@blamejs/core 0.17.19 → 0.17.21

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.17.x
 
+- v0.17.21 (2026-07-25) — **`blamejs erase` treats only `--confirm true` as confirmation, so `--confirm false` no longer triggers the irreversible erase.** Three fixes to the blamejs command line. The `erase` subcommand (a cryptographic single-row erase) gated its irreversible action on a bare-truthiness check, so `--confirm false` -- a string -- counted as confirmation and the erase proceeded; the gate now accepts only `true` / "true", matching `audit purge`, and refuses anything else. A stray `-v` / `--version` token alongside a subcommand no longer short-circuits to the version print: `blamejs migrate up --db x -v` previously returned 0 after printing the version without running the migration, handing automation a false pass; the version flag is now honored only when it is the whole invocation. And `blamejs dev` now survives a crash of the watched child -- it stays up to hot-restart on the next file change instead of draining the event loop and exiting 0 -- and awaits the child's full termination on SIGINT/SIGTERM so a shutdown cannot orphan it. **Fixed:** *blamejs erase refuses --confirm false instead of performing the irreversible erase* — The erase subcommand confirmed its irreversible action with a bare-truthiness check, so the string `--confirm false` was treated as confirmation and the erase ran. Confirmation is now satisfied only by `--confirm true` (or the bare `--confirm`), matching the check `audit purge` already used; any other value -- including `false` -- is refused with a non-zero exit and no erase. A shared confirmation helper backs every destructive subcommand so the acknowledgement contract cannot drift between them. · *A stray -v / --version no longer turns a subcommand into a silent no-op* — The top-level version flag was evaluated before subcommand dispatch and returned 0 whenever `-v` / `--version` appeared anywhere in the arguments, so a consequential command such as `migrate up`, `seed run`, or `erase` alongside a stray `-v` printed the version and exited 0 without doing anything -- a false success for any script checking the exit code. The version flag is now honored only when the invocation carries no subcommand; otherwise the subcommand runs (or fails) as written. · *blamejs dev survives a watched-child crash and shuts the child down cleanly* — The dev supervisor held the event loop open with an unref'd timer, so when the watched child process crashed the supervisor drained the loop and exited 0 -- defeating crash-resilience (it should stay up and hot-restart on the next file change) and reporting success even though the app had crashed. It now holds a referenced heartbeat so a child crash leaves the supervisor running, and on SIGINT/SIGTERM it awaits the child's full termination (graceful signal, then escalation) before exiting, so a shutdown can no longer race ahead and orphan the child.
+
+- v0.17.20 (2026-07-24) — **`b.forms.validate` enforces required checkboxes server-side and rejects malformed field bounds, closing two validation gaps.** b.forms.validate previously let an unchecked required checkbox pass: the renderer emits the HTML `required` attribute for it, but the server-side validator skipped the check, so a client that omitted the box -- or any non-browser caller -- bypassed a constraint the form advertised. It now rejects an unchecked required checkbox, keeping backend validation in lock-step with what the form displays. Separately, a field whose numeric bound (min/max/minlength/maxlength) was not a finite number went silently unenforced -- a NaN comparison is always false -- so the bound became a no-op; validate now throws on such a spec at the entry point, the same way it already rejects a non-precompiled regex pattern. Two smaller fixes: a field rendered without an explicit type now emits type="text" (matching the widget it dispatches to) rather than an empty type attribute, and b.externalDb reports EXPLAIN statements as row-returning so a query plan's rows are not dropped by the local-execution row/no-row chooser. **Changed:** *b.forms.validate option reference