@blamejs/core 0.4.26 → 0.4.28

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- **0.4.27** (2026-04-30) — primitive-drift sweep: regex + escape consolidation, IPv6 completion
+- **0.4.26** (2026-04-30) — primitive-drift sweep: middleware audit context + safeUrl
 - **0.4.25** (2026-04-30) — b.objectStore.bucketOps: bucket-level operations (SigV4)
 - **0.4.24** (2026-04-30) — b.objectStore: multipart upload + server-side encryption
 - **0.4.23** (2026-04-30) — b.mail.dkim signing + calendar invites

package/lib/api-key.js

@@ -13,7 +13,7 @@
  *     ownerId:   "user-42",
  *     scopes:    ["read:users", "write:posts"],
  *     metadata:  { name: "Mobile app v3" },
- *     expiresAt: Date.now() + 90 * 86400 * 1000,
+ *     expiresAt: Date.now() + b.constants.TIME.days(90),
  *   });
  *   // issued.key  — "bk_live_<idHex>_<secretHex>"  (returned ONCE)
  *   // issued.id   — "<idHex>"

package/lib/cli.js

@@ -34,6 +34,9 @@
  * before encryption or temporarily switch the file to plaintext.
  */
 
+var fs = require("node:fs");
+var nodeCrypto = require("node:crypto");
+var os = require("node:os");
 var path = require("path");
 var apiSnapshot = require("./api-snapshot");
 var auditTools = require("./audit-tools");
@@ -898,11 +901,7 @@ async function _runBackup(args, ctx) {
   }
 
   if (sub === "verify") {
-    var fs2 = require("node:fs");
-    var os2 = require("node:os");
-    var nodePath = require("node:path");
-    var nodeCrypto = require("node:crypto");
-    var stagingDir = nodePath.join(os2.tmpdir(),
+    var stagingDir = path.join(os.tmpdir(),
       "blamejs-backup-verify-" + nodeCrypto.randomBytes(8).toString("hex"));
     try {
       var r = await restoreBundle.extract({
@@ -917,7 +916,7 @@ async function _runBackup(args, ctx) {
     } catch (e) {
       return report.error((e && e.message) || String(e));
     } finally {
-      try { fs2.rmSync(stagingDir, { recursive: true, force: true }); } catch (_e) { /* best-effort */ }
+      try { fs.rmSync(stagingDir, { recursive: true, force: true }); } catch (_e) { /* best-effort */ }
     }
   }
 
@@ -1118,7 +1117,7 @@ async function _runMtls(args, ctx) {
           validityDays: daysP,
         });
         if (outPath) {
-          require("node:fs").writeFileSync(outPath, p12.p12, { mode: 0o600 });
+          fs.writeFileSync(outPath, p12.p12, { mode: 0o600 });
           report.write("p12 written: " + outPath);
         } else {
           // No --out: stream the bytes to stdout for piping. Operators

package/lib/db-query.js

@@ -26,6 +26,7 @@
  *     a derived hash throws (every encryption uses a fresh nonce — the lookup
  *     would always return zero rows; failing loudly is safer).
  */
+var { Readable } = require("node:stream");
 var cryptoField = require("./crypto-field");
 var { generateToken } = require("./crypto");
 
@@ -194,7 +195,6 @@ class Query {
     var stmt = this._db.prepare(sql);
     var table = this._table;
     var iter;
-    var Readable = require("node:stream").Readable;
     try { iter = stmt.iterate.apply(stmt, this._whereParams); }
     catch (e) {
       var r = new Readable({ objectMode: true, read: function () {} });

package/lib/db.js

@@ -42,6 +42,7 @@
 var fs = require("fs");
 var path = require("path");
 var { DatabaseSync } = require("node:sqlite");
+var { Readable } = require("node:stream");
 var atomicFile = require("./atomic-file");
 var audit = require("./audit");
 var auditSign = require("./audit-sign");
@@ -796,7 +797,6 @@ function stream(sql) {
   var table = opts && typeof opts.table === "string" ? opts.table : null;
   var unseal = table ? cryptoField : null;
 
-  var Readable = require("node:stream").Readable;
   var stmt;
   var iter;
   try {

package/lib/error-page.js

@@ -39,8 +39,11 @@
  */
 
 var lazyRequire = require("./lazy-require");
+var template = require("./template");
 var audit = lazyRequire(function () { return require("./audit"); });
 
