check !== "function") {
+  validateOpts.shape(opts, {
+    stagingDir: function (v, label) {
+      validateOpts.requireNonEmptyString(v, label, FileUploadError);
+      if (!nodePath.isAbsolute(v)) {
+        throw _err("BAD_OPT", "fileUpload.create: stagingDir must be an absolute path, got " +
+          JSON.stringify(v));
+      }
+    },
+    onFinalize: "optional-function",
+    onChunk:    "optional-function",
+    // Byte / count caps — finite positive ints; TTL/idle windows allow 0.
+    maxFileBytes:             "optional-positive-finite-int",
+    maxChunkBytes:            "optional-positive-finite-int",
+    maxStreamReassemblyBytes: "optional-positive-finite-int",
+    maxStagingBytes:          "optional-positive-finite-int",
+    maxActiveUploadsPerActor: "optional-positive-finite-int",
+    maxChunks:                "optional-positive-finite-int",
+    incompleteTtlMs:          "optional-non-negative-finite-int",
+    maxIdleMs:                "optional-non-negative-finite-int",
+    audit:         function (v) { validateOpts.auditShape(v, "fileUpload.create", FileUploadError); },
+    observability: function (v) { validateOpts.observabilityShape(v, "fileUpload.create", FileUploadError); },
+    clock:         "optional-function",
+    // allowedFileTypes — operator's MIME allowlist. Empty / undefined
+    // disables the gate. Setting it without wiring a fileType primitive
+    // is a misconfig — the gate would have nothing to enforce against.
+    allowedFileTypes: function (v, label) {
+      validateOpts.optionalNonEmptyStringArray(v, label, FileUploadError, "BAD_OPT");
+      if (Array.isArray(v) && v.length > 0 &&
+          (!opts.fileType || typeof opts.fileType.detect !== "function")) {
         throw _err("BAD_OPT",
-          "fileUpload.create: contentSafety[" + JSON.stringify(ext) +
-          "] must be a gate (b.guardCsv.gate / b.guardHtml.gate / etc.)");
+          "fileUpload.create: allowedFileTypes is set but fileType primitive is not wired " +
+          "(pass fileType: b.fileType so the framework can sniff magic bytes at finalize)");
       }
-    }
-  }
-  // filenameSafety — single gate for filename validation. Default: on.
-  // Operator opts out with filenameSafety: null (audited).
-  if (opts.filenameSafety !== undefined && opts.filenameSafety !== null) {
-    validateOpts.optionalObjectWithMethod(opts.filenameSafety, "check",
-      "fileUpload.create: filenameSafety", FileUploadError, "BAD_OPT",
-      "must be a gate (b.guardFilename.gate(...)), null to opt out, or " +
-      "undefined for the default-on wiring");
-  }
+    },
+    // permissions — when set, must expose check(actor, scope) → boolean.
+    permissions: function (v, label) {
+      validateOpts.optionalObjectWithMethod(v, "check", label, FileUploadError, "BAD_OPT",
+        "must be a b.permissions instance (check fn)");
+    },
+    // contentSafety — extension-keyed gate map for per-extension content
+    // validation. Default behaviour: when undefined, the framework wires
+    // b.guardAll.byExtension({ profile: "strict" }) automatically so every
+    // shipped guard is ON by default. Explicit opt-out: contentSafety:
+    // null (audited at create() time so a security review can reconstruct
+    // which deploys disabled the default-on protection).
+    // Example: contentSafety: { ".csv": b.guardCsv.gate({ profile: "strict" }) }
+    contentSafety: function (v, label) {
+      if (v === undefined || v === null) return;
+      validateOpts.optionalPlainObject(v, label, FileUploadError, "BAD_OPT",
+        "must be a plain { ext: gate } object, null to opt out, or " +
+        "undefined for the default-on b.guardAll wiring");
+      var safetyKeys = Object.keys(v);
+      for (var sk = 0; sk < safetyKeys.length; sk++) {
+        var ext = safetyKeys[sk];
+        var g = v[ext];
+        if (!g || typeof g.check !== "function") {
+          throw _err("BAD_OPT",
+            "fileUpload.create: contentSafety[" + JSON.stringify(ext) +
+            "] must be a gate (b.guardCsv.gate / b.guardHtml.gate / etc.)");
+        }
+      }
+    },
+    // filenameSafety — single gate for filename validation. Default: on.
+    // Operator opts out with filenameSafety: null (audited).
+    filenameSafety: function (v, label) {
+      if (v === undefined || v === null) return;
+      validateOpts.optionalObjectWithMethod(v, "check", label, FileUploadError, "BAD_OPT",
+        "must be a gate (b.guardFilename.gate(...)), null to opt out, or " +
+        "undefined for the default-on wiring");
+    },
+    // fileType — magic-byte sniffer (b.fileType) consumed at finalize when
+    // allowedFileTypes is set; validated here so it can't be passed un-typed.
+    fileType: function (v, label) {
+      if (v === undefined || v === null) return;
+      validateOpts.optionalObjectWithMethod(v, "detect", label, FileUploadError, "BAD_OPT",
+        "must be a b.fileType instance (detect fn)");
+    },
+    // Reason strings recorded when a default-on safety is explicitly disabled.
+    contentSafetyDisabledReason:  "optional-string",
+    filenameSafetyDisabledReason: "optional-string",
+  }, "fileUpload.create", FileUploadError, "BAD_OPT", { exhaustive: true });
 }
 
