@blamejs/core 0.15.28 → 0.15.29

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.29 (2026-06-25) — **JSON parsing of operator and untrusted input is routed through `b.safeJson` everywhere, so a `"__proto__"` member is stripped and the parse is size-bounded — `b.openapi.parse`, `b.asyncapi.parse`, and `b.sandbox.run` were using a raw `JSON.parse`.** b.openapi.parse and b.asyncapi.parse parsed an operator-supplied document string with a raw JSON.parse, which re-creates a "__proto__" member as an own key and imposes no size bound; b.sandbox.run parsed the untrusted sandboxed code's serialized result the same way (proto member kept, depth unbounded). All three now route through b.safeJson, which strips the prototype-pollution keys and applies the depth / key / size caps. A new b.safeJson.parseStringOrObject primitive captures the recurring "accept a document as a JSON string OR a pre-built object" shape (a string is parsed safely, an object passes through) that openapi and asyncapi had each hand-rolled, with each consumer's typed error class and a generous document size cap passed as data. Valid input parses identically to before; a malicious or oversized document is now defused rather than accepted. **Added:** *b.safeJson.parseStringOrObject(input, opts?)* — Accepts either a JSON string — parsed through b.safeJson.parse, so the prototype-pollution-key strip and depth / key / size caps apply — or an already-decoded plain object (returned unchanged). For the recurring "operator hands me a document as a JSON string or a pre-built object" surface (b.openapi / b.asyncapi). The consumer's typed error class, error codes, label, and size cap are passed as options, so a raw JSON.parse on operator input cannot be hand-rolled per consumer. **Security:** *Operator and untrusted JSON parses strip __proto__ and bound size (no raw JSON.parse)* — A raw JSON.parse keeps a "__proto__" object member as an own key (a prototype-pollution gadget for any downstream merge) and parses unbounded input. b.openapi.parse and b.asyncapi.parse used it on operator document strings, and b.sandbox.run used it on the untrusted sandboxed code's JSON-serialized result. All now route through b.safeJson — the prototype-pollution keys are stripped and the depth / key / size caps apply (a 16 MiB document cap for openapi/asyncapi, the existing result-bytes cap for the sandbox). Internal JSON parses (the sealed DSR store payloads, the VEX canonical re-format) route through the same primitive too, so the guarantee cannot be bypassed one call site at a time. Valid input is unaffected; a "__proto__"-laden or oversized payload is defused.
+
 - v0.15.28 (2026-06-25) — **`b.network.dns` and `b.network.tls` errors now carry a usable terminal-vs-transient signal on `err.permanent`, so a caller's retry loop re-attempts only the failures a retry can fix.** DnsError was declared always-transient and NetworkTlsError always-permanent, so a consumer driving its own retry loop got the wrong signal in both directions: it would retry a permanent DNS failure (a bad host, bad options, an unsupported query, an NXDOMAIN-style no-result, or a caller-shape/config error such as an unconfigured transport or an invalid resolver list) forever, and it would refuse to retry a transient TLS-over-network failure (an ECH connection failure, a handshake timeout, DNS momentarily unavailable). err.permanent now reflects each error's actual transience, derived from its code and failing closed (an unknown code is permanent, so a hopeless target is not retried indefinitely): for DnsError only a failed network round-trip (a lookup timeout, a resolve/reverse query that failed on the wire, a failed DoH/DoT exchange, a DDR discovery that found nothing) is transient — config, input, and environment errors raised before any network work are permanent; for NetworkTlsError only the network-layer ECH failures are transient. TlsTrustError remains always-permanent by design — a trust-verification failure (bad CA, fingerprint mismatch, OCSP not-good, CT violation, an unreachable OCSP responder) must never be silently retried past the trust decision. **Fixed:** *DnsError / NetworkTlsError expose a correct terminal/transient signal; TlsTrustError stays terminal* — b.network.dns's DnsError was always-transient and b.network.tls's NetworkTlsError always-permanent, so err.permanent misled a consumer's retry loop in both directions — retrying a permanent DNS error (bad host / options / unsupported type / no-result) indefinitely, and never retrying a transient TLS network error (ECH connect failure, handshake timeout, DNS unavailable). err.permanent now reflects each error's actual transience by code and fails closed (unknown codes are permanent): DnsError is transient only for a failed network round-trip (dns/lookup-timeout, dns/resolve-failed, dns/reverse-failed, dns/doh-failed, dns/dot-failed, dns/dot-handshake-failed, dns/ddr-not-discovered, dns/system-failed), and permanent otherwise — including the caller-shape / environment errors raised before any network work (dns/transport-unavailable for an unconfigured transport, dns/dnr-no-resolvers for an empty/invalid resolver list, dns/setservers-failed for an invalid address, dns/no-system-resolvers when none are configured). NetworkTlsError is transient only for the network-layer ECH failures (tls/ech-connect-failed, tls/ech-timeout, tls/ech-dns-unavailable), permanent otherwise. TlsTrustError remains always-permanent so a trust-verification failure is never silently retried.
 
