@blamejs/core 0.4.28 → 0.5.0

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- **0.4.29** (2026-04-30) — primitive-drift sweep: second-pass remediation
+- **0.4.28** (2026-04-30) — primitive-drift sweep: inline-require hoisting + safeAsync.sleep + time-math
 - **0.4.27** (2026-04-30) — primitive-drift sweep: regex + escape consolidation, IPv6 completion
 - **0.4.26** (2026-04-30) — primitive-drift sweep: middleware audit context + safeUrl
 - **0.4.25** (2026-04-30) — b.objectStore.bucketOps: bucket-level operations (SigV4)

package/index.js

@@ -105,6 +105,7 @@ var staticServe = require("./lib/static");
 var forms = require("./lib/forms");
 var app = require("./lib/app");
 var jobs = require("./lib/jobs");
+var breakGlass = require("./lib/break-glass");
 var mail = require("./lib/mail");
 var mailBounce = require("./lib/mail-bounce");
 var websocketChannels = require("./lib/websocket-channels");
@@ -206,6 +207,7 @@ module.exports = {
   forms:            forms,
   createApp:        app.createApp,
   jobs:             jobs,
+  breakGlass:       breakGlass,
   mail:             mail,
   mailBounce:       mailBounce,
   websocketChannels: websocketChannels,

package/lib/api-key.js

@@ -277,16 +277,10 @@ function create(opts) {
   // The audit chain treats null fields as "unknown", so partial
   // context is always safe.
   function _actor(callerOpts, userId) {
-    var override = {};
-    if (userId) override.userId = userId;
-    if (callerOpts && callerOpts.context && typeof callerOpts.context === "object") {
-      for (var k in callerOpts.context) {
-        if (Object.prototype.hasOwnProperty.call(callerOpts.context, k)) {
-          override[k] = callerOpts.context[k];
-        }
-      }
-    }
-    return requestHelpers.extractActorContext(callerOpts && callerOpts.req, override);
+    return requestHelpers.resolveActorWithOverride(
+      callerOpts,
+      userId ? { userId: userId } : null
+    );
   }
 
   function _selectAll() {

package/lib/audit-tools.js

@@ -57,9 +57,17 @@ var atomicFile = require("./atomic-file");
 var auditChain = require("./audit-chain");
 var auditSign = require("./audit-sign");
 var backupCrypto = require("./backup/crypto");
+var clusterStorage = require("./cluster-storage");
+var lazyRequire = require("./lazy-require");
 var jsonSafe = require("./safe-json");
 var { defineClass } = require("./framework-error");
 
+// Lazy `db` — db requires audit at top-of-file, audit transitively
+// reaches into audit-tools via the operator-supplied default fns,
+// so importing db at audit-tools' top would close the cycle. Lazy
+// keeps the load order one-way.
+var db = lazyRequire(function () { return require("./db"); });
+
 var AuditToolsError = defineClass("AuditToolsError", { alwaysPermanent: true });
 
 var BUNDLE_FORMAT  = "blamejs-audit-bundle-v1";
@@ -197,7 +205,6 @@ function _verifyChainSlice(rows, startPrevHash) {
 // cluster-storage reader so the tooling works in both single-node and
 // cluster deployments without the caller knowing which mode is active.
 async function _defaultReadRows(criteria) {
-  var clusterStorage = require("./cluster-storage");
   var sql = 'SELECT * FROM "audit_log"';
   var conds = [];
   var params = [];
@@ -213,7 +220,6 @@ async function _defaultReadRows(criteria) {
 }
 
 async function _defaultReadCoveringCheckpoint(lastCounter) {
-  var clusterStorage = require("./cluster-storage");
   return clusterStorage.executeOne(
     "SELECT * FROM audit_checkpoints " +
     "WHERE atMonotonicCounter >= ? " +
@@ -224,7 +230,6 @@ async function _defaultReadCoveringCheckpoint(lastCounter) {
 
 async function _defaultReadPredecessorRowHash(firstCounter) {
   if (firstCounter <= 1) return auditChain.ZERO_HASH;
-  var clusterStorage = require("./cluster-storage");
   var row = await clusterStorage.executeOne(
     "SELECT rowHash FROM audit_log WHERE monotonicCounter = ?",
     [firstCounter - 1]
@@ -640,16 +645,13 @@ async function purge(opts) {
 }
 
 async function _defaultReadPurgeAnchor() {
-  var clusterStorage = require("./cluster-storage");
   return clusterStorage.executeOne(
     "SELECT * FROM _blamejs_audit_purge_anchor WHERE scope = 'audit'"
   );
 }
 
