gina 0.6.7 → 0.6.8

package/framework/v0.6.8/core/controller/controller.render-stream.js

@@ -0,0 +1,270 @@
+'use strict';
+/**
+ * This file is part of the gina package.
+ * Copyright (c) 2009-2026 Rhinostone <contact@gina.io>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+/**
+ * renderStream delegate — streams an AsyncIterable as a chunked HTTP response.
+ *
+ * Content-type determines framing:
+ *   text/event-stream  → SSE: each chunk is wrapped as `data: {chunk}\n\n`
+ *   anything else      → raw chunks written in sequence
+ *                        (HTTP/1.1 uses chunked transfer-encoding automatically)
+ *
+ * The caller (controller action) is responsible for yielding plain strings or
+ * Buffers. Object chunks are coerced via String(). Buffer chunks are decoded
+ * as UTF-8 on the SSE path only — on any other content-type they pass through
+ * VERBATIM, byte-exact, which is what makes this delegate usable for binary
+ * serving (#STO1 Range: 206 bodies must not be re-encoded).
+ *
+ * HEAD requests answer headers-only (no body, the iterable is never consumed —
+ * a destroyable source is destroy()ed) — the same render-layer body
+ * suppression every other delegate applies.
+ *
+ * HTTP/2: uses stream.respond() + stream.write() + stream.end()
+ * HTTP/1.1: uses response.setHeader() + response.write() + response.end()
+ *
+ * In both cases all pending response headers set upstream (CORS, Content-Range,
+ * etc.) are preserved and merged into the initial headers frame, and the
+ * delegate's own defaults (cache-control, connection, x-accel-buffering) apply
+ * only where the caller has not already chosen a value.
+ *
+ * @param {AsyncIterable} asyncIterable  Source of string/Buffer chunks
+ * @param {string}        contentType    Response Content-Type (default: text/event-stream)
+ * @param {object}        deps           Injected by controller: { self, local, headersSent }
+ */
+
+module.exports = function renderStream(asyncIterable, contentType, deps) {
+
+    // #B62 (sibling of the render-swig #B61 race fix): the per-request deps
+    // are FUNCTION-scoped. In prod this module is a shared singleton across
+    // concurrent requests; with module-scoped captures, the fire-and-forget
+    // _doStream IIFE below resumed after its `for await` reading a CONCURRENT
+    // request's refs — its catch reported errors through the other request's
+    // controller, and its finally nulled the OTHER request's live
+    // local.req/res/next mid-stream (measured) while never releasing its own.
+    var self        = deps.self;
+    var local       = deps.local;
+    var headersSent = deps.headersSent;
+
+    // Prevent double-render (same guard used by renderJSON / renderTEXT)
+    if (local.options.renderingStack.length > 1) return false;
+    if (self.isProcessingError) return;
+
+    // #B38 — released-response guard (see #B31 / #B36): a terminal exit (redirect() /
+    // renderTEXT() / throwError()) nulled the per-request refs before this stream began.
+    // renderStream's wrapper and this delegate are BOTH synchronous, so the read below
+    // would throw synchronously → uncaughtException → SIGTERM. The read happens BEFORE the
+    // headersSent() guard further down, so check here — mirrors render-json.js's #B36
+    // placement (after isProcessingError, before the first local.res deref). Behaviour-
+    // neutral on live requests (guard skipped while the refs exist).
+    if (local.res == null) return;
+
+    var response = local.res;
+    var stream   = (typeof(response.stream) !== 'undefined') ? response.stream : null;
+    // #H10 — opt-in HTTP/2 response trailers (registered via self.sendTrailers()).
+    var _trailers = (local._trailers && typeof(local._trailers) === 'object') ? local._trailers : null;
+
+    if (headersSent(response)) {
+        local.req = null; local.res = null; local.next = null;
+        return;
+    }
+
+    contentType = contentType || 'text/event-stream';
+    var isSSE   = /text\/event-stream/i.test(contentType);
+
+    /**
+     * Frame one chunk for the wire.
+     *
+     * SSE is a TEXT protocol, so Buffers are decoded as UTF-8 before framing.
+     * On the raw (non-SSE) path a Buffer passes through VERBATIM: the
+     * historical unconditional `chunk.toString('utf8')` replaced every
+     * non-UTF-8 byte with U+FFFD (measured: a 12-byte PNG header round-tripped
+     * to 20 bytes), which made this delegate unusable for byte serving. A
+     * valid-UTF-8 Buffer re-encodes byte-identically on write, so text
+     * consumers see no change.
+     *
