@blamejs/core 0.16.36 → 0.16.37

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.37 (2026-07-16) — **Three fail-open / injection fixes: the age gate no longer admits a user whose age fails to compute, the query builder's OFFSET-without-LIMIT runs on every backend, and metrics exemplars can no longer carry an unsanitized value into the scrape stream.** Three defects, each in a class the framework treats as security-relevant. b.middleware.ageGate classified a non-finite age (a NaN or Infinity returned by getAge when a birth field fails to parse) as an adult -- admitting the request with none of the child-safety privacy defaults -- instead of treating an uncomputable age as unknown. b.sql (and b.db.from / b.db.collection over it) emitted a bare OFFSET with no LIMIT, which is valid only on Postgres and is a syntax error on SQLite -- the framework's own backend -- and MySQL, so a valid builder chain failed to run on two of three dialects. And b.metrics exemplars rendered their labels, value, and timestamp into the OpenMetrics scrape surface without the credential-scrub and numeric-coercion regular labels receive, so an operator-supplied exemplar could leak a credential-shaped label or inject a forged metric line through exemplar.value / exemplar.timestamp. **Fixed:** *Age gate treats a non-finite age as unknown, not as an adult* — b.middleware.ageGate now classifies a non-finite age (NaN or +/-Infinity, the shape getAge returns when a birth field fails to parse or date math goes wrong) as "unknown" rather than letting it fall through to "above-threshold". Because typeof NaN === "number" and every comparison against NaN is false, an uncomputable age previously bypassed the below-threshold branch and was admitted as a confirmed adult -- with none of the child-safety privacy defaults (Cache-Control: private, no-store; Referrer-Policy: no-referrer; the privacy-posture header) the unknown path applies. When the birth value is request-derived this is attacker-influenced. A non-finite age is now handled exactly like a null return: the request is classified unknown and the privacy defaults are applied. · *Query builder OFFSET without LIMIT runs on SQLite and MySQL, not only Postgres* — b.sql SELECT (and the b.db.from / b.db.collection consumers built on it) emitted a bare "OFFSET n" when .offset() was set without .limit(). A bare OFFSET is valid only on Postgres; SQLite (the framework's own node:sqlite backend) and MySQL both reject it as a syntax error, so a valid builder chain produced SQL that failed to prepare on two of the three supported dialects, including the default one. The builder now emits the dialect's unbounded-limit sentinel before the OFFSET -- SQLite LIMIT -1, MySQL the maximum unsigned BIGINT, Postgres LIMIT ALL -- so one query text runs unchanged across all three. Statements that set an explicit LIMIT are byte-for-byte unchanged. · *Metrics exemplars are sanitized on the scrape surface the same way regular labels are* — b.metrics histogram exemplars rendered their labels, value, and timestamp into the OpenMetrics /metrics exposition -- the same broadly-readable scrape surface regular labels reach -- without the sanitization regular labels receive. Exemplar label values bypassed the credential scrubber, so a credential-shaped value an operator attached to an exemplar (e.g. tapping a raw header alongside trace context) egressed in cleartext (CWE-532); and exemplar.value / exemplar.timestamp were appended to the exposition line raw, so a non-numeric operator-supplied value such as "1.0\n# forged 999" could inject a forged metric line. Exemplar labels now flow through the same credential scrubber as regular labels, and exemplar value and timestamp are coerced to a finite number (value falling back to the observed value, timestamp to none) at store time, so only sanitized labels and bare numbers ever reach the wire. Trace context (trace_id / span_id) and numeric values pass through unchanged.
+
 - v0.16.36 (2026-07-16) — **DKIM simple header canonicalization now signs and verifies the DKIM-Signature header verbatim, so simple-canon signatures round-trip and interoperate.** b.mail.dkim's simple header canonicalization (c=simple/... in a signature) signs and verifies each header exactly as it appears on the wire, per RFC 6376 §3.4.1. Two defects broke that for the DKIM-Signature header itself: the signer canonicalized the header UNFOLDED while emitting it FOLDED on the wire, and the verifier prefixed a spurious extra space to the parsed header value. Together they meant a simple-header-canonicalization signature never matched the bytes that were signed -- neither the framework's own signatures nor an RFC-compliant peer's would verify under simple canon. The signer now canonicalizes and emits the same folded header (appending the signature to the folded, b-emptied form), and the verifier canonicalizes the parsed header verbatim, so a simple-canon signature round-trips and is byte-compatible with other implementations. Relaxed canonicalization, the common default, is unchanged. Separately, a supply-chain gate now fails the build if a vendored component in lib/vendor/MANIFEST.json has no attribution entry in NOTICE. **Added:** *b.safeBuffer.byteLengthOfIfMeasurable — measure a value's byte length, or null when it is not a byte carrier* — byteLengthOfIfMeasurable(value) returns the byte length of a string, Buffer, or Uint8Array, and null for anything else (a plain Array, an array-like object, a number, null). It is the safe way to cap the size of an untrusted metadata bag whose byte field may be any shape: measure the cap only when the value is measurable, rather than gating byteLengthOf (which throws on a non-byte-carrier) on a hand-rolled length check that admits array-likes and crashes. The image and PDF content guards now compose it for their byte caps instead of each vetting the type inline. **Fixed:** *DKIM simple header canonicalization signs and verifies the DKIM-Signature header verbatim* — Under simple header canonicalization (RFC 6376 §3.4.1) the DKIM-Signature header is signed and verified byte-for-byte as it appears on the wire, including its folding. b.mail.dkim canonicalized the header UNFOLDED when computing the signature but emitted it FOLDED on the wire, and the verifier prepended an extra space to the parsed header value before canonicalizing -- so the bytes signed never matched the bytes verified. A simple-header-canonicalization signature therefore never verified, whether produced by the framework or by an RFC-compliant peer. The signer now canonicalizes the folded, b-emptied header and builds the wire header by appending the signature to it, and the verifier canonicalizes the parsed (folded) header verbatim -- including the DKIM-Signature field name exactly as it appears on the wire, so a peer that signs a lowercase dkim-signature: field name also verifies -- so a simple-canon signature round-trips and interoperates. This was fail-closed -- a broken simple-canon signature was reported as a verification failure, never a false pass -- and relaxed canonicalization (the common default, which normalizes folding and whitespace on both sides) was and remains correct. **Detectors:** *Every vendored component in the manifest must be attributed in NOTICE* — A gate fails the build when a component recorded in lib/vendor/MANIFEST.json has no attribution entry in the NOTICE file. Third-party components ship with their license and attribution obligations; this catches a vendored library or data file added to the manifest without its NOTICE entry before the package is published, rather than after a downstream scanner flags the omission.
 
