@blamejs/core 0.15.27 → 0.15.29

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.29 (2026-06-25) — **JSON parsing of operator and untrusted input is routed through `b.safeJson` everywhere, so a `"__proto__"` member is stripped and the parse is size-bounded — `b.openapi.parse`, `b.asyncapi.parse`, and `b.sandbox.run` were using a raw `JSON.parse`.** b.openapi.parse and b.asyncapi.parse parsed an operator-supplied document string with a raw JSON.parse, which re-creates a "__proto__" member as an own key and imposes no size bound; b.sandbox.run parsed the untrusted sandboxed code's serialized result the same way (proto member kept, depth unbounded). All three now route through b.safeJson, which strips the prototype-pollution keys and applies the depth / key / size caps. A new b.safeJson.parseStringOrObject primitive captures the recurring "accept a document as a JSON string OR a pre-built object" shape (a string is parsed safely, an object passes through) that openapi and asyncapi had each hand-rolled, with each consumer's typed error class and a generous document size cap passed as data. Valid input parses identically to before; a malicious or oversized document is now defused rather than accepted. **Added:** *b.safeJson.parseStringOrObject(input, opts?)* — Accepts either a JSON string — parsed through b.safeJson.parse, so the prototype-pollution-key strip and depth / key / size caps apply — or an already-decoded plain object (returned unchanged). For the recurring "operator hands me a document as a JSON string or a pre-built object" surface (b.openapi / b.asyncapi). The consumer's typed error class, error codes, label, and size cap are passed as options, so a raw JSON.parse on operator input cannot be hand-rolled per consumer. **Security:** *Operator and untrusted JSON parses strip __proto__ and bound size (no raw JSON.parse)* — A raw JSON.parse keeps a "__proto__" object member as an own key (a prototype-pollution gadget for any downstream merge) and parses unbounded input. b.openapi.parse and b.asyncapi.parse used it on operator document strings, and b.sandbox.run used it on the untrusted sandboxed code's JSON-serialized result. All now route through b.safeJson — the prototype-pollution keys are stripped and the depth / key / size caps apply (a 16 MiB document cap for openapi/asyncapi, the existing result-bytes cap for the sandbox). Internal JSON parses (the sealed DSR store payloads, the VEX canonical re-format) route through the same primitive too, so the guarantee cannot be bypassed one call site at a time. Valid input is unaffected; a "__proto__"-laden or oversized payload is defused.
+
+- v0.15.28 (2026-06-25) — **`b.network.dns` and `b.network.tls` errors now carry a usable terminal-vs-transient signal on `err.permanent`, so a caller's retry loop re-attempts only the failures a retry can fix.** DnsError was declared always-transient and NetworkTlsError always-permanent, so a consumer driving its own retry loop got the wrong signal in both directions: it would retry a permanent DNS failure (a bad host, bad options, an unsupported query, an NXDOMAIN-style no-result, or a caller-shape/config error such as an unconfigured transport or an invalid resolver list) forever, and it would refuse to retry a transient TLS-over-network failure (an ECH connection failure, a handshake timeout, DNS momentarily unavailable). err.permanent now reflects each error's actual transience, derived from its code and failing closed (an unknown code is permanent, so a hopeless target is not retried indefinitely): for DnsError only a failed network round-trip (a lookup timeout, a resolve/reverse query that failed on the wire, a failed DoH/DoT exchange, a DDR discovery that found nothing) is transient — config, input, and environment errors raised before any network work are permanent; for NetworkTlsError only the network-layer ECH failures are transient. TlsTrustError remains always-permanent by design — a trust-verification failure (bad CA, fingerprint mismatch, OCSP not-good, CT violation, an unreachable OCSP responder) must never be silently retried past the trust decision. **Fixed:** *DnsError / NetworkTlsError expose a correct terminal/transient signal; TlsTrustError stays terminal* — b.network.dns's DnsError was always-transient and b.network.tls's NetworkTlsError always-permanent, so err.permanent misled a consumer's retry loop in both directions — retrying a permanent DNS error (bad host / options / unsupported type / no-result) indefinitely, and never retrying a transient TLS network error (ECH connect failure, handshake timeout, DNS unavailable). err.permanent now reflects each error's actual transience by code and fails closed (unknown codes are permanent): DnsError is transient only for a failed network round-trip (dns/lookup-timeout, dns/resolve-failed, dns/reverse-failed, dns/doh-failed, dns/dot-failed, dns/dot-handshake-failed, dns/ddr-not-discovered, dns/system-failed), and permanent otherwise — including the caller-shape / environment errors raised before any network work (dns/transport-unavailable for an unconfigured transport, dns/dnr-no-resolvers for an empty/invalid resolver list, dns/setservers-failed for an invalid address, dns/no-system-resolvers when none are configured). NetworkTlsError is transient only for the network-layer ECH failures (tls/ech-connect-failed, tls/ech-timeout, tls/ech-dns-unavailable), permanent otherwise. TlsTrustError remains always-permanent so a trust-verification failure is never silently retried.
+
 - v0.15.27 (2026-06-25) — **Internal test-harness reliability only — the published library is byte-for-byte identical to 0.15.26.** The legacy single-layer smoke files used fixed-duration setTimeout sleeps to wait for asynchronous conditions (a job processed, a lease TTL lapsing, an audit flush completing). On a contended CI runner a fixed sleep is both flake-prone (too short under load) and slow (it always burns the full budget). Those condition-waits are converted to the harness's polling helpers — waitUntil for observable predicates, passiveObserve for deliberate real-time elapses, withTestTimeout for hang guards — which exit early on fast platforms and give contended platforms the full budget. No shipped framework code changed; this release is byte-for-byte identical to 0.15.26 for operators. **Fixed:** *Smoke layer files poll for conditions instead of fixed setTimeout sleeps* — The single-layer smoke files waited on asynchronous conditions with fixed-duration setTimeout sleeps, which flake under SMOKE_PARALLEL load and always burn their full budget. The condition-waits are converted to the polling helpers (waitUntil / passiveObserve / withTestTimeout) so they exit early on fast platforms and stay robust on contended ones; non-wait timers (abort triggers, child/socket watchdogs, simulated-latency mocks) are unchanged. This is test-harness reliability only — no shipped framework behavior changed.
 
