@blamejs/core 0.15.35 → 0.15.37

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.37 (2026-06-27) — **Several numeric options that silently accepted a non-finite value — disabling a clock-skew / freshness check or a resource cap — now reject it, so an `Infinity` skew or limit can no longer turn off the protection it configures.** A number of configuration options validated a numeric value with a bare `typeof === "number" && value >= 0` check, which accepts `Infinity`. Where the value is a clock-skew tolerance or a resource cap, an `Infinity` (or `NaN`) silently disabled the very check it tunes: a CWT / OCSP-staple / ARC clock-skew of `Infinity` made the expiry, freshness, and expiration comparisons unsatisfiable (an expired token / a replayed pre-revocation "good" response / an expired ARC seal would be accepted); a WebSocket-client `maxMessageBytes` / `maxFrameBytes` / `handshakeTimeoutMs` of `Infinity` disabled the inbound-OOM and stalled-handshake defenses; and inbox / flag-cache / audit-chain size and count caps of `Infinity` admitted unbounded data. These options now route through the finite-bounds validator: a present non-finite value is refused at the entry point (or falls back to the safe default on the result-returning paths). Options where an unbounded value is a deliberate intent — reconnect "retry indefinitely", inbox "retain indefinitely" — continue to accept `Infinity`. **Security:** *A non-finite clock-skew no longer disables CWT / OCSP / ARC time checks* — b.cwt.verify, the OCSP-staple freshness check in b.network.tls, and b.mail.arc.verify each took an operator clock-skew tolerance validated as `typeof === "number" && >= 0`, which accepts `Infinity`. Because each check is of the form `now > deadline + skew`, a skew of `Infinity` made it unsatisfiable and silently turned the check off: an expired CWT verified, a stale (post-nextUpdate) OCSP "good" response — the exact reply an attacker replays after the certificate is revoked — was accepted, and an expired ARC seal passed. A present clock-skew that is not a non-negative finite integer is now refused (b.cwt.verify throws cwt/bad-clock-skew; the OCSP and ARC paths fall back to their safe default). Regression tests assert an expired token / stale staple / expired ARC seal is still rejected when the skew is `Infinity`. · *WebSocket-client inbound caps can no longer be disabled by an Infinity value* — b.wsClient.connect validated maxMessageBytes, maxFrameBytes, and handshakeTimeoutMs (and the ping/pong keepalive intervals) with a bare numeric check that accepted `Infinity`, which disabled the inbound-message and frame size limits — the defenses against a malicious server sending an unbounded message — and the handshake timeout. A present non-finite value for these is now refused at connect time. The reconnect maxAttempts still accepts `Infinity` (a deliberate "reconnect indefinitely" intent). · *Inbox, flag-cache, and audit-chain caps reject a non-finite limit* — The inbox maxPayloadBytes / messageIdMaxLen / sourceMaxLen caps, the flag-cache ttlMs / maxEntries, and the audit-chain partition fan-out cap each accepted `Infinity`, disabling the cap (unbounded stored payloads, a never-expiring or unbounded cache, unbounded fan-out). These now require a positive finite integer — refused at create time, or clamped to the bounded default on the result-returning verify path. The inbox retentionDays still accepts `Infinity` (retain indefinitely).
+
+- v0.15.36 (2026-06-27) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** The codebase-patterns guard class that allows a bare comma/semicolon split on token-only RFC header grammars was re-verified from scratch and renamed to a descriptive token, with its old name recorded as retired. Each live marked site (RRULE, RFC 9421 component identifiers, TLS-RPT rua, SCIM attribute paths) was re-read and confirmed to split a grammar with no quoted-string members. Five marker comments that suppressed nothing were removed or turned into plain explanatory comments. No runtime code, public API, or wire format changed. **Detectors:** *Bare token-only header-split suppression class re-verified, renamed, and pruned of inert markers* — Each marked bare `.split(",")` / `.split(";")` on an RFC header value was re-read and confirmed to operate on a token-only grammar (no quoted-string members, so a quote-aware splitter is unnecessary): RFC 5545 RRULE, RFC 9421 signature component identifiers, RFC 8460 TLS-RPT rua, and RFC 7644 SCIM attribute paths. The guard class was renamed to a descriptive token and its old name added to the retired-token set. Five marker comments that the detector never actually evaluated (two sat on a date-normalizing `.replace`, three in header parsers the guard intentionally does not scan) were removed or converted to plain comments. This is test-suite tooling plus source-comment text; no shipped framework behavior changed.
+
 - v0.15.35 (2026-06-26) — **`b.metrics` shadow registry no longer lets a comma in a label value forge extra Prometheus label pairs — a label-injection that downstream tenant-scoping or authorization selectors could be tricked by.** The shadow registry serialized a metric's label set into a `name=value,name=value` string key and re-split it on `,` to build the Prometheus exposition. A label VALUE containing a comma therefore split into multiple label pairs, so a single operator-set label could forge additional label pairs in the scrape output (for example turning one `route` label into a `route` plus an attacker-named label), which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary; two distinct label sets could also collide into one cardinality bucket. The label key now uses canonical-JSON of the string-coerced label set (the same approach the main registry already used) and the render path emits the structured label set kept alongside that key rather than splitting or re-parsing, so a `,` or `=` inside a label value stays inside the value and a label NAMED `constructor`, `prototype`, or `__proto__` (all valid Prometheus label names) is preserved instead of being dropped. Note: the cardinality keys exposed by `shadowRegistry().snapshot()` are now canonical-JSON strings (e.g. `{"route":"/api"}`) rather than `route=/api`. **Changed:** *shadowRegistry().snapshot() cardinality keys are canonical-JSON* — As a consequence of the label-injection fix, the per-series cardinality keys in a shadow-registry snapshot are now canonical-JSON strings (e.g. `{"tenant":"a"}`) instead of the previous `tenant=a` form. Code that reads those keys directly from snapshot() should parse them as JSON; the Prometheus render output is unchanged for conforming label values. **Security:** *Label values can no longer forge extra Prometheus label pairs in the shadow registry* — b.metrics shadowRegistry built a metric's cardinality key by joining `name=value` pairs with commas, then split that string on commas when rendering the Prometheus exposition. A comma (and `=`) in a label value therefore broke one value into several forged label pairs in the scrape output, and two different label sets could collide into the same cardinality bucket. The key is now canonical-JSON of the string-coerced label set and the render emits the structured label set kept alongside that key rather than splitting or re-parsing, so a label value is emitted as a single quoted value with its commas/equals intact, distinct label sets get distinct keys, and a label NAMED `constructor`, `prototype`, or `__proto__` (each a valid Prometheus label name) is preserved rather than dropped. Deterministic regression tests assert a comma-bearing label value produces exactly one label pair and that the reserved-name labels survive render.
 