 - v0.15.27 (2026-06-25) — **Internal test-harness reliability only — the published library is byte-for-byte identical to 0.15.26.** The legacy single-layer smoke files used fixed-duration setTimeout sleeps to wait for asynchronous conditions (a job processed, a lease TTL lapsing, an audit flush completing). On a contended CI runner a fixed sleep is both flake-prone (too short under load) and slow (it always burns the full budget). Those condition-waits are converted to the harness's polling helpers — waitUntil for observable predicates, passiveObserve for deliberate real-time elapses, withTestTimeout for hang guards — which exit early on fast platforms and give contended platforms the full budget. No shipped framework code changed; this release is byte-for-byte identical to 0.15.26 for operators. **Fixed:** *Smoke layer files poll for conditions instead of fixed setTimeout sleeps* — The single-layer smoke files waited on asynchronous conditions with fixed-duration setTimeout sleeps, which flake under SMOKE_PARALLEL load and always burn their full budget. The condition-waits are converted to the polling helpers (waitUntil / passiveObserve / withTestTimeout) so they exit early on fast platforms and stay robust on contended ones; non-wait timers (abort triggers, child/socket watchdogs, simulated-latency mocks) are unchanged. This is test-harness reliability only — no shipped framework behavior changed.

package/lib/asyncapi.js

@@ -40,6 +40,8 @@ var openapiSecurity     = require("./openapi-security");
 var openapiYaml         = require("./openapi-yaml");
 var bindingsMod         = require("./asyncapi-bindings");
 var traitsMod           = require("./asyncapi-traits");
+var safeJson            = require("./safe-json");
+var C                   = require("./constants");
 var { defineClass }     = require("./framework-error");
 var AsyncApiError = defineClass("AsyncApiError", { alwaysPermanent: true });
 
@@ -470,19 +472,17 @@ function _validateServerEntry(entry, label) {
  *   bad.errors[0];      // → 'operations.pub.channel: $ref "#/channels/missing" does not resolve to a declared channel'
  */
 function parse(jsonStringOrObject) {
-  var doc;
-  if (typeof jsonStringOrObject === "string") {
-    try { doc = JSON.parse(jsonStringOrObject); }                                       // allow:bare-json-parse — operator-supplied AsyncAPI doc; size-bounded by caller
-    catch (e) {
-      throw new AsyncApiError("asyncapi/bad-json",
-        "asyncapi.parse: invalid JSON — " + e.message);
-    }
-  } else if (jsonStringOrObject != null && typeof jsonStringOrObject === "object") {
-    doc = jsonStringOrObject;
-  } else {
-    throw new AsyncApiError("asyncapi/bad-input",
-      "asyncapi.parse: input must be a JSON string or a plain object");
-  }
+  // A JSON string is parsed through safeJson (proto-pollution-key strip + depth
+  // / size caps — a raw JSON.parse here kept a "__proto__" member and was
+  // unbounded on an operator-supplied document); a pre-built object passes
+  // through. The 16 MiB cap is generous for any real AsyncAPI document.
+  var doc = safeJson.parseStringOrObject(jsonStringOrObject, {
+    maxBytes:   C.BYTES.mib(16),
+    errorClass: AsyncApiError,
+    jsonCode:   "asyncapi/bad-json",
+    inputCode:  "asyncapi/bad-input",
+    label:      "asyncapi.parse",
+  });
   var errors = [];
   if (typeof doc.asyncapi !== "string") {
     errors.push("missing or non-string `asyncapi` version field (must be 3.0.x)");