 - v0.15.26 (2026-06-25) — **Internal test-harness correctness only — the published library is byte-for-byte identical to 0.15.25.** The smoke runner requires each test module and awaits its exported run(). Several tests were instead written as a top-level (async function () {...})() IIFE that runs detached at require-time, so the runner measured and reported the test's result before the IIFE's post-await assertions executed — those checks silently never ran (one parser test exercised 4 of its 26 assertions, and a failure after the first await would have gone unseen as a false pass). Those tests are converted to the exported-run form so the runner awaits their full assertion set, and a codebase-patterns detector now refuses a top-level async IIFE in a test file so the pattern cannot return. No shipped framework code changed; this release is byte-for-byte identical to 0.15.25 for operators. **Fixed:** *Detached-IIFE tests now run their full assertion set under the smoke runner* — A test written as a top-level (async function () {...})() IIFE runs detached when the runner requires it: the runner only awaits an exported run(), so it reported the file's result before the IIFE's awaited assertions executed, and every check after the first await silently did not count (one parsers test ran 4 of 26). Such tests are rewritten to define async function run(), export it, and invoke it under if (require.main === module), so the runner awaits the complete set; a detector refuses a re-introduced top-level async IIFE in a test file. This is test-harness correctness only — no shipped framework behavior changed.