+     * @inner
+     * @param {Buffer|string|*} chunk - One yielded chunk.
+     * @returns {Buffer|string} The bytes/string to write.
+     */
+    function formatChunk(chunk) {
+        if (isSSE) {
+            var s = (chunk instanceof Buffer) ? chunk.toString('utf8') : String(chunk);
+            return 'data: ' + s + '\n\n';
+        }
+        return (chunk instanceof Buffer) ? chunk : String(chunk);
+    }
+
+    // HEAD parity — headers-only, no body, the iterable is never consumed.
+    // Every other delegate suppresses the body for HEAD in the render layer
+    // (render-json.js is the canonical pattern); this delegate was the lone
+    // exception, so a HEAD to a streaming route used to stream a full body.
+    // Runs synchronously before the IIFE: no #FI timeline entry is pushed
+    // (no stream occurred) and #H10 trailers are skipped (no body to trail).
+    if ( local.req && local.req.method && /^HEAD$/i.test(local.req.method) ) {
+        if (stream) {
+            if ( !stream.destroyed && !stream.closed && !stream.headersSent ) {
+                var _headHeaders = {
+                    ':status'      : response.statusCode || 200,
+                    'content-type' : contentType
+                };
+                var _headPending = response.getHeaders ? response.getHeaders() : {};
+                for (var hk in _headPending) {
+                    if ( !(hk in _headHeaders) ) _headHeaders[hk] = _headPending[hk];
+                }
+                stream.respond(_headHeaders);
+            }
+            if ( !stream.destroyed && !stream.closed ) stream.end();
+        } else {
+            if ( !headersSent(response) ) {
+                response.setHeader('content-type', contentType);
+                response.statusCode = response.statusCode || 200;
+            }
+            response.end();
+        }
+        // A stream-like source the caller opened would otherwise leak its
+        // handle — it is never iterated on the HEAD path.
+        if ( asyncIterable && typeof asyncIterable.destroy === 'function' ) {
+            try { asyncIterable.destroy(); } catch (_dErr) { /* best-effort */ }
+        }
+        // #B357 — see the note at the h2 arm's assignment below.
+        try { response.headersSent = true; } catch (_hsErr) { /* getter-only — already true */ }
+        local.req = null; local.res = null; local.next = null;
+        return;
+    }
+
+    // #FI — stream start time for Inspector Flow tab
+    var _timeline = local._timeline || null;
+    var _streamStart = _timeline ? Date.now() : 0;
+
+    ;(async function _doStream() {
+        var chunk;
+        try {
+            if (stream) {
+                // ── HTTP/2 ────────────────────────────────────────────────────────
+                if (stream.destroyed || stream.closed) {
+                    return;
+                }
+
+                if (!stream.headersSent) {
+                    var _headers = {
+                        // #B351 — never a literal: a hand-built h2 frame must carry the
+                        // caller's status, because `setHeader(':status', …)` throws and no
+                        // later merge can repair a pseudo-header. Without this, renderStream
+                        // can only ever answer 200 — so 206/416 (Range) and 404 are
+                        // unreachable on the h2 engine. Same class as #B172 (render-json).
+                        ':status'          : response.statusCode || 200,
+                        'content-type'     : contentType
+                    };
+                    // Merge pending response headers set upstream (CORS, cookies,
+                    // Content-Range, etc.)
+                    var _pending = response.getHeaders ? response.getHeaders() : {};
+                    for (var k in _pending) {
+                        if (!(k in _headers)) _headers[k] = _pending[k];
+                    }
+                    // Delegate defaults apply only where the caller has not chosen
+                    // a value — a byte-serving caller (#STO1 Range) sets its own
+                    // Cache-Control, which the old frame literal silently beat.
+                    if ( !('cache-control' in _headers) ) {
+                        _headers['cache-control'] = 'no-cache';
+                    }
+                    if ( !('x-accel-buffering' in _headers) ) {
+                        _headers['x-accel-buffering'] = 'no';
+                    }
+                    // #H10 — when trailers were registered, defer the stream close so the
