@blamejs/core 0.15.12 → 0.15.14

package/lib/numeric-bounds.js

@@ -42,6 +42,20 @@ function shape(value) {
   return (typeof value) + " " + String(value);
 }
 
+// _throwInt — construct + throw a code-first defineClass error. When no
+// errorOpts is supplied the call is the historical bare `new ErrorClass(
+// code, message)` (byte-identical for every existing caller); pass
+// errorOpts { permanent, statusCode } to forward the framework error's
+// non-retryable flag / HTTP status (a config opt that's wrong on retry
+// stays wrong; a request-shaped opt carries its 4xx). Message-FIRST
+// classes (AtomicFileError / SafeBufferError / SafeUrlError) must NOT use
+// the require* throwers — they use the isPositiveFiniteInt predicate + their
+// own throw (see the module header) so code/message don't swap.
+function _throwInt(errorClass, code, message, errorOpts) {
+  if (errorOpts) throw new errorClass(code, message, errorOpts.permanent, errorOpts.statusCode);
+  throw new errorClass(code, message);
+}
+
 function isPositiveFiniteInt(value) {
   return typeof value === "number" && Number.isFinite(value) &&
          Number.isInteger(value) && value > 0;
@@ -52,6 +66,14 @@ function isNonNegativeFiniteInt(value) {
          Number.isInteger(value) && value >= 0;
 }
 
+// Any-sign finite integer (no sign bound) — for callers that only require
+// integrality (e.g. a CloudEvents 32-bit signed-integer extension, a DNS
+// algorithm/digest-type code) and reject only non-numbers / floats / Infinity /
+// NaN. Distinct from isNonNegativeFiniteInt (which also forbids negatives).
+function isFiniteInt(value) {
+  return typeof value === "number" && Number.isFinite(value) && Number.isInteger(value);
+}
+
 // requirePositiveFiniteIntIfPresent / requireNonNegativeFiniteIntIfPresent —
 // optional-shape gates that throw via the caller's framework-error class
 // when the value is present but invalid. Replaces the per-file
@@ -64,11 +86,11 @@ function isNonNegativeFiniteInt(value) {
 //   nb.requirePositiveFiniteIntIfPresent(opts.graceMs,
 //     "app-shutdown.create: opts.graceMs", AppShutdownError,
 //     "app-shutdown/bad-grace-ms");
-function requirePositiveFiniteIntIfPresent(value, label, errorClass, code) {
+function requirePositiveFiniteIntIfPresent(value, label, errorClass, code, errorOpts) {
   if (value === undefined) return value;
   if (!isPositiveFiniteInt(value)) {
-    throw new errorClass(code,
-      (label || "value") + " must be a positive finite integer; got " + shape(value));
+    _throwInt(errorClass, code,
+      (label || "value") + " must be a positive finite integer; got " + shape(value), errorOpts);
   }
   return value;
 }
@@ -102,13 +124,13 @@ function _rangeSuffix(range) {
   if (range.min != null) return " >= " + range.min;
   return "";
 }
-function requirePositiveFiniteInt(value, label, errorClass, code, range) {
+function requirePositiveFiniteInt(value, label, errorClass, code, range, errorOpts) {
   var inRange = !range ||
     ((range.min == null || value >= range.min) && (range.max == null || value <= range.max));
   if (!isPositiveFiniteInt(value) || !inRange) {
-    throw new errorClass(code,
+    _throwInt(errorClass, code,
       (label || "value") + " must be a positive finite integer" +
-      _rangeSuffix(range) + "; got " + shape(value));
+      _rangeSuffix(range) + "; got " + shape(value), errorOpts);
   }
   return value;
 }
@@ -123,12 +145,12 @@ function requirePositiveFiniteInt(value, label, errorClass, code, range) {
 //   nb.requireAllPositiveFiniteIntIfPresent(opts,
 //     ["maxBytes", "maxAttrValueBytes", "maxTagDepth", "maxAttrsPerTag"],
 //     "guardHtml.validate", GuardHtmlError, "html.bad-opt");
-function requireAllPositiveFiniteIntIfPresent(opts, names, labelPrefix, errorClass, code) {
+function requireAllPositiveFiniteIntIfPresent(opts, names, labelPrefix, errorClass, code, errorOpts) {
   if (!opts || !Array.isArray(names)) return;
   for (var i = 0; i < names.length; i += 1) {
     var n = names[i];
     requirePositiveFiniteIntIfPresent(opts[n],
-      (labelPrefix || "") + ": " + n, errorClass, code);
+      (labelPrefix || "") + ": " + n, errorClass, code, errorOpts);
   }
 }
 