corrected* — The validate() reference described length bounds as minLength/maxLength, but the option keys are the HTML-attribute spellings minlength/maxlength (the same keys the renderer reads); the reference and its example are corrected, and the example now uses a numeric min bound on its number field. · *Vendored Public Suffix List refreshed to the current snapshot* — The bundled Public Suffix List that backs domain classification (registrable-domain and public-suffix checks in URL, cookie, and SSRF handling) is updated to the latest upstream publicsuffix.org snapshot, so newly delegated public suffixes and private-domain entries are recognized. **Fixed:** *Required checkboxes are enforced server-side in b.forms.validate* — A checkbox marked required is rendered with the HTML `required` attribute, but validate() treated an unchecked box (which coerces to false) as satisfying the field, so an unchecked required checkbox passed. Any caller that skipped the box -- a scripted client, or a browser with the constraint stripped -- bypassed a documented requirement. validate() now returns an error for an unchecked required checkbox (honouring the field's errorMessages.required), so the backend enforces the same constraint the frontend shows. A form that relied on the previous pass-through for an unchecked required checkbox will now surface a validation error, which is the intended behaviour. · *A malformed numeric field bound is rejected instead of silently ignored* — When a field's min, max, minlength, or maxlength was not a finite number (a non-numeric string, NaN, or Infinity), its comparison could never fire -- a NaN comparison is always false -- so the bound was quietly unenforced while appearing to constrain the field. validate() now throws at the entry point when a defined bound is non-finite, matching how it already requires pattern to be a pre-compiled RegExp. Numeric-string bounds (e.g. min: "1") remain accepted. · *A typeless field renders type="text" instead of an empty type attribute* — b.forms.render dispatches a field with no explicit type to a text input, but the emitted markup carried type="" rather than type="text". The rendered type attribute now matches the widget dispatched, so the markup is self-consistent. · *b.externalDb reports EXPLAIN statements as row-returning* — statementReturnsRows classified a plain EXPLAIN (and an EXPLAIN ANALYZE wrapping a write) as producing no row set, so the local-execution path could route it to a no-row call and drop the query plan. EXPLAIN always returns plan rows to the caller; it is now reported as row-returning whenever its prefix resolves, while an unparseable EXPLAIN prefix stays fail-closed. This is distinct from the cross-border residency read/write classification, which is unchanged.
+
 - v0.17.19 (2026-07-24) — **The error and adversarial paths of the sanctions-screening, JSON Schema, and HTTP client primitives are now under test.** This release adds no behaviour change. The fail-closed error paths, boundary conditions, and adversarial-input handling of b.complianceSanctions, b.jsonSchema, and b.httpClient -- previously exercised only on their happy paths -- are now asserted, verifying that each rejects malformed input, unresolvable references, and edge cases the documented contract already promised. No defects were found; the primitives behaved as specified. Genuinely-unreachable defensive fallbacks are documented rather than contorted into coverage. **Changed:** *Verified error-path behaviour for sanctions screening, JSON Schema, and the HTTP client* — The sanctions-screening list parsers (OFAC SDN/alias, EU CSL, UN 1267), the fuzzy/exact match strategy toggle, and the entry normalizer; the JSON Schema $ref/$dynamicRef resolution, JSON-pointer traversal, format assertions, and unevaluated-properties/items handling; and the HTTP client's error, redirect, and stream branches now have explicit tests for their failure and boundary behaviour. Behaviour is unchanged -- these assert guarantees the primitives already met -- so no migration is needed; the value is regression protection for the fail-closed paths of security-relevant primitives.
 