+                    // wantTrailers event can flush them after the final DATA frame.
+                    if (_trailers) {
+                        stream.once('wantTrailers', function() {
+                            try {
+                                if (!stream.destroyed && !stream.closed) stream.sendTrailers(_trailers);
+                            } catch (_e) { /* trailers are best-effort — never fail the response */ }
+                        });
+                        stream.respond(_headers, { waitForTrailers: true });
+                    } else {
+                        stream.respond(_headers);
+                    }
+                }
+
+                for await (chunk of asyncIterable) {
+                    if (stream.destroyed || stream.closed) break;
+                    stream.write(formatChunk(chunk));
+                }
+
+                if (!stream.destroyed && !stream.closed) stream.end();
+                // #B357 — `headersSent` is a getter-only accessor on real
+                // ServerResponse / Http2ServerResponse objects, so a bare
+                // assignment THROWS under this file's strict mode. The wire was
+                // already complete (end() above), but the throw detoured every
+                // streaming request through the catch → a swallowed late
+                // throwError — and killed the #FI timeline entries below. Real
+                // responses already read true here (the getter tracks
+                // respond()/end()); the assignment only matters for
+                // plain-object test doubles, which stay writable.
+                try { response.headersSent = true; } catch (_hs2Err) { /* getter-only — already true */ }
+
+            } else {
+                // ── HTTP/1.1 ─────────────────────────────────────────────────────
+                if (!headersSent(response)) {
+                    response.setHeader('content-type', contentType);
+                    // Delegate defaults apply only where the caller has not
+                    // already chosen a value (#STO1 Range) — setHeader would
+                    // silently clobber a pre-set Cache-Control.
+                    var _h1Pending = response.getHeaders ? response.getHeaders() : {};
+                    if ( !('cache-control' in _h1Pending) ) {
+                        response.setHeader('cache-control', 'no-cache');
+                    }
+                    if ( !('connection' in _h1Pending) ) {
+                        response.setHeader('connection', 'keep-alive');
+                    }
+                    if ( isSSE && !('x-accel-buffering' in _h1Pending) ) {
+                        response.setHeader('x-accel-buffering', 'no');
+                    }
+                    // #B351 — preserve a status the caller pre-set. The bare assignment
+                    // clobbered it, which is worse than the h2 arm's literal: a controller
+                    // that had already chosen 206/404 was silently answered 200.
+                    response.statusCode = response.statusCode || 200;
+                }
+
+                for await (chunk of asyncIterable) {
+                    if (response.writableEnded || response.destroyed) break;
+                    response.write(formatChunk(chunk));
+                }
+
+                if (!response.writableEnded) response.end();
+                // #B357 — see the h2 arm's note: guarded, real responses
+                // already read true post-end.
+                try { response.headersSent = true; } catch (_hs1Err) { /* getter-only — already true */ }
+            }
+
+            // #FI — stream response + total timing
+            if (_streamStart && _timeline) {
+                var _streamEnd = Date.now();
+                _timeline.entries.push({
+                    label: 'stream-write', cat: 'response',
+                    startMs: _streamStart, endMs: _streamEnd,
+                    durationMs: _streamEnd - _streamStart,
+                    detail: contentType
+                });
+                _timeline.entries.push({
+                    label: 'total', cat: 'total',
+                    startMs: _timeline.requestStart,
+                    endMs: _streamEnd,
+                    durationMs: _streamEnd - _timeline.requestStart,
+                    detail: null
+                });
+            }
+
+        } catch (err) {
+            self.throwError(response, 500, err);
+        } finally {
+            local.req  = null;
+            local.res  = null;
+            local.next = null;
+        }
+    })();
+};