@@ -136,6 +158,7 @@ module.exports = {
   shape:                                  shape,
   isPositiveFiniteInt:                    isPositiveFiniteInt,
   isNonNegativeFiniteInt:                 isNonNegativeFiniteInt,
+  isFiniteInt:                            isFiniteInt,
   requirePositiveFiniteInt:               requirePositiveFiniteInt,
   requirePositiveFiniteIntIfPresent:      requirePositiveFiniteIntIfPresent,
   requireNonNegativeFiniteIntIfPresent:   requireNonNegativeFiniteIntIfPresent,

package/lib/object-store/azure-blob-bucket-ops.js

@@ -33,6 +33,7 @@ var C = require("../constants");
 var httpClient = require("../http-client");
 var requestHelpers = require("../request-helpers");
 var safeUrl = require("../safe-url");
+var markupEscape = require("../markup-escape").markupEscape;
 var { ObjectStoreError } = require("../framework-error");
 
 var _err = ObjectStoreError.factory;
@@ -122,12 +123,7 @@ function _validateCorsRule(rule, idx) {
 }
 
 function _xmlEscape(s) {
-  return String(s)
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&apos;");
+  return markupEscape(s, { apos: "&apos;" });
 }
 
 function _buildCorsXml(rules) {

package/lib/object-store/azure-blob.js

@@ -37,7 +37,6 @@
  */
 var nodeCrypto = require("node:crypto");
 var { URL } = require("node:url");
-var { Readable } = require("node:stream");
 var safeXml = require("../parsers/safe-xml");
 var sharedRequest = require("./http-request");
 var sigv4 = require("./sigv4");
@@ -93,14 +92,6 @@ function _encodeBlobKey(key) {
 
 var DEFAULT_API_VERSION = "2024-08-04";
 
-// Service SAS expiry bounds. Azure doesn't enforce a hard max, but
-// matching the SigV4 / V4 7-day cap keeps semantics uniform across
-// backends and reflects best practice (long-lived SAS tokens are
-// effectively credentials).
-var SAS_DEFAULT_EXPIRES_SECONDS = C.TIME.minutes(15) / C.TIME.seconds(1);
-var SAS_MAX_EXPIRES_SECONDS     = C.TIME.days(7)     / C.TIME.seconds(1);
-var SAS_MIN_EXPIRES_SECONDS     = 1;
-
 var _err = ObjectStoreError.factory;
 
 var _httpRequest = sharedRequest;
@@ -307,38 +298,18 @@ function create(config) {
     return getResponse(key, opts).then(function (r) { return r.body; });
   }
 
-  function getStream(key, opts) { return Readable.from(get(key, opts)); }
+  function getStream(key, opts) { return sharedRequest.promiseToStream(get(key, opts)); }
 
   function getResponse(key, opts) {
     opts = opts || {};
     var url = _blobUrl(key);
-    var extraHeaders = {};
-    if (opts.range) {
-      extraHeaders["x-ms-range"] = "bytes=" + opts.range.start + "-" + opts.range.end;
-    }
-    if (opts.ifNoneMatch)       extraHeaders["If-None-Match"]       = opts.ifNoneMatch;
-    if (opts.ifMatch)           extraHeaders["If-Match"]            = opts.ifMatch;
-    if (opts.ifModifiedSince)   extraHeaders["If-Modified-Since"]   = opts.ifModifiedSince;
-    if (opts.ifUnmodifiedSince) extraHeaders["If-Unmodified-Since"] = opts.ifUnmodifiedSince;
+    var extraHeaders = sharedRequest.applyConditionalGetHeaders({}, opts, "x-ms-range");
     var headers = _signed("GET", url, extraHeaders);
     return _httpRequest("GET", url, headers, null, reqOpts).then(function (res) {
-      return {
-        statusCode:   res.statusCode,
-        body:         res.body,
-        etag:         res.headers && res.headers.etag,
-        lastModified: res.headers && res.headers["last-modified"]
-                      ? Date.parse(res.headers["last-modified"]) : null,
-        contentRange: res.headers && res.headers["content-range"] || null,
-        size:         res.headers && res.headers["content-length"]
-                      ? parseInt(res.headers["content-length"], 10) : null,
-        contentType:  res.headers && res.headers["content-type"] || null,
-      };
+      return sharedRequest.mapGetResponse(res);
     }, function (err) {
       if (err && err.statusCode === requestHelpers.HTTP_STATUS.NOT_MODIFIED) {
-        return {
-          statusCode: requestHelpers.HTTP_STATUS.NOT_MODIFIED,
-          body: null, etag: null, lastModified: null,
-        };
+        return sharedRequest.notModifiedGetResult();
       }
       throw err;
     });
@@ -348,11 +319,7 @@ function create(config) {
     var url = _blobUrl(key);
     var headers = _signed("HEAD", url, {});
     return _httpRequest("HEAD", url, headers, null, reqOpts).then(function (res) {
-      return {
-        size:         res.headers["content-length"] ? parseInt(res.headers["content-length"], 10) : null,
-        etag:         res.headers.etag,
-        lastModified: res.headers["last-modified"] ? Date.parse(res.headers["last-modified"]) : null,
-      };
+      return sharedRequest.mapHeadResponse(res);
     });
   }
 