 - v0.17.18 (2026-07-24) — **`b.i18n` validates every inline translation tree at boot, closing a path where t() could return undefined.** b.i18n.create validated the translation trees only for the locales listed in the configured locales array. A locale present in the inline translations map but absent from locales is still reachable through an explicit t(key, vars, { locale }) override, and its tree escaped validation: a plural entry there missing the mandatory CLDR 'other' category made t() with a count return undefined instead of the key -- a contract violation that could render the literal string 'undefined' into server-rendered HTML or crash a downstream length/escape. Every inline translation tree is now validated at create, so a malformed one fails closed at boot rather than at the first request that reaches it. **Fixed:** *Every inline translation tree is validated at create, not only the configured locales* — b.i18n.create walked only opts.locales when validating translation trees up front, so a locale that appears in opts.translations but not in opts.locales was never checked even though it is reachable via an explicit locale override on t()/has(). A plural entry in such a tree that omits the mandatory 'other' category caused t(key, { count }) to select 'other', find nothing, and return undefined -- violating the documented contract that t() returns a string (the key on a miss) and never a non-string. create now validates every key of opts.translations, so a malformed tree is rejected at boot regardless of whether its locale is in opts.locales.

package/NOTICE

@@ -90,7 +90,7 @@ Used for:    Top-10000 most-common (breach-derived) passwords. Loaded by
              baseline.
 --------------------------------------------------------------------------------
 Component:   publicsuffix-list (Mozilla Public Suffix List)
-Version:     master snapshot (bundled 2026-07-23)
+Version:     master snapshot (bundled 2026-07-24)
 Source:      https://publicsuffix.org/list/public_suffix_list.dat
 License:     MPL-2.0
 Copyright:   Copyright (c) Mozilla Foundation and Public Suffix List contributors

package/lib/arg-parser.js

@@ -625,7 +625,7 @@ function create(opts) {
 
 /**
  * @primitive b.argParser.parseRaw
- * @signature b.argParser.parseRaw(argv)
+ * @signature b.argParser.parseRaw(argv, opts?)
  * @since     0.8.48
  * @status    stable
  * @related   b.argParser.create
@@ -638,12 +638,21 @@ function create(opts) {
  * value`, `--key=value`, and bare `--bool`. `--` terminates flag
  * parsing.
  *
+ * Pass `opts.booleanNames` (an array of long-flag names) to declare flags
+ * that never consume a following token as their value — a bare
+ * `--version` stays boolean instead of swallowing the next token, so
+ * `--version foo` yields `flags.version === true` with `foo` left as a
+ * positional. An inline `--version=x` still records the explicit value.
+ *
  * A flag repeated on the command line accumulates every occurrence into
  * an array, in order — `--watch a --watch b` yields `["a", "b"]`, not
  * just the last value. A flag seen once stays a scalar. This keeps
  * repeatable flags (the `dev` command's `--arg` / `--watch` / `--ignore`)
  * from silently dropping all but the final occurrence.
  *
+ * @opts
+ *   booleanNames: string[],   // long-flag names that never consume a following token as a value (default: none)
+ *
  * @example
  *   var r = b.argParser.parseRaw(
  *     ["build", "--target=node", "-v", "--out", "dist", "--", "extra"]);
@@ -670,11 +679,21 @@ function _assignFlag(flags, name, val) {
   }
 }
 
-function parseRaw(argv) {
+function parseRaw(argv, opts) {
   if (!Array.isArray(argv)) {
     throw new ArgParserError("arg-parser/argv-not-array",
       "argv must be an array of strings");
   }
+  opts = opts || {};
+  // Long-flag names declared boolean never consume a following token as a
+  // value (a bare `--version` stays true instead of swallowing the next
+  // token). Inline `--flag=value` still records the explicit value.
+  var booleanNames = Object.create(null);
+  if (Array.isArray(opts.booleanNames)) {
+    for (var bn = 0; bn < opts.booleanNames.length; bn++) {
+      booleanNames[opts.booleanNames[bn]] = true;
+    }
+  }
   var pos = [];
   var flags = Object.create(null);
   for (var i = 0; i < argv.length; i++) {
@@ -694,7 +713,8 @@ function parseRaw(argv) {
       if (eq !== -1) {
         val = name.slice(eq + 1);
         name = name.slice(0, eq);
-      } else if (i + 1 < argv.length && argv[i + 1].indexOf("--") !== 0) {
+      } else if (i + 1 < argv.length && argv[i + 1].indexOf("--") !== 0 &&
+                 booleanNames[name] !== true) {
         val = argv[++i];
       } else {
         val = true;

package/lib/cli.js

@@ -84,7 +84,12 @@ function _writeLine(stream, line) {
 // written flag validation continues to read the same { pos, flags }
 // shape the cli has always exposed.
 function _parseArgs(argv) {
-  return argParser.parseRaw(argv);
+  // `--version` is the global boolean version flag — declare it so it never
+  // swallows a following token as its value. Without this, `--version <cmd>`
+  // (or `<cmd> --version <sub>`) would consume the subcommand and a stray
+  // version flag could no-op the command it accompanies. (`-v` is a
+  // single-dash flag and is already boolean in parseRaw.)
+  return argParser.parseRaw(argv, { booleanNames: ["version"] });
 }
 
 function _resolvePath(p, cwd) {
@@ -93,6 +98,16 @@ function _resolvePath(p, cwd) {
   return nodePath.resolve(cwd || process.cwd(), p);
 }
 