 /**
@@ -698,7 +712,7 @@ function create(opts) {
       throw _err("EMPTY_CHUNK",
         "fileUpload.acceptChunk: body is empty (0 bytes)");
     }
-    if (body.length > maxChunkBytes) {
+    if (safeBuffer.byteLengthOf(body) > maxChunkBytes) {
       _emitObs("fileUpload.chunk_too_large", 1);
       throw _err("CHUNK_TOO_LARGE",
         "fileUpload.acceptChunk: chunk body is " + body.length +

package/lib/flag-evaluation-context.js

@@ -17,6 +17,7 @@
  */
 
 var nodeCrypto    = require("node:crypto");
+var pick          = require("./pick");
 var validateOpts  = require("./validate-opts");
 var lazyRequire   = require("./lazy-require");
 var { defineClass } = require("./framework-error");
@@ -33,7 +34,7 @@ function _normalize(input, label) {
   var out = {};
   for (var key in input) {
     if (!Object.prototype.hasOwnProperty.call(input, key)) continue;
-    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+    if (pick.isPoisonedKey(key)) {
       continue;                                          // poisoned-keys defense
     }
     out[key] = input[key];
@@ -55,12 +56,8 @@ function merge(base, overlay) {
   var b = _normalize(base, "merge.base");
   var o = _normalize(overlay, "merge.overlay");
   var out = {};
-  for (var k1 in b) {
-    if (Object.prototype.hasOwnProperty.call(b, k1)) out[k1] = b[k1];
-  }
-  for (var k2 in o) {
-    if (Object.prototype.hasOwnProperty.call(o, k2)) out[k2] = o[k2];
-  }
+  validateOpts.assignOwnEnumerable(out, b);
+  validateOpts.assignOwnEnumerable(out, o);
   return Object.freeze(out);
 }
 
@@ -110,7 +107,7 @@ function fromRequest(req, opts) {
   if (opts.extra && typeof opts.extra === "object") {
     for (var k in opts.extra) {
       if (Object.prototype.hasOwnProperty.call(opts.extra, k)) {
-        if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
+        if (pick.isPoisonedKey(k)) continue;
         ctx[k] = opts.extra[k];
       }
     }

package/lib/flag-providers.js

@@ -41,6 +41,7 @@ var validateOpts   = require("./validate-opts");
 var lazyRequire    = require("./lazy-require");
 var safeJson       = require("./safe-json");
 var C              = require("./constants");
+var atomicFile     = require("./atomic-file");
 var { defineClass } = require("./framework-error");
 var FlagError = defineClass("FlagError", { alwaysPermanent: true });
 
