@blamejs/core 0.16.0 → 0.16.2

package/lib/parsers/index.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Multi-format safe parsers — apply the same security defaults blamejs's

package/lib/parsers/safe-env.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Security-focused .env loader.

package/lib/parsers/safe-ini.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * INI parser — same security defaults as the framework's other parsers.

package/lib/parsers/safe-toml.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Security-focused TOML 1.0 parser.

package/lib/parsers/safe-xml.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Security-focused XML parser. Same security defaults blamejs's json

package/lib/parsers/safe-yaml.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Security-focused YAML parser (safe subset of YAML 1.2).

package/lib/permissions.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.permissions

package/lib/pick.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.pick — mass-assignment (CWE-915 / OWASP API3:2023) defense.

package/lib/pipl-cn.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.pipl

package/lib/pqc-agent.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.pqcAgent

package/lib/pqc-gate.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * pqc-gate — TCP-level enforcement of post-quantum key exchange.

package/lib/pqc-software.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.pqcSoftware

package/lib/privacy-pass.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.privacyPass

package/lib/privacy.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.privacy

package/lib/problem-details.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.problemDetails

package/lib/process-spawn.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.processSpawn

package/lib/promise-pool.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.promisePool

package/lib/protobuf-encoder.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * protobuf-encoder — minimal proto3 wire-format encoder.

package/lib/protocol-dispatcher.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * protocol-dispatcher — pluggable protocol resolver with deferred-protocol

package/lib/public-suffix.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.publicSuffix

package/lib/pubsub-cluster.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * pubsub-cluster — table-polling backend for `lib/pubsub.js`.

package/lib/pubsub-redis.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * pubsub-redis — Redis PUB/SUB backend for `lib/pubsub.js`.

package/lib/pubsub.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.pubsub

package/lib/queue-local.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Local-protocol queue adapter — DB-backed, dialect-portable.

package/lib/queue-redis.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Redis-protocol queue adapter — backs b.queue with Redis instead of

package/lib/queue-sqs.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * AWS SQS queue adapter — backs `b.queue` with Amazon SQS so multi-replica

package/lib/queue.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.queue

package/lib/redact.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.redact

package/lib/redis-client.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Bespoke RESP2 Redis client — zero npm runtime deps.

package/lib/render.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.render

package/lib/request-helpers.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.requestHelpers

package/lib/resource-access-lock.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.resourceAccessLock — three-mode access-lock for arbitrary

package/lib/restore-bundle.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.restoreBundle

package/lib/restore-rollback.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.restoreRollback

package/lib/restore.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * restore — operator-facing restore from a backup bundle in storage.

package/lib/retention.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.retention

package/lib/retry.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.retry

package/lib/rfc3339.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * rfc3339 — strict RFC 3339 date-time validation, shared by the primitives

package/lib/router.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.router
@@ -42,6 +44,7 @@ var requestHelpers = require("./request-helpers");
 var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
 var safeEnv = require("./parsers/safe-env");
+var safeJson = require("./safe-json");
 var safeUrl = require("./safe-url");
 var validateOpts = require("./validate-opts");
 var websocket = require("./websocket");
@@ -161,9 +164,25 @@ function _makeSchemaValidator(spec) {
   };
 }
 
+// True when a res.end body structurally looks like a JSON document — the
+// first non-whitespace byte is an object/array opener. Narrow on purpose:
+// a plain-text / HTML body on a response-schema route (leading "<", a bare
+// word, etc.) is skipped so the validator never throws on a non-JSON
+// response, and a JSON scalar (a bare number / quoted string) is not
+// mistaken for a schema-shaped document.
+function _bodyLooksLikeJson(text) {
+  for (var i = 0; i < text.length; i += 1) {
+    var ch = text.charCodeAt(i);
+    if (ch === 0x20 || ch === 0x09 || ch === 0x0A || ch === 0x0D) continue;   // skip leading whitespace
+    return ch === 0x7B || ch === 0x5B;                                        // "{" or "["
+  }
+  return false;
+}
+
 function _makeResponseValidator(spec) {
-  // Wraps res.json (and res.end when called with a JSON-shaped buffer)
-  // to validate the response body against spec.response. Mode:
+  // Validate the response body against spec.response no matter which exit
+  // the handler used — res.json OR a raw res.end(JSON.stringify(...)) that
+  // ships a JSON-shaped buffer. Mode:
   //   - BLAMEJS_VALIDATE_RESPONSES=throw (or per-route validateResponse: "throw")
   //     → throw a SafeSchemaError-shaped error; route handler's caller sees a 500.
   //   - BLAMEJS_VALIDATE_RESPONSES=warn (or per-route validateResponse: "warn")
@@ -175,21 +194,59 @@ function _makeResponseValidator(spec) {
   if (!mode) return function passthrough(_req, _res, next) { next(); };
 