+// A destructive command's --confirm gate is satisfied ONLY by an explicit
+// `true` / "true"; a bare-truthiness check (`!flags.confirm`) would accept
+// `--confirm false` as confirmation, so an operator who typed `--confirm
+// false` — meaning "do NOT proceed" — would still trigger an irreversible
+// operation. Shared by every destructive subcommand so the acknowledgement
+// contract can't drift between them.
+function _isConfirmed(flags) {
+  return flags.confirm === true || flags.confirm === "true";
+}
+
 function _openSqlite(dbPath) {
   // Lazy-required so the CLI doesn't crash on `blamejs version` or
   // `blamejs help` if node:sqlite isn't usable for some reason.
@@ -424,7 +439,7 @@ async function _runDev(args, ctx) {
   }
   var killSignal = args.flags["kill-signal"];
 
-  var d = dev.create({
+  var d = (ctx._dev || dev.create)({
     command:    String(command),
     args:       argList,
     watch:      watchList.length ? watchList : undefined,
@@ -435,31 +450,51 @@ async function _runDev(args, ctx) {
     env:        ctx.env,
   });
 
-  // Forward parent SIGINT/SIGTERM to the child via stop()
+  // Forward parent SIGINT/SIGTERM to the child via stop(). The supervisor
+  // resolves ONLY after stop() has fully completed (SIGTERM → SIGKILL
+  // escalation → watchers disarmed), so main() never returns — and the bin
+  // shim never process.exit()s — while a child kill is still in flight and
+  // could be abandoned, orphaning the app child.
   var stopped = false;
+  var onStopComplete;
+  var stopComplete = new Promise(function (resolve) { onStopComplete = resolve; });
   function shutdown() {
     if (stopped) return;
     stopped = true;
-    d.stop().then(function () { /* exit naturally */ });
+    Promise.resolve(d.stop()).then(onStopComplete, onStopComplete);
   }
   process.once("SIGINT",  shutdown);
   process.once("SIGTERM", shutdown);
+  function _clearSignalHandlers() {
+    process.removeListener("SIGINT",  shutdown);
+    process.removeListener("SIGTERM", shutdown);
+  }
 
   try {
     await d.start();
   } catch (e) {
     _writeLine(ctx.stderr, "blamejs dev: " + ((e && e.message) || String(e)));
+    _clearSignalHandlers();
     return 1;
   }
-  // The dev loop runs until the operator interrupts. Resolve a
-  // never-settling promise so main() awaits forever; the SIGINT handler
-  // above flips stopped+resolves on Ctrl-C.
-  await new Promise(function (resolve) {
-    var iv = setInterval(function () {
-      if (stopped) { clearInterval(iv); resolve(); }
-    }, 250);
-    if (typeof iv.unref === "function") iv.unref();
-  });
+  // The dev loop runs until the operator interrupts. A REF'd heartbeat holds
+  // the event loop open so a watched-child CRASH does not drain it and exit
+  // the supervisor — dev's crash-resilience contract is to stay up and
+  // hot-restart on the next file change, but an unref'd keep-alive let a
+  // child's exit terminate the parent with a false code 0. Cleared once
+  // stop() has completed on SIGINT/SIGTERM. Unref'ing would drain the loop on
+  // a child crash and reintroduce the exit-on-crash bug this heartbeat fixes.
+  // allow:timer-no-unref-process-pinning — supervisor must stay pinned.
+  var heartbeat = setInterval(function () {}, C.TIME.minutes(1));
+  // Hand the shutdown trigger to a test seam (no-op in production) so a test
+  // can drive the signal path deterministically instead of raising SIGINT.
+  if (typeof ctx._onDevRunning === "function") ctx._onDevRunning(shutdown);
+  try {
+    await stopComplete;
+  } finally {
+    clearInterval(heartbeat);
+    _clearSignalHandlers();
+  }
   return 0;
 }
 
