@blamejs/core 0.4.11 → 0.4.13

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- **0.4.12** (2026-04-30) — b.log: multi-sink output with per-sink level filtering
+- **0.4.11** (2026-04-30) — b.cache: bytes-cap eviction, sliding TTL, tag invalidation
 - **0.4.10** (2026-04-30) — bodyParser multipart: fileFilter + per-field maxBytes/mimeTypes
 - **0.4.9** (2026-04-30) — Origin-Agent-Cluster + DNS-Prefetch-Control headers; b.auth.lockout primitive
 - **0.4.8** (2026-04-30) — wiki SEO surface: per-page OG / Twitter / JSON-LD + sitemap.xml + robots.txt

package/lib/db-query.js

@@ -184,6 +184,37 @@ class Query {
     return out;
   }
 
+  // Streaming counterpart to all(). Each row is auto-unsealed against
+  // the bound table's sealedFields registration before it lands in the
+  // operator's pipeline. For large result sets (audit exports, backup
+  // table dumps) this avoids materializing the full rowset in memory.
+  stream() {
+    var sql = "SELECT " + this._projection() + ' FROM "' + this._table + '"' +
+              this._whereClause() + this._orderLimitOffset();
+    var stmt = this._db.prepare(sql);
+    var table = this._table;
+    var iter;
+    var Readable = require("node:stream").Readable;
+    try { iter = stmt.iterate.apply(stmt, this._whereParams); }
+    catch (e) {
+      var r = new Readable({ objectMode: true, read: function () {} });
+      setImmediate(function () { r.destroy(e); });
+      return r;
+    }
+    return new Readable({
+      objectMode: true,
+      read: function () {
+        try {
+          var step = iter.next();
+          if (step.done) { this.push(null); return; }
+          this.push(cryptoField.unsealRow(table, step.value));
+        } catch (e) {
+          this.destroy(e);
+        }
+      },
+    });
+  }
+
   count() {
     var sql = 'SELECT COUNT(*) AS n FROM "' + this._table + '"' + this._whereClause();
     var stmt = this._db.prepare(sql);

package/lib/db.js

@@ -32,6 +32,8 @@
  *
  *   db.from(tableName)                 → Query (chainable)
  *   db.prepare(sql)                    → SQLite Statement (raw escape hatch)
+ *   db.stream(sql, ...params, opts?)   → Readable (object-mode rows;
+ *                                       opts.table enables auto-unseal)
  *   db.runSql(sql)                     → raw SQL execution (DDL, BEGIN/COMMIT)
  *   db.transaction(function (db) {…})  → wraps in BEGIN/COMMIT/ROLLBACK
  *   db.hashFor(table, field, value)    → derived-hash lookup helper
@@ -746,6 +748,66 @@ function prepare(sql) {
   return database.prepare(sql);
 }
 
+// stream — Readable in object mode that yields rows as node:sqlite's
+// iterate() produces them. Unlike all(), the engine doesn't materialize
+// the result set in memory before the first row arrives, so audit
+// exports / backup table dumps / large reports can process millions of
+// rows without OOM pressure.
+//
+// Optional opts.table enables auto-unseal of sealed columns via the
+// table's registered cryptoField schema. Raw / aggregate queries omit
+// it. Mid-iteration prepare()-bound errors propagate as 'error' events.
+function stream(sql) {
+  _requireInit();
+  var opts = null;
+  var params;
+  // Last arg may be a plain {table?} options object; everything else
+  // is a SQL parameter binding. node:sqlite accepts numbers, strings,
+  // bigints, Buffers, and null — plain objects can only be opts.
+  var args = Array.prototype.slice.call(arguments, 1);
+  if (args.length > 0) {
+    var last = args[args.length - 1];
+    var isOptsShape = last !== null && typeof last === "object" &&
+      !Buffer.isBuffer(last) && !Array.isArray(last) &&
+      typeof last.length !== "number"; // exclude TypedArray-shapes
+    if (isOptsShape) {
+      opts = last;
+      params = args.slice(0, -1);
+    } else {
+      params = args;
+    }
+  } else {
+    params = [];
+  }
+  var table = opts && typeof opts.table === "string" ? opts.table : null;
+  var unseal = table ? cryptoField : null;
+
+  var Readable = require("node:stream").Readable;
+  var stmt;
+  var iter;
+  try {
+    stmt = database.prepare(sql);
+    iter = stmt.iterate.apply(stmt, params);
+  } catch (e) {
+    var r = new Readable({ objectMode: true, read: function () {} });
+    setImmediate(function () { r.destroy(e); });
+    return r;
+  }
+  return new Readable({
+    objectMode: true,
+    read: function () {
+      try {
+        var step = iter.next();
+        if (step.done) { this.push(null); return; }
+        var row = step.value;
+        this.push(unseal ? unseal.unsealRow(table, row) : row);
+      } catch (e) {
+        this.destroy(e);
+      }
+    },
+  });
+}
+
 function execRaw(sql) {
   _requireInit();
   return runSql(database, sql);
@@ -946,6 +1008,7 @@ module.exports = {
   init:                init,
   from:                from,
   prepare:             prepare,
+  stream:              stream,
   runSql:              execRaw,
   // SQLite multi-statement helper alias matching the node:sqlite
   // module's shape. Operator migration / seeder files that received