package/lib/asyncapi.js

@@ -40,6 +40,8 @@ var openapiSecurity     = require("./openapi-security");
 var openapiYaml         = require("./openapi-yaml");
 var bindingsMod         = require("./asyncapi-bindings");
 var traitsMod           = require("./asyncapi-traits");
+var safeJson            = require("./safe-json");
+var C                   = require("./constants");
 var { defineClass }     = require("./framework-error");
 var AsyncApiError = defineClass("AsyncApiError", { alwaysPermanent: true });
 
@@ -470,19 +472,17 @@ function _validateServerEntry(entry, label) {
  *   bad.errors[0];      // → 'operations.pub.channel: $ref "#/channels/missing" does not resolve to a declared channel'
  */
 function parse(jsonStringOrObject) {
-  var doc;
-  if (typeof jsonStringOrObject === "string") {
-    try { doc = JSON.parse(jsonStringOrObject); }                                       // allow:bare-json-parse — operator-supplied AsyncAPI doc; size-bounded by caller
-    catch (e) {
-      throw new AsyncApiError("asyncapi/bad-json",
-        "asyncapi.parse: invalid JSON — " + e.message);
-    }
-  } else if (jsonStringOrObject != null && typeof jsonStringOrObject === "object") {
-    doc = jsonStringOrObject;
-  } else {
-    throw new AsyncApiError("asyncapi/bad-input",
-      "asyncapi.parse: input must be a JSON string or a plain object");
-  }
+  // A JSON string is parsed through safeJson (proto-pollution-key strip + depth
+  // / size caps — a raw JSON.parse here kept a "__proto__" member and was
+  // unbounded on an operator-supplied document); a pre-built object passes
+  // through. The 16 MiB cap is generous for any real AsyncAPI document.
+  var doc = safeJson.parseStringOrObject(jsonStringOrObject, {
+    maxBytes:   C.BYTES.mib(16),
+    errorClass: AsyncApiError,
+    jsonCode:   "asyncapi/bad-json",
+    inputCode:  "asyncapi/bad-input",
+    label:      "asyncapi.parse",
+  });
   var errors = [];
   if (typeof doc.asyncapi !== "string") {
     errors.push("missing or non-string `asyncapi` version field (must be 3.0.x)");

package/lib/auth/sd-jwt-vc.js

@@ -165,8 +165,8 @@ function _verifyJwt(token, publicKey, algorithm) {
   var headerStr = _b64uDecodeStr(parts[0]);
   var payloadStr = _b64uDecodeStr(parts[1]);
   return {
-    header:  safeJson.parse(headerStr, { maxBytes: 64 * 1024 }),                    // allow:bare-json-parse — header from cryptographically-verified JWT; signature verifies the bytes // allow:raw-byte-literal — JWT header cap (64 KB)
-    payload: safeJson.parse(payloadStr, { maxBytes: 1024 * 1024 }),                 // allow:bare-json-parse — payload from cryptographically-verified JWT; signature verifies the bytes // allow:raw-byte-literal — JWT payload cap (1 MB)
+    header:  safeJson.parse(headerStr, { maxBytes: 64 * 1024 }),                    // allow:raw-byte-literal — JWT header cap (64 KB)
+    payload: safeJson.parse(payloadStr, { maxBytes: 1024 * 1024 }),                 // allow:raw-byte-literal — JWT payload cap (1 MB)
   };
 }
 
