@blamejs/core 0.15.32 → 0.15.33

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.33 (2026-06-26) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** Three more suppression classes in the codebase-patterns guard suite were re-verified from scratch and renamed to descriptive tokens, with their old names recorded as retired and their in-source marker comments updated to match. No runtime code, public API, or wire format changed. **Detectors:** *Three more suppression-marker classes re-verified and their tokens retired* — Continuing the re-verification pass: each marked site for the math-random-noncrypto, raw-new-url, and dynamic-require guard classes was re-read and confirmed (non-security jitter/sampling; URL parsing for shape/origin inspection or behind the safe wrapper; operator-supplied module loads), then the class was renamed to a descriptive token and its old name added to the retired-token set. This is test-suite tooling; no shipped framework behavior changed.
+
 - v0.15.32 (2026-06-26) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** Three more suppression classes in the codebase-patterns guard suite were re-verified from scratch and renamed to descriptive tokens, with their old names recorded as retired so the prior approval cannot be silently resurrected and their in-source marker comments updated to match. No runtime code, public API, or wire format changed. **Detectors:** *Three more suppression-marker classes re-verified and their tokens retired* — Continuing the re-verification pass: each marked site for the process-exit, hand-rolled buffer-collect, and raw-outbound-http guard classes was re-read and confirmed (operator-opt-in exits; bounded protocol-framing / TLV assembly; framework-routed outbound calls), then the class was renamed to a descriptive token and its old name added to the retired-token set. This is test-suite tooling; no shipped framework behavior changed.
 
 - v0.15.31 (2026-06-26) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** The codebase-patterns guard suite gains a gate that retires a renamed suppression-marker token: once a suppression class is re-verified and renamed, its old token cannot be silently re-registered, so a later suppression has to be re-examined under the new name instead of inheriting a stale approval. Eight suppression classes were re-verified and renamed to descriptive tokens this release, and their in-source marker comments were updated to match. No runtime code, public API, or wire format changed. **Detectors:** *Re-verification gate retires a renamed suppression-marker token* — A new guard refuses to re-register a retired suppression-marker token, and the orphan check points a stale marker at its current name. When a suppression class is re-verified, it is renamed to a descriptive token and the old name is recorded as retired, so the old approval cannot be quietly resurrected — a future suppression must be re-examined and re-stamped under the new name. This is test-suite tooling; no shipped framework behavior changed.

package/lib/acme.js

@@ -1026,7 +1026,7 @@ function create(opts) {
         // Non-crypto: RFC 9773 §4.2 fleet-scheduling jitter inside the
         // CA-suggested renewal window. Predictability is not a threat
         // here; uniform distribution across the window is the goal.
-        renewAtMs = jLo + Math.floor(Math.random() * (jHi - jLo + 1));   // allow:math-random-noncrypto — RFC 9773 fleet jitter, predictability not a threat
+        renewAtMs = jLo + Math.floor(Math.random() * (jHi - jLo + 1));   // allow:math-random-noncrypto-jitter-sampling — RFC 9773 fleet jitter, predictability not a threat
       } else {
         // Past-window — renew immediately, no jitter.
         renewAtMs = nowMs;

package/lib/agent-trace.js

@@ -256,7 +256,7 @@ function _shouldSample(globalRate, perMethod, method, traceId) {
   // No trace-id supplied — start of a new trace. Operators wire
   // shouldSample(method, ctx.traceId) on every downstream hop so
   // children inherit the decision deterministically.
-  return Math.random() < rate;                                                                          // allow:math-random-noncrypto — start-of-trace seed only; downstream hops pass traceId for deterministic propagation
+  return Math.random() < rate;                                                                          // allow:math-random-noncrypto-jitter-sampling — start-of-trace seed only; downstream hops pass traceId for deterministic propagation
 }
 
