@blamejs/core 0.15.31 → 0.15.32

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.32 (2026-06-26) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** Three more suppression classes in the codebase-patterns guard suite were re-verified from scratch and renamed to descriptive tokens, with their old names recorded as retired so the prior approval cannot be silently resurrected and their in-source marker comments updated to match. No runtime code, public API, or wire format changed. **Detectors:** *Three more suppression-marker classes re-verified and their tokens retired* — Continuing the re-verification pass: each marked site for the process-exit, hand-rolled buffer-collect, and raw-outbound-http guard classes was re-read and confirmed (operator-opt-in exits; bounded protocol-framing / TLV assembly; framework-routed outbound calls), then the class was renamed to a descriptive token and its old name added to the retired-token set. This is test-suite tooling; no shipped framework behavior changed.
+
 - v0.15.31 (2026-06-26) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** The codebase-patterns guard suite gains a gate that retires a renamed suppression-marker token: once a suppression class is re-verified and renamed, its old token cannot be silently re-registered, so a later suppression has to be re-examined under the new name instead of inheriting a stale approval. Eight suppression classes were re-verified and renamed to descriptive tokens this release, and their in-source marker comments were updated to match. No runtime code, public API, or wire format changed. **Detectors:** *Re-verification gate retires a renamed suppression-marker token* — A new guard refuses to re-register a retired suppression-marker token, and the orphan check points a stale marker at its current name. When a suppression class is re-verified, it is renamed to a descriptive token and the old name is recorded as retired, so the old approval cannot be quietly resurrected — a future suppression must be re-examined and re-stamped under the new name. This is test-suite tooling; no shipped framework behavior changed.
 
 - v0.15.30 (2026-06-26) — **Importing the webhook module for inbound signature verification no longer pulls the Node HTTP client (or its `node:http` / `node:https` / `node:http2` chain), so `b.webhook.verify` runs in a Worker / edge runtime when the module is imported directly.** lib/webhook and its delivery store eagerly required the outbound HTTP client at module load — directly, and transitively through the persistence-backed dispatcher — so importing the webhook module threw in a Cloudflare Workers / edge runtime that has no node:http / node:net / node:tls, even though b.webhook.verify needs only HMAC-SHA-256 and a timing-safe compare. The HTTP client and the SQL-backed dispatcher are now resolved lazily, only on the outbound send / dispatch paths; importing the module for inbound verification loads no Node networking module. Verified by asserting no networking builtin appears in process.moduleLoadList on the verify path. The framework's aggregate entry point still initializes the networking stack eagerly, so the edge verify path is the webhook module imported directly rather than the aggregate b namespace. **Fixed:** *Inbound webhook verification loads without the Node networking stack (Worker / edge runtime)* — The webhook module and its dispatcher delivery store required the outbound HTTP client (node:http / node:https / node:http2) at module load, so importing the module threw in a runtime without those builtins — even though b.webhook.verify is HMAC-SHA-256 plus a timing-safe compare and the dispatcher (SQL-backed persistence) is only needed for outbound delivery. The HTTP client and the dispatcher are now resolved lazily, on the outbound send / dispatch paths only; the inbound verify path loads no Node networking module. An edge handler that imports the webhook module directly can pre-verify an inbound Stripe webhook signature with the primitive's hardening (Stripe-Signature size cap, v1-hex anti-DoS cap, minimum-tolerance floor, optional atomic replay store) instead of hand-rolling the t=/v1= parse, tolerance window, and timing-safe compare. The framework's aggregate entry still loads the networking stack eagerly; import the webhook module directly for the edge verify path.

package/lib/app-shutdown.js

@@ -247,7 +247,7 @@ function create(opts) {
         var exitCode = (process.exitCode !== undefined && process.exitCode !== 0)
           ? process.exitCode : (allOk ? 0 : 1);
         setImmediate(function () {
-          // allow:process-exit — operator opted into exitAfterPhases,
+          // allow:process-exit-operator-optin — operator opted into exitAfterPhases,
           // delegating process lifecycle to the orchestrator
           process.exit(exitCode);
         });
@@ -280,7 +280,7 @@ function create(opts) {
         // Bounded forced exit after the grace deadline, armed ONLY inside the
         // signal handler (operator opted into installSignalHandlers,
         // delegating process lifecycle to the orchestrator).
-        // allow:process-exit — operator-delegated lifecycle, watchdog only
+        // allow:process-exit-operator-optin — operator-delegated lifecycle, watchdog only
         process.exit(process.exitCode || 1);
       }, graceMs + forceExitMarginMs);
       if (typeof watchdog.unref === "function") watchdog.unref();