@@ -415,15 +382,7 @@ function create(config) {
   // "Create a service SAS". We sign with the account key (HMAC-SHA256
   // over the canonical string) and emit the token as URL query params.
   function _buildSasToken(permissions, opts) {
-    var expiresIn = opts.expiresIn != null ? opts.expiresIn : SAS_DEFAULT_EXPIRES_SECONDS;
-    if (typeof expiresIn !== "number" ||
-        expiresIn < SAS_MIN_EXPIRES_SECONDS ||
-        expiresIn > SAS_MAX_EXPIRES_SECONDS) {
-      throw _err("INVALID_EXPIRES",
-        "presigned URL: expiresIn must be a number of seconds between " +
-        SAS_MIN_EXPIRES_SECONDS + " and " + SAS_MAX_EXPIRES_SECONDS +
-        " (7 days)", true);
-    }
+    var expiresIn = sharedRequest.resolvePresignExpires(opts, "presigned URL", "");
     var nowDate = opts.date || new Date();
     var expiry = new Date(nowDate.getTime() + C.TIME.seconds(expiresIn));
     // Azure accepts ISO 8601 with second precision; strip ms.

package/lib/object-store/gcs-bucket-ops.js

@@ -23,13 +23,13 @@
  * Auth: same service-account JSON / RSA-SHA256-signed JWT exchanged
  * for an OAuth2 access token as `lib/object-store/gcs.js`.
  */
-var nodeFs = require("node:fs");
 var gcs = require("./gcs");
 var authHeader = require("../auth-header");
 var httpClient = require("../http-client");
 var safeJson = require("../safe-json");
 var safeUrl = require("../safe-url");
 var C = require("../constants");
+var atomicFile = require("../atomic-file");
 var requestHelpers = require("../request-helpers");
 var { ObjectStoreError } = require("../framework-error");
 
@@ -139,7 +139,9 @@ function create(config) {
   var serviceAccount = config.serviceAccount;
   if (!serviceAccount && config.serviceAccountFile) {
     try {
-      serviceAccount = safeJson.parse(nodeFs.readFileSync(config.serviceAccountFile));
+      // Cap + fd-bound read of the GCS service-account JSON (private_key). NO
+      // refuseSymlink: commonly a k8s projected-secret mount (symlink).
+      serviceAccount = safeJson.parse(atomicFile.fdSafeReadSync(config.serviceAccountFile, { maxBytes: C.BYTES.kib(64), encoding: "utf8" }));
     } catch (e) {
       throw _err("BAD_OPT", "gcs bucketOps: failed to read serviceAccountFile '" +
         config.serviceAccountFile + "': " + ((e && e.message) || String(e)), true);

package/lib/object-store/gcs.js

@@ -22,13 +22,11 @@
  *   https://cloud.google.com/storage/docs/json_api/v1
  *   https://developers.google.com/identity/protocols/oauth2/service-account
  */
-var nodeFs = require("node:fs");
 var nodeCrypto = require("node:crypto");
-var { Readable } = require("node:stream");
 var bCrypto = require("../crypto");
 var safeJson = require("../safe-json");
 var C = require("../constants");
-var numericBounds = require("../numeric-bounds");
+var atomicFile = require("../atomic-file");
 var requestHelpers = require("../request-helpers");
 var { ObjectStoreError } = require("../framework-error");
 var safeUrl = require("../safe-url");
@@ -60,11 +58,6 @@ var GCS_V4_ALGORITHM = "GOOG4-RSA-SHA256";
 var GCS_V4_SERVICE   = "storage";
 var GCS_V4_REGION    = "auto";
 
