@blamejs/core 0.15.12 → 0.15.14

package/lib/middleware/speculation-rules.js

@@ -66,6 +66,7 @@
 
 var validateOpts = require("../validate-opts");
 var safeBuffer = require("../safe-buffer");
+var safeJson = require("../safe-json");
 
 // Per W3C draft + Chromium implementation. `immediate` triggers the
 // speculation as soon as the rules are seen; `conservative` waits
@@ -129,7 +130,7 @@ function _validateRules(rules, label) {
         throw new TypeError(label + "." + actionKey + "[" + ei +
           "].where must be a `where` clause object (W3C draft, e.g. { href_matches: \"/path/*\" })");
       }
-      if (typeof rule.eagerness !== "string" || !EAGERNESS_LEVELS[rule.eagerness]) {
+      if (typeof rule.eagerness !== "string" || !Object.prototype.hasOwnProperty.call(EAGERNESS_LEVELS, rule.eagerness)) {
         throw new TypeError(label + "." + actionKey + "[" + ei +
           "].eagerness must be one of: " + Object.keys(EAGERNESS_LEVELS).join(", "));
       }
@@ -245,8 +246,10 @@ function create(opts) {
   }
 
   // Pre-built inline JSON. The body is small (rules objects are
-  // typically ~200 bytes); JSON.stringify once and cache.
-  var inlineJson = inline ? JSON.stringify(rulesObj) : null;
+  // typically ~200 bytes); stringify once and cache. Uses the
+  // <script>-safe serializer so a rules value containing "</script>"
+  // (or U+2028/U+2029) cannot break out of the injected element.
+  var inlineJson = inline ? safeJson.stringifyForScript(rulesObj) : null;
 
   return function speculationRules(req, res, next) {
     if (!inline) {

package/lib/middleware/tus-upload.js

@@ -150,10 +150,10 @@ function _parseChecksumHeader(headerValue, allowedSet) {
   // alphabet); refuse those on the RAW value BEFORE the slice/trim
   // normalisation (same v0.8.90 trim-before-validate bug class).
   if (structuredFields.containsControlBytes(headerValue)) return { error: "malformed" };
-  var sp = headerValue.indexOf(" ");
-  if (sp === -1) return { error: "malformed" };
-  var algo = headerValue.slice(0, sp).trim().toLowerCase();
-  var digestB64 = headerValue.slice(sp + 1).trim();
+  var kvp = structuredFields.parseKeyValuePiece(headerValue, " ");
+  if (kvp.value === null) return { error: "malformed" };
+  var algo = kvp.key;
+  var digestB64 = kvp.value.trim();
   if (algo.length === 0 || digestB64.length === 0) return { error: "malformed" };
   if (!allowedSet[algo]) return { error: "algo-unsupported" };
   if (!/^[A-Za-z0-9+/=]+$/.test(digestB64)) return { error: "malformed" };
@@ -311,19 +311,11 @@ function _emitTusBaseHeaders(res, extra) {
 }
 
 function _readChunk(req, maxChunkSize) {
-  return new Promise(function (resolve, reject) {
-    var collector = safeBuffer.boundedChunkCollector({
-      maxBytes:    maxChunkSize,
-      errorClass:  TusError,
-      sizeCode:    "tus/chunk-too-large",
-      sizeMessage: "PATCH body exceeded maxChunkSize",
-    });
-    req.on("data", function (c) {
-      try { collector.push(c); }
-      catch (e) { req.removeAllListeners("data"); reject(e); }
-    });
-    req.on("end", function () { resolve(collector.result()); });
-    req.on("error", function (e) { reject(e); });
+  return safeBuffer.collectStream(req, {
+    maxBytes:    maxChunkSize,
+    errorClass:  TusError,
+    sizeCode:    "tus/chunk-too-large",
+    sizeMessage: "PATCH body exceeded maxChunkSize",
   });
 }
 
