@blamejs/core 0.16.16 → 0.16.17

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.17 (2026-07-12) — **Reject INI float literals that overflow to Infinity, return a verdict (not an exception) when a reverse-DNS lookup faults, wrap an async redirect-hook rejection like a sync throw, and refuse a fractional --max-rows — four defects surfaced by covering previously-untested error branches.** Covering previously-untested error and adversarial branches across four primitives surfaced four genuine defects, each fixed at the root. b.parsers.ini.parse coerced a value like `x = 1e999` straight to ±Infinity — its integer and hex branches already reject out-of-range numbers, but the float branch had no finiteness guard, so an overflowing float slipped through and could poison a downstream size cap or timeout; it is now rejected with ini/value-out-of-range. b.mail.iprev.verify threw an unhandled exception when the forward-confirm DNS lookup returned an error code outside the handful it enumerated (EREFUSED / ENOTIMP / …), even though its reverse-lookup path and every sibling (SPF/DKIM/DMARC/ARC) return a verdict for such faults; it now returns a temperror verdict, and — like those siblings — accepts an operator opts.dnsLookup resolver so the confirm path is resolvable offline. b.httpClient wrapped a synchronous onRedirect hook throw into a REDIRECT_ABORTED error but let an async hook rejection escape unwrapped; both now abort the redirect identically. And the blamejs audit verify-chain --max-rows flag accepted a fractional value (2.5), which truncated the chain walk mid-row and reported a nonsensical fractional count; it now requires a whole positive integer, matching its own error message. **Fixed:** *b.parsers.ini.parse rejects an overflowing float instead of coercing to Infinity* — A float literal that exceeds the representable range (e.g. `x = 1e999`) coerced to ±Infinity. The integer and hex coercion branches already reject out-of-range numbers via Number.isSafeInteger, but the float branch returned Number(raw) with no finiteness check — so an Infinity could flow into a downstream size cap or timeout, a denial-of-service vector. The float branch now rejects a non-finite result with ini/value-out-of-range; a large-but-finite float (1e308) and underflow (1e-999 → 0) still parse. · *b.mail.iprev.verify returns a temperror verdict on an un-enumerated reverse/forward DNS fault* — The forward-confirm DNS lookup's error handler enumerated a few transient codes and threw for anything else, so a resolver returning EREFUSED / ENOTIMP / EBADRESP produced an unhandled exception from the public API rather than a verdict. The reverse-lookup path and every sibling result type (SPF / DKIM / DMARC / ARC) return a verdict for a DNS-derived fault; the forward path now does too (temperror). iprev.verify also gains an operator opts.dnsLookup resolver, matching the dnsLookup contract the other types already honor, so the forward-confirm path is resolvable offline. · *b.httpClient aborts a redirect on an async onRedirect hook rejection* — A synchronous throw from the onRedirect hook was wrapped into a REDIRECT_ABORTED error, but an async hook that rejected let the rejection escape unwrapped — inconsistent handling for the same operator control point. An async onRedirect rejection now aborts the redirect with REDIRECT_ABORTED, identical to the synchronous throw. · *blamejs audit verify-chain --max-rows requires a whole positive integer* — The --max-rows flag validated only that the value was finite and >= 1, so a fractional value (2.5) was accepted and passed to the chain walk, where it truncated the verification mid-row and reported a fractional rowsVerified count — despite the flag's own error message promising a positive integer. It now rejects a non-integer value, matching the sibling --steps flag.
+
 - v0.16.16 (2026-07-12) — **Build the data-subject-request ticket store's SQL through the shared b.sql query builder instead of hand-assembled statements, and add a static check that keeps db-handle primitives composing b.sql.** A maintainability change with no behavior difference for operators. The b.dsr ticket store built its reads and writes by concatenating table and column names into SQL strings passed to db.prepare, re-implementing the identifier quoting and sealed-field handling that b.sql — the same builder b.db.from() uses — already provides. That hand-rolled shape is how b.tenant.quota's storage query drifted from the query builder and accrued a run of parity defects fixed in 0.16.15 (reserved-word names, schema-qualified names, sealed-column filtering). The store's DML now composes b.sql (its schema DDL, which is not a b.sql concern, stays as direct statements), so its SQL cannot diverge from the builder. A new codebase-patterns check flags any db-handle primitive that passes an inline SELECT / INSERT / UPDATE / DELETE string literal to db.prepare / runSql, directing it to compose b.sql instead, so this class of drift cannot recur. **Changed:** *b.dsr ticket store composes b.sql for its reads and writes* — The data-subject-request ticket store (insert / get / list / update / delete / purge and the legacy re-seal backfill) now builds its DML with the b.sql query builder — sql.select / insert / update / delete(table, { dialect, quoteName }).…toSql() — and prepares the resulting statement, rather than concatenating identifiers into SQL strings by hand. This removes a hand-rolled identifier-quoting surface that could drift from what b.db.from() accepts. Schema provisioning (CREATE TABLE / INDEX, ALTER, PRAGMA) is not a b.sql concern and remains as direct statements. One behavior change: on a store backed by a vault, a ticket payload is AEAD-sealed and base64-encoded (~4/3 expansion) before it is bound, and the bound cell must fit the query builder's 64 MiB per-value ceiling — so the payload is now capped at an expansion-safe plaintext size (~48 MiB) and a larger ticket is refused with dsr/ticket-too-large (route large access/portability exports through chunked storage rather than one giant sealed cell). Plaintext stores keep the full 64 MiB limit. When a vault is first enabled on a table that already holds an over-cap legacy plaintext row, the one-time re-seal backfill still migrates that row's subject columns and derived hashes — so it stays findable by subject lookup and erasable by the data-subject erasure purge — and leaves only the over-cap payload plaintext (still under the read ceiling, DB-encrypted at rest, and removed when the row is erased), rather than failing provisioning with a query-builder error. **Detectors:** *Static check: db-handle primitives must compose b.sql for DML* — A new codebase-patterns check flags any primitive holding a db handle that runs DML by passing an inline SELECT / INSERT / UPDATE / DELETE string literal to db.prepare / runSql — the shape that lets a query drift from b.sql's identifier quoting and sealed-field rewrite (the b.tenant.quota storage defect class). It directs authors to build the query with b.sql and prepare the resulting string. DDL and PRAGMA (not b.sql verbs) and queries already built through a b.sql variable are out of scope.
 