 async function _defaultApplyPurge(args) {
-  var db = require("./db");
-  var clusterStorage = require("./cluster-storage");
-  var del = await db.purgeAuditChain({ lastPurgedCounter: args.lastPurgedCounter });
+  var del = await db().purgeAuditChain({ lastPurgedCounter: args.lastPurgedCounter });
   // UPSERT the single-row anchor. SQLite + Postgres both support
   // INSERT ... ON CONFLICT(scope) DO UPDATE.
   await clusterStorage.execute(

package/lib/audit.js

@@ -201,6 +201,7 @@ var FRAMEWORK_NAMESPACES = [
   // Per-primitive namespaces — keep alphabetical
   "apikey",     // b.apiKey
   "backup",     // b.backup
+  "breakglass", // b.breakGlass — column-policy / row-enforcement step-up auth
   "cache",      // b.cache
   "dkim",       // b.mail.dkim (DKIM-Signature generation events)
   "mail",       // b.mail (b.mail-bounce uses "system.mail.*")

package/lib/auth/oauth.js

@@ -106,11 +106,18 @@
 
 var nodeCrypto = require("node:crypto");
 var cache = require("../cache");
+var safeJson = require("../safe-json");
 var safeUrl = require("../safe-url");
 var C = require("../constants");
 var { defineClass } = require("../framework-error");
 var { boot } = require("../log");
 
+// Cap on responses parsed from upstream OAuth providers. Token /
+// userinfo / discovery responses are tiny in spec; 256 KiB leaves
+// huge headroom and prevents a hostile (or compromised) upstream
+// from staging a parse-bomb against the framework.
+var OAUTH_MAX_RESPONSE_BYTES = C.BYTES.kib(256);
+
 var OAuthError = defineClass("OAuthError", { alwaysPermanent: true });
 var log = boot("auth.oauth");
 
@@ -360,7 +367,7 @@ function create(opts) {
         url + " returned " + res.statusCode + ": " + bodyText.slice(0, 500));
     }
     if (!res.body) return null;
-    try { return JSON.parse(res.body.toString("utf8")); }
+    try { return safeJson.parse(res.body.toString("utf8"), { maxBytes: OAUTH_MAX_RESPONSE_BYTES }); }
     catch (e) {
       throw new OAuthError("auth-oauth/bad-json",
         url + " response not JSON: " + ((e && e.message) || String(e)));
@@ -547,7 +554,7 @@ function create(opts) {
         endpoint + " returned " + res.statusCode + ": " + text.slice(0, 500));
     }
     var parsed;
-    try { parsed = JSON.parse(text); }
+    try { parsed = safeJson.parse(text, { maxBytes: OAUTH_MAX_RESPONSE_BYTES }); }
     catch (e) {
       throw new OAuthError("auth-oauth/bad-token-json",
         "token endpoint response not JSON: " + ((e && e.message) || String(e)));
@@ -604,8 +611,8 @@ function create(opts) {
     }
     var header, payload;
     try {
-      header  = JSON.parse(_b64urlDecode(parts[0]).toString("utf8"));
-      payload = JSON.parse(_b64urlDecode(parts[1]).toString("utf8"));
+      header  = safeJson.parse(_b64urlDecode(parts[0]).toString("utf8"), { maxBytes: OAUTH_MAX_RESPONSE_BYTES });
+      payload = safeJson.parse(_b64urlDecode(parts[1]).toString("utf8"), { maxBytes: OAUTH_MAX_RESPONSE_BYTES });
     } catch (e) {
       throw new OAuthError("auth-oauth/malformed-jwt",
         "ID token header/payload base64 decode failed: " + ((e && e.message) || String(e)));

package/lib/backup/manifest.js

@@ -69,6 +69,7 @@
  */
 
 var C = require("../constants");
+var safeJson = require("../safe-json");
 var { FrameworkError } = require("../framework-error");
 
 class BackupManifestError extends FrameworkError {
@@ -250,7 +251,9 @@ function parse(jsonStr) {
   }
   var s = Buffer.isBuffer(jsonStr) ? jsonStr.toString("utf8") : jsonStr;
   var obj;
-  try { obj = JSON.parse(s); }
+  // Backup manifests are file-bounded operator-supplied input. 16 MiB
+  // is generous; real manifests are kilobytes.
+  try { obj = safeJson.parse(s, { maxBytes: C.BYTES.mib(16) }); }
   catch (e) {
     throw new BackupManifestError("backup-manifest/bad-json",
       "parse: not valid JSON: " + ((e && e.message) || String(e)));