 - v0.16.35 (2026-07-16) — **A resumed saga that later fails now compensates the steps it completed before the crash, and a webhook delivery retries a transient DNS failure during its safety re-check instead of dead-lettering.** Two durability fixes in the agent orchestration and webhook delivery primitives. b.agent.saga rebuilt its completed-step list from empty when a saga resumed from a persisted checkpoint, so a failure after the resume compensated only the steps that ran in that resumed pass -- the steps completed before the crash were never rolled back, defeating the saga's whole purpose (a charge committed before the crash would never be refunded when a later step failed). Resume now seeds the completed-step list with the steps that finished before the crash, so a failure compensates the full set in reverse order. Separately, b.webhook.dispatcher re-checks a delivery's destination for an SSRF rebind just before each attempt; that check resolves the destination host, and a transient resolver failure (a temporary DNS error) during it was treated as a permanent failure and dead-lettered the delivery on the first attempt. The re-check now dead-letters only a genuine SSRF refusal or malformed URL and treats a transient resolver fault as retryable, like every other transport error. **Added:** *b.webhook.dispatcher accepts a dnsLookup override for the destination SSRF check* — b.webhook.dispatcher now accepts an optional dnsLookup(host) resolver, forwarded to the SSRF destination check, so an operator can point destination resolution at a specific resolver (and a test can drive the transient-versus-permanent classification offline). It defaults to the framework's DNS-over-TLS resolver, unchanged. **Fixed:** *A resumed saga compensates the steps it completed before the crash, not only those in the resumed run* — b.agent.saga runs a sequence of steps and, on a step failure, compensates the completed steps in reverse order. When a saga resumed from a persisted checkpoint, it started its completed-step list empty, so a failure after the resume compensated only the steps that ran in the resumed pass -- the steps completed before the crash were left uncompensated. For a distributed transaction that is the exact failure the pattern exists to prevent: work committed before the crash (a charge, a reservation, an external call) would never be rolled back when a later step failed. Resume now seeds the completed-step list with the steps that finished before the crash, reconstructed from the saga definition, so a subsequent failure compensates the full completed set in reverse; compensation runs against the resumed state, which already reflects those steps' effects, and the failing step itself is not compensated. To keep that reseeding safe against replay, resume also refuses a saga the state store marks terminal (failed-and-compensated or completed) rather than re-running its compensators, and the state-store interface documents that compensators must be idempotent -- a crash mid-compensation can replay a compensation on the next resume, so compensating twice must be safe. · *Webhook delivery retries a transient DNS failure during its SSRF re-check instead of dead-lettering* — b.webhook.dispatcher re-validates a delivery's destination against SSRF (private / loopback / metadata IPs, or a rebind since registration) just before each attempt, which resolves the destination host. A transient resolver failure during that resolution -- a lookup timeout or system/resolve failure -- was caught and marked a permanent failure, dead-lettering the delivery on its first attempt rather than retrying. The re-check now classifies the failure: a genuine SSRF refusal or malformed URL dead-letters, a resolver failure honors the framework DNS resolver's own terminal-versus-transient verdict (a permanent failure such as a host with no addresses or a removed record dead-letters immediately, a transient one is retried on the backoff curve, capped at maxAttempts), matching how the dispatcher already treats a transient DNS error during the delivery POST itself. So a webhook is no longer lost to a momentary DNS blip, a genuine rebind to an internal address is still dead-lettered immediately, and a permanently unresolvable destination dead-letters without burning every retry attempt.