@@ -330,7 +330,7 @@ function present(opts) {
   if (_jwtParts.length === 3) {
     try {
       _issuerPayload = safeJson.parse(_b64uDecodeStr(_jwtParts[1]),
-        { maxBytes: 64 * 1024 });                                                                  // allow:bare-json-parse — payload only read to pull _sd_alg; final auth happens in verify() // allow:raw-byte-literal — JWT payload cap (64 KB)
+        { maxBytes: 64 * 1024 });                                                                  // allow:raw-byte-literal — JWT payload cap (64 KB)
     } catch (_e) { _issuerPayload = null; }
   }
   var _sdAlg = (_issuerPayload && typeof _issuerPayload._sd_alg === "string")
@@ -448,7 +448,7 @@ async function verify(presentation, opts) {
       "verify: JWT must have 3 dot-separated parts");
   }
   var headerObj;
-  try { headerObj = safeJson.parse(_b64uDecodeStr(jwtParts[0]), { maxBytes: 64 * 1024 }); }  // allow:bare-json-parse — pre-verify header parse to look up the key resolver; checked again post-signature // allow:raw-byte-literal — JWT header cap (64 KB)
+  try { headerObj = safeJson.parse(_b64uDecodeStr(jwtParts[0]), { maxBytes: 64 * 1024 }); }  // allow:raw-byte-literal — JWT header cap (64 KB)
   catch (e) {
     throw new AuthError("auth-sd-jwt-vc/bad-header",
       "verify: malformed JWT header: " + e.message);
@@ -622,7 +622,7 @@ async function verify(presentation, opts) {
     }
     // Verify KB-JWT signature
     var kbHeaderObj;
-    try { kbHeaderObj = safeJson.parse(_b64uDecodeStr(maybeKbJwt.split(".")[0]), { maxBytes: 4096 }); }  // allow:bare-json-parse — kb header from validated KB-JWT; signature verifies
+    try { kbHeaderObj = safeJson.parse(_b64uDecodeStr(maybeKbJwt.split(".")[0]), { maxBytes: 4096 }); }
     catch (e) {
       throw new AuthError("auth-sd-jwt-vc/bad-kb-header",
         "verify: malformed KB-JWT header: " + e.message);

package/lib/dsr.js

@@ -114,6 +114,7 @@ var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");
+var safeJson = require("./safe-json");
 var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
@@ -1142,12 +1143,23 @@ function dbTicketStore(opts) {
   // the derived lookup hashes are computed from the plaintext; vault-less
   // it stores plaintext (matching the agent-* fallback).
   function _sealColumns(id, ticket) {
+    // The payload column is read back through safeJson.parse, whose hard
+    // ceiling (safeJson.ABSOLUTE_MAX_BYTES) caps what any read can accept.
+    // Refuse a ticket whose serialized form exceeds that same ceiling on
+    // write so the store never holds a payload it cannot read back later
+    // (write cap == read cap, measured the same way: UTF-8 byte length).
+    var serializedPayload = JSON.stringify(ticket);
+    if (Buffer.byteLength(serializedPayload, "utf8") > safeJson.ABSOLUTE_MAX_BYTES) {
+      throw new DsrError("dsr/ticket-too-large",
+        "_sealColumns: ticket " + id + " payload exceeds the " +
+          safeJson.ABSOLUTE_MAX_BYTES + "-byte store limit");
+    }
     var row = {
       id:            id,
       subject_id:    (ticket.subject && ticket.subject.subjectId) || null,
       subject_email: (ticket.subject && ticket.subject.email)     || null,
       subject_phone: (ticket.subject && ticket.subject.phone)     || null,
-      payload:       JSON.stringify(ticket),
+      payload:       serializedPayload,
     };
     var out = {
       $sid:       row.subject_id,
@@ -1252,7 +1264,7 @@ function dbTicketStore(opts) {
       var rows = db.prepare("SELECT id, payload FROM " + qTable + " WHERE id = $id")
                    .all({ $id: id });
       if (!rows || rows.length === 0) return null;
-      return JSON.parse(_unsealPayload(rows[0].payload, rows[0].id));               // allow:bare-json-parse — payload was JSON.stringify-ed by this same store (unsealed above), never from operator/network input
+      return safeJson.parse(_unsealPayload(rows[0].payload, rows[0].id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES });
     },
     list: async function (filter) {
       filter = filter || {};
@@ -1267,7 +1279,7 @@ function dbTicketStore(opts) {
       if (conds.length > 0) sql += " WHERE " + conds.join(" AND ");
       sql += " ORDER BY submitted_at DESC";
       var rows = db.prepare(sql).all(params);
-      return rows.map(function (r) { return JSON.parse(_unsealPayload(r.payload, r.id)); });  // allow:bare-json-parse — payload was JSON.stringify-ed by this same store (unsealed above), never from operator/network input
+      return rows.map(function (r) { return safeJson.parse(_unsealPayload(r.payload, r.id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES }); });
     },
     update: async function (id, ticket) {
       var cols = _sealColumns(id, ticket);
@@ -1314,7 +1326,7 @@ function dbTicketStore(opts) {
       var del = db.prepare("DELETE FROM " + qTable + " WHERE id = $id");
       for (var i = 0; i < rows.length; i++) {
         try {
-          var t = JSON.parse(_unsealPayload(rows[i].payload, rows[i].id));          // allow:bare-json-parse — payload was JSON.stringify-ed by this same store (unsealed above), never from operator/network input
+          var t = safeJson.parse(_unsealPayload(rows[i].payload, rows[i].id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES });
           if (t.retentionUntil && t.retentionUntil < asOf) {
             del.run({ $id: rows[i].id });
             purged += 1;