package/lib/arg-parser.js

@@ -550,7 +550,7 @@ function create(opts) {
       // `<prog> help [<cmd>]`
       var topic = (split.rest && split.rest.length > 0) ? split.rest[0] : null;
       var msg = topic && commandsByName[topic] ? help(topic) : help();
-      if (exitOnHelp) { stdout.write(msg + "\n"); process.exit(0); } // allow:process-exit — explicit { exit: true } from a bin/ shim
+      if (exitOnHelp) { stdout.write(msg + "\n"); process.exit(0); } // allow:process-exit-operator-optin — explicit { exit: true } from a bin/ shim
       return { command: null, flags: {}, positionals: [], helpRequested: true, helpText: msg };
     }
 
@@ -582,7 +582,7 @@ function create(opts) {
 
       if (cmdParsed.helpRequested || preParsed.helpRequested) {
         var cmsg = _renderCommandHelp(parser, cmdEntry);
-        if (exitOnHelp) { stdout.write(cmsg + "\n"); process.exit(0); } // allow:process-exit — explicit { exit: true } from a bin/ shim
+        if (exitOnHelp) { stdout.write(cmsg + "\n"); process.exit(0); } // allow:process-exit-operator-optin — explicit { exit: true } from a bin/ shim
         return { command: cmdEntry.name, flags: {}, positionals: [], helpRequested: true, helpText: cmsg };
       }
 
@@ -606,7 +606,7 @@ function create(opts) {
     // as a flag-only parser. Honor `--` and aggregate everything else.
     if (preParsed.helpRequested) {
       var hmsg = _renderHelp(parser);
-      if (exitOnHelp) { stdout.write(hmsg + "\n"); process.exit(0); } // allow:process-exit — explicit { exit: true } from a bin/ shim
+      if (exitOnHelp) { stdout.write(hmsg + "\n"); process.exit(0); } // allow:process-exit-operator-optin — explicit { exit: true } from a bin/ shim
       return { command: null, flags: {}, positionals: [], helpRequested: true, helpText: hmsg };
     }
     _applyDefaultsAndRequired(parser.flags.list, preParsed.flags, "top-level");

package/lib/auth/fido-mds3.js

@@ -420,7 +420,7 @@ function _verifyAndParseBlob(token) {
  *   typeof blob.entries.length === "number";
  *   // → true
  */
-async function fetch(opts) {   // allow:raw-outbound-http — function name is fetch, internal call routes through b.httpClient
+async function fetch(opts) {   // allow:raw-outbound-http-framework-internal — function name is fetch, internal call routes through b.httpClient
   opts = opts || {};
   validateOpts(opts, ["url", "caCertificate", "force", "timeoutMs"], "auth.fido_mds3.fetch");
 

package/lib/cert.js

@@ -721,7 +721,7 @@ function create(opts) {
     var chain = _splitPemChain(ctx.cert);
     if (chain.length < 2) return;   // no issuer in the served chain
     try {
-      // allow:raw-outbound-http — b.network.tls.ocsp.fetch composes b.httpClient internally (SSRF guard + pinned DNS); not a raw outbound call
+      // allow:raw-outbound-http-framework-internal — b.network.tls.ocsp.fetch composes b.httpClient internally (SSRF guard + pinned DNS); not a raw outbound call
       var rv = await networkTls().ocsp.fetch({ leafPem: chain[0], issuerPem: chain[1] });
       ctx.ocspResponse = rv.ocspDer;
       _emitAudit("cert.ocsp.refreshed", "success", { name: name });

package/lib/mail-send-deliver.js

@@ -213,7 +213,7 @@ async function _applyMtaStsPolicy(domain, mxs, policyMode, auditEmit) {
   if (policyMode === "off") return mxs;
   var sts;
   try {
-    sts = await smtpPolicy().mtaSts.fetch(domain);   // allow:raw-outbound-http — method call on b.network.smtp.policy wrapper, not a raw `fetch(`
+    sts = await smtpPolicy().mtaSts.fetch(domain);   // allow:raw-outbound-http-framework-internal — method call on b.network.smtp.policy wrapper, not a raw `fetch(`
   } catch (e) {
     if (policyMode === "enforce") {
       throw new DeliverError("deliver/mta-sts-fetch-failed",