@@ -128,7 +129,10 @@ function localFile(opts) {
   validateOpts.requireNonEmptyString(opts.path,
     "providers.localFile: path", FlagError, "flag/bad-provider");
   var raw;
-  try { raw = nodeFs.readFileSync(opts.path, "utf8"); }
+  // Capped fd-bound read; the cap precedes the alloc so an oversized flag file
+  // can't OOM boot. refuseSymlink stays OFF: a flag file is commonly a k8s
+  // ConfigMap mount, which is a symlink chain — refusing it would break that.
+  try { raw = atomicFile.fdSafeReadSync(opts.path, { maxBytes: C.BYTES.mib(1), encoding: "utf8" }); }
   catch (e) {
     throw new FlagError("flag/bad-provider",
       "providers.localFile: cannot read file " + JSON.stringify(opts.path) +
@@ -154,7 +158,7 @@ function localFile(opts) {
     try {
       nodeFs.watch(opts.path, { persistent: false }, function () {
         try {
-          var nextRaw = nodeFs.readFileSync(opts.path, "utf8");
+          var nextRaw = atomicFile.fdSafeReadSync(opts.path, { maxBytes: C.BYTES.mib(1), encoding: "utf8" });
           var nextParsed = safeJson.parse(nextRaw, { maxBytes: C.BYTES.mib(1) });
           if (nextParsed && nextParsed.flags) {
             for (var k in nextParsed.flags) {

package/lib/forms.js

@@ -252,7 +252,7 @@ function _renderField(field) {
   var control;
   if (type === "textarea") control = _renderTextarea(field);
   else if (type === "select") control = _renderSelect(field);
-  else if (INPUT_TYPES[type])  control = _renderInput(field);
+  else if (Object.prototype.hasOwnProperty.call(INPUT_TYPES, type))  control = _renderInput(field);
   else throw new Error("forms.render: unsupported field type: " + type);
 
   // Hidden + submit fields don't need a label wrapper

package/lib/framework-error.js

@@ -144,6 +144,11 @@ var SchedulerError        = defineClass("SchedulerError");
 var SessionError          = defineClass("SessionError");
 var SlugError             = defineClass("SlugError",             { alwaysPermanent: true });
 var WebhookError          = defineClass("WebhookError",          { alwaysPermanent: true });
+// WebhookDispatcherError covers the durable signed-webhook delivery store
+// (b.webhook.dispatcher): endpoint registration, fan-out, retry/backoff, and
+// dead-letter operations. Distinct from WebhookError (the stateless
+// sign/verify surface) so the persistence-layer error codes stay separable.
+var WebhookDispatcherError = defineClass("WebhookDispatcherError", { alwaysPermanent: true });
 var ApiKeyError           = defineClass("ApiKeyError",           { alwaysPermanent: true });
 var PermissionsError      = defineClass("PermissionsError",      { alwaysPermanent: true });
 // CacheError is alwaysPermanent: bad opts / missing key / closed-state
@@ -196,6 +201,11 @@ var GateContractError     = defineClass("GateContractError",     { alwaysPermane
 // validate paths. alwaysPermanent — chunk-shape errors / formula-injection
 // attempts / schema drift are all caller-shape errors.
 var GuardCsvError         = defineClass("GuardCsvError",         { alwaysPermanent: true });
+// GuardTextError covers free-text codepoint-threat violations on the validate /
+// sanitize / gate paths (bidi-override / control / null / zero-width /
+// Unicode-Tags / mixed-script-confusable). alwaysPermanent — every case is a
+// hostile-codepoint detection or a caller-shape opt error.
+var GuardTextError        = defineClass("GuardTextError",        { alwaysPermanent: true });
 // GuardAllError covers parity-check failures, exceptFor opt validation, and
 // override opt validation in the b.guardAll registry. alwaysPermanent — every
 // case is a config-time programming bug, not a transient runtime condition.
@@ -693,6 +703,7 @@ module.exports = {
   SessionError:           SessionError,
   SlugError:              SlugError,
   WebhookError:           WebhookError,
+  WebhookDispatcherError: WebhookDispatcherError,
   ApiKeyError:            ApiKeyError,
   PermissionsError:       PermissionsError,
   CacheError:             CacheError,
@@ -705,6 +716,7 @@ module.exports = {
   StaticServeError:       StaticServeError,
   GateContractError:      GateContractError,
   GuardCsvError:          GuardCsvError,
+  GuardTextError:         GuardTextError,
   GuardAllError:          GuardAllError,
   GuardHtmlError:         GuardHtmlError,
   GuardSvgError:          GuardSvgError,