@@ -388,11 +380,8 @@ function create(opts) {
   }
 
   var store = opts.store;
-  if (!store || typeof store.create !== "function" || typeof store.head !== "function" ||
-      typeof store.append !== "function" || typeof store.terminate !== "function") {
-    throw new TusError("tus/bad-store",
-      "middleware.tusUpload: store must implement { create, head, append, terminate }");
-  }
+  validateOpts.requireMethods(store, ["create", "head", "append", "terminate"],
+    "middleware.tusUpload: store", TusError, "tus/bad-store");
 
   var maxSize = opts.maxSize;
   if (maxSize !== undefined && (typeof maxSize !== "number" || !isFinite(maxSize) || maxSize <= 0)) {
@@ -410,7 +399,7 @@ function create(opts) {
 
   var extensions = Array.isArray(opts.extensions) ? opts.extensions.slice() : DEFAULT_EXTENSIONS.slice();
   for (var i = 0; i < extensions.length; i++) {
-    if (!KNOWN_EXTENSIONS[extensions[i]]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_EXTENSIONS, extensions[i])) {
       throw new TusError("tus/bad-opts",
         "middleware.tusUpload: unknown extension '" + extensions[i] + "'");
     }
@@ -427,7 +416,7 @@ function create(opts) {
   var checksumAlgorithmSet = {};
   for (var j = 0; j < checksumAlgorithms.length; j++) {
     var algo = checksumAlgorithms[j];
-    if (!KNOWN_CHECKSUM_ALGORITHMS[algo]) {
+    if (!Object.prototype.hasOwnProperty.call(KNOWN_CHECKSUM_ALGORITHMS, algo)) {
       throw new TusError("tus/bad-opts",
         "middleware.tusUpload: unknown checksum algorithm '" + algo + "'");
     }
@@ -451,11 +440,7 @@ function create(opts) {
     return new Date(rec.expireAt).toUTCString();
   }
 
-  function _emitMetric(verb, _outcome, _metadata) {
-    if (!auditOn) return;
-    try { observability().safeEvent("middleware.tusUpload." + verb, 1, {}); }
-    catch (_e) { /* drop-silent — observability sink */ }
-  }
+  var _emitMetric = observability().namespaced("middleware.tusUpload", auditOn);
 
   async function _handleOptions(req, res) {
     var headers = _emitTusBaseHeaders(res, {

package/lib/middleware/web-app-manifest.js

@@ -29,6 +29,7 @@
 var lazyRequire = require("../lazy-require");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response");
 var { defineClass } = require("../framework-error");
 
 var WebAppManifestError = defineClass("WebAppManifestError", { alwaysPermanent: true });
@@ -135,13 +136,7 @@ function create(opts) {
                   (alsoAtJsonPath && path === "/manifest.json");
     if (!matches) return next();
     if (req.method !== "GET" && req.method !== "HEAD") {
-      var bodyMsg = "Method Not Allowed";
-      res.writeHead(405, {                                                       // HTTP 405 status
-        "Allow":          "GET, HEAD",
-        "Content-Type":   "text/plain; charset=utf-8",
-        "Content-Length": Buffer.byteLength(bodyMsg),
-      });
-      res.end(bodyMsg);
+      denyResponse.methodNotAllowed(res, "GET, HEAD");
       return;
     }
     res.writeHead(200, {                                                         // HTTP 200 status

package/lib/migrations.js

@@ -39,6 +39,7 @@
  */
 
 var nodePath = require("node:path");
+var moduleLoader = require("./module-loader");
 var atomicFile = require("./atomic-file");
 var dbSchema = require("./db-schema");
 var frameworkSchema = require("./framework-schema");
@@ -269,21 +270,11 @@ function _resolveDb(opts) {
 }
 