 function _formatAttributes(info) {

package/lib/auth/oauth.js

@@ -282,7 +282,7 @@ function _validateUrl(url, allowHttp, label) {
   // global flag.
   var isLocalhostHttp = false;
   try {
-    var parsed = new URL(url);                                                                  // allow:raw-new-url — RFC 9700 §4.1.1 localhost-exception lookup; safeUrl re-validates below for non-localhost paths
+    var parsed = new URL(url);                                                                  // allow:raw-new-url-parse-only — RFC 9700 §4.1.1 localhost-exception lookup; safeUrl re-validates below for non-localhost paths
     // Strip trailing root-zone dot before the localhost compare.
     // RFC 1034 §3.1 — `localhost.` resolves identically to `localhost`;
     // without the strip, an attacker who registers `evil.com` as a
@@ -2168,7 +2168,7 @@ function create(opts) {
         "parseFrontchannelLogoutRequest: req with url required");
     }
     var u;
-    try { u = new URL(req.url, "http://placeholder.invalid"); }                                  // allow:raw-new-url — req.url is the framework-normalized path; placeholder base provides a synthetic origin for relative-path parse
+    try { u = new URL(req.url, "http://placeholder.invalid"); }                                  // allow:raw-new-url-parse-only — req.url is the framework-normalized path; placeholder base provides a synthetic origin for relative-path parse
     catch (_e) {
       throw new OAuthError("auth-oauth/bad-frontchannel-logout-url",
         "parseFrontchannelLogoutRequest: malformed request URL");

package/lib/cli.js

@@ -455,11 +455,11 @@ function _resolveTargetModule(modulePath, ctx) {
   // code never reaches this nodePath.
   if (!modulePath) {
     var root = nodePath.resolve(__dirname, "..");
-    return require(nodePath.join(root, "index.js"));   // allow:dynamic-require — operator-extensibility entry point
+    return require(nodePath.join(root, "index.js"));   // allow:dynamic-require-operator-module — operator-extensibility entry point
   }
   var abs = nodePath.isAbsolute(modulePath) ? modulePath : nodePath.resolve(ctx.cwd, modulePath);
   delete require.cache[require.resolve(abs)];
-  return require(abs);                              // allow:dynamic-require — operator-extensibility entry point
+  return require(abs);                              // allow:dynamic-require-operator-module — operator-extensibility entry point
 }
 
 function _runApiSnapshot(args, ctx) {

package/lib/cluster.js

@@ -750,7 +750,7 @@ async function _heartbeat() {
   // budget is in `leaseTtl - heartbeatMs`, not in the jitter
   // window).
   if (!lease) {
-    var jitterMs = Math.floor(Math.random() * (heartbeatMs * 0.4));            // allow:math-random-noncrypto — heartbeat jitter, not security-bearing
+    var jitterMs = Math.floor(Math.random() * (heartbeatMs * 0.4));            // allow:math-random-noncrypto-jitter-sampling — heartbeat jitter, not security-bearing
     if (jitterMs > 0) {
       await safeAsync.sleep(jitterMs);
     }

package/lib/db-schema.js

@@ -605,7 +605,7 @@ function runMigrations(database, migrationDir) {
       // Operator-supplied migration file — by definition not statically
       // require-able by a bundler. Anyone bundling this surface into SEA
       // accepts that runtime migration loading won't resolve.
-      mig = require(fullPath);   // allow:dynamic-require — operator-supplied migration
+      mig = require(fullPath);   // allow:dynamic-require-operator-module — operator-supplied migration
     } catch (e) {
       throw new Error("migration '" + file + "' failed to load: " + e.message);
     }

package/lib/gate-contract.js

@@ -940,7 +940,7 @@ function canaryGate(gate, opts) {
     name: opts.name || "canary",
     check: async function (ctx) {
       var d = await gate.check(ctx);
-      if (d.action === "refuse" && Math.random() > rate) {       // allow:math-random-noncrypto — canary sampling, non-security
+      if (d.action === "refuse" && Math.random() > rate) {       // allow:math-random-noncrypto-jitter-sampling — canary sampling, non-security
         return Object.assign({}, d, { ok: true, action: "warn" });
       }
       return d;