package/lib/framework-schema.js

@@ -116,6 +116,10 @@ var LOCAL_TO_EXTERNAL = Object.freeze({
   // places — cluster-storage.execute routes the SQL to the right DB
   // based on cluster.isClusterMode().
   _blamejs_sessions:  "_blamejs_sessions",
+  // _blamejs_session_valid_from — per-subject valid-from boundary for
+  // stateless-token revocation (b.session.bump / check / validFrom). Same
+  // dual-storage shape as _blamejs_sessions; identity-mapped.
+  _blamejs_session_valid_from: "_blamejs_session_valid_from",
   // _blamejs_jobs — same dual-storage pattern as sessions. The local-
   // protocol queue (lib/queue-local.js) routes through cluster-storage
   // so writes/reads land in the leader's external-db when cluster
@@ -649,6 +653,20 @@ function _sessionsDDL(dialect) {
   ]);
 }
 
+// _blamejs_session_valid_from — monotonic per-subject valid-from boundary for
+// stateless-token revocation. Mirrors the local-SQLite schema in db.js's
+// FRAMEWORK_SCHEMA so single-node and cluster behavior are identical.
+// subjectHash is the PRIMARY KEY (the plaintext subject id never lands here);
+// validFromEpoch is the monotonic boundary (ms); updatedAt records the bump.
+function _sessionValidFromDDL(dialect) {
+  var t = _types(dialect);
+  return _table(tableName("_blamejs_session_valid_from"), dialect, [
+    { col: "subjectHash",    def: t.KT + " PRIMARY KEY" },
+    { col: "validFromEpoch", def: t.INT + " NOT NULL" },
+    { col: "updatedAt",      def: t.INT + " NOT NULL" },
+  ], []);
+}
+
 // _blamejs_jobs — local-protocol queue jobs. Mirrors db.js's
 // FRAMEWORK_SCHEMA for the same table; sealed columns (payload,
 // lastError) are stored vault-sealed. Indexes target the lease
@@ -824,6 +842,7 @@ function _allDDLs(dialect) {
     _apiEncryptNoncesDDL(dialect),
     _apiKeysDDL(dialect),
     _sessionsDDL(dialect),
+    _sessionValidFromDDL(dialect),
     _jobsDDL(dialect),
     _cacheDDL(dialect),
     _cacheTagsDDL(dialect),

package/lib/fsm.js

@@ -439,18 +439,13 @@ async function _runTransition(instance, name, opts) {
   // drop-silent; the additional try/catch protects against the
   // lazy-loaded audit module throwing at first-access time.
   try {
-    audit().safeEmit({
-      action: "fsm." + instance._def.name + ".transition",
-      actor:  opts.actor ? { id: opts.actor } : { id: "<system>" },
-      outcome: "success",
-      metadata: {
-        from:       fromState,
-        to:         toState,
-        transition: name,
-        machine:    instance._def.name,
-        callerMeta: opts.metadata || null,
-      },
-    });
+    audit().namespaced("fsm")(instance._def.name + ".transition", "success", {
+      from:       fromState,
+      to:         toState,
+      transition: name,
+      machine:    instance._def.name,
+      callerMeta: opts.metadata || null,
+    }, { actor: opts.actor ? { id: opts.actor } : { id: "<system>" } });
   } catch (_e) { /* drop-silent — audit best-effort */ }
   return { from: fromState, to: toState, on: name };
 }