package/framework/{v0.6.7 → v0.6.8}/core/gna.js

@@ -1689,7 +1689,9 @@ isBundleMounted(projects, bundlesPath, getContext('bundle'), function onBundleMo
                                             for (var _stoN in _stoDrivers) {
                                                 if ( typeof(_stoDrivers[_stoN].store) == 'string' && _stoDrivers[_stoN].store.length > 0 ) {
                                                     try {
-                                                        _stoStores[_stoN] = lib.StorageStore(_stoDrivers[_stoN].store);
+                                                        // the driver name namespaces the store's rows, so two
+                                                        // drivers may share one connectors.json entry
+                                                        _stoStores[_stoN] = lib.StorageStore(_stoDrivers[_stoN].store, _stoN);
                                                     } catch (stoStoreErr) {
                                                         var _stoStoreMsg = '[storage] driver `' + _stoN + '` names store `' + _stoDrivers[_stoN].store + '`, which could not be built — aborting boot: ' + (stoStoreErr.message || stoStoreErr);
                                                         console.emerg(_stoStoreMsg + '\n' + (stoStoreErr.stack || ''));
@@ -1703,7 +1705,13 @@ isBundleMounted(projects, bundlesPath, getContext('bundle'), function onBundleMo
                                                 // (§4 — a strategy flip on populated storage warns
                                                 // every boot; a hash change warns once). Same sink as
                                                 // the validateConfig warnings above.
-                                                if ( lib.storage.start({ drivers: _stoDrivers, default: _stoSettings.default, stores: _stoStores, warn: function(stoWarnMsg) { console.warn('[storage] ' + stoWarnMsg); } }) ) {
+                                                if ( lib.storage.start({ drivers: _stoDrivers, default: _stoSettings.default, stores: _stoStores, requireProjectModule: function(stoPkgName) {
+                                                    // s3-adapter SDK resolution — built HERE because
+                                                    // lib/storage is framework-independent (no `_`/
+                                                    // `getPath` globals inside it, test-enforced);
+                                                    // same project-path idiom as every connector.
+                                                    return require( _(getPath('project') + '/node_modules/' + stoPkgName, true) );
+                                                }, warn: function(stoWarnMsg) { console.warn('[storage] ' + stoWarnMsg); } }) ) {
                                                     // console.info, NOT debug — the shipped
                                                     // default log level filters debug, and an
                                                     // operator needs to see which roots went live.

package/framework/{v0.6.7 → v0.6.8}/core/router.js

@@ -266,7 +266,26 @@ function Router(env, scope) {
         // (raw) value (the #B65 freeze-guard). Host-only, public; scheme prefers
         // X-Forwarded-Proto (TLS-terminating proxy) then PROXY_SCHEME then the
         // bundle scheme.
-        var proxyReqHost = request.headers.host || request.headers[':authority'];
+        // #B367 — SECURITY: these header values are attacker-supplied and end up
+        // spliced UNESCAPED into the client loader's JS string literals via
+        // page.environment.hostname / .webroot / .proxyHost / .proxyHostname
+        // (whisper() is a raw token replace — helpers/context.js:798-802), so a
+        // single quote in one of them closes the literal and executes arbitrary
+        // script on every rendered page, unauthenticated. Sanitise at ingest and
+        // fall back to the bundle's internal configured values when a value is
+        // malformed. Note `proxyReqHost` is the caller's own Host/:authority
+        // header and is validated for the same reason.
+        // Keep in sync with the core/server.isaac.js twin.
+        var _isSafeHostToken = function(v) {
+            return ( typeof(v) == 'string' && v.length > 0 && v.length <= 255
+                     && /^[A-Za-z0-9._:\[\]-]+$/.test(v) );
+        };
+        var _rawProxyReqHost = request.headers.host || request.headers[':authority'];
+        var proxyReqHost     = _isSafeHostToken(_rawProxyReqHost) ? _rawProxyReqHost : null;
+        var _rawXfh          = request.headers['x-forwarded-host'];
+        var _xfh             = _isSafeHostToken(_rawXfh) ? _rawXfh : null;
+        var _rawXfProto      = request.headers['x-forwarded-proto'];
+        var _safeXfProto     = ( _rawXfProto === 'http' || _rawXfProto === 'https' ) ? _rawXfProto : null;
         // #B152 — opt-in: server.proxy.requireForwardedHeaders (boot-resolved
         // to process.gina._proxyRequireForwarded by server.js) disables the
         // port-less-Host heuristic — only an explicit X-Forwarded-Host
@@ -274,15 +293,15 @@ function Router(env, scope) {
         var proxyReqIsProxied = (
             ( proxyReqHost && !/\:[0-9]+$/.test(proxyReqHost)
                 && process.gina._proxyRequireForwarded !== true )
-            || request.headers['x-forwarded-host']
+            || _xfh
         ) ? true : false;
         if ( proxyReqIsProxied ) {
-            var proxyReqScheme = request.headers['x-forwarded-proto']
+            var proxyReqScheme = _safeXfProto
                 || process.gina.PROXY_SCHEME
                 || conf.server.scheme;
-            if ( request.headers['x-forwarded-host'] ) {
-                process.gina.PROXY_HOSTNAME = proxyReqScheme +'://'+ request.headers['x-forwarded-host'];
-                process.gina.PROXY_HOST     = request.headers['x-forwarded-host'];
+            if ( _xfh ) {
+                process.gina.PROXY_HOSTNAME = proxyReqScheme +'://'+ _xfh;
+                process.gina.PROXY_HOST     = _xfh;
             } else {
                 process.gina.PROXY_HOSTNAME = proxyReqScheme +'://'+ proxyReqHost;
                 process.gina.PROXY_HOST     = proxyReqHost;
@@ -302,12 +321,13 @@ function Router(env, scope) {
         if ( typeof(request._ginaIsProxyHost) == 'undefined' ) {
             request._ginaIsProxyHost = proxyReqIsProxied;
             if (proxyReqIsProxied) {
-                var _slotScheme = request.headers['x-forwarded-proto']
+                // #B367 — sanitised tokens only (see the block above).
+                var _slotScheme = _safeXfProto
                     || process.gina.PROXY_SCHEME
                     || conf.server.scheme;
-                if ( request.headers['x-forwarded-host'] ) {
-                    request._ginaProxyHostname = _slotScheme +'://'+ request.headers['x-forwarded-host'];
-                    request._ginaProxyHost     = request.headers['x-forwarded-host'];
+                if ( _xfh ) {
+                    request._ginaProxyHostname = _slotScheme +'://'+ _xfh;
+                    request._ginaProxyHost     = _xfh;
                 } else {
                     request._ginaProxyHostname = _slotScheme +'://'+ proxyReqHost;
                     request._ginaProxyHost     = proxyReqHost;