package/lib/json-schema.js

@@ -104,7 +104,7 @@ function _resolveUri(ref, base) {
   // RFC 3986 relative→absolute resolution of a schema $id/$ref (operator-
   // trusted schema text, not request data); safeUrl.parse intentionally
   // rejects the relative refs and non-http schemes schemas legitimately use.
-  try { return new URL(ref, base).href; }   // allow:raw-new-url — schema $id/$ref URI resolution, not request-data URL handling
+  try { return new URL(ref, base).href; }   // allow:raw-new-url-parse-only — schema $id/$ref URI resolution, not request-data URL handling
   catch (_e) {
     // Relative resolution against a non-URL base (e.g. "urn:..." or a
     // bare name). Fall back to fragment-aware concatenation.
@@ -730,7 +730,7 @@ function _checkFormat(format, value, type) {
       if (/\s/.test(value)) return false;                       // raw whitespace is not a valid URI
       if (/%(?![0-9A-Fa-f]{2})/.test(value)) return false;      // malformed percent-escape
       if (!/^[A-Za-z][A-Za-z0-9+.-]*:/.test(value)) return false;   // absolute URI requires a scheme   // allow:regex-no-length-cap — linear scheme prefix
-      try { new URL(value); return true; } catch (_e) { return false; }   // allow:raw-new-url — string-shape check, no fetch / SSRF surface
+      try { new URL(value); return true; } catch (_e) { return false; }   // allow:raw-new-url-parse-only — string-shape check, no fetch / SSRF surface
     }
     case "uuid": return /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(value);   // allow:regex-no-length-cap — fixed-width UUID
     case "ipv4": return /^(\d{1,3}\.){3}\d{1,3}$/.test(value) && value.split(".").every(function (o) { return Number(o) <= 255; });   // allow:regex-no-length-cap — bounded dotted-quad

package/lib/mcp.js

@@ -510,7 +510,7 @@ function _toolResultSanitize(result, opts) {
     } else if (block.type === "image" || block.type === "resource_link" || block.type === "audio") {
       var url = block.url || (block.resource && block.resource.uri);
       if (typeof url === "string" && url.length > 0 && allowedHosts.length > 0) {
-        var u; try { u = new URL(url); } catch (_e) { u = null; }                                // allow:raw-new-url — operator-supplied tool URL; allowlist enforced below
+        var u; try { u = new URL(url); } catch (_e) { u = null; }                                // allow:raw-new-url-parse-only — operator-supplied tool URL; allowlist enforced below
         if (!u || allowedHosts.indexOf(u.host) === -1) {
           issues.push({ kind: "off-allowlist-url", index: i, url: url });
           if (posture === "sanitize") continue;                                                  // drop the block in sanitize mode

package/lib/middleware/csrf-protect.js

@@ -194,7 +194,7 @@ function _checkOriginAllowed(req, allowedOrigins, isHttpsFn, requireOrigin) {
 
   function _originOf(rawUrl) {
     try {
-      var u = new URL(rawUrl);                                                   // allow:raw-new-url — origin-shape inspection (NOT outbound). Intentionally tolerates file:// / data: which safeUrl.parse refuses.
+      var u = new URL(rawUrl);                                                   // allow:raw-new-url-parse-only — origin-shape inspection (NOT outbound). Intentionally tolerates file:// / data: which safeUrl.parse refuses.
       return u.origin;                                                           // "https://host:port" — no path / query / fragment
     } catch (_e) { return null; }
   }

package/lib/module-loader.js

@@ -4,7 +4,7 @@
  * operator-supplied module file (a migration or a seed) by path.
  *
  * Operator modules execute arbitrary code on `require`, so the dynamic
- * `require()` lives here behind ONE `allow:dynamic-require` marker rather
+ * `require()` lives here behind ONE `allow:dynamic-require-operator-module` marker rather
  * than scattered across every host-CLI loader (`b.migrations`,
  * `b.seeders`, `b.externalDb.migrate`). The require cache is busted first
  * so a dev / test rewriting a fixture between calls picks up the new
@@ -33,7 +33,7 @@
 function requireFresh(absPath, onLoadError) {
   try { delete require.cache[require.resolve(absPath)]; } catch (_e) { /* not yet cached */ }
   try {
-    return require(absPath);   // allow:dynamic-require — operator-supplied module (migration / seed)
+    return require(absPath);   // allow:dynamic-require-operator-module — operator-supplied module (migration / seed)
   } catch (e) {
     throw onLoadError(e);
   }

package/lib/retry.js

@@ -284,7 +284,7 @@ function backoffDelay(attempt, opts) {
   // 30-50K randomInt/sec under a retry storm without any security
   // payoff. Math.random's PRNG is the right tool for
   // thundering-herd avoidance.
-  var jitter = capped * opts.jitterFactor * Math.random();                                           // allow:math-random-noncrypto — jitter for thundering-herd, not a confidentiality primitive
+  var jitter = capped * opts.jitterFactor * Math.random();                                           // allow:math-random-noncrypto-jitter-sampling — jitter for thundering-herd, not a confidentiality primitive
   return Math.floor(capped - jitter);
 }
 