 function _loadMigration(file, dir) {
-  var fullPath = nodePath.join(dir, file);
-  // Drop the require cache for this path before loading so a test that
-  // changes a migration file between calls picks up the new content.
-  // Production deployments would always restart the process, but this
-  // keeps test fixtures sane.
-  try { delete require.cache[require.resolve(fullPath)]; } catch (_e) { /* not yet cached */ }
-  var mod;
-  // Operator-supplied migration — dynamic by design, can't be bundle-
-  // traced. Host-CLI scope; deploying via SEA / pkg drops this surface.
-  try { mod = require(fullPath); }   // allow:dynamic-require — operator-supplied migration
-  catch (e) {
-    throw new MigrationError("migrations/load-failed",
+  var mod = moduleLoader.requireFresh(nodePath.join(dir, file), function (e) {
+    return new MigrationError("migrations/load-failed",
       "migration '" + file + "' failed to load: " + ((e && e.message) || String(e)),
       true);
-  }
+  });
   if (!mod || typeof mod.up !== "function") {
     throw new MigrationError("migrations/missing-up",
       "migration '" + file + "' must export an `up(db)` function", true);

package/lib/mime-parse.js

@@ -37,32 +37,48 @@
  * mdn: 1 MiB) so this module's hot-path doesn't add its own cap.
  */
 
-function parseHeaderBlock(text) {
-  // RFC 5322 §2.2.3 — continuation lines (lines starting with WSP)
-  // fold onto the previous header value. The header section ends at
-  // the first empty line; subsequent lines belong to the body.
-  var lines = text.split(/\r?\n/);
-  var unfolded = [];
+function classifyHeaderBlock(text) {
+  // RFC 5322 §2.2 — every line of a header section is either a header field
+  // (`name: value`), a folding continuation (leading WSP), or the empty line
+  // that ends the section. Anything else is MALFORMED — and a colon-less line
+  // sitting in the header section is the header-injection / SMTP-smuggling
+  // signal (attacker content on a bare line followed by an injected
+  // Bcc/To/From header). `fields` is the parsed headers (boundary-aware,
+  // continuation-unfolded); `malformed` is the injection/structure evidence the
+  // silent-skip parsers (email, mime, dsn, arc) all dropped on the floor.
+  var lines = String(text == null ? "" : text).split(/\r?\n/);
+  var unfolded = [];                                                            // [{ line, lineIndex }]
   for (var i = 0; i < lines.length; i += 1) {
     var line = lines[i];
-    if (line.length === 0) break;
+    if (line.length === 0) break;                                              // header/body boundary
     if ((line.charAt(0) === " " || line.charAt(0) === "\t") && unfolded.length > 0) {
-      unfolded[unfolded.length - 1] += " " + line.replace(/^\s+/, "");
+      unfolded[unfolded.length - 1].line += " " + line.replace(/^\s+/, "");
     } else {
-      unfolded.push(line);
+      unfolded.push({ line: line, lineIndex: i });
     }
   }
-  var headers = [];
+  var fields = [];
+  var malformed = [];
   for (var j = 0; j < unfolded.length; j += 1) {
-    var l = unfolded[j];
-    var colonAt = l.indexOf(":");
-    if (colonAt === -1) continue;
-    headers.push({
-      name:  l.slice(0, colonAt).trim(),
-      value: l.slice(colonAt + 1).trim(),
+    var entry = unfolded[j];
+    var colonAt = entry.line.indexOf(":");
+    if (colonAt === -1) {
+      malformed.push({ lineIndex: entry.lineIndex, line: entry.line, reason: "no-colon" });
+      continue;
+    }
+    fields.push({
+      name:  entry.line.slice(0, colonAt).trim(),
+      value: entry.line.slice(colonAt + 1).trim(),
     });
   }
-  return headers;
+  return { fields: fields, malformed: malformed };
+}
+
+function parseHeaderBlock(text) {
+  // The fields view of the shared classifier — kept for every caller that only
+  // wants the parsed headers (the malformed lines are reached via
+  // classifyHeaderBlock for structure/injection validation).
+  return classifyHeaderBlock(text).fields;
 }
 
 function splitHeadersAndBody(text) {
@@ -189,6 +205,7 @@ function addressType(addr) {
 
 module.exports = {
   parseHeaderBlock:    parseHeaderBlock,
+  classifyHeaderBlock: classifyHeaderBlock,
   splitHeadersAndBody: splitHeadersAndBody,
   findHeader:          findHeader,
   parseContentType:    parseContentType,