package/lib/auth/sd-jwt-vc.js

@@ -165,8 +165,8 @@ function _verifyJwt(token, publicKey, algorithm) {
   var headerStr = _b64uDecodeStr(parts[0]);
   var payloadStr = _b64uDecodeStr(parts[1]);
   return {
-    header:  safeJson.parse(headerStr, { maxBytes: 64 * 1024 }),                    // allow:bare-json-parse — header from cryptographically-verified JWT; signature verifies the bytes // allow:raw-byte-literal — JWT header cap (64 KB)
-    payload: safeJson.parse(payloadStr, { maxBytes: 1024 * 1024 }),                 // allow:bare-json-parse — payload from cryptographically-verified JWT; signature verifies the bytes // allow:raw-byte-literal — JWT payload cap (1 MB)
+    header:  safeJson.parse(headerStr, { maxBytes: 64 * 1024 }),                    // allow:raw-byte-literal — JWT header cap (64 KB)
+    payload: safeJson.parse(payloadStr, { maxBytes: 1024 * 1024 }),                 // allow:raw-byte-literal — JWT payload cap (1 MB)
   };
 }
 
@@ -330,7 +330,7 @@ function present(opts) {
   if (_jwtParts.length === 3) {
     try {
       _issuerPayload = safeJson.parse(_b64uDecodeStr(_jwtParts[1]),
-        { maxBytes: 64 * 1024 });                                                                  // allow:bare-json-parse — payload only read to pull _sd_alg; final auth happens in verify() // allow:raw-byte-literal — JWT payload cap (64 KB)
+        { maxBytes: 64 * 1024 });                                                                  // allow:raw-byte-literal — JWT payload cap (64 KB)
     } catch (_e) { _issuerPayload = null; }
   }
   var _sdAlg = (_issuerPayload && typeof _issuerPayload._sd_alg === "string")
@@ -448,7 +448,7 @@ async function verify(presentation, opts) {
       "verify: JWT must have 3 dot-separated parts");
   }
   var headerObj;
-  try { headerObj = safeJson.parse(_b64uDecodeStr(jwtParts[0]), { maxBytes: 64 * 1024 }); }  // allow:bare-json-parse — pre-verify header parse to look up the key resolver; checked again post-signature // allow:raw-byte-literal — JWT header cap (64 KB)
+  try { headerObj = safeJson.parse(_b64uDecodeStr(jwtParts[0]), { maxBytes: 64 * 1024 }); }  // allow:raw-byte-literal — JWT header cap (64 KB)
   catch (e) {
     throw new AuthError("auth-sd-jwt-vc/bad-header",
       "verify: malformed JWT header: " + e.message);
@@ -622,7 +622,7 @@ async function verify(presentation, opts) {
     }
     // Verify KB-JWT signature
     var kbHeaderObj;
-    try { kbHeaderObj = safeJson.parse(_b64uDecodeStr(maybeKbJwt.split(".")[0]), { maxBytes: 4096 }); }  // allow:bare-json-parse — kb header from validated KB-JWT; signature verifies
+    try { kbHeaderObj = safeJson.parse(_b64uDecodeStr(maybeKbJwt.split(".")[0]), { maxBytes: 4096 }); }
     catch (e) {
       throw new AuthError("auth-sd-jwt-vc/bad-kb-header",
         "verify: malformed KB-JWT header: " + e.message);