-// Same expiry bounds as SigV4 — V4 presigning shares the spec's 7-day cap.
-var PRESIGN_DEFAULT_EXPIRES_SECONDS = C.TIME.minutes(15) / C.TIME.seconds(1);
-var PRESIGN_MAX_EXPIRES_SECONDS     = C.TIME.days(7)     / C.TIME.seconds(1);
-var PRESIGN_MIN_EXPIRES_SECONDS     = 1;
-
 var SERVICE_ACCOUNT_SCHEMA = {
   type: "object",
   required: ["client_email", "private_key"],
@@ -121,7 +114,10 @@ function create(config) {
   var serviceAccount = config.serviceAccount;
   if (!serviceAccount && config.serviceAccountFile) {
     try {
-      serviceAccount = safeJson.parse(nodeFs.readFileSync(config.serviceAccountFile), { schema: SERVICE_ACCOUNT_SCHEMA });
+      // Cap + fd-bound read of the GCS service-account JSON (contains the
+      // private_key). NO refuseSymlink: the SA file is commonly a k8s
+      // projected-secret mount (symlink). 64 KiB bounds the uncapped read.
+      serviceAccount = safeJson.parse(atomicFile.fdSafeReadSync(config.serviceAccountFile, { maxBytes: C.BYTES.kib(64), encoding: "utf8" }), { schema: SERVICE_ACCOUNT_SCHEMA });
     } catch (e) {
       throw new Error("gcs: failed to read serviceAccountFile '" + config.serviceAccountFile + "': " + e.message);
     }
@@ -230,7 +226,7 @@ function create(config) {
   }
 
   function getStream(key, opts) {
-    return Readable.from(get(key, opts));
+    return sharedRequest.promiseToStream(get(key, opts));
   }
 
   async function getResponse(key, opts) {
@@ -238,32 +234,13 @@ function create(config) {
     var token = await _ensureToken();
     var url = _objectUrl(key, { alt: "media" });
     var headers = authHeader.bearer(token);
-    if (opts.range) {
-      headers["Range"] = "bytes=" + opts.range.start + "-" + opts.range.end;
-    }
-    if (opts.ifNoneMatch)       headers["If-None-Match"]       = opts.ifNoneMatch;
-    if (opts.ifMatch)           headers["If-Match"]            = opts.ifMatch;
-    if (opts.ifModifiedSince)   headers["If-Modified-Since"]   = opts.ifModifiedSince;
-    if (opts.ifUnmodifiedSince) headers["If-Unmodified-Since"] = opts.ifUnmodifiedSince;
+    sharedRequest.applyConditionalGetHeaders(headers, opts, "Range");
     try {
       var res = await _httpRequest("GET", url, headers, null, reqOpts);
-      return {
-        statusCode:   res.statusCode,
-        body:         res.body,
-        etag:         res.headers && res.headers.etag,
-        lastModified: res.headers && res.headers["last-modified"]
-                      ? Date.parse(res.headers["last-modified"]) : null,
-        contentRange: res.headers && res.headers["content-range"] || null,
-        size:         res.headers && res.headers["content-length"]
-                      ? parseInt(res.headers["content-length"], 10) : null,
-        contentType:  res.headers && res.headers["content-type"] || null,
-      };
+      return sharedRequest.mapGetResponse(res);
     } catch (err) {
       if (err && err.statusCode === requestHelpers.HTTP_STATUS.NOT_MODIFIED) {
-        return {
-          statusCode: requestHelpers.HTTP_STATUS.NOT_MODIFIED,
-          body: null, etag: null, lastModified: null,
-        };
+        return sharedRequest.notModifiedGetResult();
       }
       throw err;
     }
@@ -326,21 +303,8 @@ function create(config) {
 