package/framework/{v0.6.7 → v0.6.8}/core/server.isaac.js

@@ -1987,22 +1987,49 @@ function ServerEngineClass(options) {
             // port-less-Host heuristic — only an explicit X-Forwarded-Host
             // classifies as proxied. Keep in sync with the core/router.js twin
             // (proxyReqIsProxied).
+            // #B367 — SECURITY: every value below is attacker-supplied and is spliced
+            // UNESCAPED into the client loader's JS string literals (gina.onload.min.js:
+            // `hostname:'{{ page.environment.hostname }}'`, `window.__ginaWebroot='…'`),
+            // because whisper() (helpers/context.js:798-802) is a raw token replace with
+            // no escaping. A single quote in one of these headers therefore CLOSES the
+            // literal and executes arbitrary script on every rendered page, unauthenticated
+            // (reproduced over real HTTP). SANITISE AT INGEST rather than escape at
+            // emission: a host is `name[:port]` (or a bracketed IPv6 literal) and a prefix
+            // is a path — neither legitimately carries a quote, backslash, angle bracket or
+            // whitespace — so a malformed value is malformed at the source, and rejecting it
+            // here protects EVERY downstream consumer of these slots, not just the loader.
+            // Rejection is fail-safe: the request simply falls back to the bundle's internal
+            // configured values, exactly as if the header had been absent.
+            // Keep in sync with the core/router.js twin.
+            var _isSafeHostToken = function(v) {
+                return ( typeof(v) == 'string' && v.length > 0 && v.length <= 255
+                         && /^[A-Za-z0-9._:\[\]-]+$/.test(v) );
+            };
+            var _xfhRaw = request.headers['x-forwarded-host'];
+            var _xfh    = _isSafeHostToken(_xfhRaw)   ? _xfhRaw   : null;
+            var _safeRequestHost = _isSafeHostToken(requestHost) ? requestHost : null;
+            // Scheme is a two-value whitelist — it is concatenated straight into the
+            // whispered origin, and the pre-#B367 code emitted a literal `undefined://`
+            // when the header was absent.
+            var _xfpr       = request.headers['x-forwarded-proto'];
+            var _safeScheme = ( _xfpr === 'http' || _xfpr === 'https' ) ? _xfpr : null;
+
             var _thisReqProxied = (
-                ( requestHost && !/\:[0-9]+$/.test(requestHost)
+                ( _safeRequestHost && !/\:[0-9]+$/.test(_safeRequestHost)
                     && process.gina._proxyRequireForwarded !== true )
-                || request.headers['x-forwarded-host']
+                || _xfh
             ) ? true : false;
             request._ginaIsProxyHost = _thisReqProxied;
             if ( _thisReqProxied ) {
                 // this request's proxied host/hostname — X-Forwarded-Host wins (multi-hop:
                 // TLS-terminating ingress -> inner proxy -> bundle), else the port-less
                 // Host (single-hop: reverse proxy -> bundle).
-                if ( request.headers['x-forwarded-host'] ) {
-                    request._ginaProxyHostname = request.headers['x-forwarded-proto'] +'://'+ request.headers['x-forwarded-host'];
-                    request._ginaProxyHost     = request.headers['x-forwarded-host'];
+                if ( _xfh ) {
+                    request._ginaProxyHostname = ( _safeScheme || process.gina.PROXY_SCHEME ) +'://'+ _xfh;
+                    request._ginaProxyHost     = _xfh;
                 } else {
-                    request._ginaProxyHostname = process.gina.PROXY_SCHEME +'://'+ requestHost;
-                    request._ginaProxyHost     = requestHost;
+                    request._ginaProxyHostname = process.gina.PROXY_SCHEME +'://'+ _safeRequestHost;
+                    request._ginaProxyHost     = _safeRequestHost;
                 }
                 // Refresh the worker-global on EVERY proxied request (freeze fix) — the
                 // value is always this request's proxied host, so a later internal
@@ -2034,6 +2061,14 @@ function ServerEngineClass(options) {
                 if (_xfp.length > 0 && _xfp.charAt(0) !== '/') {
                     _xfp = '/' + _xfp;
                 }
+                // #B367 — SECURITY: this value is concatenated into the public webroot and
+                // whispered into `window.__ginaWebroot='…'` in the client loader, so a quote
+                // here closes that literal and executes arbitrary script (reproduced over
+                // real HTTP). A mount path is percent-encoded URL-path characters only;
+                // reject anything else and fall back to the bundle's internal webroot.
+                if ( _xfp.length > 255 || !/^[A-Za-z0-9._~\/%-]*$/.test(_xfp) ) {
+                    _xfp = '';
+                }
                 if (_xfp.length > 0) {
                     request._ginaProxyPrefix = _xfp;
                 }