package/lib/network-dns-resolver.js

@@ -488,7 +488,7 @@ async function _wireLookup(name, qtype, timeoutMs) {
     // Raw DoH wire-format request — bypasses b.httpClient envelope
     // because we need the raw binary response bytes for safeDns to
     // parse (httpClient assumes JSON/text shapes).
-    var req = https.request({                                                                            // allow:raw-outbound-http — DoH wire-format response bytes; b.httpClient envelopes assume text/JSON, and httpClient → ssrfGuard → DNS → DoH would form a cycle
+    var req = https.request({                                                                            // allow:raw-outbound-http-framework-internal — DoH wire-format response bytes; b.httpClient envelopes assume text/JSON, and httpClient → ssrfGuard → DNS → DoH would form a cycle
       hostname:   u.hostname,
       port:       u.port || 443,                                                                        // HTTPS port
       path:       u.pathname + u.search,

package/lib/network-smtp-policy.js

@@ -660,7 +660,7 @@ async function tlsRptSubmit(report, opts) {
     try {
       if (/^https:\/\//i.test(uri)) {
         entry.kind = "https";
-        // allow:raw-outbound-http — `client` is the framework httpClient
+        // allow:raw-outbound-http-framework-internal — `client` is the framework httpClient
         // (or operator-supplied test mock); SSRF + DNS-pin already
         // applied through the framework wrapper.
         var rv = await client.request({

package/lib/pqc-gate.js

@@ -232,7 +232,7 @@ function create(opts) {
       // each chunk to read the record-length prefix) before deciding
       // whether more data is needed. boundedChunkCollector is append-
       // only with no peek, doesn't fit.
-      // allow:handrolled-buffer-collect — see comment above
+      // allow:handrolled-buffer-collect-bounded-framing — see comment above
       var buf = Buffer.concat(chunks);
       var recordLen = buf.readUInt16BE(3);
       var neededLen = 5 + recordLen;

package/lib/vault-aad.js

@@ -99,7 +99,7 @@ function _canonicalize(parts) {
     valLenBuf.writeUInt32BE(valBuf.length);
     chunks.push(keyLenBuf, keyBuf, valLenBuf, valBuf);
   }
-  return Buffer.concat(chunks);                  // allow:handrolled-buffer-collect — AAD canonicalization, bounded by length-prefixed field shape
+  return Buffer.concat(chunks);                  // allow:handrolled-buffer-collect-bounded-framing — AAD canonicalization, bounded by length-prefixed field shape
 }
 
 function buildColumnAad(opts) {

package/lib/ws-client.js

@@ -492,7 +492,7 @@ class WsClient extends EventEmitter {
   }
 
   _consumeHandshake(chunk) {
-    // allow:handrolled-buffer-collect — handshake header capped at 64 KiB below; once handshake parses we switch to FrameParser
+    // allow:handrolled-buffer-collect-bounded-framing — handshake header capped at 64 KiB below; once handshake parses we switch to FrameParser
     this._handshakeBuf = Buffer.concat([this._handshakeBuf, chunk]);
     var headerEnd = this._handshakeBuf.indexOf("\r\n\r\n");
     if (headerEnd === -1) {
@@ -737,7 +737,7 @@ class WsClient extends EventEmitter {
       return;
     }
     if (frame.fin) {
-      var fullPayload = Buffer.concat(this._fragmentChunks);                              // allow:handrolled-buffer-collect — bounded by maxMessageBytes below
+      var fullPayload = Buffer.concat(this._fragmentChunks);                              // allow:handrolled-buffer-collect-bounded-framing — bounded by maxMessageBytes below
       if (safeBuffer.byteLengthOf(fullPayload) > this._opts.maxMessageBytes) {
         this._handleSocketError(new WsClientError("ws-client/message-too-big",
           "incoming message exceeds maxMessageBytes (" + this._opts.maxMessageBytes + ")"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.31",
+  "version": "0.15.32",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4097a213-458e-41ee-81c8-2db35819839f",
+  "serialNumber": "urn:uuid:c545cdae-c805-48ed-bc85-5ab5c993961a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-26T19:40:07.451Z",
+    "timestamp": "2026-06-26T20:40:06.256Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.31",
+      "bom-ref": "@blamejs/core@0.15.32",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.31",
+      "version": "0.15.32",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.31",
+      "purl": "pkg:npm/%40blamejs/core@0.15.32",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.31",
+      "ref": "@blamejs/core@0.15.32",
       "dependsOn": []
     }
   ]