@@ -766,7 +801,7 @@ async function _runAudit(args, ctx) {
       _writeLine(ctx.stderr, "blamejs audit purge: --archive (path to verified archive bundle) is required");
       return 2;
     }
-    if (args.flags.confirm !== true && args.flags.confirm !== "true") {
+    if (!_isConfirmed(args.flags)) {
       _writeLine(ctx.stderr, "blamejs audit purge: --confirm is REQUIRED — destructive operation");
       return 2;
     }
@@ -2081,7 +2116,7 @@ async function _runErase(args, ctx) {
   var rowId = args.flags["row-id"];
   if (!table || table === true)  return report.error("--table <name> is required", 2);
   if (!rowId || rowId === true)  return report.error("--row-id <id> is required", 2);
-  if (!args.flags.confirm) {
+  if (!_isConfirmed(args.flags)) {
     return report.error("--confirm is required (this operation is irreversible)", 2);
   }
   var dataDirFlag = args.flags["data-dir"];
@@ -2317,12 +2352,24 @@ async function main(argv, opts) {
     stderr: opts.stderr || process.stderr,
     env:    opts.env    || process.env,
     cwd:    opts.cwd    || process.cwd(),
+    // Test seams (undefined in production): _dev injects the dev-supervisor
+    // factory; _onDevRunning receives the shutdown fn once `dev` is live, so
+    // a test can drive graceful teardown without raising a real OS signal.
+    _dev:          opts._dev,
+    _onDevRunning: opts._onDevRunning,
   };
   if (!Array.isArray(argv)) argv = [];
   var args = _parseArgs(argv);
 
-  // Top-level flags handled before subcommand dispatch
-  if (args.flags.version || args.flags.v) {
+  // Version is honored only as the WHOLE invocation — a bare `-v` /
+  // `--version` with no subcommand. `_parseArgs` declares `--version`
+  // boolean, so a stray version flag never swallows a token: it works in any
+  // order (leading, trailing, or between a command and its subcommand) and
+  // leaves the positional list intact, so the command dispatches instead of
+  // a silent version no-op returning a false 0. A `-v` used as another
+  // option's value stays that value, and a version token after the `--`
+  // terminator stays a literal positional.
+  if ((args.flags.version || args.flags.v) && args.pos.length === 0) {
     _writeLine(ctx.stdout, C.version);
     return 0;
   }

package/lib/dev.js

@@ -255,14 +255,29 @@ function create(opts) {
         if (killTimer) { try { clearTimeoutFn(killTimer); } catch (_e) { /* timer already cleared */ } killTimer = null; }
         resolve();
       }
+      // 'exit' is the only event that reliably means the process is gone, so
+      // it is the only one that completes shutdown. A child that FAILED TO
+      // SPAWN has no pid and never emits 'exit' — it is settled by the
+      // no-process check below, NOT by listening for 'error'/'close', which
+      // can also fire for a LIVE child (a rejected kill emits 'error' while
+      // the process keeps running) and must not complete shutdown then.
       c.once("exit", done);
-      try { c.kill(killSignal); }
+      var sent;
+      try { sent = c.kill(killSignal); }
       catch (e) {
         _logVia(log, "warn", "kill threw, child may already be gone",
           { error: (e && e.message) || String(e) });
         done();
         return;
       }
+      // kill() returning false means the signal was NOT delivered — which can
+      // be either "no process exists" (a child that failed to spawn has no
+      // pid; no 'exit' will ever arrive, so settle now) OR "a live process
+      // rejected the signal" (e.g. EPERM after the child changed credentials;
+      // pid is set). Only the no-process case completes shutdown here; a live
+      // child keeps the SIGKILL escalation + awaits exit/close, so stop()
+      // never falsely reports termination while the process is still running.
+      if (!sent && !c.pid) { done(); return; }
       // Hard-kill if the child ignores SIGTERM
       killTimer = setTimeoutFn(function () {
         if (settled) return;

package/lib/external-db.js

@@ -381,6 +381,18 @@ var _ROW_RETURNING_CLASS = Object.freeze({ SELECT: true, READ_INFO: true });
 
 function statementReturnsRows(sql) {
   if (typeof sql !== "string" || sql.length === 0) return false;
+  // EXPLAIN — with or without ANALYZE, wrapping any inner statement —
+  // always returns a plan row set to the caller: `EXPLAIN ANALYZE INSERT`
+  // executes the write AND yields the plan. That is the row-set question,
+  // orthogonal to the residency gate's read/write class (where a plain
+  // EXPLAIN is a read and EXPLAIN ANALYZE <write> is a write). An EXPLAIN
+  // prefix that does not resolve (no inner statement, unbalanced option
+  // parens, unterminated span) stays fail-closed false so the .all()/.run()
+  // chooser never mis-routes an unparseable statement.
+  var m = _STATEMENT_CLASS_RE.exec(sql);
+  if (m && m[1].toUpperCase() === "EXPLAIN") {
+    return _explainResolve(sql, m.index + m[0].length) !== null;
+  }
   if (_ROW_RETURNING_CLASS[_classifyStatement(sql)] === true) return true;
   return _hasTopLevelReturning(sql);
 }