   function _v4Presign(method, opts) {
     opts = opts || {};
-    if (!opts.key || typeof opts.key !== "string") {
-      throw _err("INVALID_KEY", "presigned URL: key is required", true);
-    }
-    if (opts.key.indexOf("\0") !== -1) {
-      throw _err("INVALID_KEY", "null byte in key", true);
-    }
-    var expiresIn = opts.expiresIn != null ? opts.expiresIn : PRESIGN_DEFAULT_EXPIRES_SECONDS;
-    if (typeof expiresIn !== "number" ||
-        expiresIn < PRESIGN_MIN_EXPIRES_SECONDS ||
-        expiresIn > PRESIGN_MAX_EXPIRES_SECONDS) {
-      throw _err("INVALID_EXPIRES",
-        "presigned URL: expiresIn must be a number of seconds between " +
-        PRESIGN_MIN_EXPIRES_SECONDS + " and " + PRESIGN_MAX_EXPIRES_SECONDS +
-        " (7 days, V4 hard cap)", true);
-    }
+    sharedRequest.requirePresignKey(opts, "presigned URL");
+    var expiresIn = sharedRequest.resolvePresignExpires(opts, "presigned URL", "V4");
 
     // V4 presigned URLs target the XML API path-style endpoint
     // (storage.googleapis.com/{bucket}/{key}), not the JSON API used
@@ -418,34 +382,9 @@ function create(config) {
   // declared range get a 403 from the bucket itself.
   function presignedUploadPolicy(opts) {
     opts = opts || {};
-    if (!opts.key || typeof opts.key !== "string") {
-      throw _err("INVALID_KEY", "presignedUploadPolicy: key is required", true);
-    }
-    if (opts.key.indexOf("\0") !== -1) {
-      throw _err("INVALID_KEY", "null byte in key", true);
-    }
-    if (typeof opts.maxBytes !== "number" || !Number.isFinite(opts.maxBytes) ||
-        opts.maxBytes <= 0) {
-      throw _err("INVALID_MAX_BYTES",
-        "presignedUploadPolicy: maxBytes (positive number of bytes) is required — " +
-        "POST-form policy enforces body size via the content-length-range condition; " +
-        "use presignedUploadUrl if size enforcement is not needed", true);
-    }
-    if (opts.minBytes !== undefined && !numericBounds.isNonNegativeFiniteInt(opts.minBytes)) {
-      throw _err("INVALID_MIN_BYTES",
-        "presignedUploadPolicy: minBytes must be a non-negative finite integer; got " +
-        numericBounds.shape(opts.minBytes), true);
-    }
-    var minBytes = opts.minBytes !== undefined ? opts.minBytes : 0;
-    var expiresIn = opts.expiresIn != null ? opts.expiresIn : PRESIGN_DEFAULT_EXPIRES_SECONDS;
-    if (typeof expiresIn !== "number" ||
-        expiresIn < PRESIGN_MIN_EXPIRES_SECONDS ||
-        expiresIn > PRESIGN_MAX_EXPIRES_SECONDS) {
-      throw _err("INVALID_EXPIRES",
-        "presignedUploadPolicy: expiresIn must be a number of seconds between " +
-        PRESIGN_MIN_EXPIRES_SECONDS + " and " + PRESIGN_MAX_EXPIRES_SECONDS +
-        " (7 days, V4 hard cap)", true);
-    }
+    sharedRequest.requirePresignKey(opts, "presignedUploadPolicy");
+    var minBytes = sharedRequest.resolvePresignUploadMinBytes(opts);
+    var expiresIn = sharedRequest.resolvePresignExpires(opts, "presignedUploadPolicy", "V4");
 
     var date = opts.date || new Date();
     var amzDate = sigv4.formatAmzDate(date);

package/lib/object-store/http-put.js

@@ -16,7 +16,6 @@
  * Errors are surfaced as object-store errors with statusCode set so the
  * retry layer can classify retryable vs permanent.
  */
-var { Readable } = require("node:stream");
 var { ObjectStoreError } = require("../framework-error");
 var safeUrl = require("../safe-url");
 var sharedRequest = require("./http-request");
@@ -96,17 +95,13 @@ function create(config) {
     // https that doesn't buffer; return a Readable wrapping the buffered
     // body. Backends that support chunked transfer (e.g. SigV4) implement
     // a real streaming getStream in their own adapter.
-    return Readable.from(get(key));
+    return sharedRequest.promiseToStream(get(key));
   }
 
   function head(key) {
     var url = _keyToUrl(baseUrl, key);
     return _request("HEAD", url, null, headers, reqOpts).then(function (res) {
-      return {
-        size:         res.headers["content-length"] ? parseInt(res.headers["content-length"], 10) : null,
-        etag:         res.headers.etag,
-        lastModified: res.headers["last-modified"] ? Date.parse(res.headers["last-modified"]) : null,
-      };
+      return sharedRequest.mapHeadResponse(res);
     });
   }
 

package/lib/object-store/http-request.js

@@ -16,9 +16,19 @@
  * different class pass `errorClass: SomeError` in opts.
  */
 