package/lib/dsr.js

@@ -114,6 +114,7 @@ var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");
+var safeJson = require("./safe-json");
 var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
@@ -1142,12 +1143,23 @@ function dbTicketStore(opts) {
   // the derived lookup hashes are computed from the plaintext; vault-less
   // it stores plaintext (matching the agent-* fallback).
   function _sealColumns(id, ticket) {
+    // The payload column is read back through safeJson.parse, whose hard
+    // ceiling (safeJson.ABSOLUTE_MAX_BYTES) caps what any read can accept.
+    // Refuse a ticket whose serialized form exceeds that same ceiling on
+    // write so the store never holds a payload it cannot read back later
+    // (write cap == read cap, measured the same way: UTF-8 byte length).
+    var serializedPayload = JSON.stringify(ticket);
+    if (Buffer.byteLength(serializedPayload, "utf8") > safeJson.ABSOLUTE_MAX_BYTES) {
+      throw new DsrError("dsr/ticket-too-large",
+        "_sealColumns: ticket " + id + " payload exceeds the " +
+          safeJson.ABSOLUTE_MAX_BYTES + "-byte store limit");
+    }
     var row = {
       id:            id,
       subject_id:    (ticket.subject && ticket.subject.subjectId) || null,
       subject_email: (ticket.subject && ticket.subject.email)     || null,
       subject_phone: (ticket.subject && ticket.subject.phone)     || null,
-      payload:       JSON.stringify(ticket),
+      payload:       serializedPayload,
     };
     var out = {
       $sid:       row.subject_id,
@@ -1252,7 +1264,7 @@ function dbTicketStore(opts) {
       var rows = db.prepare("SELECT id, payload FROM " + qTable + " WHERE id = $id")
                    .all({ $id: id });
       if (!rows || rows.length === 0) return null;
-      return JSON.parse(_unsealPayload(rows[0].payload, rows[0].id));               // allow:bare-json-parse — payload was JSON.stringify-ed by this same store (unsealed above), never from operator/network input
+      return safeJson.parse(_unsealPayload(rows[0].payload, rows[0].id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES });
     },
     list: async function (filter) {
       filter = filter || {};
@@ -1267,7 +1279,7 @@ function dbTicketStore(opts) {
       if (conds.length > 0) sql += " WHERE " + conds.join(" AND ");
       sql += " ORDER BY submitted_at DESC";
       var rows = db.prepare(sql).all(params);
-      return rows.map(function (r) { return JSON.parse(_unsealPayload(r.payload, r.id)); });  // allow:bare-json-parse — payload was JSON.stringify-ed by this same store (unsealed above), never from operator/network input
+      return rows.map(function (r) { return safeJson.parse(_unsealPayload(r.payload, r.id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES }); });
     },
     update: async function (id, ticket) {
       var cols = _sealColumns(id, ticket);
@@ -1314,7 +1326,7 @@ function dbTicketStore(opts) {
       var del = db.prepare("DELETE FROM " + qTable + " WHERE id = $id");
       for (var i = 0; i < rows.length; i++) {
         try {
-          var t = JSON.parse(_unsealPayload(rows[i].payload, rows[i].id));          // allow:bare-json-parse — payload was JSON.stringify-ed by this same store (unsealed above), never from operator/network input
+          var t = safeJson.parse(_unsealPayload(rows[i].payload, rows[i].id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES });
           if (t.retentionUntil && t.retentionUntil < asOf) {
             del.run({ $id: rows[i].id });
             purged += 1;

package/lib/openapi.js

@@ -47,6 +47,8 @@ var schemaWalk            = require("./openapi-schema-walk");
 var pathsBuilderMod       = require("./openapi-paths-builder");
 var openapiSecurity       = require("./openapi-security");
 var openapiYaml           = require("./openapi-yaml");
+var safeJson              = require("./safe-json");
+var C                     = require("./constants");
 var { defineClass }       = require("./framework-error");
 var audit                 = lazyRequire(function () { return require("./audit"); });
 
@@ -520,19 +522,17 @@ function _validateItemOperations(item, label, errors, securitySchemes) {
  *   bad.errors[0];      // → 'path "users" must start with \'/\''
  */
 function parse(jsonStringOrObject) {
-  var doc;
-  if (typeof jsonStringOrObject === "string") {
-    try { doc = JSON.parse(jsonStringOrObject); }                                       // allow:bare-json-parse — operator-supplied OpenAPI doc; size-bounded by caller
-    catch (e) {
-      throw new OpenApiError("openapi/bad-json",
-        "openapi.parse: invalid JSON — " + e.message);
-    }
-  } else if (jsonStringOrObject != null && typeof jsonStringOrObject === "object") {
-    doc = jsonStringOrObject;
-  } else {
-    throw new OpenApiError("openapi/bad-input",
-      "openapi.parse: input must be a JSON string or a plain object");
-  }
+  // A JSON string is parsed through safeJson (proto-pollution-key strip + depth
+  // / size caps — a raw JSON.parse here kept a "__proto__" member and was
+  // unbounded on an operator-supplied document); a pre-built object passes
+  // through. The 16 MiB cap is generous for any real OpenAPI document.
+  var doc = safeJson.parseStringOrObject(jsonStringOrObject, {
+    maxBytes:   C.BYTES.mib(16),
+    errorClass: OpenApiError,
+    jsonCode:   "openapi/bad-json",
+    inputCode:  "openapi/bad-input",
+    label:      "openapi.parse",
+  });
   var errors = [];
   if (typeof doc.openapi !== "string") {
     errors.push("missing or non-string `openapi` version field (must be 3.1.x or 3.2.x)");

package/lib/safe-json.js

@@ -240,6 +240,61 @@ function parseOrDefault(input, fallback, opts) {
   catch (_e) { return fallback; }
 }
 