 - v0.15.34 (2026-06-26) — **`b.mail.crypto.pgp.verify` now accepts every valid RSA OpenPGP signature — one whose value happened to have a high zero byte (about 1 in 256) was being rejected.** An OpenPGP RSA signature is an integer modulo the key's modulus, and ~1 in 256 signatures have a value that begins with a zero byte. The MPI encoding strips those leading zero bytes (RFC 9580 §3.2), but b.mail.crypto.pgp.verify passed the stripped value straight to the RSA verification, which requires a signature exactly the modulus byte length — so a perfectly valid signature was intermittently reported invalid. The signature is now left-padded back to the modulus width before verification, exactly as the Ed25519 path already pads its components. Verification of every valid RSA signature is now reliable, including signatures produced by other OpenPGP implementations. Also includes internal test-tooling: two more guard-suite suppression classes were re-verified and their tokens retired. **Fixed:** *RSA OpenPGP signatures with a high zero byte now verify reliably* — b.mail.crypto.pgp.verify read the RSA signature MPI (whose leading zero bytes the OpenPGP wire format strips) and handed it to the RSA verification without restoring the stripped bytes. Node's RSA verify requires the signature to be exactly the modulus byte length, so a signature whose value had one or more high zero bytes — about 1 in 256 of all signatures, for any key — was rejected as invalid even though it was correct. The signature is now left-padded to the modulus width before verification (the same correction the Ed25519 verification path already applied to its R/S components). This affects signatures the framework produces and signatures from other OpenPGP implementations alike. A deterministic regression test searches for a short-MPI signature and asserts it verifies. **Detectors:** *Two more suppression-marker classes re-verified and their tokens retired* — The raw-hash-compare and seal-without-aad guard classes were re-read and confirmed (a data-residency region tag compared with === — not a secret; and two intentional non-AEAD-bound seals — a non-regulated plain-mode column whose AAD is enforced by the posture seal-envelope floor where it matters, and a throwaway vault-readiness probe), then renamed to descriptive tokens with their old names added to the retired-token set. Test-suite tooling only.

package/lib/agent-posture-chain.js

@@ -124,7 +124,7 @@ function create(opts) {
   var auditImpl = opts.audit || audit();
   var declaredRegimes = Object.create(null);
   for (var i = 0; i < BUILTIN_REGIMES.length; i += 1) declaredRegimes[BUILTIN_REGIMES[i]] = true;
-  // allow:numeric-opt-Infinity — operator opt clamped to [1, DEFAULT_MAX_HOP_COUNT]; bad input falls back to default
+  // allow:numeric-opt-Infinity-intentional — operator opt clamped to [1, DEFAULT_MAX_HOP_COUNT] (the `<= DEFAULT_MAX_HOP_COUNT` upper bound rejects Infinity); bad input falls back to default
   var maxHopCount = typeof opts.maxHopCount === "number" && opts.maxHopCount > 0 &&
                     opts.maxHopCount <= DEFAULT_MAX_HOP_COUNT
                       ? Math.floor(opts.maxHopCount)

package/lib/audit-chain.js

@@ -37,6 +37,7 @@ var canonicalJson = require("./canonical-json");
 var C = require("./constants");
 var clusterStorage = require("./cluster-storage");
 var frameworkSchema = require("./framework-schema");
+var numericBounds = require("./numeric-bounds");
 var sql = require("./sql");
 var safeSql = require("./safe-sql");
 var safeBuffer = require("./safe-buffer");
@@ -305,7 +306,10 @@ async function verifyChain(queryAllAsync, tableName, opts) {
     // coerce so a Postgres INTEGER/BIGINT chainKey is type-stable in the
     // reported break-shape and the per-key WHERE bind, matching SQLite.
     var keyRows = frameworkSchema.coerceRows(await queryAllAsync(keysBuilt.sql, keysBuilt.params));
-    var maxChains = (typeof opts.maxChains === "number" && opts.maxChains > 0) ? opts.maxChains : 100000;   // allow:numeric-opt-Infinity — partition fan-out cap; non-number / <=0 falls back to the default
+    // Partition fan-out cap; a non-finite / <= 0 / non-integer value (Infinity
+    // would make the `keyRows.length > maxChains` cap unsatisfiable) falls back
+    // to the bounded default rather than disabling the cap.
+    var maxChains = numericBounds.isPositiveFiniteInt(opts.maxChains) ? opts.maxChains : 100000;
     if (keyRows.length > maxChains) {
       return {
         ok:           false,

package/lib/calendar.js

@@ -1119,7 +1119,7 @@ function _firstParamValue(prop, paramName) {
 
 function _icalRruleToJscal(rrule) {
   var out = { "@type": "RecurrenceRule", frequency: "daily" };
-  var parts = String(rrule).split(";");                                                                // allow:bare-split-on-quoted-header — RFC 5545 RRULE grammar has no quoted-string members; values are token-only
+  var parts = String(rrule).split(";");                                                                // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 RRULE grammar has no quoted-string members; values are token-only
   for (var i = 0; i < parts.length; i += 1) {
     var kv = parts[i].split("=");
     if (kv.length !== 2) continue;
@@ -1129,11 +1129,11 @@ function _icalRruleToJscal(rrule) {
     else if (key === "INTERVAL") out.interval = parseInt(val, 10);
     else if (key === "COUNT") out.count = parseInt(val, 10);
     else if (key === "UNTIL") out.until = _icalDateTimeToUtc(val);
-    else if (key === "BYDAY") out.byDay = val.split(",").map(function (d) {                            // allow:bare-split-on-quoted-header — RFC 5545 BYDAY values are token-only
+    else if (key === "BYDAY") out.byDay = val.split(",").map(function (d) {                            // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 BYDAY values are token-only
       return { "@type": "NDay", day: d.slice(-2).toLowerCase() };
     });
-    else if (key === "BYMONTH") out.byMonth = val.split(",");                                          // allow:bare-split-on-quoted-header — RFC 5545 BYMONTH values are integer-only
-    else if (key === "BYMONTHDAY") out.byMonthDay = val.split(",").map(function (n) { return parseInt(n, 10); }); // allow:bare-split-on-quoted-header — RFC 5545 BYMONTHDAY values are integer-only
+    else if (key === "BYMONTH") out.byMonth = val.split(",");                                          // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 BYMONTH values are integer-only
+    else if (key === "BYMONTHDAY") out.byMonthDay = val.split(",").map(function (n) { return parseInt(n, 10); }); // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 BYMONTHDAY values are integer-only
   }
   return out;
 }
@@ -1168,13 +1168,13 @@ function _utcDateTimeToIcal(s) {
   // JSCalendar UTCDateTime "2026-05-22T10:00:00.123Z" →
   // "20260522T100000Z" (RFC 5545 §3.3.5 form 2 has NO fractional
   // seconds; strict ICS consumers reject `T100000.123Z`).
-  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");                                          // allow:bare-split-on-quoted-header — not a header split
+  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");
 }
 
 function _localDateTimeToIcal(s) {
   // JSCalendar LocalDateTime "2026-05-22T09:00:00.123" →
   // "20260522T090000" (same fractional-second strip as the UTC form).
-  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");                                          // allow:bare-split-on-quoted-header — not a header split
+  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");
 }
 
 function _isUtcDateTime(s) {

package/lib/cwt.js

@@ -39,6 +39,7 @@
 var cose = require("./cose");
 var cbor = require("./cbor");
 var C = require("./constants");
+var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -191,7 +192,11 @@ async function verify(cwt, opts) {
   }
 
   // Time claims (NumericDate, seconds). Skew tolerance both directions.
-  var skew = (typeof opts.clockSkewSec === "number" && opts.clockSkewSec >= 0) ? opts.clockSkewSec : 60;   // allow:numeric-opt-Infinity — clamped non-negative, else default / allow:raw-time-literal — clock-skew in seconds (NumericDate units), not a ms duration
+  // A present clockSkewSec must be a non-negative finite integer — an
+  // Infinity / NaN / negative skew would otherwise make `now > exp + skew`
+  // unsatisfiable and silently disable the expiry / not-before checks.
+  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.clockSkewSec, "cwt.verify: opts.clockSkewSec", CwtError, "cwt/bad-clock-skew");
+  var skew = (typeof opts.clockSkewSec === "number") ? opts.clockSkewSec : 60;   // allow:raw-time-literal — clock-skew in seconds (NumericDate units), not a ms duration
   var now = _nowSec(opts);
   // A present exp / nbf MUST be a well-formed NumericDate — a non-numeric
   // value would otherwise bypass the time check entirely (a token could

package/lib/external-db.js

@@ -1338,8 +1338,9 @@ async function transaction(fn, opts) {
   // (serialization_failure) are transient — retry with capped attempts
   // and a small jittered backoff. Operators tune retries via opts.deadlockRetries (default 3).
   // numeric-bounds doesn't have a non-negative-int helper; use a
-  // direct check with allow marker (zero is permitted to disable
-  // retries entirely).
+  // Explicit isFinite/integer guard (zero is permitted to disable retries
+  // entirely); a non-finite deadlockRetries is refused here, so Math.floor
+  // below only ever sees a validated finite integer.
   if (opts.deadlockRetries !== undefined) {
     if (typeof opts.deadlockRetries !== "number" || !isFinite(opts.deadlockRetries) ||
         opts.deadlockRetries < 0 || (opts.deadlockRetries | 0) !== opts.deadlockRetries) {
@@ -1348,7 +1349,7 @@ async function transaction(fn, opts) {
     }
   }
   var maxRetries = (typeof opts.deadlockRetries === "number")
-    ? Math.floor(opts.deadlockRetries) : 3;                                       // allow:numeric-opt-Infinity
+    ? Math.floor(opts.deadlockRetries) : 3;
   // Validate the transaction-level residency tag shape at entry (the
   // sessionGucs / deadlockRetries discipline) so an empty-string tag
   // fails before BEGIN rather than at the first statement.

package/lib/flag-cache.js

@@ -24,6 +24,7 @@
 var validateOpts = require("./validate-opts");
 var lazyRequire  = require("./lazy-require");
 var C            = require("./constants");
+var numericBounds = require("./numeric-bounds");
 var { defineClass } = require("./framework-error");
 var FlagError = defineClass("FlagError", { alwaysPermanent: true });
 
@@ -36,18 +37,17 @@ function cache(downstream, opts) {
     throw new FlagError("flag/bad-cache",
       "cache: downstream provider must implement .evaluate()");
   }
-  // allow:numeric-opt-Infinity — defaults clamped + ttl-floor enforced below
-  var ttlMs = (typeof opts.ttlMs === "number" && opts.ttlMs > 0)
-    ? opts.ttlMs
-    : C.TIME.seconds(30);
+  // A present ttlMs / maxEntries must be a positive finite integer — Infinity
+  // would pass a bare `typeof === "number" && > 0` check and give a
+  // never-expiring entry (ttlMs) or an unbounded cache (maxEntries).
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.ttlMs, "flag.cache: opts.ttlMs", FlagError, "flag/bad-cache");
+  var ttlMs = (typeof opts.ttlMs === "number") ? opts.ttlMs : C.TIME.seconds(30);
   if (ttlMs < C.TIME.seconds(1)) {
     throw new FlagError("flag/bad-cache",
       "cache: ttlMs must be >= 1000ms - got " + ttlMs);
   }
-  // allow:numeric-opt-Infinity — maxEntries default + Math.floor coerce; throws on bad type at config time
-  var maxEntries = (typeof opts.maxEntries === "number" && opts.maxEntries > 0)
-    ? Math.floor(opts.maxEntries)
-    : 10000;                                       // entry-count default
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxEntries, "flag.cache: opts.maxEntries", FlagError, "flag/bad-cache");
+  var maxEntries = (typeof opts.maxEntries === "number") ? opts.maxEntries : 10000;   // entry-count default
   var auditOn = opts.audit === true;            // off by default — too chatty
   var entries = new Map();
   var hits   = 0;

package/lib/http-client-cache.js

@@ -212,7 +212,7 @@ function _buildCacheKey(method, url, varyHeaderValues) {
 // uncacheable.
 function _extractVaryValues(varyHeader, requestHeaders) {
   if (typeof varyHeader !== "string" || varyHeader.length === 0) return [];
-  var names = varyHeader.split(",").map(function (s) {                                          // allow:bare-split-on-quoted-header — RFC 9110 §12.5.5 Vary is a comma-list of field-names (token grammar); no quoted-string
+  var names = varyHeader.split(",").map(function (s) {                                          // RFC 9110 §12.5.5 Vary is a comma-list of field-names (token grammar); no quoted-string, so a bare split is correct
     return s.trim().toLowerCase();
   }).filter(function (s) { return s.length > 0; });
   if (names.indexOf("*") !== -1) return null;  // sentinel: "uncacheable"
@@ -262,7 +262,7 @@ function _evaluateStorage(method, statusCode, responseHeaders, sharedCache) {
 
   // Vary: * is uncacheable per RFC 9110 §12.5.5.
   if (typeof varyHeader === "string" && varyHeader.indexOf("*") !== -1) {
-    var trimmed = varyHeader.split(",").map(function (s) { return s.trim(); });                  // allow:bare-split-on-quoted-header — RFC 9110 §12.5.5 Vary field-names; token grammar only
+    var trimmed = varyHeader.split(",").map(function (s) { return s.trim(); });                  // RFC 9110 §12.5.5 Vary field-names; token grammar only, so a bare split is correct
     if (trimmed.indexOf("*") !== -1) {
       return { cacheable: false, reason: "vary-star", freshnessMs: -1, directives: directives, varyHeader: varyHeader };
     }

package/lib/http-message-signature.js

@@ -319,7 +319,7 @@ function sign(msg, opts) {
   // header isn't already supplied. Operators wanting to use the
   // RFC 9530 "sha-512" identifier (SHA-512 instead of SHA3-512) supply
   // the header themselves; the framework emits SHA3-512.
-  var coveredLower = opts.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header — opts.covered is operator-supplied component-id list (e.g. "content-digest;sf"); component identifiers are RFC 9421 §2.1 derived-field names with token-only grammar; no quoted-string
+  var coveredLower = opts.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header-token-grammar — opts.covered is operator-supplied component-id list (e.g. "content-digest;sf"); component identifiers are RFC 9421 §2.1 derived-field names with token-only grammar; no quoted-string
   if (coveredLower.indexOf("content-digest") !== -1 &&
       _resolveHeader(m.headers, "content-digest") === null) {
     if (m.body == null) {
@@ -451,7 +451,7 @@ function _parseSignature(headerValue, label) {
   if (headerValue.indexOf(prefix) !== 0) {
     // Multiple signature labels can appear; comma-separated. Find the
     // matching label.
-    var parts = headerValue.split(",");                                                        // allow:bare-split-on-quoted-header — RFC 9421 §2.4 Signature header values are `label=:b64:` form; base64 alphabet excludes `,` and the label tokens are RFC 8941 §3.3.4 sf-token (no DQUOTE in practice)
+    var parts = headerValue.split(",");                                                        // allow:bare-split-on-quoted-header-token-grammar — RFC 9421 §2.4 Signature header values are `label=:b64:` form; base64 alphabet excludes `,` and the label tokens are RFC 8941 §3.3.4 sf-token (no DQUOTE in practice)
     for (var i = 0; i < parts.length; i++) {
       var p = parts[i].trim();
       if (p.indexOf(prefix) === 0) {
@@ -519,7 +519,7 @@ function verify(msg, opts) {
   // If content-digest is covered, recompute and compare. RFC 9421 §B.2.5
   // mandates that verifiers re-run the digest over the body — a stale
   // header from a proxy would otherwise verify trivially.
-  var coveredLower = parsedInput.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header — same as sign() above: covered items are RFC 9421 §2.1 component-ids, token grammar
+  var coveredLower = parsedInput.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header-token-grammar — same as sign() above: covered items are RFC 9421 §2.1 component-ids, token grammar
   if (coveredLower.indexOf("content-digest") !== -1) {
     if (m.body == null) {
       return { valid: false, reason: "content-digest-no-body" };

package/lib/inbox.js

@@ -44,6 +44,7 @@
 
 var C = require("./constants");
 var codepointClass = require("./codepoint-class");
+var numericBounds = require("./numeric-bounds");
 var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var safeSql = require("./safe-sql");
@@ -155,15 +156,17 @@ function create(opts) {
   // The table identifier reaches SQL through b.sql, which validates +
   // quotes it by construction on every emitted statement; _validateTableName
   // above fails fast at create() time on a bad name.
-  var retentionDays  = (typeof opts.retentionDays === "number" && opts.retentionDays > 0)        // allow:numeric-opt-Infinity
+  var retentionDays  = (typeof opts.retentionDays === "number" && opts.retentionDays > 0)        // allow:numeric-opt-Infinity-intentional — Infinity = retain indefinitely, a supported intent
     ? opts.retentionDays : 30;                                                                   // default retention days
   var auditOn        = opts.audit !== false;
-  var maxPayloadBytes = (typeof opts.maxPayloadBytes === "number" && opts.maxPayloadBytes > 0)   // allow:numeric-opt-Infinity
-    ? opts.maxPayloadBytes : C.BYTES.kib(64);
-  var messageIdMaxLen = (typeof opts.messageIdMaxLen === "number" && opts.messageIdMaxLen > 0)   // allow:numeric-opt-Infinity
-    ? opts.messageIdMaxLen : 256;                                                                // message-id length cap
-  var sourceMaxLen = (typeof opts.sourceMaxLen === "number" && opts.sourceMaxLen > 0)            // allow:numeric-opt-Infinity
-    ? opts.sourceMaxLen : 256;                                                                   // source length cap
+  // The byte / length caps must be positive finite integers — Infinity would
+  // disable the cap and admit unbounded stored payloads / identifiers.
+  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
+    ["maxPayloadBytes", "messageIdMaxLen", "sourceMaxLen"],
+    "inbox.create", InboxError, "inbox/bad-opt");
+  var maxPayloadBytes = (typeof opts.maxPayloadBytes === "number") ? opts.maxPayloadBytes : C.BYTES.kib(64);
+  var messageIdMaxLen = (typeof opts.messageIdMaxLen === "number") ? opts.messageIdMaxLen : 256;   // message-id length cap
+  var sourceMaxLen = (typeof opts.sourceMaxLen === "number") ? opts.sourceMaxLen : 256;            // source length cap
 
   function _emitAudit(action, outcome, metadata) {
     if (!auditOn) return;
@@ -346,6 +349,14 @@ function create(opts) {
   }
 
   async function sweep() {
+    // retentionDays: Infinity is the documented "retain indefinitely" intent —
+    // there is no horizon to age past, so sweep deletes nothing. (Computing a
+    // cutoff would otherwise throw: `new Date(Date.now() - Infinity)` is an
+    // Invalid Date, and "Infinity days" is not a valid Postgres interval.)
+    if (!isFinite(retentionDays)) {
+      _emitAudit("inbox.swept", "success", { deleted: 0, retentionDays: retentionDays });
+      return 0;
+    }
     var dialect = _sqlDialect(externalDb);
     var deleted = 0;
     await externalDb.transaction(async function (xdb) {

package/lib/mail-arc-sign.js

@@ -51,6 +51,7 @@
 var nodeCrypto = require("node:crypto");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
+var numericBounds = require("./numeric-bounds");
 var safeBuffer = require("./safe-buffer");
 var dkim = require("./mail-dkim");
 var { defineClass } = require("./framework-error");
@@ -246,8 +247,11 @@ function sign(opts) {
         "sign: headersToSign[" + hi + "] must be a non-empty string");
     }
   }
-  var timestamp = (typeof opts.timestamp === "number" && opts.timestamp > 0)            // allow:numeric-opt-Infinity
-    ? Math.floor(opts.timestamp) : Math.floor(Date.now() / 1000);                       // Unix epoch seconds divisor
+  // A present t= timestamp must be a positive finite integer (NumericDate
+  // seconds) — an Infinity / NaN value would serialize into a malformed t= tag.
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.timestamp, "arc.sign: opts.timestamp", MailAuthError, "arc-sign/bad-timestamp");
+  var timestamp = (typeof opts.timestamp === "number")
+    ? opts.timestamp : Math.floor(Date.now() / 1000);                                   // Unix epoch seconds divisor
   var auditOn = opts.audit !== false;
 
   var keyObject;

package/lib/mail-auth.js

@@ -52,6 +52,7 @@ var structuredFields = require("./structured-fields");
 var markupEscape = require("./markup-escape").markupEscape;
 var bCrypto = require("./crypto");
 var C = require("./constants");
+var numericBounds = require("./numeric-bounds");
 var dkim = require("./mail-dkim");
 var mimeParse = require("./mime-parse");
 var safeXml = require("./parsers/safe-xml");
@@ -1575,7 +1576,11 @@ async function arcVerify(rfc822, opts) {
   var anyFail = false;
   // RFC 8617 §5.2 — operator-tunable clock skew on t= (signing
   // timestamp) and x= (expiration) tags. Default 5 min.
-  var arcClockSkewMs = typeof opts.clockSkewMs === "number" && opts.clockSkewMs >= 0           // allow:numeric-opt-Infinity — operator-supplied skew, default 5 min
+  // A present clockSkewMs must be a non-negative finite integer; an Infinity /
+  // NaN / negative skew makes `amsX + skewSec < nowSec` (and the t= future
+  // check) unsatisfiable and silently disables the RFC 8617 §5.2 expiry /
+  // future-timestamp gate. Non-finite falls to the default.
+  var arcClockSkewMs = numericBounds.isNonNegativeFiniteInt(opts.clockSkewMs)
     ? opts.clockSkewMs : C.TIME.minutes(5);
   var nowSec = Math.floor(Date.now() / 1000);                                                  // Unix epoch seconds divisor
 

package/lib/middleware/age-gate.js

@@ -101,9 +101,9 @@ function create(opts) {
       "middleware.ageGate: opts.getAge must be a function (req) -> number | null");
   }
   var getAge = opts.getAge;
-  var requireAge = (typeof opts.requireAge === "number" && opts.requireAge > 0)            // allow:numeric-opt-Infinity — age is operator domain, not a bytes/time-shaped opt
+  var requireAge = (typeof opts.requireAge === "number" && opts.requireAge > 0)            // allow:numeric-opt-Infinity-intentional — age threshold; an Infinity bound is fail-closed (denies everyone), never a bypass
     ? opts.requireAge : null;
-  var consentRequired = (typeof opts.consentRequired === "number" && opts.consentRequired > 0)  // allow:numeric-opt-Infinity — age threshold, not a bytes/time-shaped opt
+  var consentRequired = (typeof opts.consentRequired === "number" && opts.consentRequired > 0)  // allow:numeric-opt-Infinity-intentional — age threshold; an Infinity bound is fail-closed (classifies everyone below-threshold), never a bypass
     ? opts.consentRequired : null;
   var hasParentalConsent = typeof opts.hasParentalConsent === "function" ? opts.hasParentalConsent : null;
   var skipPaths = Array.isArray(opts.skipPaths) ? opts.skipPaths.slice() : [];

package/lib/middleware/body-parser.js

@@ -351,7 +351,7 @@ function _detectSmuggling(req) {
   //    (RFC 9112 §6.1). Anything else is a smuggling vector or
   //    server-side decode error.
   if (typeof te === "string" && te.length > 0) {
-    var tokens = te.toLowerCase().split(",").map(function (t) { return t.trim(); });               // allow:bare-split-on-quoted-header — RFC 9112 §6.1 Transfer-Encoding values (chunked / gzip / deflate / identity) are token-only; no quoted-string in the grammar
+    var tokens = te.toLowerCase().split(",").map(function (t) { return t.trim(); });               // RFC 9112 §6.1 Transfer-Encoding values (chunked / gzip / deflate / identity) are token-only; no quoted-string in the grammar, so a bare split is correct
     var last = tokens[tokens.length - 1];
     if (last !== "chunked") {
       return {

package/lib/middleware/scim-server.js

@@ -237,8 +237,8 @@ async function _dispatch(req, res, basePath, bearer, opts, maxPageSize, bulkCfg)
       count:              pageSize,
       sortBy:             query.sortBy || null,
       sortOrder:          query.sortOrder || null,
-      attributes:         query.attributes ? query.attributes.split(",") : null,                  // allow:bare-split-on-quoted-header — RFC 7644 §3.9 attributes/excludedAttributes are SCIM attribute paths (URN-ish identifiers); grammar excludes DQUOTE
-      excludedAttributes: query.excludedAttributes ? query.excludedAttributes.split(",") : null,    // allow:bare-split-on-quoted-header — same SCIM attribute-name grammar
+      attributes:         query.attributes ? query.attributes.split(",") : null,                  // allow:bare-split-on-quoted-header-token-grammar — RFC 7644 §3.9 attributes/excludedAttributes are SCIM attribute paths (URN-ish identifiers); grammar excludes DQUOTE
+      excludedAttributes: query.excludedAttributes ? query.excludedAttributes.split(",") : null,    // allow:bare-split-on-quoted-header-token-grammar — same SCIM attribute-name grammar
     }, ctx);
     _writeJson(res, H.OK, {
       schemas:      [SCIM_MESSAGE_LIST],

package/lib/network-smtp-policy.js

@@ -613,7 +613,7 @@ async function tlsRptFetchPolicy(domain, opts) {
   var rua = [];
   for (var p = 0; p < pairs.length; p += 1) {
     if (pairs[p][0] === "rua") {
-      var uris = pairs[p][1].split(",");                                                      // allow:bare-split-on-quoted-header — allow:raw-time-literal — TLS-RPT rua grammar (RFC 8460 §3): rua = tlsrpt-uri *("," tlsrpt-uri); URIs percent-encode reserved chars, no quoted-string
+      var uris = pairs[p][1].split(",");                                                      // allow:bare-split-on-quoted-header-token-grammar — allow:raw-time-literal — TLS-RPT rua grammar (RFC 8460 §3): rua = tlsrpt-uri *("," tlsrpt-uri); URIs percent-encode reserved chars, no quoted-string
       for (var u = 0; u < uris.length; u += 1) {
         var uri = uris[u].trim();
         if (uri.length > 0) rua.push(uri);

package/lib/network-tls.js

@@ -1204,7 +1204,11 @@ function evaluateOcspResponse(ocspDer, opts) {
   // gets revoked, the attacker keeps presenting the cached "good" and
   // the framework keeps accepting it. requireGood postures depend on
   // freshness — reject expired or future-dated responses outright.
-  var clockSkewMs = typeof opts.clockSkewMs === "number" && opts.clockSkewMs >= 0           // allow:numeric-opt-Infinity — operator-supplied skew, default 5 min if absent or invalid
+  // A present clockSkewMs must be a non-negative finite integer; an Infinity /
+  // NaN / negative skew would make the staleness check `now > nextUpdate + skew`
+  // unsatisfiable and silently disable the freshness window — accepting a
+  // replayed pre-revocation "good" response. Non-finite falls to the default.
+  var clockSkewMs = numericBounds.isNonNegativeFiniteInt(opts.clockSkewMs)
     ? opts.clockSkewMs : C.TIME.minutes(5);
   var now = typeof opts.now === "number" ? opts.now : Date.now();
   // thisUpdate / nextUpdate are already unix-ms NUMBERS (parseOcspResponse →

package/lib/ws-client.js

@@ -52,6 +52,7 @@ var { EventEmitter } = require("node:events");
 
 var lazyRequire    = require("./lazy-require");
 var validateOpts   = require("./validate-opts");
+var numericBounds  = require("./numeric-bounds");
 var safeAsync      = require("./safe-async");
 var safeBuffer     = require("./safe-buffer");
 var bCrypto        = lazyRequire(function () { return require("./crypto"); });
@@ -217,16 +218,18 @@ function connect(target, opts) {
         "wsClient.connect: subprotocols[" + sp + "] must be a non-empty string");
     }
   }
-  var pingMs = (typeof opts.pingMs === "number" && opts.pingMs > 0)              // allow:numeric-opt-Infinity
-    ? opts.pingMs : DEFAULT_PING_MS;
-  var pongMs = (typeof opts.pongMs === "number" && opts.pongMs > 0)              // allow:numeric-opt-Infinity
-    ? opts.pongMs : DEFAULT_PONG_MS;
-  var maxMessageBytes = (typeof opts.maxMessageBytes === "number" && opts.maxMessageBytes > 0)   // allow:numeric-opt-Infinity
-    ? opts.maxMessageBytes : DEFAULT_MAX_BYTES;
-  var maxFrameBytes = (typeof opts.maxFrameBytes === "number" && opts.maxFrameBytes > 0)         // allow:numeric-opt-Infinity
-    ? opts.maxFrameBytes : DEFAULT_MAX_FRAME;
-  var handshakeTimeoutMs = (typeof opts.handshakeTimeoutMs === "number" && opts.handshakeTimeoutMs > 0)  // allow:numeric-opt-Infinity
-    ? opts.handshakeTimeoutMs : DEFAULT_HANDSHAKE_TIMEOUT_MS;
+  // These are keepalive/timeout intervals and inbound-OOM caps; a present
+  // value must be a positive finite integer. A bare `typeof === "number" && > 0`
+  // check accepts Infinity, which silently disables the cap (a malicious server
+  // could then send an unbounded message/frame, or stall the handshake forever).
+  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
+    ["pingMs", "pongMs", "maxMessageBytes", "maxFrameBytes", "handshakeTimeoutMs"],
+    "wsClient.connect", WsClientError, "ws-client/bad-opt");
+  var pingMs = (typeof opts.pingMs === "number") ? opts.pingMs : DEFAULT_PING_MS;
+  var pongMs = (typeof opts.pongMs === "number") ? opts.pongMs : DEFAULT_PONG_MS;
+  var maxMessageBytes = (typeof opts.maxMessageBytes === "number") ? opts.maxMessageBytes : DEFAULT_MAX_BYTES;
+  var maxFrameBytes = (typeof opts.maxFrameBytes === "number") ? opts.maxFrameBytes : DEFAULT_MAX_FRAME;
+  var handshakeTimeoutMs = (typeof opts.handshakeTimeoutMs === "number") ? opts.handshakeTimeoutMs : DEFAULT_HANDSHAKE_TIMEOUT_MS;
 
   var reconnectOpts = _normaliseReconnect(opts.reconnect);
   var permessageDeflate = opts.permessageDeflate !== false;
@@ -281,14 +284,18 @@ function _normaliseReconnect(input) {
       "wsClient.connect: reconnect must be false / null / object");
   }
   validateOpts(input, ["maxAttempts", "baseMs", "maxMs", "enabled"], "wsClient.connect.reconnect");
+  // baseMs / maxMs are backoff durations; a present value must be a positive
+  // finite integer (an Infinity base would stall the first reconnect forever).
+  numericBounds.requireAllPositiveFiniteIntIfPresent(input, ["baseMs", "maxMs"],
+    "wsClient.connect.reconnect", WsClientError, "ws-client/bad-reconnect-opt");
   return {
     enabled:     input.enabled !== false,
-    maxAttempts: (typeof input.maxAttempts === "number" && input.maxAttempts >= 0)            // allow:numeric-opt-Infinity
+    // maxAttempts: Infinity is a deliberate "reconnect indefinitely" intent, so
+    // a non-finite value is accepted here (unlike the bounded caps above).
+    maxAttempts: (typeof input.maxAttempts === "number" && input.maxAttempts >= 0)            // allow:numeric-opt-Infinity-intentional — Infinity = reconnect indefinitely, a supported intent
       ? input.maxAttempts : DEFAULT_RECONNECT_MAX_ATTEMPTS,
-    baseMs:      (typeof input.baseMs === "number" && input.baseMs > 0)                       // allow:numeric-opt-Infinity
-      ? input.baseMs : DEFAULT_RECONNECT_BASE_MS,
-    maxMs:       (typeof input.maxMs === "number" && input.maxMs > 0)                         // allow:numeric-opt-Infinity
-      ? input.maxMs : DEFAULT_RECONNECT_MAX_MS,
+    baseMs:      (typeof input.baseMs === "number") ? input.baseMs : DEFAULT_RECONNECT_BASE_MS,
+    maxMs:       (typeof input.maxMs === "number") ? input.maxMs : DEFAULT_RECONNECT_MAX_MS,
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.35",
+  "version": "0.15.37",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:ecbff4b1-ce1e-42ec-93f8-46f7c036e3e8",
+  "serialNumber": "urn:uuid:a1be0521-cb1d-4b8e-9ed6-b0053b5b9bfd",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-27T06:52:37.069Z",
+    "timestamp": "2026-06-27T09:36:13.300Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.35",
+      "bom-ref": "@blamejs/core@0.15.37",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.35",
+      "version": "0.15.37",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.35",
+      "purl": "pkg:npm/%40blamejs/core@0.15.37",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.35",
+      "ref": "@blamejs/core@0.15.37",
       "dependsOn": []
     }
   ]