+var { Readable } = require("node:stream");
 var httpClient = require("../http-client");
+var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
+var requestHelpers = require("../request-helpers");
 var { ObjectStoreError } = require("../framework-error");
 
+// Same code-first error factory the object-store backends use; the bare
+// cloud-provider-style codes (INVALID_KEY / INVALID_EXPIRES / ...) are the
+// existing object-store convention, swept to namespace/kebab-case for the
+// whole family in the v1.0 error-code pass.
+var _err = ObjectStoreError.factory;
+
 function request(method, url, headers, body, opts) {
   opts = opts || {};
   var req = {
@@ -35,4 +45,151 @@ function request(method, url, headers, body, opts) {
   return httpClient.request(req);
 }
 
+// ---- Shared presign opts validation (gcs / sigv4) ----
+// Every presigning entry point (presigned GET/PUT URLs and the POST-form
+// upload policy) opened with the same key + expiry bounds checks, varying
+// only in the message prefix and the signature-version label in the
+// hard-cap text. Centralized so the bounds are enforced identically and a
+// future change (a new cap, a different default) is one edit.
+var PRESIGN_DEFAULT_EXPIRES_SECONDS = C.TIME.minutes(15) / C.TIME.seconds(1);   // 15 minutes
+var PRESIGN_MAX_EXPIRES_SECONDS     = C.TIME.days(7)     / C.TIME.seconds(1);   // 7 days
+var PRESIGN_MIN_EXPIRES_SECONDS     = 1;
+
+function requirePresignKey(opts, msgPrefix) {
+  if (!opts.key || typeof opts.key !== "string") {
+    throw _err("INVALID_KEY", msgPrefix + ": key is required", true);
+  }
+  if (opts.key.indexOf("\0") !== -1) {
+    throw _err("INVALID_KEY", "null byte in key", true);
+  }
+}
+
+// hardCapLabel names the signing version in the cap text ("V4" / "SigV4"
+// → "(7 days, V4 hard cap)"); an empty / omitted label yields the plain
+// "(7 days)" tail used by the Azure SAS path, whose cap is the same 7 days
+// but is not a SigV4 family limit.
+function resolvePresignExpires(opts, msgPrefix, hardCapLabel) {
+  var expiresIn = opts.expiresIn != null ? opts.expiresIn : PRESIGN_DEFAULT_EXPIRES_SECONDS;
+  if (typeof expiresIn !== "number" ||
+      expiresIn < PRESIGN_MIN_EXPIRES_SECONDS ||
+      expiresIn > PRESIGN_MAX_EXPIRES_SECONDS) {
+    var capTail = hardCapLabel ? " (7 days, " + hardCapLabel + " hard cap)" : " (7 days)";
+    throw _err("INVALID_EXPIRES",
+      msgPrefix + ": expiresIn must be a number of seconds between " +
+      PRESIGN_MIN_EXPIRES_SECONDS + " and " + PRESIGN_MAX_EXPIRES_SECONDS +
+      capTail, true);
+  }
+  return expiresIn;
+}
+
+// POST-form upload policy size bounds — returns the resolved minBytes
+// (defaulting to 0). maxBytes is validated here but consumed by the
+// caller (it becomes the content-length-range upper bound).
+function resolvePresignUploadMinBytes(opts) {
+  if (typeof opts.maxBytes !== "number" || !Number.isFinite(opts.maxBytes) ||
+      opts.maxBytes <= 0) {
+    throw _err("INVALID_MAX_BYTES",
+      "presignedUploadPolicy: maxBytes (positive number of bytes) is required — " +
+      "POST-form policy enforces body size via the content-length-range condition; " +
+      "use presignedUploadUrl if size enforcement is not needed", true);
+  }
+  if (opts.minBytes !== undefined && !numericBounds.isNonNegativeFiniteInt(opts.minBytes)) {
+    throw _err("INVALID_MIN_BYTES",
+      "presignedUploadPolicy: minBytes must be a non-negative finite integer; got " +
+      numericBounds.shape(opts.minBytes), true);
+  }
+  return opts.minBytes !== undefined ? opts.minBytes : 0;
+}
+
+// ---- Shared conditional-GET request + response mapping (gcs / sigv4 / azure) ----
+// Every backend's getResponse() set the same RFC 7232/7233 conditional
+// headers (Range + If-Match family), mapped the HTTP response into the same
+// { statusCode, body, etag, lastModified, contentRange, size, contentType }
+// shape, and turned a 304 into the same short-circuit result. Only the Range
+// header NAME differs (S3/GCS "Range" vs Azure "x-ms-range"), so it is a
+// parameter; the rest is identical.
+function applyConditionalGetHeaders(target, opts, rangeHeaderName) {
+  if (opts.range) {