+var _esc = template.escapeHtml;
+
 // Status code → default short reason. Used when the error doesn't carry
 // its own message (e.g. a generic Error thrown from a route).
 var STATUS_REASONS = {
@@ -114,16 +117,6 @@ function _wantsJson(req, defaultFormat) {
   return req && req.method && req.method.toUpperCase() !== "GET";
 }
 
-function _esc(s) {
-  if (s === undefined || s === null) return "";
-  return String(s)
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
-
 function _redactHeaders(headers) {
   if (!headers || typeof headers !== "object") return {};
   var out = {};

package/lib/forms.js

@@ -36,6 +36,7 @@
  *   forms.escapeHtml = template.escapeHtml (re-export for convenience)
  */
 var nodeCrypto = require("crypto");
+var safeSchema = require("./safe-schema");
 var safeUrl = require("./safe-url");
 var template = require("./template");
 
@@ -319,10 +320,10 @@ function validate(spec, body) {
       }
     }
     if (f.type === "email" && typeof coerced === "string") {
-      // Pragmatic email check — RFC 5322 is impractical to regex
-      // correctly; this catches obvious nonsense ("foo", "foo@",
-      // "@bar") without over-engineering.
-      if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(coerced)) {
+      // Same pragmatic check the rest of the framework uses
+      // (safeSchema.EMAIL_RE — shared so we don't carry parallel
+      // copies of the same /^[^\s@]+@[^\s@]+\.[^\s@]+$/ regex).
+      if (!safeSchema.EMAIL_RE.test(coerced)) {
         errors[f.name] = (f.label || f.name) + " must be a valid email address";
         continue;
       }

package/lib/http-client.js

@@ -64,6 +64,8 @@
 var http  = require("http");
 var https = require("https");
 var http2 = require("http2");
+var nodeCrypto = require("node:crypto");
+var nodeStream = require("node:stream");
 var { URL } = require("url");
 var C = require("./constants");
 var pqcAgent = require("./pqc-agent");
@@ -321,7 +323,6 @@ function _attachJarCookie(headers, jar, url) {
 // parser accepts so round-trip from one blamejs app's outbound to
 // another's inbound is exact.
 function _buildMultipartBody(spec) {
-  var nodeCrypto = require("node:crypto");
   var boundary = "----blamejs-mp-" + nodeCrypto.randomBytes(16).toString("hex");
   var CRLF = "\r\n";
   var parts = [];
@@ -701,7 +702,7 @@ function _requestH1(transport, u, opts) {
           // The framework's contract is to hand back the response stream
           // unmodified; fix-up via a passthrough keeps that contract while
           // observing the chunk sizes.
-          var passthrough = new (require("node:stream").PassThrough)();
+          var passthrough = new nodeStream.PassThrough();
           res.on("data", function (chunk) { _emitDownload(chunk.length); passthrough.write(chunk); });
           res.on("end",  function () { passthrough.end(); });
           res.on("error", function (e) { passthrough.destroy(e); });

package/lib/mail.js

@@ -67,6 +67,7 @@ var audit = lazyRequire(function () { return require("./audit"); });
 var httpClient = lazyRequire(function () { return require("./http-client"); });
 var net = lazyRequire(function () { return require("net"); });
 var tls = lazyRequire(function () { return require("tls"); });
+var safeSchema = require("./safe-schema");
 var validateOpts = require("./validate-opts");
 var { FrameworkError } = require("./framework-error");
 
@@ -80,10 +81,10 @@ class MailError extends FrameworkError {
   }
 }
 
-// Pragmatic email check — same shape as forms.validate. RFC 5322 in a
-// regex is a fool's errand; this catches obvious nonsense and lets
-// real-world addresses through.
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+// Pragmatic email regex — shared with forms.validate / safe-schema.
+// RFC 5322 in a regex is a fool's errand; this catches obvious nonsense
+// and lets real-world addresses through.
+var EMAIL_RE = safeSchema.EMAIL_RE;
 
 function _normalizeRecipientList(value, label) {
   if (value === undefined || value === null) return [];