package/lib/forms.js

@@ -178,8 +178,11 @@ var INPUT_TYPES = {
 };
 
 function _renderInput(field) {
+  // A field with no explicit type defaults to a text input — mirror the
+  // `|| "text"` dispatch in _renderField so the emitted type attribute
+  // agrees with the widget actually rendered (never a bare type="").
   var attrs = [
-    'type="' + escapeAttribute(field.type) + '"',
+    'type="' + escapeAttribute(field.type || "text") + '"',
     'name="' + escapeAttribute(field.name) + '"',
   ];
   if (field.value !== undefined && field.value !== null) {
@@ -358,7 +361,14 @@ function _coerce(field, raw) {
   // (false), not "not provided." Coerce to false BEFORE the generic
   // undefined-passthrough below.
   if (field.type === "checkbox") {
-    if (raw === undefined || raw === null || raw === "" || raw === "false" || raw === "0") return false;
+    // A urlencoded checkbox submits its VALUE string only when checked, so
+    // any present string — including a custom value of "false" / "0" / "" —
+    // means checked: presence, not the string content, is the checked
+    // signal. Unchecked is the field's ABSENCE (undefined / null) or, for a
+    // typed (JSON) body, an explicit boolean false / numeric 0. This keeps a
+    // required checkbox satisfiable whatever value it is rendered with, while
+    // a JSON false / 0 still reads as unchecked.
+    if (raw === undefined || raw === null || raw === false || raw === 0) return false;
     return true;
   }
   if (raw === undefined) return undefined;
@@ -381,6 +391,74 @@ function _isEmpty(v) {
   return v === undefined || v === null || v === "";
 }
 