 - v0.16.15 (2026-07-11) — **Restore break-glass certificate key escrow, hand a failed production-security assertion its real diagnostic message, and make tenant storage-byte quotas actually enforce — three defects surfaced by broadening test coverage and fixed at the root.** Three primitives had defects that only a hostile or previously-untested path reached. b.cert key escrow — the optional break-glass path that seals a renewed private key to an operator's offline recipient — never worked: writeEscrow called a b.crypto method that does not exist, so any certificate configured with keyEscrow threw the moment renewal tried to seal the key. It now seals via b.crypto.encrypt (ML-KEM-1024, plus the P-384 hybrid leg when the recipient supplies an ecPublicKey) and the operator recovers the key offline with b.crypto.decrypt; the recipient accepts an ML-KEM-1024 public-key PEM string or a { publicKey, ecPublicKey } pair from b.crypto.generateEncryptionKeyPair(). b.security.assertProduction constructed its error with the code and message transposed, so a failed production-security assertion threw with a bare token (BAD_OPT / ASSERT_FAILED) as its .message and buried the human-readable explanation in .code — operators now get the full diagnostic where they read it. And b.tenant.quota storage-byte accounting was broken several ways: the per-tenant byte sum issued a query the builder rejects, so snapshot / assert / list always threw once a storage cap was set; it read rows through the auto-unsealing ORM, so a sealed column was measured as its small decrypted plaintext rather than the larger on-disk vault envelope (letting sealed-column tenants slip under the cap); when the tenant identifier itself was a sealed column, the plaintext lookup matched no rows at all and the cap silently counted zero; and BLOB columns (handed back as Uint8Array by node:sqlite) were stringified before measuring, roughly tripling their counted size and refusing writes far below the real cap. All are fixed — the sum now filters a sealed tenant id by its derived-hash blind index, reads the raw stored rows, and measures true on-disk byte lengths — so storage quotas enforce at the configured limit. **Fixed:** *b.cert break-glass key escrow seals the renewed key instead of throwing* — A certificate configured with keyEscrow forwarded the private key to writeEscrow, which called a b.crypto.encryptEnvelope method that does not exist — so escrow threw on every renewal and the break-glass recovery path was unusable. It now seals the key to the operator's offline recipient with b.crypto.encrypt: ML-KEM-1024 always, plus a P-384 hybrid leg when the recipient carries an ecPublicKey. The recipient accepts an ML-KEM-1024 public-key PEM string or a { publicKey, ecPublicKey } pair from b.crypto.generateEncryptionKeyPair(); the sealed key is never decrypted by the framework and is recovered offline with b.crypto.decrypt and the matching private key(s). · *b.security.assertProduction throws with the diagnostic in .message* — SecurityAssertError was constructed with its code and message arguments transposed, so a failed production-security assertion surfaced a bare token (BAD_OPT / ASSERT_FAILED) as its .message while the explanatory text — including the per-assertion failure list — landed in .code. Operators catching the error now read the full diagnostic in .message and the stable token in .code, as documented. · *b.tenant.quota enforces storage-byte caps at the configured limit* — The per-tenant storage-bytes accounting had several defects. It issued a query the query builder rejects (a literal '*' column), so snapshot / assert / list threw as soon as a storage cap was configured — the storage half of tenant quotas never ran against a real database. It read rows through the ORM, which auto-unseals sealed columns, so a sealed cell was measured as its small decrypted plaintext rather than the much larger vault envelope actually on disk — a tenant whose data lives in sealed columns could sail under the cap. When the tenant identifier column itself was sealed, the plaintext lookup compared against the on-disk envelope and matched no rows, so the cap silently counted zero for those tenants. And BLOB columns, which node:sqlite returns as a Uint8Array rather than a Node Buffer, were stringified before measuring: String(uint8array) is the decimal-joined bytes, roughly a 3x overcount that refused writes well below the real cap. The sum now filters a sealed tenant identifier by its derived-hash blind index (as the query builder does), reads the raw stored rows (no unseal), and counts text as its UTF-8 byte length and typed-array views by their true byte length, so a storage cap — including data in sealed columns — enforces at the limit operators set.