package/lib/middleware/body-parser.js

@@ -26,23 +26,23 @@
  *
  *   var bp = b.middleware.bodyParser({
  *     json: {
- *       limit:        1024 * 1024,
+ *       limit:        b.constants.BYTES.mib(1),
  *       strict:       true,                  // require the body to start with {/[
  *       parseHook:    function (parsed) { ... return validatedShape; },
  *     },
  *     urlencoded: {
- *       limit:        1024 * 1024,
+ *       limit:        b.constants.BYTES.mib(1),
  *       arrayLimit:   100,                   // for ?tag=a&tag=b → tag: ["a","b"]
  *     },
- *     text:        { limit: 1024 * 1024, charset: "utf-8" },
- *     raw:         { limit: 10 * 1024 * 1024, contentTypes: ["application/octet-stream"] },
+ *     text:        { limit: b.constants.BYTES.mib(1), charset: "utf-8" },
+ *     raw:         { limit: b.constants.BYTES.mib(10), contentTypes: ["application/octet-stream"] },
  *     multipart: {
  *       tmpDir:       os.tmpdir(),
- *       fileSize:     10 * 1024 * 1024,
- *       totalSize:    50 * 1024 * 1024,
+ *       fileSize:     b.constants.BYTES.mib(10),
+ *       totalSize:    b.constants.BYTES.mib(50),
  *       fileCount:    20,
  *       fieldCount:   100,
- *       fieldSize:    1024 * 1024,
+ *       fieldSize:    b.constants.BYTES.mib(1),
  *       mimeAllowlist: ["image/jpeg", "image/png", "application/pdf"], // null = any
  *
  *       // Per-part predicate. Runs after sanitization + MIME checks but
@@ -64,8 +64,8 @@
  *       // global mimeAllowlist for the named field; other fields still
  *       // use the global list.
  *       fields: {
- *         avatar:   { maxBytes: 2 * 1024 * 1024, mimeTypes: ["image/jpeg", "image/png"] },
- *         document: { maxBytes: 25 * 1024 * 1024 },
+ *         avatar:   { maxBytes: b.constants.BYTES.mib(2),  mimeTypes: ["image/jpeg", "image/png"] },
+ *         document: { maxBytes: b.constants.BYTES.mib(25) },
  *       },
  *
  *       // When wired, fileFilter rejections emit body-parser.multipart.file_rejected

package/lib/object-store/gcs.js

@@ -175,7 +175,7 @@ function create(config) {
     if (!tokenResp.access_token) {
       throw _err("AUTH_FAILED", "GCS token endpoint returned no access_token: " + res.body.toString("utf8"), true);
     }
-    var expiresInMs = (tokenResp.expires_in || 3600) * 1000;
+    var expiresInMs = C.TIME.seconds(tokenResp.expires_in || 3600);
     cachedToken = {
       accessToken: tokenResp.access_token,
       expiresAt:   Date.now() + expiresInMs,

package/lib/object-store/sigv4-bucket-ops.js

@@ -54,6 +54,7 @@ var nodeCrypto = require("crypto");
 var sigv4 = require("./sigv4");
 var safeXml = require("../parsers/safe-xml");
 var safeUrl = require("../safe-url");
+var template = require("../template");
 var httpClient = require("../http-client");
 var { ObjectStoreError } = require("../framework-error");
 
@@ -83,15 +84,18 @@ function _validateBucketName(name) {
   }
 }
 
-function _xmlEscape(s) {
-  return String(s)
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&apos;");
-}
+// XML body strings flow through template.escapeHtml — `&#x27;` (which
+// it emits for the apostrophe) is a numeric character reference and
+// is valid in both XML and HTML, where `&apos;` is XML-only. AWS S3
+// accepts both; using the shared HTML escape keeps the framework
+// down to one canonical escape primitive.
+var _xmlEscape = template.escapeHtml;
 
+// AWS PutBucketLifecycle / PutBucketCors require a Content-MD5 header
+// for body integrity (legacy AWS API requirement; SigV4 already covers
+// integrity via x-amz-content-sha256 but the API still validates this).
+// MD5 here is NOT a credential or security primitive — it's an AWS API
+// shape. b.credentialHash is the wrong tool.
 function _md5Base64(buf) {
   return nodeCrypto.createHash("md5").update(buf).digest("base64");
 }

package/lib/queue-local.js

@@ -33,8 +33,9 @@ var cluster = require("./cluster");
 var clusterStorage = require("./cluster-storage");
 var { generateToken } = require("./crypto");
 var cryptoField = require("./crypto-field");
-var safeJson = require("./safe-json");
 var lazyRequire = require("./lazy-require");
+var safeJson = require("./safe-json");
+var scheduler = require("./scheduler");
 var { QueueError } = require("./framework-error");
 
