@blamejs/core 0.6.7 → 0.6.12

package/lib/seeders.js

@@ -36,14 +36,14 @@
  * truncating the seeded tables themselves; "unseed" isn't framework-
  * knowable.
  *
- * Validation tiers:
+ * Validation policy:
  *
- *   - create() opts                       → Tier A (throw at boot)
- *   - run/status `env` arg                → Tier A (throw — explicit)
- *   - seed file shape (missing run, etc)  → Tier A (throw at load)
- *   - dependsOn cycle                     → Tier A (throw at load)
- *   - dependsOn missing                   → Tier A (throw at run)
- *   - audit emit failures                 → Tier B (drop silent)
+ *   - create() opts                       → throw at boot
+ *   - run/status `env` arg                → throw at call site (explicit)
+ *   - seed file shape (missing run, etc)  → throw at load
+ *   - dependsOn cycle                     → throw at load
+ *   - dependsOn missing                   → throw at run
+ *   - audit emit failures                 → drop silent (hot-path sink)
  *
  * Security defaults:
  *
@@ -103,7 +103,7 @@ function _runSql(db, sql) {
   throw _err("BAD_DB", "seeders: db handle exposes no DDL runner (exec / runSql)");
 }
 
-// ---- Tier-A validation helpers ----
+// ---- Call-site validation helpers (throw on bad input) ----
 
 function _validateEnv(name, value) {
   if (typeof value !== "string" || value.length === 0) {
@@ -399,7 +399,7 @@ function create(opts) {
 
   function _emitObs(name, labels) {
     try { observability().event(name, 1, labels || {}); }
-    catch (_e) { /* Tier B */ }
+    catch (_e) { /* drop-silent — observability sink must not crash seeders */ }
   }
 
   function _emitAudit(action, info) {

package/lib/session.js

@@ -212,8 +212,11 @@ async function touch(token, opts) {
   // assembly) and matches the call shape clusterStorage expects.
   // extendBy resets expiresAt relative to NOW, not relative to the
   // current expiresAt — a soaked session with continuous traffic
-  // shouldn't accumulate unbounded expiry.
-  if (typeof opts.extendBy === "number" && opts.extendBy > 0) {
+  // shouldn't accumulate unbounded expiry. The same MAX_TTL_MS
+  // ceiling create() and rotate() apply gates extendBy too — repeated
+  // touch() calls cannot push expiresAt past the framework's bound.
+  if (opts.extendBy !== undefined && opts.extendBy !== null) {
+    _validateTtl(opts.extendBy, "session.touch");
     var newExpires = nowMs + opts.extendBy;
     var result = await clusterStorage.execute(
       "UPDATE _blamejs_sessions SET lastActivity = ?, expiresAt = ? " +

package/lib/slug.js

@@ -20,12 +20,12 @@
  * symbols, and separators — Cyrillic, Greek, CJK, and other scripts pass
  * through. Operators with non-Latin user content opt into preserveUnicode.
  *
- * Validation tiers:
+ * Validation policy:
  *
- *   - Opts at first call (every public fn) → Tier A (throw)
- *   - title not a string                   → Tier A (throw)
- *   - title normalizes to empty            → Tier C (return opts.fallback)
- *   - unique() exhausts maxAttempts        → Tier A (throw SlugError)
+ *   - Opts at first call (every public fn) → throw at call site
+ *   - title not a string                   → throw at call site
+ *   - title normalizes to empty            → return opts.fallback (tolerant)
+ *   - unique() exhausts maxAttempts        → throw SlugError at call site
  *
  * Out of scope (v1):
  *   - Word-by-word transliteration tables (Russian → English, Chinese →
@@ -61,7 +61,7 @@ var _RESERVED = Object.freeze([
   "new", "edit", "delete", "create", "update",
 ]);
 
-// ---- Tier-A validation helpers ----
+// ---- Call-site validation helpers (throw on bad input) ----
 
 function _isPositiveInt(n) {
   return typeof n === "number" && isFinite(n) && n >= 1 && Math.floor(n) === n;

package/lib/testing.js

@@ -82,7 +82,7 @@ var DEFAULTS = Object.freeze({
   runMiddlewareTimeoutMs:  5000,
 });
 
-// ---- Tier-A helpers ----
+// ---- Call-site validation helpers (throw on bad input) ----
 
 function _isPositiveInt(n) {
   return typeof n === "number" && isFinite(n) && n >= 1 && Math.floor(n) === n;
@@ -268,7 +268,7 @@ function fakeHttpClient(responder) {
 
 // ---- captureAudit ----
 //
-// Matches b.audit.safeEmit Tier-B drop-silent contract. captured holds
+// Matches b.audit.safeEmit's drop-silent contract. captured holds
 // every event pushed; clear() empties; byAction(name) filters.
 
 function captureAudit() {
@@ -276,9 +276,9 @@ function captureAudit() {
   return {
     captured: captured,
     safeEmit: function (event) {
-      // Tier B: drop-silent on caller-side bugs that throw inside the
-      // capture push (shouldn't happen with array.push, but matches the
-      // real safeEmit's defensive shape).
+      // Drop-silent on caller-side bugs that throw inside the capture
+      // push (shouldn't happen with array.push, but matches the real
+      // safeEmit's defensive shape).
       try { captured.push(event); }
       catch (_e) { /* drop-silent */ }
     },

package/lib/validate-opts.js

@@ -1,6 +1,7 @@
 "use strict";
 /**
- * validate-opts — shared Tier-A helper for primitive create() functions.
+ * validate-opts — shared call-site helper for primitive create() functions
+ * that throws on unknown / bad-shape opts at config time.
  *
  * Catches silent operator typos: `cors({ allowedOrigins: [] })` (wrong
  * key name) currently looks like config but does nothing — the primitive

package/lib/webhook.js

@@ -57,12 +57,12 @@
  *     reference impl; operators plug in Redis/SQL by passing any object
  *     with `checkAndInsert(nonce, expireAt) → bool/Promise<bool>`.
  *
- * Validation tiers:
+ * Validation policy:
  *
- *   - signer/verifier creation opts → Tier A (throw)
- *   - signer.sign body type         → Tier A (throw)
- *   - signer.send url shape         → Tier A (throw via safeUrl)
- *   - verifier.verify input shape   → Tier A (throw WebhookError)
+ *   - signer/verifier creation opts → throw at config time
+ *   - signer.sign body type         → throw at call site
+ *   - signer.send url shape         → throw at call site (via safeUrl)
+ *   - verifier.verify input shape   → throw WebhookError at call site
  *   - nonceStore.checkAndInsert err → propagates (fail-closed)
  */
 
@@ -79,7 +79,7 @@ var observability = lazyRequire(function () { return require("./observability");
 
 function _emitEvent(name, value, labels) {
   try { observability().event(name, value, labels || {}); }
-  catch (_e) { /* Tier B: hot-path observability sink */ }
+  catch (_e) { /* hot-path observability sink — drops silent on internal throws */ }
 }
 
 var _err = WebhookError.factory;
@@ -111,7 +111,7 @@ var DEFAULTS = Object.freeze({
   auditSuccess:    true,
 });
 
-// ---- Tier-A validation helpers ----
+// ---- Call-site validation helpers (throw on bad input) ----
 
 function _isPositiveInt(n) {
   return typeof n === "number" && isFinite(n) && n >= 1 && Math.floor(n) === n;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.7",
+  "version": "0.6.12",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",