@ferricstore/ferricstore 0.13.3 → 0.13.5

package/README.md

@@ -34,7 +34,7 @@ covers every public adapter class and option.
 
 ## Compatibility
 
-TypeScript SDK `0.13.3` requires FerricStore server `0.11.4` or newer. With
+TypeScript SDK `0.13.5` requires FerricStore server `0.11.4` or newer. With
 FerricStore 0.11.11 it negotiates compact Stream mode 34 for homogeneous auto-ID
 `XADD` pipelines and compact Pub/Sub mode 35 for homogeneous `PUBLISH`
 pipelines. Native wire protocol v1 and the generic fallback are unchanged.
@@ -62,7 +62,7 @@ const { FerricStoreClient, JsonCodec } = require("@ferricstore/ferricstore");
 docker run -p 6388:6388 \
   -e FERRICSTORE_PROTECTED_MODE=false \
   -v ferricstore_data:/data \
-  quay.io/ferricstore/ferricstore:0.11.19@sha256:6275175c71a75f2d2a47c30c47a6561f994d8a5e31570fc8bd11a9f6ebcb6b31
+  quay.io/ferricstore/ferricstore:0.11.21@sha256:d297c91414ecf206671685d6e74efcec715e5f14a96c5cef09ac5d8c4664c74b
 ```
 
 ## Query durable runs
@@ -152,7 +152,7 @@ Run the complete HTTP-compatible integration surface through a real TLS
 listener with ACL authentication using:
 