package/framework/{v0.6.7 → v0.6.8}/lib/cmd/storage/gc.js

@@ -246,6 +246,12 @@ function Gc(opt, cmd) {
             if ( i >= names.length ) { return done(out); }
             var name = names[i];
             var d    = block.drivers[name];
+            // s3 first — before the `store` check, so a warn-ignored `store`
+            // key on a remote driver cannot produce a misleading skip reason.
+            if ( d.adapter === 's3' ) {
+                out.drivers.push({ name: name, skipped: true, reason: 'remote adapter (`s3`) — no sweep to run (only `cas` collects garbage)' });
+                return nextDriver(i + 1);
+            }
             if ( d.store ) {
                 out.drivers.push({ name: name, skipped: true, reason: 'connector-backed store (`' + d.store + '`) — nothing local to open; start the bundle and re-run' });
                 return nextDriver(i + 1);

package/framework/{v0.6.7 → v0.6.8}/lib/cmd/storage/stats.js

@@ -250,6 +250,13 @@ function Stats(opt, cmd) {
             if ( i >= names.length ) { return done(out); }
             var name = names[i];
             var d    = block.drivers[name];
+            // s3 first — a remote adapter has neither a root nor a local
+            // store, and its SDK is resolvable only in a bundle's project
+            // scope; the RUNNING path serves its stats.
+            if ( d.adapter === 's3' ) {
+                out.drivers.push({ name: name, adapter: 's3', strategy: d.strategy || 'sharded', skipped: true, reason: 'remote adapter (`s3`) — nothing local to open; start the bundle and re-run' });
+                return nextDriver(i + 1);
+            }
             if ( d.store ) {
                 out.drivers.push({ name: name, strategy: d.strategy, skipped: true, reason: 'connector-backed store (`' + d.store + '`) — nothing local to open; start the bundle and re-run' });
                 return nextDriver(i + 1);

package/framework/{v0.6.7 → v0.6.8}/lib/cmd/storage/verify.js

@@ -248,6 +248,12 @@ function Verify(opt, cmd) {
             if ( i >= names.length ) { return done(out); }
             var name = names[i];
             var d    = block.drivers[name];
+            // s3 first — before the `store` check, so a warn-ignored `store`
+            // key on a remote driver cannot produce a misleading skip reason.
+            if ( d.adapter === 's3' ) {
+                out.drivers.push({ name: name, skipped: true, reason: 'remote adapter (`s3`) — verify is cas-only in v1' });
+                return nextDriver(i + 1);
+            }
             if ( d.store ) {
                 out.drivers.push({ name: name, skipped: true, reason: 'connector-backed store (`' + d.store + '`) — nothing local to open; start the bundle and re-run' });
                 return nextDriver(i + 1);