package/lib/safe-url.js

@@ -444,7 +444,7 @@ function format(url) {
     }
     // Constructing URL() is the path that surfaces the IDN-crash on
     // older Node — wrap so the listener never crashes.
-    var u = new URL(url);   // allow:raw-new-url — safeUrl.format wraps URL ctor for CVE-2026-21712; this IS the safe wrapper.
+    var u = new URL(url);   // allow:raw-new-url-parse-only — safeUrl.format wraps URL ctor for CVE-2026-21712; this IS the safe wrapper.
     return u.href;
   } catch (e) {
     if (e && e.isSafeUrlError) throw e;

package/lib/ssrf-guard.js

@@ -754,7 +754,7 @@ function createAllowlist(opts) {
   }
   async function assertUrl(url) {
     var parsed;
-    try { parsed = new URL(url); }                                                 // allow:raw-new-url — local URL parse for hostname extraction
+    try { parsed = new URL(url); }                                                 // allow:raw-new-url-parse-only — local URL parse for hostname extraction
     catch (_e) {
       throw new SsrfError("invalid URL", "ssrf-guard/bad-url", { url: url });
     }

package/lib/vendor-data.js

@@ -176,8 +176,8 @@ function _loadAndVerify(name) {
     throw new VendorDataError("vendor-data/module-missing",
       "vendorData: '" + name + "' .data.js module not statically " +
       "require'd by lib/vendor-data.js. Add the literal-string require " +
-      "to the _MODULES table at the top of the file — dynamic " +    // allow:dynamic-require — diagnostic message text
-      "require(variable) breaks SEA / esbuild bundling.");           // allow:dynamic-require — diagnostic message text
+      "to the _MODULES table at the top of the file — dynamic " +    // allow:dynamic-require-operator-module — diagnostic message text
+      "require(variable) breaks SEA / esbuild bundling.");           // allow:dynamic-require-operator-module — diagnostic message text
   }
 
   // Module-shape gate

package/lib/websocket.js

@@ -460,7 +460,7 @@ function isOriginAllowed(req, origins) {
     var host = (req.headers || {}).host;
     if (!host) return false;
     var originHost;
-    try { originHost = new URL(origin).host; }                                   // allow:raw-new-url — comparing browser-supplied Origin header against Host; safeUrl.parse adds policy filtering that isn't appropriate for exact host comparison
+    try { originHost = new URL(origin).host; }                                   // allow:raw-new-url-parse-only — comparing browser-supplied Origin header against Host; safeUrl.parse adds policy filtering that isn't appropriate for exact host comparison
     catch (_e) { return false; }
     return originHost === host;
   }

package/lib/ws-client.js

@@ -964,7 +964,7 @@ class WsClient extends EventEmitter {
     this._reconnectAttempt += 1;
     var attempt = Math.min(this._reconnectAttempt, 30);                                   // clamp 2^attempt overflow
     var ceiling = Math.min(rOpts.maxMs, rOpts.baseMs * Math.pow(2, attempt - 1));
-    var delay   = Math.floor(Math.random() * ceiling);                                    // allow:math-random-noncrypto — backoff jitter, not security
+    var delay   = Math.floor(Math.random() * ceiling);                                    // allow:math-random-noncrypto-jitter-sampling — backoff jitter, not security
     var self = this;
     this._reconnectTimer = setTimeout(function () {
       self._reconnectTimer = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.32",
+  "version": "0.15.33",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c545cdae-c805-48ed-bc85-5ab5c993961a",
+  "serialNumber": "urn:uuid:cfba44f6-db8e-47b3-b1dc-e142692c3a97",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-26T20:40:06.256Z",
+    "timestamp": "2026-06-26T23:00:05.686Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.32",
+      "bom-ref": "@blamejs/core@0.15.33",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.32",
+      "version": "0.15.33",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.32",
+      "purl": "pkg:npm/%40blamejs/core@0.15.33",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.32",
+      "ref": "@blamejs/core@0.15.33",
       "dependsOn": []
     }
   ]