package/lib/network-dns.js

@@ -16,7 +16,34 @@ var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 var { boundedMap } = require("./bounded-map");
 
-var DnsError = defineClass("DnsError", { alwaysPermanent: false });
+// DnsError carries a terminal-vs-transient signal on err.permanent so a caller
+// driving a retry loop knows which failures are worth re-attempting. Fail
+// CLOSED: only a failure of an actual network round-trip that a retry can
+// plausibly fix is transient (a lookup timeout, a resolve/reverse query that
+// failed on the wire, a DoH/DoT exchange that failed, a DDR discovery query that
+// found nothing). Everything else is permanent — bad config / options, an
+// unsupported query, a malformed or empty/NXDOMAIN-style reply, AND the
+// caller-shape / environment errors raised BEFORE any network work: requesting a
+// transport that was never configured (dns/transport-unavailable), an
+// empty/invalid designated-resolver list (dns/dnr-no-resolvers), an invalid
+// setServers address (dns/setservers-failed), or no system resolvers configured
+// (dns/no-system-resolvers). A retry cannot make invalid input or absent
+// configuration valid.
+var DNS_TRANSIENT_CODES = {
+  "dns/lookup-timeout":       true,
+  "dns/system-failed":        true,
+  "dns/resolve-failed":       true,
+  "dns/reverse-failed":       true,
+  "dns/doh-http":             true,
+  "dns/doh-failed":           true,
+  "dns/dot-handshake-failed": true,
+  "dns/dot-failed":           true,
+  "dns/ddr-not-discovered":   true,
+};
+function _dnsErrorIsPermanent(code) {
+  return !Object.prototype.hasOwnProperty.call(DNS_TRANSIENT_CODES, code);
+}
+var DnsError = defineClass("DnsError", { permanentClassifier: _dnsErrorIsPermanent });
 
 // Protocol-fixed byte counts and radixes — passthrough through C.BYTES
 // keeps every numeric literal routed through one helper.

package/lib/network-tls.js

@@ -16,8 +16,28 @@ var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
 var { defineClass } = require("./framework-error");
 