package/lib/cli.js

@@ -713,7 +713,14 @@ async function _runAudit(args, ctx) {
     var tableV = args.flags.table ? String(args.flags.table) : "audit_log";
     var maxRows = args.flags["max-rows"];
     var maxRowsN = maxRows === undefined ? undefined : Number(maxRows);
-    if (maxRowsN !== undefined && (!Number.isFinite(maxRowsN) || maxRowsN < 1)) {
+    // Positive-INTEGER validation, mirroring `migrate down --steps`: reject
+    // NaN/Infinity, < 1, AND any fractional value. The message promises "a
+    // positive integer", so a value like 2.5 must be refused here at the
+    // entry point rather than passed to verifyChain, where a fractional
+    // maxRows truncates the walk mid-chain and reports a nonsensical
+    // fractional rowsVerified (Math.min(rows.length, 2.5)).
+    if (maxRowsN !== undefined &&
+        (!Number.isFinite(maxRowsN) || maxRowsN < 1 || Math.floor(maxRowsN) !== maxRowsN)) {
       _writeLine(ctx.stderr, "blamejs audit verify-chain: --max-rows must be a positive integer");
       return 2;
     }

package/lib/http-client.js

@@ -1358,14 +1358,21 @@ function _requestWithRedirects(opts, hopsLeft) {
           headersStripped: headersStripped,
           method:          nextMethod,
         });
+        function _redirectAborted(e) {
+          return Promise.reject(_makeError(opts.errorClass, "REDIRECT_ABORTED",
+            "onRedirect hook refused redirect: " + ((e && e.message) || String(e)), true));
+        }
         try {
           var hookResult = onRedirect(hookEvent);
           if (hookResult && typeof hookResult.then === "function") {
-            return hookResult.then(function () { return _continueFollow(); });
+            // An async hook's rejection must abort the follow with the SAME
+            // REDIRECT_ABORTED shape a sync throw produces — otherwise an
+            // operator who awaits inside the hook (or returns a rejected
+            // Promise) silently gets an un-coded raw rejection instead.
+            return hookResult.then(function () { return _continueFollow(); }, _redirectAborted);
           }
         } catch (e) {
-          return Promise.reject(_makeError(opts.errorClass, "REDIRECT_ABORTED",
-            "onRedirect hook refused redirect: " + ((e && e.message) || String(e)), true));
+          return _redirectAborted(e);
         }
       }
       return _continueFollow();

package/lib/mail-auth.js

@@ -197,7 +197,7 @@ async function _safeResolveMx(qname, operatorLookup) {
   return entries.map(function (e) { return e.exchange; });
 }
 
-async function _safeReverse(ip) {
+async function _safeReverse(ip, operatorLookup) {
   // PTR query against the reverse-arpa name. IPv4: a.b.c.d.in-addr.arpa
   // (reversed octets); IPv6: nibble-reversed under ip6.arpa.
   var qname = _ipToReverseArpa(ip);
@@ -206,6 +206,30 @@ async function _safeReverse(ip) {
     err.code = "ENOTFOUND";
     throw err;
   }
+  // Operator-supplied resolver: the callback receives the reverse-arpa
+  // qname (the same name a real resolver queries) and returns the
+  // documented flat PTR-name array. Threading it here makes the iprev
+  // forward-confirm path operator-mockable, matching the dnsLookup
+  // contract every other type in this file already honors.
+  if (operatorLookup) {
+    var resp = await operatorLookup(qname, "PTR");
+    if (!Array.isArray(resp) || resp.length === 0) {
+      var perr = new Error("no PTR records for " + ip);
+      perr.code = "ENODATA";
+      throw perr;
+    }
+    var names = [];
+    for (var pi = 0; pi < resp.length; pi += 1) {
+      var nm = String(resp[pi]).replace(/\.$/, "");
+      if (nm.length > 0) names.push(nm);
+    }
+    if (names.length === 0) {
+      var perr2 = new Error("no PTR records for " + ip);
+      perr2.code = "ENODATA";
+      throw perr2;
+    }
+    return names;
+  }
   var r = await _getDefaultResolver().query(qname, "PTR");
   var out = [];
   for (var i = 0; i < r.rrs.length; i += 1) {
@@ -2864,13 +2888,22 @@ function dmarcBuildAggregateReport(report, opts) {
 // Authentication-Results header so downstream policies can react.
 //
 // Surface:
-//   await b.mail.iprev.verify(ip)
+//   await b.mail.iprev.verify(ip, opts?)
 //   → { result: "pass"|"fail"|"permerror"|"temperror",
 //       ptr, forward, fcrdns, ip }
 //
-// Returns "permerror" on bad-shape input (not an IP literal); returns
-// "temperror" on ENODATA / ENOTFOUND / lookup failure (the receiver
-// retries on transient DNS faults). Pure-DNS — no operator state.
+// Returns "permerror" on bad-shape input (not an IP literal, or a PTR
+// whose rdata isn't a valid DNS name). A definitive negative answer
+// (no PTR record, or the PTR forward-resolves to a set that omits the
+// connecting IP) is a "fail"; a transient resolver fault (SERVFAIL,
+// timeout, or any non-negative error code) is a "temperror" the
+// receiver retries on. Every path RETURNS a verdict object — the
+// primitive never throws on a message- or DNS-derived fault.
+//
+// DNS defaults to b.network.dns.resolver; an operator `opts.dnsLookup`
+// callback overrides it (same shape as the rest of this file — the PTR
+// query receives the reverse-arpa qname; the forward query the PTR
+// name), so a receiver can unit-test the forward-confirm decision.
 
 // RFC 8601 §3 — PTR result shape. The PTR rdata is an FQDN (1*labels).
 // Reject answers that aren't shaped as a DNS name: non-strings,
@@ -2897,7 +2930,10 @@ function _isValidPtrName(name) {
   return true;
 }
 
-async function iprevVerify(ip) {
+async function iprevVerify(ip, opts) {
+  opts = opts || {};
+  validateOpts(opts, ["dnsLookup"], "mail.iprev.verify");
+  var dnsLookup = opts.dnsLookup;
   if (typeof ip !== "string" || ip.length === 0) {
     return { result: "permerror", ip: ip || null,
              ptr: null, forward: [], fcrdns: false,
@@ -2910,7 +2946,7 @@ async function iprevVerify(ip) {
   }
 
   var ptrs;
-  try { ptrs = await _safeReverse(ip); }
+  try { ptrs = await _safeReverse(ip, dnsLookup); }
   catch (e) {
     var rcode = e && e.code;
     if (rcode === "ENOTFOUND" || rcode === "ENODATA") {
@@ -2942,7 +2978,7 @@ async function iprevVerify(ip) {
   var isV6 = net.isIPv6(ip);
   var forwardAddrs;
   try {
-    forwardAddrs = await _safeResolveA(ptr, isV6 ? 6 : 4);
+    forwardAddrs = await _safeResolveA(ptr, isV6 ? 6 : 4, dnsLookup);
   } catch (e) {
     var fcode = e && e.code;
     if (fcode === "ENOTFOUND" || fcode === "ENODATA") {
@@ -2950,23 +2986,32 @@ async function iprevVerify(ip) {
                ptr: ptr, forward: [], fcrdns: false,
                explanation: "no forward record for PTR " + ptr };
     }
-    if (fcode === "ETIMEOUT" || fcode === "ESERVFAIL") {
-      return { result: "temperror", ip: ip,
-               ptr: ptr, forward: [], fcrdns: false,
-               explanation: "forward lookup transient failure: " + fcode };
-    }
-    // Anything else — propagate as temperror; Node DNS surfaces some
-    // non-RFC error codes via the platform resolver. Permerror only
-    // for definitive negative answers above.
-    throw new MailAuthError("mail-auth/iprev-temperror",
-      "iprev.verify: forward lookup of " + ptr + " threw: " +
-      ((e && e.message) || String(e)));
+    // Every non-negative fault (SERVFAIL, timeout, or any other
+    // platform-resolver code) is transient — RETURN a temperror verdict,
+    // mirroring the reverse-lookup catch above. Throwing here broke the
+    // primitive's contract that every message/DNS-derived fault surfaces
+    // as a verdict object: a caller of the documented API got an
+    // exception on e.g. an EREFUSED forward fault. Only the definitive
+    // negative answers above (no forward record) are a "fail".
+    return { result: "temperror", ip: ip,
+             ptr: ptr, forward: [], fcrdns: false,
+             explanation: "forward lookup of " + ptr + " transient failure: " +
+                          (fcode || (e && e.message) || String(e)) };
   }
   var forward = Array.isArray(forwardAddrs) ? forwardAddrs.slice() : [];
-  var ipLc = ip.toLowerCase();
+  // RFC 8601 §3 forward-confirm match. An IPv6 address has many equivalent
+  // textual forms (compressed `2001:db8::1` vs expanded
+  // `2001:0db8:0:0:0:0:0:1`); the connecting literal and the AAAA rdata
+  // routinely differ. Compare the CANONICAL form (fixed-width hex nibbles)
+  // so an equivalent-but-differently-written IPv6 address still confirms.
+  // IPv4 has a single canonical dotted form, so a lowercased string compare
+  // is exact there.
+  var ipCanon = isV6 ? ipUtils.expandIpv6Hex(ip) : ip.toLowerCase();
   var fcrdns = false;
   for (var i = 0; i < forward.length; i += 1) {
-    if (String(forward[i]).toLowerCase() === ipLc) { fcrdns = true; break; }
+    var fwdStr = String(forward[i]);
+    var fwdCanon = isV6 ? ipUtils.expandIpv6Hex(fwdStr) : fwdStr.toLowerCase();
+    if (ipCanon && fwdCanon && fwdCanon === ipCanon) { fcrdns = true; break; }
   }
   return {
     result:      fcrdns ? "pass" : "fail",

package/lib/parsers/safe-ini.js

@@ -132,7 +132,15 @@ function _coerceValue(raw) {
     return n;
   }
   if (/^-?\d+\.\d+([eE][+-]?\d+)?$/.test(raw) || /^-?\d+[eE][+-]?\d+$/.test(raw)) {
-    return Number(raw);
+    var f = Number(raw);
+    // Float overflow (e.g. 1e999) coerces to ±Infinity — the same
+    // never-silently-coerce refusal the integer/hex branches enforce with
+    // Number.isSafeInteger. An Infinity slipping into a downstream size cap
+    // or timeout is a live DoS, so an out-of-range float is rejected here.
+    if (!Number.isFinite(f)) {
+      throw _err("ini/value-out-of-range", "float exceeds representable range: " + raw);
+    }
+    return f;
   }
   return _unquote(raw);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.16",
+  "version": "0.16.17",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4536f3b2-ce54-4f57-930f-5250f9a34d41",
+  "serialNumber": "urn:uuid:3e3c1217-5f8b-4f16-b9f5-bea246e83437",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-12T04:34:36.482Z",
+    "timestamp": "2026-07-12T06:26:29.484Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.16",
+      "bom-ref": "@blamejs/core@0.16.17",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.16",
+      "version": "0.16.17",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.16",
+      "purl": "pkg:npm/%40blamejs/core@0.16.17",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.16",
+      "ref": "@blamejs/core@0.16.17",
       "dependsOn": []
     }
   ]