 var _err = QueueError.factory;
@@ -241,7 +242,6 @@ function create(_config) {
     if (row && row.repeatCron) {
       try {
         var unsealedRow = cryptoField.unsealRow("_blamejs_jobs", row);
-        var scheduler = require("./scheduler");
         var cron = scheduler.parseCron(unsealedRow.repeatCron);
         var nextMs = scheduler.nextCronFire(cron, new Date(nowMs), unsealedRow.repeatTimezone || null);
         await enqueue(unsealedRow.queueName,

package/lib/queue.js

@@ -31,12 +31,13 @@
  *                                       failed (status='failed')
  */
 var C = require("./constants");
-var localProto = require("./queue-local");
-var retryHelper = require("./retry");
-var safeAsync = require("./safe-async");
 var lazyRequire = require("./lazy-require");
+var nodeCrypto = require("node:crypto");
 var observability = require("./observability");
 var protocolDispatcher = require("./protocol-dispatcher");
+var localProto = require("./queue-local");
+var retryHelper = require("./retry");
+var safeAsync = require("./safe-async");
 var { QueueError } = require("./framework-error");
 
 var dispatcher = protocolDispatcher.create({
@@ -565,7 +566,6 @@ function enqueueFlow(spec) {
     return Promise.reject(e);
   }
 
-  var nodeCrypto = require("node:crypto");
   var flowId = "flow-" + nodeCrypto.randomBytes(8).toString("hex");
 
   return observability.tap("queue.enqueueFlow",

package/lib/router.js

@@ -25,6 +25,7 @@ var fs = require("fs");
 var path = require("path");
 var { URL } = require("url");
 var C = require("./constants");
+var safeAsync = require("./safe-async");
 var websocket = require("./websocket");
 var { boot } = require("./log");
 
@@ -217,12 +218,13 @@ class Router {
       });
     });
 
-    var allClosed = Promise.all(closes);
-    var timeout = new Promise(function (resolve) {
-      var t = setTimeout(resolve, timeoutMs);
-      t.unref();
-    });
-    await Promise.race([allClosed, timeout]);
+    // Wait up to `timeoutMs` for graceful WS closes, then force-destroy
+    // any laggards. `safeAsync.sleep({ unref: true })` matches the
+    // framework's outbound-timeout convention.
+    await Promise.race([
+      Promise.all(closes),
+      safeAsync.sleep(timeoutMs, { unref: true }),
+    ]);
     // Force-destroy any laggards — at this point we've waited the full
     // timeout and they didn't ack. The operator chose timeoutMs; honor it.
     this._activeWsConns.forEach(function (conn) {

package/lib/safe-schema.js

@@ -109,6 +109,7 @@
  *   so the two stay distinct rather than one wrapping the other.
  */
 
+var safeJson = require("./safe-json");
 var { defineClass } = require("./framework-error");
 
 var SafeSchemaError = defineClass("SafeSchemaError", { alwaysPermanent: true });
@@ -143,10 +144,17 @@ var ULID_RE     = /^[0-9A-HJKMNP-TV-Z]{26}$/;
 // base64 (standard alphabet, with optional padding). Base64url variants
 // rejected — operators chain .regex(...) for that.
 var BASE64_RE   = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
-// IPv6 — covers full, compressed (::), and IPv4-mapped forms. Not
-// exhaustive on every legal corner, but rejects the common malformed
-// inputs operators actually see at HTTP boundaries.
-var IPV6_RE     = /^(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|::(?:[0-9a-fA-F]{1,4}:){0,6}[0-9a-fA-F]{0,4}|(?:[0-9a-fA-F]{1,4}:){1,6}(?::[0-9a-fA-F]{1,4}){1,1}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5})$/;
+// IPv6 structural pattern — full 8-hextet, every `::`-compressed shape,
+// `::` and `::1` literals, IPv4-mapped (`::ffff:1.2.3.4`), and 6-prefix
+// + IPv4 tail. Adapted from validator.js (Apache-2.0); zone IDs
+// (`fe80::1%eth0`) are deliberately omitted — the framework rejects
+// them as non-portable, matching `safe-json.formats.ipv6`. Bounded
+// quantifiers, no nested-quantifier alternation, ReDoS-safe.
+//
+// `.ipv6()` schema method delegates to `safeJson.formats.ipv6` for
+// stricter algorithmic validation; this regex is exported as a
+// structural pattern for operators who want it directly.
+var IPV6_RE     = /^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/;
 