+    // The documented + shipped contract is an array [start, end] (see
+    // b.archive.adapters.objectStore and b.backup). Reading .start/.end off an
+    // array yields undefined → "bytes=undefined-undefined", which every store
+    // IGNORES — silently returning the FULL object instead of the byte range
+    // (over-fetch + wrong data for a partial read). Accept the array form (and
+    // {start,end} for compatibility) and validate, so a malformed range fails
+    // loudly rather than emitting a garbage header.
+    var r = opts.range;
+    var start = Array.isArray(r) ? r[0] : r.start;
+    var end   = Array.isArray(r) ? r[1] : r.end;
+    if (!Number.isInteger(start) || !Number.isInteger(end) || start < 0 || end < start) {
+      throw _err("INVALID_RANGE",
+        "range must be [start, end] (or { start, end }) with 0 <= start <= end, got " +
+        JSON.stringify(r), true);
+    }
+    target[rangeHeaderName] = "bytes=" + start + "-" + end;
+  }
+  if (opts.ifNoneMatch)       target["If-None-Match"]       = opts.ifNoneMatch;
+  if (opts.ifMatch)           target["If-Match"]            = opts.ifMatch;
+  if (opts.ifModifiedSince)   target["If-Modified-Since"]   = opts.ifModifiedSince;
+  if (opts.ifUnmodifiedSince) target["If-Unmodified-Since"] = opts.ifUnmodifiedSince;
+  return target;
+}
+
+function mapGetResponse(res) {
+  return {
+    statusCode:   res.statusCode,
+    body:         res.body,
+    etag:         res.headers && res.headers.etag,
+    lastModified: res.headers && res.headers["last-modified"]
+                  ? Date.parse(res.headers["last-modified"]) : null,
+    contentRange: res.headers && res.headers["content-range"] || null,
+    size:         res.headers && res.headers["content-length"]
+                  ? parseInt(res.headers["content-length"], 10) : null,
+    contentType:  res.headers && res.headers["content-type"] || null,
+  };
+}
+
+// HEAD response projection — { size, etag, lastModified } from the response
+// headers. Shared by the header-driven backends (azure / sigv4 / http-put);
+// gcs.head is NOT a member (it reads a JSON metadata body, not headers).
+function mapHeadResponse(res) {
+  return {
+    size:         res.headers["content-length"] ? parseInt(res.headers["content-length"], 10) : null,
+    etag:         res.headers.etag,
+    lastModified: res.headers["last-modified"] ? Date.parse(res.headers["last-modified"]) : null,
+  };
+}
+
+// The structured result a conditional GET returns when the server answers
+// 304 Not Modified (httpClient surfaces it as a non-2xx error each backend
+// catches and maps here).
+function notModifiedGetResult() {
+  return {
+    statusCode: requestHelpers.HTTP_STATUS.NOT_MODIFIED,
+    body: null, etag: null, lastModified: null,
+  };
+}
+
+// Wrap a Promise<Buffer|string> as a Readable WITHOUT awaiting it first, so a
+// backend's getStream() stays synchronous (the dispatcher hands the returned
+// Readable straight to the consumer). A bare `Readable.from(promise)` throws
+// ERR_INVALID_ARG_TYPE — Readable.from needs an (async-)iterable, not a Promise
+// — which broke getStream on every remote backend. The async generator defers
+// the await to the first read; a rejection surfaces as the stream's 'error'
+// event, matching the dispatcher's "the Readable surfaces its own errors"
+// contract.
+function promiseToStream(promise) {
+  return Readable.from((async function* () { yield await promise; })());
+}
+
 module.exports = request;
+module.exports.applyConditionalGetHeaders = applyConditionalGetHeaders;
+module.exports.promiseToStream = promiseToStream;
+module.exports.mapGetResponse = mapGetResponse;
+module.exports.mapHeadResponse = mapHeadResponse;
+module.exports.notModifiedGetResult = notModifiedGetResult;
+module.exports.PRESIGN_DEFAULT_EXPIRES_SECONDS = PRESIGN_DEFAULT_EXPIRES_SECONDS;
+module.exports.PRESIGN_MAX_EXPIRES_SECONDS = PRESIGN_MAX_EXPIRES_SECONDS;
+module.exports.PRESIGN_MIN_EXPIRES_SECONDS = PRESIGN_MIN_EXPIRES_SECONDS;
+module.exports.requirePresignKey = requirePresignKey;
+module.exports.resolvePresignExpires = resolvePresignExpires;
+module.exports.resolvePresignUploadMinBytes = resolvePresignUploadMinBytes;