+// TlsTrustError is a TRUST-verification failure (bad CA/PEM, fingerprint
+// mismatch, OCSP not-good / revoked, CT violation, hostname/PKIX failure, an
+// unreachable OCSP responder). These are ALWAYS permanent: a caller must never
+// silently retry past a trust decision — a transient-looking OCSP-fetch failure
+// is the operator's soft-fail policy to make explicitly, not something a retry
+// loop should paper over. Fail closed.
 var TlsTrustError = defineClass("TlsTrustError", { alwaysPermanent: true });
-var NetworkTlsError = defineClass("NetworkTlsError", { alwaysPermanent: true });
+
+// NetworkTlsError carries a terminal-vs-transient signal on err.permanent. Fail
+// CLOSED: only the network-layer ECH failures a retry can plausibly fix (a
+// connect failure, a timeout, DNS being momentarily unavailable) are transient;
+// bad options, a malformed ECH config, and PKIX hostname/SAN validation failures
+// are permanent (config / validation errors a retry cannot fix).
+var TLS_TRANSIENT_CODES = {
+  "tls/ech-connect-failed": true,
+  "tls/ech-timeout":        true,
+  "tls/ech-dns-unavailable": true,
+};
+function _networkTlsErrorIsPermanent(code) {
+  return !Object.prototype.hasOwnProperty.call(TLS_TRANSIENT_CODES, code);
+}
+var NetworkTlsError = defineClass("NetworkTlsError", { permanentClassifier: _networkTlsErrorIsPermanent });
 
 var observability = lazyRequire(function () { return require("./observability"); });
 var audit = lazyRequire(function () { return require("./audit"); });

package/lib/openapi.js

@@ -47,6 +47,8 @@ var schemaWalk            = require("./openapi-schema-walk");
 var pathsBuilderMod       = require("./openapi-paths-builder");
 var openapiSecurity       = require("./openapi-security");
 var openapiYaml           = require("./openapi-yaml");
+var safeJson              = require("./safe-json");
+var C                     = require("./constants");
 var { defineClass }       = require("./framework-error");
 var audit                 = lazyRequire(function () { return require("./audit"); });
 
@@ -520,19 +522,17 @@ function _validateItemOperations(item, label, errors, securitySchemes) {
  *   bad.errors[0];      // → 'path "users" must start with \'/\''
  */
 function parse(jsonStringOrObject) {
-  var doc;
-  if (typeof jsonStringOrObject === "string") {
-    try { doc = JSON.parse(jsonStringOrObject); }                                       // allow:bare-json-parse — operator-supplied OpenAPI doc; size-bounded by caller
-    catch (e) {
-      throw new OpenApiError("openapi/bad-json",
-        "openapi.parse: invalid JSON — " + e.message);
-    }
-  } else if (jsonStringOrObject != null && typeof jsonStringOrObject === "object") {
-    doc = jsonStringOrObject;
-  } else {
-    throw new OpenApiError("openapi/bad-input",
-      "openapi.parse: input must be a JSON string or a plain object");
-  }
+  // A JSON string is parsed through safeJson (proto-pollution-key strip + depth
+  // / size caps — a raw JSON.parse here kept a "__proto__" member and was
+  // unbounded on an operator-supplied document); a pre-built object passes
+  // through. The 16 MiB cap is generous for any real OpenAPI document.
+  var doc = safeJson.parseStringOrObject(jsonStringOrObject, {
+    maxBytes:   C.BYTES.mib(16),
+    errorClass: OpenApiError,
+    jsonCode:   "openapi/bad-json",
+    inputCode:  "openapi/bad-input",
+    label:      "openapi.parse",
+  });
   var errors = [];
   if (typeof doc.openapi !== "string") {
     errors.push("missing or non-string `openapi` version field (must be 3.1.x or 3.2.x)");

package/lib/safe-json.js

@@ -240,6 +240,61 @@ function parseOrDefault(input, fallback, opts) {
   catch (_e) { return fallback; }
 }
 