+/**
+ * @primitive b.safeJson.parseStringOrObject
+ * @signature b.safeJson.parseStringOrObject(input, opts?)
+ * @since     0.15.29
+ * @status    stable
+ * @related   b.safeJson.parse
+ *
+ * Accept EITHER a JSON string — parsed through `parse`, so the
+ * proto-pollution-key strip, depth/key caps, and size cap all apply — OR an
+ * already-decoded plain object (returned unchanged). This is the recurring
+ * "operator hands me a document as a JSON string or a pre-built object" surface
+ * (b.openapi / b.asyncapi). Routing it here means a raw `JSON.parse` on operator
+ * input — which keeps a `"__proto__"` member as an own key and imposes no size
+ * bound — cannot be hand-rolled per consumer. The divergence each consumer needs
+ * (its typed error class + codes + a generous document size cap) is carried as
+ * data, so there is no per-consumer branch.
+ *
+ * @opts
+ *   maxBytes:   number,    // forwarded to parse (default 1 MiB; capped 64 MiB)
+ *   maxDepth:   number,    // forwarded to parse
+ *   maxKeys:    number,    // forwarded to parse
+ *   errorClass: function,  // typed error class to throw (else SafeJsonError)
+ *   jsonCode:   string,    // error code for invalid JSON (used with errorClass)
+ *   inputCode:  string,    // error code for a non-string/non-object input
+ *   label:      string,    // message prefix (default "safeJson.parseStringOrObject")
+ *
+ * @example
+ *   var doc = b.safeJson.parseStringOrObject(input, {
+ *     maxBytes: C.BYTES.mib(16), errorClass: OpenApiError,
+ *     jsonCode: "openapi/bad-json", inputCode: "openapi/bad-input",
+ *     label: "openapi.parse",
+ *   });
+ */
+function parseStringOrObject(input, opts) {
+  opts = opts || {};
+  var label = opts.label || "safeJson.parseStringOrObject";
+  if (typeof input === "string") {
+    try { return parse(input, opts); }
+    catch (e) {
+      if (typeof opts.errorClass === "function") {
+        throw new opts.errorClass(opts.jsonCode, label + ": invalid JSON — " + (e && e.message));
+      }
+      throw e;
+    }
+  }
+  if (input !== null && typeof input === "object" &&
+      !Buffer.isBuffer(input) && !(input instanceof Uint8Array)) {
+    return input;
+  }
+  if (typeof opts.errorClass === "function") {
+    throw new opts.errorClass(opts.inputCode, label + ": input must be a JSON string or a plain object");
+  }
+  throw new SafeJsonError(label + ": input must be a JSON string or a plain object", "json/wrong-input-type");
+}
+
 function _stripProtoKeys(key, value) {
   if (pick.isPoisonedKey(key)) return undefined;
   return value;
@@ -997,6 +1052,7 @@ function isJsonObject(value) {
 module.exports = {
   parse:          parse,
   parseOrDefault: parseOrDefault,
+  parseStringOrObject: parseStringOrObject,
   isJsonObject:   isJsonObject,
   stringify:      stringify,
   stringifyForScript: stringifyForScript,

package/lib/sandbox.js

@@ -31,7 +31,9 @@
  *   - Timeout (default: 250ms, max: 10s) terminates the worker.
  *   - Heap caps (maxOldGenerationSizeMb / maxYoungGenerationSizeMb)
  *     derived from maxBytes; v8 kills the worker on overflow.
- *   - Result size cap = maxBytes / 4.
+ *   - Result size cap = min(maxBytes / 4, 64 MiB) - the host re-parses
+ *     the untrusted result through safeJson, whose hard ceiling bounds
+ *     it at 64 MiB regardless of a larger maxBytes.
  *
  * Allowed-globals list:
  *   The allowed opt names which extra globals operator source may
@@ -63,7 +65,7 @@
  *   - sandbox/bad-input           - input is not JSON-serializable
  *   - sandbox/input-too-large     - JSON.stringify(input).length > maxBytes
  *   - sandbox/timeout             - worker exceeded timeoutMs
- *   - sandbox/oversized-result    - worker output > maxBytes / 4
+ *   - sandbox/oversized-result    - worker output > min(maxBytes / 4, 64 MiB)
  *   - sandbox/parse-error         - source did not parse inside the worker
  *   - sandbox/runtime-error       - operator transform threw
  *   - sandbox/spawn-failed        - worker thread failed to spawn
@@ -83,6 +85,7 @@ var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
 var safeBuffer = require("./safe-buffer");
+var safeJson = require("./safe-json");
 var C = require("./constants");
 var { SandboxError } = require("./framework-error");
 