package/lib/module-loader.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * lib/module-loader.js — the single audited entry point for loading an
+ * operator-supplied module file (a migration or a seed) by path.
+ *
+ * Operator modules execute arbitrary code on `require`, so the dynamic
+ * `require()` lives here behind ONE `allow:dynamic-require` marker rather
+ * than scattered across every host-CLI loader (`b.migrations`,
+ * `b.seeders`, `b.externalDb.migrate`). The require cache is busted first
+ * so a dev / test rewriting a fixture between calls picks up the new
+ * content (production deployments restart the process). The dynamic
+ * require does not survive SEA / esbuild bundling — operator migrations
+ * and seeds are host-CLI scope, not framework-internal scope.
+ *
+ * The caller owns path construction (it knows its own directory layout)
+ * and the typed, domain-specific error it throws on a load failure
+ * (parse error, throwing top-level code), so resolution stays identical
+ * to the per-loader form it replaces.
+ */
+
+/**
+ * requireFresh(absPath, onLoadError) — bust the require cache for
+ * `absPath`, then require it fresh. `absPath` MUST be absolute (a bare
+ * relative path would resolve against node_modules, which is never an
+ * operator file). On a load failure, `onLoadError(err)` builds the
+ * caller's typed error, which is thrown.
+ *
+ *   var mod = moduleLoader.requireFresh(path.join(dir, file), function (e) {
+ *     return new MigrationError("migrations/load-failed",
+ *       "migration '" + file + "' failed to load: " + ((e && e.message) || String(e)), true);
+ *   });
+ */
+function requireFresh(absPath, onLoadError) {
+  try { delete require.cache[require.resolve(absPath)]; } catch (_e) { /* not yet cached */ }
+  try {
+    return require(absPath);   // allow:dynamic-require — operator-supplied module (migration / seed)
+  } catch (e) {
+    throw onLoadError(e);
+  }
+}
+
+module.exports = {
+  requireFresh: requireFresh,
+};

package/lib/money.js

@@ -277,6 +277,32 @@ Money.prototype.multiply = function (factor, opts) {
   return new Money(quotient, this.currency);
 };
 
+/**
+ * @primitive  b.money.Money.roundToIncrement
+ * @signature  b.money.Money.roundToIncrement(step, opts?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.money.roundMinor, b.money.Money
+ *
+ * Snap this amount to the nearest multiple of `step` minor units, returning a
+ * new `Money` in the same currency — the cash-rounding step a coarser
+ * denomination needs (CHF to the nearest 0.05, SEK to the nearest 0.10, a
+ * 100-unit price step) without leaving the type. Integer-only; immutable;
+ * negative amounts (refund previews) round on the correct side of the tie. See
+ * `b.money.roundMinor` for the raw-integer form and the mode semantics.
+ *
+ * @opts
+ *   mode:  "half-even" | "half-up" | "half-down" | "ceiling" | "floor",  // default: half-even
+ *
+ * @example
+ *   b.money.of("12.32", "CHF").roundToIncrement(5, { mode: "half-up" });  // → CHF 12.30
+ *   b.money.of("19.97", "SEK").roundToIncrement(10);                      // → SEK 20.00
+ */
+Money.prototype.roundToIncrement = function (step, opts) {
+  opts = opts || {};
+  return new Money(roundMinor(this._minor, step, opts.mode || "half-even"), this.currency);
+};
+
 // _rationalFromDecimalString -- `"1.085"` -> { num: 1085n, den: 1000n }.
 // Strict shape; same refusals as _parseDecimalString.
 function _rationalFromDecimalString(s) {
@@ -333,6 +359,84 @@ function _divRound(n, d, rounding) {
   return r < 0n ? q - 1n : q + 1n;
 }
 