+/**
+ * @primitive b.safeJson.parseStringOrObject
+ * @signature b.safeJson.parseStringOrObject(input, opts?)
+ * @since     0.15.29
+ * @status    stable
+ * @related   b.safeJson.parse
+ *
+ * Accept EITHER a JSON string — parsed through `parse`, so the
+ * proto-pollution-key strip, depth/key caps, and size cap all apply — OR an
+ * already-decoded plain object (returned unchanged). This is the recurring
+ * "operator hands me a document as a JSON string or a pre-built object" surface
+ * (b.openapi / b.asyncapi). Routing it here means a raw `JSON.parse` on operator
+ * input — which keeps a `"__proto__"` member as an own key and imposes no size
+ * bound — cannot be hand-rolled per consumer. The divergence each consumer needs
+ * (its typed error class + codes + a generous document size cap) is carried as
+ * data, so there is no per-consumer branch.
+ *
+ * @opts
+ *   maxBytes:   number,    // forwarded to parse (default 1 MiB; capped 64 MiB)
+ *   maxDepth:   number,    // forwarded to parse
+ *   maxKeys:    number,    // forwarded to parse
+ *   errorClass: function,  // typed error class to throw (else SafeJsonError)
+ *   jsonCode:   string,    // error code for invalid JSON (used with errorClass)
+ *   inputCode:  string,    // error code for a non-string/non-object input
+ *   label:      string,    // message prefix (default "safeJson.parseStringOrObject")
+ *
+ * @example
+ *   var doc = b.safeJson.parseStringOrObject(input, {
+ *     maxBytes: C.BYTES.mib(16), errorClass: OpenApiError,
+ *     jsonCode: "openapi/bad-json", inputCode: "openapi/bad-input",
+ *     label: "openapi.parse",
+ *   });
+ */
+function parseStringOrObject(input, opts) {
+  opts = opts || {};
+  var label = opts.label || "safeJson.parseStringOrObject";
+  if (typeof input === "string") {
+    try { return parse(input, opts); }
+    catch (e) {
+      if (typeof opts.errorClass === "function") {
+        throw new opts.errorClass(opts.jsonCode, label + ": invalid JSON — " + (e && e.message));
+      }
+      throw e;
+    }
+  }
+  if (input !== null && typeof input === "object" &&
+      !Buffer.isBuffer(input) && !(input instanceof Uint8Array)) {
+    return input;
+  }
+  if (typeof opts.errorClass === "function") {
+    throw new opts.errorClass(opts.inputCode, label + ": input must be a JSON string or a plain object");
+  }
+  throw new SafeJsonError(label + ": input must be a JSON string or a plain object", "json/wrong-input-type");
+}
+
 function _stripProtoKeys(key, value) {
   if (pick.isPoisonedKey(key)) return undefined;
   return value;
@@ -997,6 +1052,7 @@ function isJsonObject(value) {
 module.exports = {
   parse:          parse,
   parseOrDefault: parseOrDefault,
+  parseStringOrObject: parseStringOrObject,
   isJsonObject:   isJsonObject,
   stringify:      stringify,
   stringifyForScript: stringifyForScript,

package/lib/sandbox.js

@@ -31,7 +31,9 @@
  *   - Timeout (default: 250ms, max: 10s) terminates the worker.
  *   - Heap caps (maxOldGenerationSizeMb / maxYoungGenerationSizeMb)
  *     derived from maxBytes; v8 kills the worker on overflow.
- *   - Result size cap = maxBytes / 4.
+ *   - Result size cap = min(maxBytes / 4, 64 MiB) - the host re-parses
+ *     the untrusted result through safeJson, whose hard ceiling bounds
+ *     it at 64 MiB regardless of a larger maxBytes.
  *
  * Allowed-globals list:
  *   The allowed opt names which extra globals operator source may
@@ -63,7 +65,7 @@
  *   - sandbox/bad-input           - input is not JSON-serializable
  *   - sandbox/input-too-large     - JSON.stringify(input).length > maxBytes
  *   - sandbox/timeout             - worker exceeded timeoutMs
- *   - sandbox/oversized-result    - worker output > maxBytes / 4
+ *   - sandbox/oversized-result    - worker output > min(maxBytes / 4, 64 MiB)
  *   - sandbox/parse-error         - source did not parse inside the worker
  *   - sandbox/runtime-error       - operator transform threw
  *   - sandbox/spawn-failed        - worker thread failed to spawn
@@ -83,6 +85,7 @@ var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
 var safeBuffer = require("./safe-buffer");
+var safeJson = require("./safe-json");
 var C = require("./constants");
 var { SandboxError } = require("./framework-error");
 