 ```bash
-FERRICSTORE_IMAGE=quay.io/ferricstore/ferricstore:0.11.19@sha256:6275175c71a75f2d2a47c30c47a6561f994d8a5e31570fc8bd11a9f6ebcb6b31 \
+FERRICSTORE_IMAGE=quay.io/ferricstore/ferricstore:0.11.21@sha256:d297c91414ecf206671685d6e74efcec715e5f14a96c5cef09ac5d8c4664c74b \
   npm run test:integration:http
 ```
 
@@ -449,10 +449,19 @@ worker-mode default. If an asynchronous completion fails after earlier writes
 succeed, `QueueCompletionError.completed` reports every successful completion
 drained by the same call, regardless of where the failed completion appeared.
 
-When a worker combines `blockMs` with an `AbortSignal`, native long polls are
-bounded by `abortPollMs` (default `1_000`) so shutdown is observed without
-abandoning an in-flight claim that may already have leased work. Finite server
-blocking time is added to the transport timeout rather than consuming it.
+Worker `blockMs` values must be safe non-negative integers from `0` through
+`4_294_967_295`; invalid values fail before a blocking claim is dispatched. When
+a worker combines `blockMs` with an `AbortSignal`, native long polls are bounded
+by `abortPollMs` (default `1_000`) so shutdown is observed without abandoning an
+in-flight claim that may already have leased work. Finite server blocking time
+is added to the transport timeout rather than consuming it. Raw
+`FLOW.CLAIM_DUE` `BLOCK` and `BLOCK_MS` arguments use the same validation before
+native or HTTP preparation.
+For malformed raw commands, recognized option/value pairs are skipped before an
+unsupported tail is scanned for `BLOCK`/`BLOCK_MS`; every subsequent marker is
+treated as an option and its successor is validated. This intentionally fails
+closed when arbitrary malformed tail data happens to equal `BLOCK`. Explicit
+`COMMAND_EXEC` wrappers and custom executors remain opaque escape hatches.
 
 Unpartitioned `enqueueMany` calls group items in linear time, preserve caller
 result order, keep chunks for the same auto-partition sequential, and dispatch

package/dist/index.cjs

@@ -3986,6 +3986,78 @@ function expandFlowClaimStates(args) {
   return expanded;
 }
 
+// src/flow-block-validation.ts
+var MAX_FLOW_BLOCK_MS = 4294967295;
+var FLOW_BLOCK_MS_ERROR = "blockMs must be a safe non-negative integer no greater than 4294967295";
+function validateFlowBlockMs(value) {
+  if (value != null && (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > MAX_FLOW_BLOCK_MS)) {
+    throw new TypeError(FLOW_BLOCK_MS_ERROR);
+  }
+}
+function validateRawFlowBlockMs(value) {
+  let parsed;
+  try {
+    parsed = integerArg(value);
+  } catch {
+    throw new TypeError(FLOW_BLOCK_MS_ERROR);
+  }
+  validateFlowBlockMs(parsed);
+}
+function validateRawFlowClaimBlockOptions(args) {
+  for (let index = 1; index < args.length; ) {
+    const token = asText(args[index]).toUpperCase();
+    switch (token) {
+      case "BLOCK":
+      case "BLOCK_MS":
+        validateRawFlowBlockMs(args[index + 1]);
+        index += 2;
+        break;
+      case "STATE":
+      case "PARTITION":
+      case "WORKER":
+      case "LEASE_MS":
+      case "LIMIT":
+      case "PRIORITY":
+      case "NOW":
+      case "RECLAIM_RATIO":
+      case "RETURN":
+      case "MAXBYTES":
+      case "VALUE":
+      case "VALUE_MAX_BYTES":
+        index += 2;
+        break;
+      case "STATES":
+      case "PARTITIONS": {
+        const count = Number(args[index + 1]);
+        const valuesStart = index + 2;
+        if (!Number.isSafeInteger(count) || count < 0 || count > args.length - valuesStart) {
+          validateRawFlowClaimBlockFallback(args, valuesStart);
+          return;
+        }
+        index = valuesStart + count;
+        break;
+      }
+      case "RECLAIM_EXPIRED":
+      case "INCLUDE_STATE":
+        index += index + 1 < args.length && isBoolToken(args[index + 1]) ? 2 : 1;
+        break;
+      case "PAYLOAD":
+      case "NOPAYLOAD":
+        index += 1;
+        break;
+      default:
+        validateRawFlowClaimBlockFallback(args, index);
+        return;
+    }
+  }
+}
+function validateRawFlowClaimBlockFallback(args, start) {
+  for (let index = start; index < args.length; index += 1) {
+    const token = asText(args[index]).toUpperCase();
+    if (token === "BLOCK" || token === "BLOCK_MS") validateRawFlowBlockMs(args[index + 1]);
+  }
+}
+
 // src/protocol-flow.ts
 function flowCreatePayload(args) {
   if (args.length < 7) return void 0;
@@ -4113,6 +4185,7 @@ function flowCreateManyPayload(args, maxBodyBytes, allowCompact) {
 }
 function flowClaimDuePayload(args, maxBodyBytes, allowCompact) {
   if (args.length < 1) return void 0;
+  validateRawFlowClaimBlockOptions(args);
   const options = parseFlowOptions(args, 1, args.length, {
     allowed: /* @__PURE__ */ new Set([
       "STATE",
@@ -4139,6 +4212,7 @@ function flowClaimDuePayload(args, maxBodyBytes, allowCompact) {
     readValues: true
   });
   if (options == null) return void 0;
+  validateFlowBlockMs(options.block_ms);
   const returnMode = options.return == null ? "" : asText(options.return).toUpperCase();
   if (!returnMode.startsWith("JOBS_COMPACT")) {
     const fallback = Array.isArray(options.states) ? commandExec(["FLOW.CLAIM_DUE", ...expandFlowClaimStates(args)]) : commandExec(["FLOW.CLAIM_DUE", ...args]);
@@ -18653,6 +18727,7 @@ var FerricStoreClaimClient = class extends FerricStoreMutationClient {
   }
   claimDueRequest(type, options, reusableAfterAwait = false) {
     const captured = snapshotClaimOptions(options, reusableAfterAwait);
+    validateFlowBlockMs(captured.blockMs);
     if (captured.state != null && captured.states != null) {
       throw new Error("state and states are mutually exclusive");
     }
@@ -20085,11 +20160,11 @@ function workerClaimBlockMs(options, useBlocking) {
   if (!useBlocking || options.blockMs == null) {
     return void 0;
   }
-  if (options.signal == null || !Number.isFinite(options.blockMs) || options.blockMs < 0) {
-    return options.blockMs;
-  }
-  const abortPollMs = positiveInteger5(options.abortPollMs, 1e3);
-  return options.blockMs === 0 ? abortPollMs : Math.min(Math.trunc(options.blockMs), abortPollMs);
+  validateFlowBlockMs(options.blockMs);
+  const blockMs = options.blockMs;
+  if (options.signal == null) return blockMs;
+  const abortPollMs = Math.min(positiveInteger5(options.abortPollMs, 1e3), MAX_FLOW_BLOCK_MS);
+  return blockMs === 0 ? abortPollMs : Math.min(blockMs, abortPollMs);
 }
 function workerMaxIdleSleepMs(options, idleSleepMs = workerIdleSleepMs(options)) {
   return Math.max(idleSleepMs, nonNegativeDuration(options.maxIdleSleepMs, 5e3));
@@ -21988,7 +22063,7 @@ function throwError(value) {
 }
 
 // src/version.ts
-var FERRICSTORE_SDK_VERSION = "0.13.3";
+var FERRICSTORE_SDK_VERSION = "0.13.5";
 var FERRICSTORE_MINIMUM_SERVER_VERSION = "0.11.4";
 var FERRICSTORE_NATIVE_PROTOCOL_VERSION = 1;
 // Annotate the CommonJS export names for ESM import in node: