@blamejs/core 0.15.36 → 0.15.38

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.38 (2026-06-27) — **Regex patterns supplied in feature-flag targeting rules and MCP tool input schemas are now screened for catastrophic-backtracking (ReDoS) shapes before compilation, so a pattern matched against request data can't pin a CPU.** Two places compiled a caller-supplied regex pattern and `.test()`'d it against request-controlled input with only a length bound as the stated defense: a feature-flag targeting condition (`op: "regex"`) matched against runtime attribute values, and an MCP tool's input-schema `pattern` matched against tool-call arguments. A length bound is not a ReDoS defense — a catastrophic-backtracking pattern such as `(a+)+$` is six characters and pins a CPU on a crafted input. Both patterns now pass through `b.guardRegex` (strict profile) before compilation, which refuses nested-quantifier, alternation-with-quantifier, and quantifier-inside-lookaround shapes. A ReDoS-shaped flag pattern is refused when the rules are validated; a ReDoS-shaped MCP schema pattern fails tool-input validation. Patterns built from the framework's own static tables, operator-owned JSON Schema patterns, the Sieve glob translator (which cannot express nested quantifiers), and the I-Regexp translator (linear by dialect) are unchanged. **Security:** *Feature-flag regex targeting conditions are screened for ReDoS before compilation* — A flag targeting rule with `op: "regex"` compiled the operator-supplied pattern and `.test()`'d it against runtime attribute values, guarded only by a 200-character length cap. Length does not bound catastrophic backtracking, so a pattern like `(a+)+$` combined with an attacker-controlled attribute value could pin a CPU during flag evaluation. The pattern is now screened through b.guardRegex (strict) when the rules are validated, and a catastrophic-backtracking shape is refused with a clear error. · *MCP tool input-schema patterns are screened for ReDoS before matching request input* — b.mcp.validateToolInput compiled a tool author's input-schema `pattern` and matched it against tool-call argument values; the 4096-character input cap does not bound backtracking (a `(a+)+$` pattern blows up at roughly forty input characters). The schema pattern is now screened through b.guardRegex (strict) before compilation, so a ReDoS-shaped pattern in a registered tool's schema fails input validation instead of letting hostile arguments hang the validator. · *b.guardRegex now catches wrapped nested-quantifier patterns* — The nested-quantifier detector matched a quantified group whose body contained a quantifier, but its inner match was paren-blind, so wrapping the inner quantifier in an extra group — `((a)+)+`, `(([a-z]+)*)*`, `((a+))+` — slipped past it while remaining catastrophic. A structural scan now tracks group nesting and refuses an unbounded-quantified group whose body itself contains an unbounded quantifier at any depth, so the wrapped forms are rejected alongside the bare `(a+)+`. Bounded repeats (`{n}`, `{n,m}`) are unaffected. This strengthens every b.guardRegex caller, including the flag-targeting and MCP screening above.
+
+- v0.15.37 (2026-06-27) — **Several numeric options that silently accepted a non-finite value — disabling a clock-skew / freshness check or a resource cap — now reject it, so an `Infinity` skew or limit can no longer turn off the protection it configures.** A number of configuration options validated a numeric value with a bare `typeof === "number" && value >= 0` check, which accepts `Infinity`. Where the value is a clock-skew tolerance or a resource cap, an `Infinity` (or `NaN`) silently disabled the very check it tunes: a CWT / OCSP-staple / ARC clock-skew of `Infinity` made the expiry, freshness, and expiration comparisons unsatisfiable (an expired token / a replayed pre-revocation "good" response / an expired ARC seal would be accepted); a WebSocket-client `maxMessageBytes` / `maxFrameBytes` / `handshakeTimeoutMs` of `Infinity` disabled the inbound-OOM and stalled-handshake defenses; and inbox / flag-cache / audit-chain size and count caps of `Infinity` admitted unbounded data. These options now route through the finite-bounds validator: a present non-finite value is refused at the entry point (or falls back to the safe default on the result-returning paths). Options where an unbounded value is a deliberate intent — reconnect "retry indefinitely", inbox "retain indefinitely" — continue to accept `Infinity`. **Security:** *A non-finite clock-skew no longer disables CWT / OCSP / ARC time checks* — b.cwt.verify, the OCSP-staple freshness check in b.network.tls, and b.mail.arc.verify each took an operator clock-skew tolerance validated as `typeof === "number" && >= 0`, which accepts `Infinity`. Because each check is of the form `now > deadline + skew`, a skew of `Infinity` made it unsatisfiable and silently turned the check off: an expired CWT verified, a stale (post-nextUpdate) OCSP "good" response — the exact reply an attacker replays after the certificate is revoked — was accepted, and an expired ARC seal passed. A present clock-skew that is not a non-negative finite integer is now refused (b.cwt.verify throws cwt/bad-clock-skew; the OCSP and ARC paths fall back to their safe default). Regression tests assert an expired token / stale staple / expired ARC seal is still rejected when the skew is `Infinity`. · *WebSocket-client inbound caps can no longer be disabled by an Infinity value* — b.wsClient.connect validated maxMessageBytes, maxFrameBytes, and handshakeTimeoutMs (and the ping/pong keepalive intervals) with a bare numeric check that accepted `Infinity`, which disabled the inbound-message and frame size limits — the defenses against a malicious server sending an unbounded message — and the handshake timeout. A present non-finite value for these is now refused at connect time. The reconnect maxAttempts still accepts `Infinity` (a deliberate "reconnect indefinitely" intent). · *Inbox, flag-cache, and audit-chain caps reject a non-finite limit* — The inbox maxPayloadBytes / messageIdMaxLen / sourceMaxLen caps, the flag-cache ttlMs / maxEntries, and the audit-chain partition fan-out cap each accepted `Infinity`, disabling the cap (unbounded stored payloads, a never-expiring or unbounded cache, unbounded fan-out). These now require a positive finite integer — refused at create time, or clamped to the bounded default on the result-returning verify path. The inbox retentionDays still accepts `Infinity` (retain indefinitely).
+
 - v0.15.36 (2026-06-27) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** The codebase-patterns guard class that allows a bare comma/semicolon split on token-only RFC header grammars was re-verified from scratch and renamed to a descriptive token, with its old name recorded as retired. Each live marked site (RRULE, RFC 9421 component identifiers, TLS-RPT rua, SCIM attribute paths) was re-read and confirmed to split a grammar with no quoted-string members. Five marker comments that suppressed nothing were removed or turned into plain explanatory comments. No runtime code, public API, or wire format changed. **Detectors:** *Bare token-only header-split suppression class re-verified, renamed, and pruned of inert markers* — Each marked bare `.split(",")` / `.split(";")` on an RFC header value was re-read and confirmed to operate on a token-only grammar (no quoted-string members, so a quote-aware splitter is unnecessary): RFC 5545 RRULE, RFC 9421 signature component identifiers, RFC 8460 TLS-RPT rua, and RFC 7644 SCIM attribute paths. The guard class was renamed to a descriptive token and its old name added to the retired-token set. Five marker comments that the detector never actually evaluated (two sat on a date-normalizing `.replace`, three in header parsers the guard intentionally does not scan) were removed or converted to plain comments. This is test-suite tooling plus source-comment text; no shipped framework behavior changed.
 
 - v0.15.35 (2026-06-26) — **`b.metrics` shadow registry no longer lets a comma in a label value forge extra Prometheus label pairs — a label-injection that downstream tenant-scoping or authorization selectors could be tricked by.** The shadow registry serialized a metric's label set into a `name=value,name=value` string key and re-split it on `,` to build the Prometheus exposition. A label VALUE containing a comma therefore split into multiple label pairs, so a single operator-set label could forge additional label pairs in the scrape output (for example turning one `route` label into a `route` plus an attacker-named label), which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary; two distinct label sets could also collide into one cardinality bucket. The label key now uses canonical-JSON of the string-coerced label set (the same approach the main registry already used) and the render path emits the structured label set kept alongside that key rather than splitting or re-parsing, so a `,` or `=` inside a label value stays inside the value and a label NAMED `constructor`, `prototype`, or `__proto__` (all valid Prometheus label names) is preserved instead of being dropped. Note: the cardinality keys exposed by `shadowRegistry().snapshot()` are now canonical-JSON strings (e.g. `{"route":"/api"}`) rather than `route=/api`. **Changed:** *shadowRegistry().snapshot() cardinality keys are canonical-JSON* — As a consequence of the label-injection fix, the per-series cardinality keys in a shadow-registry snapshot are now canonical-JSON strings (e.g. `{"tenant":"a"}`) instead of the previous `tenant=a` form. Code that reads those keys directly from snapshot() should parse them as JSON; the Prometheus render output is unchanged for conforming label values. **Security:** *Label values can no longer forge extra Prometheus label pairs in the shadow registry* — b.metrics shadowRegistry built a metric's cardinality key by joining `name=value` pairs with commas, then split that string on commas when rendering the Prometheus exposition. A comma (and `=`) in a label value therefore broke one value into several forged label pairs in the scrape output, and two different label sets could collide into the same cardinality bucket. The key is now canonical-JSON of the string-coerced label set and the render emits the structured label set kept alongside that key rather than splitting or re-parsing, so a label value is emitted as a single quoted value with its commas/equals intact, distinct label sets get distinct keys, and a label NAMED `constructor`, `prototype`, or `__proto__` (each a valid Prometheus label name) is preserved rather than dropped. Deterministic regression tests assert a comma-bearing label value produces exactly one label pair and that the reserved-name labels survive render.

package/lib/agent-posture-chain.js

@@ -124,7 +124,7 @@ function create(opts) {
   var auditImpl = opts.audit || audit();
   var declaredRegimes = Object.create(null);
   for (var i = 0; i < BUILTIN_REGIMES.length; i += 1) declaredRegimes[BUILTIN_REGIMES[i]] = true;
-  // allow:numeric-opt-Infinity — operator opt clamped to [1, DEFAULT_MAX_HOP_COUNT]; bad input falls back to default
+  // allow:numeric-opt-Infinity-intentional — operator opt clamped to [1, DEFAULT_MAX_HOP_COUNT] (the `<= DEFAULT_MAX_HOP_COUNT` upper bound rejects Infinity); bad input falls back to default
   var maxHopCount = typeof opts.maxHopCount === "number" && opts.maxHopCount > 0 &&
                     opts.maxHopCount <= DEFAULT_MAX_HOP_COUNT
                       ? Math.floor(opts.maxHopCount)

package/lib/audit-chain.js

@@ -37,6 +37,7 @@ var canonicalJson = require("./canonical-json");
 var C = require("./constants");
 var clusterStorage = require("./cluster-storage");
 var frameworkSchema = require("./framework-schema");
+var numericBounds = require("./numeric-bounds");
 var sql = require("./sql");
 var safeSql = require("./safe-sql");
 var safeBuffer = require("./safe-buffer");
@@ -305,7 +306,10 @@ async function verifyChain(queryAllAsync, tableName, opts) {
     // coerce so a Postgres INTEGER/BIGINT chainKey is type-stable in the
     // reported break-shape and the per-key WHERE bind, matching SQLite.
     var keyRows = frameworkSchema.coerceRows(await queryAllAsync(keysBuilt.sql, keysBuilt.params));
-    var maxChains = (typeof opts.maxChains === "number" && opts.maxChains > 0) ? opts.maxChains : 100000;   // allow:numeric-opt-Infinity — partition fan-out cap; non-number / <=0 falls back to the default
+    // Partition fan-out cap; a non-finite / <= 0 / non-integer value (Infinity
+    // would make the `keyRows.length > maxChains` cap unsatisfiable) falls back
+    // to the bounded default rather than disabling the cap.
+    var maxChains = numericBounds.isPositiveFiniteInt(opts.maxChains) ? opts.maxChains : 100000;
     if (keyRows.length > maxChains) {
       return {
         ok:           false,

package/lib/cwt.js

@@ -39,6 +39,7 @@
 var cose = require("./cose");
 var cbor = require("./cbor");
 var C = require("./constants");
+var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -191,7 +192,11 @@ async function verify(cwt, opts) {
   }
 
   // Time claims (NumericDate, seconds). Skew tolerance both directions.
-  var skew = (typeof opts.clockSkewSec === "number" && opts.clockSkewSec >= 0) ? opts.clockSkewSec : 60;   // allow:numeric-opt-Infinity — clamped non-negative, else default / allow:raw-time-literal — clock-skew in seconds (NumericDate units), not a ms duration
+  // A present clockSkewSec must be a non-negative finite integer — an
+  // Infinity / NaN / negative skew would otherwise make `now > exp + skew`
+  // unsatisfiable and silently disable the expiry / not-before checks.
+  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.clockSkewSec, "cwt.verify: opts.clockSkewSec", CwtError, "cwt/bad-clock-skew");
+  var skew = (typeof opts.clockSkewSec === "number") ? opts.clockSkewSec : 60;   // allow:raw-time-literal — clock-skew in seconds (NumericDate units), not a ms duration
   var now = _nowSec(opts);
   // A present exp / nbf MUST be a well-formed NumericDate — a non-numeric
   // value would otherwise bypass the time check entirely (a token could

package/lib/external-db.js

@@ -1338,8 +1338,9 @@ async function transaction(fn, opts) {
   // (serialization_failure) are transient — retry with capped attempts
   // and a small jittered backoff. Operators tune retries via opts.deadlockRetries (default 3).
   // numeric-bounds doesn't have a non-negative-int helper; use a
-  // direct check with allow marker (zero is permitted to disable
-  // retries entirely).
+  // Explicit isFinite/integer guard (zero is permitted to disable retries
+  // entirely); a non-finite deadlockRetries is refused here, so Math.floor
+  // below only ever sees a validated finite integer.
   if (opts.deadlockRetries !== undefined) {
     if (typeof opts.deadlockRetries !== "number" || !isFinite(opts.deadlockRetries) ||
         opts.deadlockRetries < 0 || (opts.deadlockRetries | 0) !== opts.deadlockRetries) {
@@ -1348,7 +1349,7 @@ async function transaction(fn, opts) {
     }
   }
   var maxRetries = (typeof opts.deadlockRetries === "number")
-    ? Math.floor(opts.deadlockRetries) : 3;                                       // allow:numeric-opt-Infinity
+    ? Math.floor(opts.deadlockRetries) : 3;
   // Validate the transaction-level residency tag shape at entry (the
   // sessionGucs / deadlockRetries discipline) so an empty-string tag
   // fails before BEGIN rather than at the first statement.

package/lib/flag-cache.js

@@ -24,6 +24,7 @@
 var validateOpts = require("./validate-opts");
 var lazyRequire  = require("./lazy-require");
 var C            = require("./constants");
+var numericBounds = require("./numeric-bounds");
 var { defineClass } = require("./framework-error");
 var FlagError = defineClass("FlagError", { alwaysPermanent: true });
 
@@ -36,18 +37,17 @@ function cache(downstream, opts) {
     throw new FlagError("flag/bad-cache",
       "cache: downstream provider must implement .evaluate()");
   }
-  // allow:numeric-opt-Infinity — defaults clamped + ttl-floor enforced below
-  var ttlMs = (typeof opts.ttlMs === "number" && opts.ttlMs > 0)
-    ? opts.ttlMs
-    : C.TIME.seconds(30);
+  // A present ttlMs / maxEntries must be a positive finite integer — Infinity
+  // would pass a bare `typeof === "number" && > 0` check and give a
+  // never-expiring entry (ttlMs) or an unbounded cache (maxEntries).
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.ttlMs, "flag.cache: opts.ttlMs", FlagError, "flag/bad-cache");
+  var ttlMs = (typeof opts.ttlMs === "number") ? opts.ttlMs : C.TIME.seconds(30);
   if (ttlMs < C.TIME.seconds(1)) {
     throw new FlagError("flag/bad-cache",
       "cache: ttlMs must be >= 1000ms - got " + ttlMs);
   }
-  // allow:numeric-opt-Infinity — maxEntries default + Math.floor coerce; throws on bad type at config time
-  var maxEntries = (typeof opts.maxEntries === "number" && opts.maxEntries > 0)
-    ? Math.floor(opts.maxEntries)
-    : 10000;                                       // entry-count default
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxEntries, "flag.cache: opts.maxEntries", FlagError, "flag/bad-cache");
+  var maxEntries = (typeof opts.maxEntries === "number") ? opts.maxEntries : 10000;   // entry-count default
   var auditOn = opts.audit === true;            // off by default — too chatty
   var entries = new Map();
   var hits   = 0;

package/lib/flag-targeting.js

@@ -27,6 +27,8 @@
  */
 
 var validateOpts = require("./validate-opts");
+var lazyRequire = require("./lazy-require");
+var guardRegex = lazyRequire(function () { return require("./guard-regex"); });
 var { defineClass } = require("./framework-error");
 var FlagError = defineClass("FlagError", { alwaysPermanent: true });
 
@@ -171,8 +173,19 @@ function validateRules(rules, label) {
           throw new FlagError("flag/bad-condition",
             clabel + ".value: regex pattern must be <= 200 chars (DoS defense)");
         }
+        // The compiled regex is .test()'d against runtime attribute values, so a
+        // catastrophic-backtracking (ReDoS) pattern is a DoS vector. A length
+        // bound does NOT defend ReDoS (`(a+)+$` is 6 chars); screen the pattern
+        // through b.guardRegex first — it refuses nested-quantifier / alternation-
+        // quantifier / lookaround-quantifier shapes before compilation.
         try {
-          // allow:dynamic-regex — operator-supplied targeting pattern, length-bounded to 200 chars above
+          guardRegex().sanitize(cond.value, { profile: "strict" });
+        } catch (ge) {
+          throw new FlagError("flag/bad-condition",
+            clabel + ".value: regex pattern rejected as unsafe (ReDoS shape) - " + ge.message);
+        }
+        try {
+          // allow:dynamic-regex — operator targeting pattern, ReDoS-screened via guardRegex.sanitize (strict) + length-bounded to 200 chars above
           validatedCond._compiledRegex = new RegExp(cond.value);
         } catch (e) {
           throw new FlagError("flag/bad-condition",

package/lib/guard-regex.js

@@ -128,19 +128,68 @@ var DEFAULTS = gateContract.strictDefaults(PROFILES);
 
 var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256 });
 
+// Structural nested-unbounded-quantifier detector. NESTED_QUANT_RE is paren-
+// blind (its `[^()]*` can't span a nested group), so it misses WRAPPED forms
+// like `((a)+)+` / `(([a-z]+)*)*` / `((a+))+` — adding one extra group around
+// the inner quantifier bypasses the regex while the pattern stays catastrophic.
+// This linear scan tracks group nesting and flags an unbounded-quantified group
+// (`)+`, `)*`, `){n,}`) whose body itself contains an unbounded quantifier — the
+// two-nested-unbounded-quantifier ReDoS class — at any group depth. Bounded
+// repeats (`{n}`, `{n,m}`, `?`) are not unbounded, so they don't trip it (the
+// large-bound case is handled separately by maxBoundedRepeat).
+function _hasNestedQuantifier(src) {
+  var stack = [];        // open groups: each { quant } — body has an unbounded quantifier
+  var inClass = false;   // inside a [...] character class
+  var i = 0;
+  var n = src.length;
+  var UNBOUNDED_AFTER_GROUP = /^(?:[*+]\??|\{\d*,\})/;   // )+ )* )+? )*? ){n,}
+  while (i < n) {
+    var c = src.charAt(i);
+    if (c === "\\") { i += 2; continue; }                          // escaped atom — skip both chars
+    if (inClass) { if (c === "]") inClass = false; i += 1; continue; }
+    if (c === "[") { inClass = true; i += 1; continue; }
+    if (c === "(") { stack.push({ quant: false }); i += 1; continue; }
+    if (c === ")") {
+      var grp = stack.pop() || { quant: false };
+      var qm = UNBOUNDED_AFTER_GROUP.exec(src.slice(i + 1));       // allow:regex-no-length-cap — bounded slice of a maxPatternBytes-capped input
+      var closeUnbounded = qm !== null;
+      if (grp.quant && closeUnbounded) return true;               // nested unbounded quantifier → catastrophic
+      // The closing group contributes an unbounded quantifier to its PARENT's
+      // body if its own body had one, or if it is itself unbounded-quantified.
+      if (stack.length && (grp.quant || closeUnbounded)) stack[stack.length - 1].quant = true;
+      i += 1 + (qm ? qm[0].length : 0);
+      continue;
+    }
+    if (c === "*" || c === "+") {                                  // unbounded quantifier on the preceding atom
+      if (stack.length) stack[stack.length - 1].quant = true;
+      i += 1; continue;
+    }
+    if (c === "{") {
+      var open = /^\{\d*,\}/.exec(src.slice(i));                  // allow:regex-no-length-cap — bounded slice // {n,} unbounded
+      if (open) { if (stack.length) stack[stack.length - 1].quant = true; i += open[0].length; continue; }
+      var bounded = /^\{\d+(?:,\d+)?\}/.exec(src.slice(i));       // allow:regex-no-length-cap — bounded slice // {n} / {n,m} bounded
+      if (bounded) { i += bounded[0].length; continue; }
+      i += 1; continue;                                            // literal `{`
+    }
+    i += 1;
+  }
+  return false;
+}
+
 
 function _detectIssues(input, opts) {
   var pre = gateContract.detectStringInput(input, opts, { name: "regex", noun: "regex pattern", cap: { bytes: opts.maxPatternBytes, kind: "pattern-cap", snippet: "regex pattern exceeds maxPatternBytes " + opts.maxPatternBytes } });
   if (pre.done) return pre.issues;
   var issues = pre.issues;
 
-  if (opts.nestedQuantPolicy !== "allow" && NESTED_QUANT_RE.test(input)) {       // allow:regex-no-length-cap — input bounded by maxPatternBytes
+  if (opts.nestedQuantPolicy !== "allow" &&
+      (NESTED_QUANT_RE.test(input) || _hasNestedQuantifier(input))) {            // allow:regex-no-length-cap — input bounded by maxPatternBytes
     issues.push({
       kind: "nested-quantifier", severity: "critical",
       ruleId: "regex.nested-quantifier",
       snippet: "pattern contains nested-quantifier shape (e.g. " +
-               "`(a+)+`) — canonical ReDoS catastrophic-backtracking " +
-               "class (CVE-2024-21538 cross-spawn / CVE-2022-25929)",
+               "`(a+)+` / `((a)+)+`) — canonical ReDoS catastrophic-" +
+               "backtracking class (CVE-2024-21538 cross-spawn / CVE-2022-25929)",
     });
   }
 

package/lib/inbox.js

@@ -44,6 +44,7 @@
 
 var C = require("./constants");
 var codepointClass = require("./codepoint-class");
+var numericBounds = require("./numeric-bounds");
 var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var safeSql = require("./safe-sql");
@@ -155,15 +156,17 @@ function create(opts) {
   // The table identifier reaches SQL through b.sql, which validates +
   // quotes it by construction on every emitted statement; _validateTableName
   // above fails fast at create() time on a bad name.
-  var retentionDays  = (typeof opts.retentionDays === "number" && opts.retentionDays > 0)        // allow:numeric-opt-Infinity
+  var retentionDays  = (typeof opts.retentionDays === "number" && opts.retentionDays > 0)        // allow:numeric-opt-Infinity-intentional — Infinity = retain indefinitely, a supported intent
     ? opts.retentionDays : 30;                                                                   // default retention days
   var auditOn        = opts.audit !== false;
-  var maxPayloadBytes = (typeof opts.maxPayloadBytes === "number" && opts.maxPayloadBytes > 0)   // allow:numeric-opt-Infinity
-    ? opts.maxPayloadBytes : C.BYTES.kib(64);
-  var messageIdMaxLen = (typeof opts.messageIdMaxLen === "number" && opts.messageIdMaxLen > 0)   // allow:numeric-opt-Infinity
-    ? opts.messageIdMaxLen : 256;                                                                // message-id length cap
-  var sourceMaxLen = (typeof opts.sourceMaxLen === "number" && opts.sourceMaxLen > 0)            // allow:numeric-opt-Infinity
-    ? opts.sourceMaxLen : 256;                                                                   // source length cap
+  // The byte / length caps must be positive finite integers — Infinity would
+  // disable the cap and admit unbounded stored payloads / identifiers.
+  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
+    ["maxPayloadBytes", "messageIdMaxLen", "sourceMaxLen"],
+    "inbox.create", InboxError, "inbox/bad-opt");
+  var maxPayloadBytes = (typeof opts.maxPayloadBytes === "number") ? opts.maxPayloadBytes : C.BYTES.kib(64);
+  var messageIdMaxLen = (typeof opts.messageIdMaxLen === "number") ? opts.messageIdMaxLen : 256;   // message-id length cap
+  var sourceMaxLen = (typeof opts.sourceMaxLen === "number") ? opts.sourceMaxLen : 256;            // source length cap
 
   function _emitAudit(action, outcome, metadata) {
     if (!auditOn) return;
@@ -346,6 +349,14 @@ function create(opts) {
   }
 
   async function sweep() {
+    // retentionDays: Infinity is the documented "retain indefinitely" intent —
+    // there is no horizon to age past, so sweep deletes nothing. (Computing a
+    // cutoff would otherwise throw: `new Date(Date.now() - Infinity)` is an
+    // Invalid Date, and "Infinity days" is not a valid Postgres interval.)
+    if (!isFinite(retentionDays)) {
+      _emitAudit("inbox.swept", "success", { deleted: 0, retentionDays: retentionDays });
+      return 0;
+    }
     var dialect = _sqlDialect(externalDb);
     var deleted = 0;
     await externalDb.transaction(async function (xdb) {

package/lib/mail-arc-sign.js

@@ -51,6 +51,7 @@
 var nodeCrypto = require("node:crypto");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
+var numericBounds = require("./numeric-bounds");
 var safeBuffer = require("./safe-buffer");
 var dkim = require("./mail-dkim");
 var { defineClass } = require("./framework-error");
@@ -246,8 +247,11 @@ function sign(opts) {
         "sign: headersToSign[" + hi + "] must be a non-empty string");
     }
   }
-  var timestamp = (typeof opts.timestamp === "number" && opts.timestamp > 0)            // allow:numeric-opt-Infinity
-    ? Math.floor(opts.timestamp) : Math.floor(Date.now() / 1000);                       // Unix epoch seconds divisor
+  // A present t= timestamp must be a positive finite integer (NumericDate
+  // seconds) — an Infinity / NaN value would serialize into a malformed t= tag.
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.timestamp, "arc.sign: opts.timestamp", MailAuthError, "arc-sign/bad-timestamp");
+  var timestamp = (typeof opts.timestamp === "number")
+    ? opts.timestamp : Math.floor(Date.now() / 1000);                                   // Unix epoch seconds divisor
   var auditOn = opts.audit !== false;
 
   var keyObject;

package/lib/mail-auth.js

@@ -52,6 +52,7 @@ var structuredFields = require("./structured-fields");
 var markupEscape = require("./markup-escape").markupEscape;
 var bCrypto = require("./crypto");
 var C = require("./constants");
+var numericBounds = require("./numeric-bounds");
 var dkim = require("./mail-dkim");
 var mimeParse = require("./mime-parse");
 var safeXml = require("./parsers/safe-xml");
@@ -1575,7 +1576,11 @@ async function arcVerify(rfc822, opts) {
   var anyFail = false;
   // RFC 8617 §5.2 — operator-tunable clock skew on t= (signing
   // timestamp) and x= (expiration) tags. Default 5 min.
-  var arcClockSkewMs = typeof opts.clockSkewMs === "number" && opts.clockSkewMs >= 0           // allow:numeric-opt-Infinity — operator-supplied skew, default 5 min
+  // A present clockSkewMs must be a non-negative finite integer; an Infinity /
+  // NaN / negative skew makes `amsX + skewSec < nowSec` (and the t= future
+  // check) unsatisfiable and silently disables the RFC 8617 §5.2 expiry /
+  // future-timestamp gate. Non-finite falls to the default.
+  var arcClockSkewMs = numericBounds.isNonNegativeFiniteInt(opts.clockSkewMs)
     ? opts.clockSkewMs : C.TIME.minutes(5);
   var nowSec = Math.floor(Date.now() / 1000);                                                  // Unix epoch seconds divisor
 

package/lib/mcp.js

@@ -37,6 +37,8 @@ var safeJson = require("./safe-json");
 var safeBuffer = require("./safe-buffer");
 var requestHelpers = require("./request-helpers");
 var audit = require("./audit");
+var lazyRequire = require("./lazy-require");
+var guardRegex = lazyRequire(function () { return require("./guard-regex"); });
 var { McpError } = require("./framework-error");
 
 var TOOL_NAME_MAX     = 64;                                                                  // string-length cap, not bytes
@@ -642,8 +644,14 @@ function _validateValueAgainstSchema(value, schema, path) {
       // cost scales with the number of code units the engine scans, so 4096
       // chars is the correct ReDoS bound regardless of UTF-8 byte size.
       if (value.length > 4096) return path + ": value exceeds 4096-char cap before regex test";    // ReDoS char cap (not bytes)
+      // The input-length cap above does NOT bound catastrophic backtracking
+      // (a `(a+)+$` pattern blows up at ~40 input chars). Screen the tool
+      // author's pattern through b.guardRegex so a ReDoS-shaped schema pattern
+      // can't pin a CPU when matched against request input.
+      try { guardRegex().sanitize(schema.pattern, { profile: "strict" }); }
+      catch (_ge) { return path + ": schema pattern rejected as unsafe (ReDoS shape)"; }
       try {
-        var pat = new RegExp(schema.pattern);                                                    // allow:dynamic-regex — schema.pattern from registered tool author, not request input; bounded above
+        var pat = new RegExp(schema.pattern);                                                    // allow:dynamic-regex — schema.pattern is ReDoS-screened via guardRegex.sanitize (strict) above + input length-capped
         if (!pat.test(value)) return path + ": does not match pattern";
       }
       catch (_e) { return path + ": invalid pattern in schema"; }

package/lib/middleware/age-gate.js

@@ -101,9 +101,9 @@ function create(opts) {
       "middleware.ageGate: opts.getAge must be a function (req) -> number | null");
   }
   var getAge = opts.getAge;
-  var requireAge = (typeof opts.requireAge === "number" && opts.requireAge > 0)            // allow:numeric-opt-Infinity — age is operator domain, not a bytes/time-shaped opt
+  var requireAge = (typeof opts.requireAge === "number" && opts.requireAge > 0)            // allow:numeric-opt-Infinity-intentional — age threshold; an Infinity bound is fail-closed (denies everyone), never a bypass
     ? opts.requireAge : null;
-  var consentRequired = (typeof opts.consentRequired === "number" && opts.consentRequired > 0)  // allow:numeric-opt-Infinity — age threshold, not a bytes/time-shaped opt
+  var consentRequired = (typeof opts.consentRequired === "number" && opts.consentRequired > 0)  // allow:numeric-opt-Infinity-intentional — age threshold; an Infinity bound is fail-closed (classifies everyone below-threshold), never a bypass
     ? opts.consentRequired : null;
   var hasParentalConsent = typeof opts.hasParentalConsent === "function" ? opts.hasParentalConsent : null;
   var skipPaths = Array.isArray(opts.skipPaths) ? opts.skipPaths.slice() : [];

package/lib/network-tls.js

@@ -1204,7 +1204,11 @@ function evaluateOcspResponse(ocspDer, opts) {
   // gets revoked, the attacker keeps presenting the cached "good" and
   // the framework keeps accepting it. requireGood postures depend on
   // freshness — reject expired or future-dated responses outright.
-  var clockSkewMs = typeof opts.clockSkewMs === "number" && opts.clockSkewMs >= 0           // allow:numeric-opt-Infinity — operator-supplied skew, default 5 min if absent or invalid
+  // A present clockSkewMs must be a non-negative finite integer; an Infinity /
+  // NaN / negative skew would make the staleness check `now > nextUpdate + skew`
+  // unsatisfiable and silently disable the freshness window — accepting a
+  // replayed pre-revocation "good" response. Non-finite falls to the default.
+  var clockSkewMs = numericBounds.isNonNegativeFiniteInt(opts.clockSkewMs)
     ? opts.clockSkewMs : C.TIME.minutes(5);
   var now = typeof opts.now === "number" ? opts.now : Date.now();
   // thisUpdate / nextUpdate are already unix-ms NUMBERS (parseOcspResponse →

package/lib/ws-client.js

@@ -52,6 +52,7 @@ var { EventEmitter } = require("node:events");
 
 var lazyRequire    = require("./lazy-require");
 var validateOpts   = require("./validate-opts");
+var numericBounds  = require("./numeric-bounds");
 var safeAsync      = require("./safe-async");
 var safeBuffer     = require("./safe-buffer");
 var bCrypto        = lazyRequire(function () { return require("./crypto"); });
@@ -217,16 +218,18 @@ function connect(target, opts) {
         "wsClient.connect: subprotocols[" + sp + "] must be a non-empty string");
     }
   }
-  var pingMs = (typeof opts.pingMs === "number" && opts.pingMs > 0)              // allow:numeric-opt-Infinity
-    ? opts.pingMs : DEFAULT_PING_MS;
-  var pongMs = (typeof opts.pongMs === "number" && opts.pongMs > 0)              // allow:numeric-opt-Infinity
-    ? opts.pongMs : DEFAULT_PONG_MS;
-  var maxMessageBytes = (typeof opts.maxMessageBytes === "number" && opts.maxMessageBytes > 0)   // allow:numeric-opt-Infinity
-    ? opts.maxMessageBytes : DEFAULT_MAX_BYTES;
-  var maxFrameBytes = (typeof opts.maxFrameBytes === "number" && opts.maxFrameBytes > 0)         // allow:numeric-opt-Infinity
-    ? opts.maxFrameBytes : DEFAULT_MAX_FRAME;
-  var handshakeTimeoutMs = (typeof opts.handshakeTimeoutMs === "number" && opts.handshakeTimeoutMs > 0)  // allow:numeric-opt-Infinity
-    ? opts.handshakeTimeoutMs : DEFAULT_HANDSHAKE_TIMEOUT_MS;
+  // These are keepalive/timeout intervals and inbound-OOM caps; a present
+  // value must be a positive finite integer. A bare `typeof === "number" && > 0`
+  // check accepts Infinity, which silently disables the cap (a malicious server
+  // could then send an unbounded message/frame, or stall the handshake forever).
+  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
+    ["pingMs", "pongMs", "maxMessageBytes", "maxFrameBytes", "handshakeTimeoutMs"],
+    "wsClient.connect", WsClientError, "ws-client/bad-opt");
+  var pingMs = (typeof opts.pingMs === "number") ? opts.pingMs : DEFAULT_PING_MS;
+  var pongMs = (typeof opts.pongMs === "number") ? opts.pongMs : DEFAULT_PONG_MS;
+  var maxMessageBytes = (typeof opts.maxMessageBytes === "number") ? opts.maxMessageBytes : DEFAULT_MAX_BYTES;
+  var maxFrameBytes = (typeof opts.maxFrameBytes === "number") ? opts.maxFrameBytes : DEFAULT_MAX_FRAME;
+  var handshakeTimeoutMs = (typeof opts.handshakeTimeoutMs === "number") ? opts.handshakeTimeoutMs : DEFAULT_HANDSHAKE_TIMEOUT_MS;
 
   var reconnectOpts = _normaliseReconnect(opts.reconnect);
   var permessageDeflate = opts.permessageDeflate !== false;
@@ -281,14 +284,18 @@ function _normaliseReconnect(input) {
       "wsClient.connect: reconnect must be false / null / object");
   }
   validateOpts(input, ["maxAttempts", "baseMs", "maxMs", "enabled"], "wsClient.connect.reconnect");
+  // baseMs / maxMs are backoff durations; a present value must be a positive
+  // finite integer (an Infinity base would stall the first reconnect forever).
+  numericBounds.requireAllPositiveFiniteIntIfPresent(input, ["baseMs", "maxMs"],
+    "wsClient.connect.reconnect", WsClientError, "ws-client/bad-reconnect-opt");
   return {
     enabled:     input.enabled !== false,
-    maxAttempts: (typeof input.maxAttempts === "number" && input.maxAttempts >= 0)            // allow:numeric-opt-Infinity
+    // maxAttempts: Infinity is a deliberate "reconnect indefinitely" intent, so
+    // a non-finite value is accepted here (unlike the bounded caps above).
+    maxAttempts: (typeof input.maxAttempts === "number" && input.maxAttempts >= 0)            // allow:numeric-opt-Infinity-intentional — Infinity = reconnect indefinitely, a supported intent
       ? input.maxAttempts : DEFAULT_RECONNECT_MAX_ATTEMPTS,
-    baseMs:      (typeof input.baseMs === "number" && input.baseMs > 0)                       // allow:numeric-opt-Infinity
-      ? input.baseMs : DEFAULT_RECONNECT_BASE_MS,
-    maxMs:       (typeof input.maxMs === "number" && input.maxMs > 0)                         // allow:numeric-opt-Infinity
-      ? input.maxMs : DEFAULT_RECONNECT_MAX_MS,
+    baseMs:      (typeof input.baseMs === "number") ? input.baseMs : DEFAULT_RECONNECT_BASE_MS,
+    maxMs:       (typeof input.maxMs === "number") ? input.maxMs : DEFAULT_RECONNECT_MAX_MS,
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.36",
+  "version": "0.15.38",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:88f8b769-23a3-43f0-824e-6239b53c0528",
+  "serialNumber": "urn:uuid:742c0889-e56f-4bee-8220-91a6cac8307b",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-27T08:05:51.707Z",
+    "timestamp": "2026-06-27T16:52:08.760Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.36",
+      "bom-ref": "@blamejs/core@0.15.38",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.36",
+      "version": "0.15.38",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.36",
+      "purl": "pkg:npm/%40blamejs/core@0.15.38",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.36",
+      "ref": "@blamejs/core@0.15.38",
       "dependsOn": []
     }
   ]