@@ -236,9 +239,14 @@ function run(opts) {
     stackSizeMb:              stackMib,
   };
 
-  // Reserve 1/4 of maxBytes as the per-result hard cap. The worker
-  // refuses any result whose stringified form exceeds this.
-  var maxResultBytes = Math.floor(maxBytes / 4);
+  // Reserve 1/4 of maxBytes as the per-result hard cap, clamped to the
+  // host-side JSON parse ceiling so the worker's output cap and the host's
+  // safeJson.parse cap agree exactly. Without the clamp a sandbox with
+  // maxBytes over 256 MiB would let the worker emit a result the host then
+  // refuses (safeJson hard-caps at ABSOLUTE_MAX_BYTES) — the worker refuses
+  // it too, so an oversized untrusted result fails the same way on both
+  // sides rather than passing the worker and crossing to a rejecting host.
+  var maxResultBytes = Math.min(Math.floor(maxBytes / 4), safeJson.ABSOLUTE_MAX_BYTES);
 
   return new Promise(function (resolve, reject) {
     var startedAt = Date.now();
@@ -312,7 +320,11 @@ function run(opts) {
       var peakBytes = (typeof msg.peakBytes === "number") ? msg.peakBytes : 0;
       if (msg.ok) {
         var parsed;
-        try { parsed = (msg.resultJson === undefined) ? undefined : JSON.parse(msg.resultJson); }   // allow:bare-json-parse — resultJson is produced by lib/sandbox-worker.js via JSON.stringify and bounded by maxResultBytes; never directly from operator/network input
+        // resultJson is the JSON.stringify of UNTRUSTED sandboxed code's return
+        // value: parse it through safeJson so a "__proto__" member is stripped
+        // and a pathologically deep/large result is bounded (maxResultBytes), not
+        // a raw JSON.parse that re-creates the key and is depth-unbounded.
+        try { parsed = (msg.resultJson === undefined) ? undefined : safeJson.parse(msg.resultJson, { maxBytes: maxResultBytes }); }
         catch (eParse) {
           _emitAudit("sandbox.run.refused", "failure", {
             reason: "sandbox/bad-result-json", runtimeMs: runtimeMs, peakBytes: peakBytes, sourceBytes: sourceBytes,

package/lib/vex.js

@@ -48,6 +48,8 @@
  */
 
 var canonicalJson = require("./canonical-json");
+var safeJson = require("./safe-json");
+var C = require("./constants");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -633,7 +635,10 @@ function serialize(doc) {
   // of truth for sort/scrub behaviour across the framework (rule
   // §canonicalize).
   var canonical = canonicalJson.stringify(doc);
-  return JSON.stringify(JSON.parse(canonical), null, 2);   // allow:bare-json-parse — canonical is canonicalJson.stringify output, not operator input
+  // Re-indent the canonical bytes for human-diffable output. allowProto keeps
+  // the canonicalizer's exact key set (this is a faithful re-format of trusted
+  // framework output, not a defense boundary); the size cap bounds the parse.
+  return JSON.stringify(safeJson.parse(canonical, { allowProto: true, maxBytes: C.BYTES.mib(16) }), null, 2);
 }
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.27",
+  "version": "0.15.29",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2b373536-53d6-476a-9d21-69b153ba2a17",
+  "serialNumber": "urn:uuid:9d6b0acf-4b88-47bc-b14b-ba2342410a0e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-26T02:24:20.400Z",
+    "timestamp": "2026-06-26T09:20:08.812Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.27",
+      "bom-ref": "@blamejs/core@0.15.29",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.27",
+      "version": "0.15.29",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.27",
+      "purl": "pkg:npm/%40blamejs/core@0.15.29",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.27",
+      "ref": "@blamejs/core@0.15.29",
       "dependsOn": []
     }
   ]