 // ---- helpers ----
 
@@ -424,22 +432,33 @@ function _stringMethods(schema, spec) {
         _fail(p, "string/datetime", "must be an ISO-8601 datetime with timezone");
     });
   };
+  // IP-address validators delegate to safe-json's algorithmic format
+  // checks rather than re-running regex matches. The algorithmic path
+  // handles edge cases that pure regex misses (compressed `::` shapes,
+  // IPv4-mapped `::ffff:1.2.3.4`, multi-`::` rejection, group-count
+  // bounds) and keeps the framework's IP-validation behavior in one
+  // tested place. IPV4_RE / IPV6_RE remain exported for operators who
+  // want the structural pattern, but `.ipv4()` / `.ipv6()` / `.ip()`
+  // are the canonical validation surface.
   schema.ipv4 = function () {
     return chain(function (v, p) {
-      return IPV4_RE.test(v) ? { ok: true } :
-        _fail(p, "string/ipv4", "must be a valid IPv4 address");
+      return (typeof v === "string" && safeJson.formats.ipv4(v))
+        ? { ok: true }
+        : _fail(p, "string/ipv4", "must be a valid IPv4 address");
     });
   };
   schema.ipv6 = function () {
     return chain(function (v, p) {
-      return IPV6_RE.test(v) ? { ok: true } :
-        _fail(p, "string/ipv6", "must be a valid IPv6 address");
+      return (typeof v === "string" && safeJson.formats.ipv6(v))
+        ? { ok: true }
+        : _fail(p, "string/ipv6", "must be a valid IPv6 address");
     });
   };
   schema.ip = function () {
     return chain(function (v, p) {
-      return (IPV4_RE.test(v) || IPV6_RE.test(v)) ? { ok: true } :
-        _fail(p, "string/ip", "must be a valid IP address (v4 or v6)");
+      return (typeof v === "string" && safeJson.formats.ip(v))
+        ? { ok: true }
+        : _fail(p, "string/ip", "must be a valid IP address (v4 or v6)");
     });
   };
   schema.cuid = function () {
@@ -1173,4 +1192,17 @@ module.exports = {
 
   // Errors
   SafeSchemaError:  SafeSchemaError,
+
+  // Validation regexes — exported so other modules don't re-declare
+  // their own copies. Pragmatic patterns; operators wanting RFC-strict
+  // behavior chain `.refine()` on top of the schema instead.
+  EMAIL_RE:         EMAIL_RE,
+  URL_RE:           URL_RE,
+  UUID_RE:          UUID_RE,
+  DATE_RE:          DATE_RE,
+  DATETIME_RE:      DATETIME_RE,
+  IPV4_RE:          IPV4_RE,
+  IPV6_RE:          IPV6_RE,
+  CUID_RE:          CUID_RE,
+  ULID_RE:          ULID_RE,
 };

package/lib/session.js

@@ -35,12 +35,13 @@
  *   verify / count
  *     — anywhere (any node can read shared session state)
  */
-var { generateToken, sha3Hash } = require("./crypto");
-var safeJson = require("./safe-json");
-var cryptoField = require("./crypto-field");
-var clusterStorage = require("./cluster-storage");
+var audit = require("./audit");
 var cluster = require("./cluster");
+var clusterStorage = require("./cluster-storage");
 var C = require("./constants");
+var { generateToken, sha3Hash } = require("./crypto");
+var cryptoField = require("./crypto-field");
+var safeJson = require("./safe-json");
 var { SessionError } = require("./framework-error");
 
 var _err = SessionError.factory;
@@ -260,13 +261,12 @@ async function rotate(oldToken, opts) {
   // privilege transition so post-incident review can trace which
   // session id covered which privilege state.
   try {
-    var audit = require("./audit");
     audit.emit({
       action:  "auth.session.rotate",
       outcome: "success",
       metadata: { reason: opts.reason || "explicit" },
     });
-  } catch (_e) { /* boot-order tolerance */ }
+  } catch (_e) { /* audit emit best-effort — never block rotate() */ }
 
   return { token: newSid, expiresAt: expiresAt };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.4.26",
+  "version": "0.4.28",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",