package/lib/log.js

@@ -9,7 +9,8 @@
  *
  * Each line is one JSON object on a single line, terminated with `\n`.
  * Levels: debug (0) < info (1) < warn (2) < error (3) < fatal (4).
- * info-and-below routes to stdout; warn-and-up routes to stderr.
+ * Default routing: debug / info / warn → stdout; error / fatal → stderr.
+ * Multi-sink config (`sinks: [...]`) takes full control of routing.
  *
  *   var log = b.log.create({
  *     level:   "info",            // env LOG_LEVEL > opts.level > "info"
@@ -17,6 +18,19 @@
  *     redact:  true,              // run extras through lib/redact
  *   });
  *
+ *   // Multi-sink: each sink gets every line at-or-above its own level.
+ *   // Default (no `sinks` opt) splits info-and-below to stdout and
+ *   // warn-and-up to stderr — same as before.
+ *   var log = b.log.create({
+ *     level: "debug",
+ *     sinks: [
+ *       { stream: process.stdout,                              level: "info"  },
+ *       { stream: fs.createWriteStream("./logs/debug.log"),    level: "debug" },
+ *       { stream: fs.createWriteStream("./logs/errors.log"),   level: "error" },
+ *     ],
+ *   });
+ *   // sinks: [...] is mutually exclusive with destination/errorDestination.
+ *
  *   log.info("user logged in", { userId: "u-1" });
  *   log.error("payment failed", { orderId, err: e.message });
  *
@@ -116,10 +130,56 @@ function _mergeExtras(into, extras, redactExtras) {
   return clobberAttempt;
 }
 
+function _resolveSinks(opts) {
+  // Three input shapes — pick exactly one:
+  //   (a) opts.sinks: [{ stream, level }, ...]
+  //   (b) opts.destination + opts.errorDestination (legacy two-sink split)
+  //   (c) neither — defaults to stdout for info-and-below, stderr for warn-and-up
+  if (Array.isArray(opts.sinks)) {
+    if (opts.destination !== undefined || opts.errorDestination !== undefined) {
+      throw new LogError("log/conflicting-sinks",
+        "log.create: pass either { sinks: [...] } OR { destination, errorDestination }, not both");
+    }
+    if (opts.sinks.length === 0) {
+      throw new LogError("log/no-sinks",
+        "log.create: sinks: [] would silently drop every line — pass at least one sink");
+    }
+    return opts.sinks.map(function (s, i) {
+      if (!s || typeof s !== "object") {
+        throw new LogError("log/bad-sink", "sinks[" + i + "]: expected object with { stream, level? }");
+      }
+      var allowed = ["stream", "level"];
+      var keys = Object.keys(s);
+      for (var j = 0; j < keys.length; j++) {
+        if (allowed.indexOf(keys[j]) === -1) {
+          throw new LogError("log/bad-sink",
+            "sinks[" + i + "]: unknown key '" + keys[j] + "' (allowed: " + allowed.join(", ") + ")");
+        }
+      }
+      var stream = _normalizeDestination(s.stream, null);
+      if (!stream) {
+        throw new LogError("log/bad-sink", "sinks[" + i + "]: stream is required");
+      }
+      // Per-sink level: missing → no filter beyond the global; present → must be valid.
+      var minLevel = (s.level === undefined) ? null : _normalizeLevel(s.level);
+      return { stream: stream, minLevel: minLevel };
+    });
+  }
+  // Legacy / default — synthesize the two-sink split.
+  var stdoutDest = _normalizeDestination(opts.destination, process.stdout);
+  var stderrDest = _normalizeDestination(opts.errorDestination, process.stderr);
+  return [
+    // Order matters for emit fan-out: stdout sink catches debug-info-warn;
+    // stderr catches error-and-up. Existing behavior — same boundary.
+    { stream: stdoutDest, minLevel: null, _maxLevelExclusive: LEVELS.error },
+    { stream: stderrDest, minLevel: LEVELS.error },
+  ];
+}
+
 function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
-    "level", "destination", "errorDestination",
+    "level", "destination", "errorDestination", "sinks",
     "format", "redact", "base", "clock",
   ], "b.log");
 
@@ -134,8 +194,7 @@ function create(opts) {
     level = LEVELS.info;
   }
 
-  var stdoutDest = _normalizeDestination(opts.destination, process.stdout);
-  var stderrDest = _normalizeDestination(opts.errorDestination, process.stderr);
+  var sinks = _resolveSinks(opts);
 
   var format    = opts.format || "json"; // reserved for future formats
   if (format !== "json") {
@@ -197,9 +256,16 @@ function create(opts) {
       }) + "\n";
     }
 
-    var dest = (LEVELS[levelName] >= LEVELS.error) ? stderrDest : stdoutDest;
-    try { dest.write(line); }
-    catch (_e) { /* destination write best-effort — never throw out of a log call */ }
+    var lvlNum = LEVELS[levelName];
+    for (var s = 0; s < sinks.length; s++) {
+      var sink = sinks[s];
+      if (sink.minLevel !== null && lvlNum < sink.minLevel) continue;
+      // Legacy default-sinks split uses an exclusive upper bound so the
+      // stdout sink catches only info-and-below (warn+ goes to stderr).
+      if (sink._maxLevelExclusive !== undefined && lvlNum >= sink._maxLevelExclusive) continue;
+      try { sink.stream.write(line); }
+      catch (_e) { /* sink write best-effort — never throw out of a log call */ }
+    }
   }
 
   function _makeInstance(boundChain) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.4.11",
+  "version": "0.4.13",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",