+// A field's numeric bound (min / max / minlength / maxlength) must resolve
+// to a finite number. A non-finite bound (a non-numeric string, NaN,
+// Infinity) would make its comparison a silent no-op — NaN comparisons are
+// always false — turning a documented constraint into nothing. That is an
+// operator config error, so throw at the entry point (mirrors the
+// pre-compiled-RegExp requirement for `pattern`) rather than shipping a
+// form whose bound is quietly unenforced.
+// A clean numeric literal: an optional sign, an integer/decimal mantissa,
+// and an optional exponent. Linear (no nested quantifier over overlapping
+// classes), so it is a framework-internal constant with no ReDoS surface.
+var NUMERIC_LITERAL_RE = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?$/;
+// Any real numeric bound is short — Number.MAX_VALUE stringifies to ~23
+// chars — so cap the length before the regex test; a longer "number" string
+// is malformed, and running a regex over an unbounded operator string is a
+// DoS shape regardless of the pattern's own linearity.
+var MAX_NUMERIC_BOUND_CHARS = 40;
+
+function _numericBound(f, key) {
+  var v = f[key];
+  // Accept ONLY a genuine finite number or a string that is a clean numeric
+  // literal. A bare Number() coerces null / "" / whitespace / false / [] to a
+  // finite 0 (and true to 1), which would let a malformed bound — e.g.
+  // min: null, which the renderer emits as min="" (no constraint) — silently
+  // validate as 0 on the backend and diverge from the browser. Those are
+  // rejected here, not coerced.
+  var n = NaN;
+  if (typeof v === "number") n = v;
+  else if (typeof v === "string" && v.length <= MAX_NUMERIC_BOUND_CHARS && NUMERIC_LITERAL_RE.test(v)) n = Number(v);
+  if (!Number.isFinite(n)) {
+    throw new Error("forms.validate: field '" + f.name + "'." + key +
+      " must be a finite number; got " +
+      (typeof v === "string" ? JSON.stringify(v) : typeof v) +
+      ". Fix the form spec.");
+  }
+  return n;
+}
+
+// Validate a field's SPEC — the operator-supplied shape, independent of any
+// submitted value. A numeric bound (min / max / minlength / maxlength) must
+// be finite, and a `pattern` must be a pre-compiled, ReDoS-safe RegExp
+// (compiling operator source on the request path would be an engine ReDoS
+// surface). A malformed spec is an operator config error surfaced
+// deterministically at the entry point — never conditionally on whether a
+// given request happens to carry a value that reaches the bound, which would
+// turn a config bug into an input-dependent runtime failure.
+function _assertFieldSpec(f) {
+  if (!f.name || f.type === "submit") return;
+  // min / max are compared numerically only for number / range controls;
+  // date / time / datetime-local / month / week controls carry ISO-string
+  // bounds (e.g. min: "2026-01-01") that validate() never compares
+  // numerically, so those are not numeric bounds and must not be rejected.
+  if (f.type === "number" || f.type === "range") {
+    if (f.min !== undefined) _numericBound(f, "min");
+    if (f.max !== undefined) _numericBound(f, "max");
+  }
+  // minlength / maxlength are always character counts, whatever the control.
+  if (f.minlength !== undefined) _numericBound(f, "minlength");
+  if (f.maxlength !== undefined) _numericBound(f, "maxlength");
+  if (f.pattern) {
+    if (!(f.pattern instanceof RegExp)) {
+      throw new Error("forms.validate: field '" + f.name +
+        "'.pattern must be a pre-compiled RegExp; got " +
+        (typeof f.pattern) + ". Wrap the source string with `RegExp` at config time.");
+    }
+    guardRegex.assertSafe(f.pattern, "forms: field[" + f.name + "].pattern");
+  }
+}
+
 /**
  * @primitive b.forms.validate
  * @signature b.forms.validate(spec, body)
@@ -390,8 +468,9 @@ function _isEmpty(v) {
  *
  * Walks the same spec the renderer accepts and validates a submitted
  * body. Per field: required-field check, type coercion (string /
- * number / boolean / email / url), `minLength` / `maxLength` bounds,
- * regex `pattern`, `enum` membership. Returns
+ * number / boolean / email / url), `minlength` / `maxlength` bounds,
+ * numeric `min` / `max` bounds, regex `pattern`, `enum` membership.
+ * Returns
  * `{ valid: boolean, errors: { field: msg, ... }, values: { ... } }`.
  * The `values` object holds coerced values keyed by field name —
  * route handlers consume `result.values` directly without re-parsing.
@@ -400,7 +479,7 @@ function _isEmpty(v) {
  *   var result = b.forms.validate(
  *     { fields: [
  *         { type: "email",  name: "email", required: true },
- *         { type: "number", name: "age",   minLength: 1 },
+ *         { type: "number", name: "age",   min: 1 },
  *     ] },
  *     { email: "ada@example.com", age: "37" }
  *   );
@@ -410,6 +489,12 @@ function validate(spec, body) {
   if (!spec || !Array.isArray(spec.fields)) {
     throw new Error("forms.validate: spec.fields must be an array");
   }
+  // Validate every field's spec up front — a malformed bound or pattern is
+  // rejected on the first call, deterministically, regardless of the body
+  // (never only when a request happens to carry a value that reaches it).
+  for (var s = 0; s < spec.fields.length; s++) {
+    _assertFieldSpec(spec.fields[s]);
+  }
   body = body || {};
   var errors = {};
   var values = {};
@@ -423,7 +508,21 @@ function validate(spec, body) {
     var coerced = _coerce(f, raw);
     values[f.name] = coerced;
 