@@ -236,9 +239,14 @@ function run(opts) {
     stackSizeMb:              stackMib,
   };
 
-  // Reserve 1/4 of maxBytes as the per-result hard cap. The worker
-  // refuses any result whose stringified form exceeds this.
-  var maxResultBytes = Math.floor(maxBytes / 4);
+  // Reserve 1/4 of maxBytes as the per-result hard cap, clamped to the
+  // host-side JSON parse ceiling so the worker's output cap and the host's
+  // safeJson.parse cap agree exactly. Without the clamp a sandbox with
+  // maxBytes over 256 MiB would let the worker emit a result the host then
+  // refuses (safeJson hard-caps at ABSOLUTE_MAX_BYTES) — the worker refuses
+  // it too, so an oversized untrusted result fails the same way on both
+  // sides rather than passing the worker and crossing to a rejecting host.
+  var maxResultBytes = Math.min(Math.floor(maxBytes / 4), safeJson.ABSOLUTE_MAX_BYTES);
 
   return new Promise(function (resolve, reject) {
     var startedAt = Date.now();
@@ -312,7 +320,11 @@ function run(opts) {
       var peakBytes = (typeof msg.peakBytes === "number") ? msg.peakBytes : 0;
       if (msg.ok) {
         var parsed;
-        try { parsed = (msg.resultJson === undefined) ? undefined : JSON.parse(msg.resultJson); }   // allow:bare-json-parse — resultJson is produced by lib/sandbox-worker.js via JSON.stringify and bounded by maxResultBytes; never directly from operator/network input
+        // resultJson is the JSON.stringify of UNTRUSTED sandboxed code's return
+        // value: parse it through safeJson so a "__proto__" member is stripped
+        // and a pathologically deep/large result is bounded (maxResultBytes), not
+        // a raw JSON.parse that re-creates the key and is depth-unbounded.
+        try { parsed = (msg.resultJson === undefined) ? undefined : safeJson.parse(msg.resultJson, { maxBytes: maxResultBytes }); }
         catch (eParse) {
           _emitAudit("sandbox.run.refused", "failure", {
             reason: "sandbox/bad-result-json", runtimeMs: runtimeMs, peakBytes: peakBytes, sourceBytes: sourceBytes,

package/lib/vex.js

@@ -48,6 +48,8 @@
  */
 
 var canonicalJson = require("./canonical-json");
+var safeJson = require("./safe-json");
+var C = require("./constants");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -633,7 +635,10 @@ function serialize(doc) {
   // of truth for sort/scrub behaviour across the framework (rule
   // §canonicalize).
   var canonical = canonicalJson.stringify(doc);
-  return JSON.stringify(JSON.parse(canonical), null, 2);   // allow:bare-json-parse — canonical is canonicalJson.stringify output, not operator input
+  // Re-indent the canonical bytes for human-diffable output. allowProto keeps
+  // the canonicalizer's exact key set (this is a faithful re-format of trusted
+  // framework output, not a defense boundary); the size cap bounds the parse.
+  return JSON.stringify(safeJson.parse(canonical, { allowProto: true, maxBytes: C.BYTES.mib(16) }), null, 2);
 }
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.28",
+  "version": "0.15.29",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1bbafc03-fa7f-407c-b852-9caa724d07c2",
+  "serialNumber": "urn:uuid:9d6b0acf-4b88-47bc-b14b-ba2342410a0e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-26T06:34:07.791Z",
+    "timestamp": "2026-06-26T09:20:08.812Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.28",
+      "bom-ref": "@blamejs/core@0.15.29",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.28",
+      "version": "0.15.29",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.28",
+      "purl": "pkg:npm/%40blamejs/core@0.15.29",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.28",
+      "ref": "@blamejs/core@0.15.29",
       "dependsOn": []
     }
   ]