package/lib/object-store/local.js

@@ -14,6 +14,7 @@
 var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var atomicFile = require("../atomic-file");
+var C = require("../constants");
 var cluster = require("../cluster");
 var { ObjectStoreError } = require("../framework-error");
 
@@ -54,16 +55,14 @@ function create(config) {
       return Promise.resolve({ size: body.length });
     }
     if (body && typeof body.pipe === "function") {
-      // Streaming put — pipe directly to disk
-      return new Promise(function (resolve, reject) {
-        var ws = nodeFs.createWriteStream(full);
-        var bytes = 0;
-        body.on("data", function (chunk) { bytes += chunk.length; });
-        body.pipe(ws);
-        ws.on("finish", function () { resolve({ size: bytes }); });
-        ws.on("error", reject);
-        body.on("error", reject);
-      });
+      // Streaming put — stage into a no-follow exclusive temp + atomic rename
+      // (a bare createWriteStream(full) follows a symlink planted at `full` and
+      // leaves a half-written object there if the source aborts). maxBytes is
+      // raised to the object-store ceiling; default 64 MiB is too small here.
+      return atomicFile.writeStream(full, body, {
+        fileMode: 0o600,
+        maxBytes: C.BYTES.gib(64),
+      }).then(function (r) { return { size: r.bytesWritten }; });
     }
     if (typeof body === "string") {
       var buf = Buffer.from(body, "utf8");
@@ -75,18 +74,39 @@ function create(config) {
 
   function get(key) {
     var full = _resolveSafe(rootDir, key);
-    if (!nodeFs.existsSync(full)) {
-      return Promise.reject(_err("NOT_FOUND", "key not found: " + key, true));
-    }
-    return Promise.resolve(nodeFs.readFileSync(full));
+    // One capped fd-bound read (no existsSync check-then-read TOCTOU): get()
+    // buffers the whole object, so an uncapped read of a multi-GiB object is an
+    // OOM lever — cap it (large reads should use getStream). refuseSymlink stays
+    // OFF: operators may legitimately symlink into the store, and _resolveSafe
+    // already confines the key to rootDir.
+    try {
+      return Promise.resolve(atomicFile.fdSafeReadSync(full, {
+        maxBytes: C.BYTES.mib(64),
+        errorFor: function (kind, detail) {
+          if (kind === "enoent") return _err("NOT_FOUND", "key not found: " + key, true);
+          if (kind === "too-large") {
+            return _err("OBJECT_TOO_LARGE", "object " + key + " exceeds the buffered-get read cap (" +
+              detail.size + " > " + detail.max + " bytes) — use getStream()", true);
+          }
+          return _err("READ_FAILED", "failed to read " + key, true);
+        },
+      }));
+    } catch (e) { return Promise.reject(e); }
   }
 
   function getStream(key) {
     var full = _resolveSafe(rootDir, key);
-    if (!nodeFs.existsSync(full)) {
-      throw _err("NOT_FOUND", "key not found: " + key, true);
+    // Open once and stream from that fd, mapping ENOENT to NOT_FOUND, so the
+    // existsSync→createReadStream check-then-read window is collapsed. Plain
+    // O_RDONLY (follows symlinks): operators may symlink into the store, and the
+    // key is already confined by _resolveSafe.
+    var fd;
+    try { fd = nodeFs.openSync(full, "r"); }
+    catch (e) {
+      if (e && e.code === "ENOENT") throw _err("NOT_FOUND", "key not found: " + key, true);
+      throw e;
     }
-    return nodeFs.createReadStream(full);
+    return nodeFs.createReadStream(full, { fd: fd });
   }
 
   function head(key) {