-    if (f.required && _isEmpty(coerced) && coerced !== false) {
+    // Checkbox: the only constraint is `required`, which HTML defines as
+    // "must be checked" — and the renderer emits that attribute, so the
+    // server enforces the same (backend validates what the frontend
+    // displays). An unchecked required box (coerced === false) is an error,
+    // never a silent pass. No length / pattern / enum checks apply.
+    if (f.type === "checkbox") {
+      if (f.required && coerced !== true) {
+        errors[f.name] = f.errorMessages && f.errorMessages.required
+          ? f.errorMessages.required
+          : (f.label || f.name) + " is required";
+      }
+      continue;
+    }
+
+    if (f.required && _isEmpty(coerced)) {
       errors[f.name] = f.errorMessages && f.errorMessages.required
         ? f.errorMessages.required
         : (f.label || f.name) + " is required";
@@ -486,27 +585,14 @@ function validate(spec, body) {
         errors[f.name] = (f.label || f.name) + " must be at most " + f.maxlength + " characters";
         continue;
       }
-      if (f.pattern) {
-        // Pattern accepts a pre-compiled RegExp only — taking a string
-        // and compiling it here would be a ReDoS surface against the
-        // form-render engine. Operators construct the RegExp at config
-        // time so the framework never compiles operator-supplied source
-        // on the request path.
-        if (!(f.pattern instanceof RegExp)) {
-          throw new Error("forms.validate: field '" + f.name +
-            "'.pattern must be a pre-compiled RegExp; got " +
-            (typeof f.pattern) + ". Wrap the source string with `RegExp` at config time.");
-        }
-        // Screen the operator-supplied pattern for catastrophic-backtracking
-        // (ReDoS) shapes before the test, so a pathological regex can't be
-        // run against the submitted value.
-        guardRegex.assertSafe(f.pattern, "forms: field[" + f.name + "].pattern");
-        if (!f.pattern.test(coerced)) {
-          errors[f.name] = f.errorMessages && f.errorMessages.pattern
-            ? f.errorMessages.pattern
-            : (f.label || f.name) + " has an invalid format";
-          continue;
-        }
+      // `pattern` was proven a pre-compiled, ReDoS-safe RegExp by the
+      // up-front spec pass, so only the match against the submitted value
+      // remains on the request path.
+      if (f.pattern && !f.pattern.test(coerced)) {
+        errors[f.name] = f.errorMessages && f.errorMessages.pattern
+          ? f.errorMessages.pattern
+          : (f.label || f.name) + " has an invalid format";
+        continue;
       }
     }
     if ((f.type === "select" || f.type === "radio") && Array.isArray(f.options)) {

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
       },
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:2880c288b1285ef51d356d057bee6f0c8a00de36638cf47b47617e8c1faf10d5"
       },
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
       },
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -152,14 +152,14 @@
         "data_js": "lib/vendor/public-suffix-list.data.js"
       },
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
-      "bundledAt": "2026-07-23T00:00:00Z",
+      "bundledAt": "2026-07-24T00:00:00Z",
       "hashes": {
-        "server": "sha256:04220f6e1c20c9af1edfcd891dd4663b2c92a020b13e698dd13b3630573520ca",
-        "data_js": "sha256:52428436de68a79537db52f2b0cb7ac0a1cc3e6397db87533c6e2f1bd2e12087"
+        "server": "sha256:1fc04fd8ebd4b77c78c38c76d832673c27b56ca154fda6339be61f38b9918701",
+        "data_js": "sha256:1d17ee3059030d1de7208d699ffdd1595c97cd3009d1f41bbfde2ba1a3315372"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -190,7 +190,7 @@
       "hashes": {
         "server": "sha256:2307ef65e070757ffb13442b377e45efb9fa1a10432d9b39618387720ab990ed"
       },
-      "refreshedAt": "2026-07-23T22:29:23.692Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     }
   }
 }

package/lib/vendor/public-suffix-list.dat

@@ -5,8 +5,8 @@
 // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
 // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
 
-// VERSION: 2026-07-23_18-24-27_UTC
-// COMMIT: 93b4eb174b2da9ee3f6effc363b579a96a65c93a
+// VERSION: 2026-07-24_16-56-26_UTC
+// COMMIT: f85a38e61c222ea2d9901a41296c6c74fd3e2c28
 
 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
 
@@ -6838,7 +6838,7 @@ org.zw
 
 // newGTLDs
 
-// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2026-07-15T16:20:56Z
+// List of new gTLDs imported from https://www.icann.org/resources/registries/gtlds/v2/gtlds.json on 2026-07-24T16:40:16Z
 // This list is auto-generated, don't edit it manually.
 // aaa : American Automobile Association, Inc.
 // https://www.iana.org/domains/root/db/aaa.html
@@ -10732,6 +10732,10 @@ weather
 // https://www.iana.org/domains/root/db/weatherchannel.html
 weatherchannel
 
+// web : VeriSign, Inc.
+// https://www.iana.org/domains/root/db/web.html
+web
+
 // webcam : dot Webcam Limited
 // https://www.iana.org/domains/root/db/webcam.html
 webcam