   return function responseValidator(req, res, next) {
+    // One request-scoped check shared by both the res.json and res.end
+    // wrappers so a single failure shape covers every exit.
+    var validated = false;
+    function runCheck(value, headersAlreadySent) {
+      var rr = spec.response.safeParse(value);
+      if (rr.ok) return;
+      if (mode === "throw") {
+        // A raw res.end after writeHead cannot be un-sent — throwing there
+        // would abort mid-flush and can't reach a clean 500. Degrade to a
+        // logged error in that case; res.json (and a pre-writeHead res.end)
+        // still throw before any header is committed.
+        if (!headersAlreadySent) {
+          throw new Error("router response-validation failed for " +
+            (req.method + " " + req.routePattern) + ": " +
+            JSON.stringify(rr.errors));
+        }
+        log.error("response-validation failed after headers sent on " +
+                  req.method + " " + req.routePattern + ": " +
+                  JSON.stringify(rr.errors).slice(0, 500));
+        return;
+      }
+      // warn mode
+      log.warn("response-validation drift on " + req.method + " " + req.routePattern +
+               ": " + JSON.stringify(rr.errors).slice(0, 500));
+    }
+
     var origJson = typeof res.json === "function" ? res.json.bind(res) : null;
     if (origJson) {
       res.json = function (value) {
-        var rr = spec.response.safeParse(value);
-        if (!rr.ok) {
-          if (mode === "throw") {
-            throw new Error("router response-validation failed for " +
-              (req.method + " " + req.routePattern) + ": " +
-              JSON.stringify(rr.errors));
+        runCheck(value, false);   // res.json validates before it writes headers
+        validated = true;         // res.json delegates to res.end internally — don't re-check
+        return origJson(value);
+      };
+    }
+
+    var origEnd = typeof res.end === "function" ? res.end.bind(res) : null;
+    if (origEnd) {
+      res.end = function (chunk) {
+        if (!validated) {
+          var text = null;
+          if (typeof chunk === "string") text = chunk;
+          else if (Buffer.isBuffer(chunk)) text = chunk.toString("utf8");
+          if (text !== null && _bodyLooksLikeJson(text)) {
+            var parsed;
+            var parsedOk = true;
+            try { parsed = safeJson.parse(text); } catch (_e) { parsedOk = false; }
+            if (parsedOk) {
+              validated = true;
+              runCheck(parsed, res.headersSent === true);
+            }
           }
-          // warn mode
-          log.warn("response-validation drift on " + req.method + " " + req.routePattern +
-                   ": " + JSON.stringify(rr.errors).slice(0, 500));
         }
-        return origJson(value);
+        return origEnd.apply(res, arguments);
       };
     }
     next();
@@ -956,16 +1013,24 @@ class Router {
             "res.redirect: target must be a non-empty string"
           );
         }
-        // Reject embedded CR / LF / NUL early — header injection class.
-        // Node's writeHead would refuse these too, but the explicit
-        // refusal here gives operators a router-shaped error rather than
-        // a generic ERR_INVALID_CHAR.
+        // Reject every byte a header line or a URL-parsing user agent
+        // treats specially. CR / LF / NUL are the header-injection class
+        // (Node's writeHead would refuse them too — the explicit refusal
+        // gives operators a router-shaped error over ERR_INVALID_CHAR).
+        // TAB (0x09) is the open-redirect class: Node PERMITS a horizontal
+        // tab in a header value, but WHATWG URL removes ASCII TAB / LF / CR
+        // from a URL before parsing it, so "/<TAB>/evil.example" — which
+        // the same-origin heuristic below reads as a rooted path — collapses
+        // to the protocol-relative "//evil.example" in the browser and
+        // bounces to an attacker origin. Refuse the whole browser-stripped
+        // set here so the byte the heuristic inspects is the byte the user
+        // agent parses.
         for (var ci = 0; ci < url.length; ci += 1) {
           var cc = url.charCodeAt(ci);
-          if (cc === 0x00 || cc === 0x0A || cc === 0x0D) {
+          if (cc === 0x00 || cc === 0x09 || cc === 0x0A || cc === 0x0D) {
             throw new RouterError(
               "router/redirect-target-has-control-chars",
-              "res.redirect: target must not contain CR / LF / NUL bytes"
+              "res.redirect: target must not contain CR / LF / TAB / NUL bytes"
             );
           }
         }

package/lib/safe-archive.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeArchive

package/lib/safe-async.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeAsync

package/lib/safe-buffer.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeBuffer

package/lib/safe-decompress.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeDecompress

package/lib/safe-dns.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeDns

package/lib/safe-ical.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeIcal

package/lib/safe-icap.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // codebase-patterns:allow-file raw-byte-literal — RFC 3507 ICAP status-code
 // table (200 / 204 / 400 / 403 / 404 / 405 / 408 / 500 / 504). These are

package/lib/safe-json.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeJson

package/lib/safe-jsonpath.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * safe-jsonpath — Postgres SQL/JSON path validator for JSONB query

package/lib/safe-mime.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeMime

package/lib/safe-mount-info.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeMountInfo

package/lib/safe-path.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safePath

package/lib/safe-redirect.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * safe-redirect — open-redirect (CWE-601) defense for operator-supplied

package/lib/safe-schema.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeSchema

package/lib/safe-sieve.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 /**

package/lib/safe-smtp.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeSmtp

package/lib/safe-sql.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeSql

package/lib/safe-url.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.safeUrl

package/lib/safe-vcard.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.safeVcard

package/lib/sandbox-worker.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * sandbox-worker — bootstrap module loaded inside the worker_threads

package/lib/sandbox.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.sandbox - isolation harness for operator-supplied transforms.

package/lib/scheduler.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.scheduler

package/lib/scitt.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.scitt

package/lib/sd-notify.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.sdNotify

package/lib/sec-cyber.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.secCyber — SEC Cybersecurity Disclosure Item 1.05 (Form 8-K)

package/lib/security-assert.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * security-assert — boot-time policy assertions for production posture.

package/lib/seeders.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.seeders — DB seeders.

package/lib/self-update-standalone-verifier.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.selfUpdate.standaloneVerifier

package/lib/self-update.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.selfUpdate

package/lib/server-timing.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.serverTiming

package/lib/session-device-binding.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.sessionDeviceBinding — bind sessions to a device fingerprint and