+// Cash-rounding modes for roundMinor / Money.roundToIncrement. half-even
+// (banker's) is the default and matches the rest of the module; half-up rounds
+// a tie away from zero, half-down toward zero; ceiling/floor are directional
+// (toward +inf / -inf) regardless of distance.
+var INCREMENT_MODES = {
+  "half-even": true, "half-up": true, "half-down": true, "ceiling": true, "floor": true,
+};
+
+function _toIncrementBigInt(step) {
+  if (typeof step === "bigint") {
+    if (step <= 0n) throw new MoneyError("money/bad-increment",
+      "step must be a positive integer of minor units");
+    return step;
+  }
+  if (typeof step === "number" && Number.isInteger(step) && step > 0) return BigInt(step);
+  throw new MoneyError("money/bad-increment",
+    "step must be a positive integer (BigInt or safe integer Number) of minor units; got " +
+    (typeof step === "number" ? String(step) : typeof step));
+}
+
+/**
+ * @primitive  b.money.roundMinor
+ * @signature  b.money.roundMinor(minor, step, mode?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.money.Money, b.money.fromMinorUnits
+ *
+ * Snap a raw minor-unit integer to the nearest multiple of `step` minor units —
+ * the cash-rounding step a coarser cash denomination needs even though the
+ * currency's ISO 4217 minor unit is finer (a CHF total to the nearest 5 rappen
+ * after the 1/2-rappen coins were retired, a SEK total to the nearest 10 öre, a
+ * JPY total to a 100-unit psychological-pricing step). Pure BigInt math — no
+ * `Number` in the value path — and the remainder sign is handled so a negative
+ * amount (a refund preview) rounds on the correct side of the tie.
+ *
+ * `minor` accepts a BigInt or a safe integer `Number`; the return is a BigInt.
+ *
+ * @opts
+ *   mode:  "half-even" | "half-up" | "half-down" | "ceiling" | "floor",  // default: half-even
+ *
+ * @example
+ *   b.money.roundMinor(1232n, 5n);              // CHF 12.32 → nearest 0.05 → 1230n (12.30)
+ *   b.money.roundMinor(25n, 10n, "half-even");  // tie → even multiple → 20n
+ *   b.money.roundMinor(25n, 10n, "half-up");    // tie away from zero → 30n
+ *   b.money.roundMinor(-25n, 10n, "half-up");   // refund tie away from zero → -30n
+ */
+function roundMinor(minor, step, mode) {
+  mode = mode || "half-even";
+  if (typeof minor === "number" && Number.isInteger(minor)) minor = BigInt(minor);
+  if (typeof minor !== "bigint") {
+    throw new MoneyError("money/bad-minor-units",
+      "minor must be an integer (BigInt or safe integer Number); got " + (typeof minor));
+  }
+  if (!Object.prototype.hasOwnProperty.call(INCREMENT_MODES, mode)) {
+    throw new MoneyError("money/bad-rounding-mode",
+      "mode must be one of half-even | half-up | half-down | ceiling | floor; got " + String(mode));
+  }
+  var stepBig = _toIncrementBigInt(step);
+  var q = minor / stepBig;
+  var r = minor - q * stepBig;
+  if (r === 0n) return minor;
+  // lower = the multiple toward -inf, upper = toward +inf. BigInt division
+  // truncates toward zero, so the bracket flips by sign of `minor`.
+  var lower, upper;
+  if (minor >= 0n) { lower = q * stepBig; upper = lower + stepBig; }
+  else { upper = q * stepBig; lower = upper - stepBig; }
+  if (mode === "floor") return lower;
+  if (mode === "ceiling") return upper;
+  var distLow = minor - lower;     // >= 0
+  var distHigh = upper - minor;    // >= 0
+  if (distLow < distHigh) return lower;
+  if (distHigh < distLow) return upper;
+  // Exactly on the tie.
+  if (mode === "half-up") return (minor >= 0n) ? upper : lower;     // away from zero
+  if (mode === "half-down") return (minor >= 0n) ? lower : upper;   // toward zero
+  return ((lower / stepBig) % 2n === 0n) ? lower : upper;           // half-even
+}
+
 // allocate -- split `this` into `weights.length` parts proportional to
 // the weights, distributing every minor unit. Largest-remainder
 // method: floor each share, then hand out the leftover units to the
@@ -693,6 +797,7 @@ module.exports = {
   parse:           parse,
   zero:            zero,
   convert:         convert,
+  roundMinor:      roundMinor,
   CURRENCIES:      CURRENCIES,
   Money:           Money,
   MoneyError:      MoneyError,