package/lib/metrics.js

@@ -211,6 +211,34 @@ function _validateLabelValue(value) {
   return coerced;
 }
 
+// Redact every value of a free-form label map through the credential
+// scrubber. Exemplar labels (trace_id / span_id, or any operator-supplied
+// pair passed to histogram.observe) are rendered verbatim into the
+// OpenMetrics exposition — the SAME scrape surface regular labels reach — so
+// they get the same scrub. Redacting at STORE time mirrors how _resolveLabels
+// scrubs regular labels before they land in entry.labels, keeping
+// _renderFamilyLines a verbatim renderer for every exposition path that shares
+// it (CWE-532).
+function _redactLabelMap(labelObj) {
+  var out = {};
+  if (!labelObj || typeof labelObj !== "object") return out;
+  var keys = Object.keys(labelObj);
+  for (var i = 0; i < keys.length; i++) out[keys[i]] = _validateLabelValue(labelObj[keys[i]]);
+  return out;
+}
+
+// Coerce an exemplar's value / timestamp to a finite number. Per OpenMetrics
+// 1.0 §6.2 both are numeric, but _renderFamilyLines appends them to the
+// exposition line RAW (unlike labels, which _escapeLabelValue quotes). A
+// non-numeric operator-supplied field — `exemplar.value = "1\n# forged 9"` —
+// would otherwise inject a forged metric line into every scrape. Reject any
+// non-finite value to the caller-supplied fallback so only a bare number ever
+// reaches the wire.
+function _numericExemplarField(value, fallback) {
+  var n = typeof value === "number" ? value : Number(value);
+  return isFinite(n) ? n : fallback;
+}
+
 // Serialize a labels object to a canonical Map key. Routed through
 // canonical-json so the framework has one canonical-sort source of
 // truth for sorted-keys serialization (avoiding the silent-data-loss
@@ -290,7 +318,11 @@ function _renderFamilyLines(family, openMetrics, lines) {
         if (openMetrics && entry.exemplars && entry.exemplars[bi]) {
           var ex = entry.exemplars[bi];
           bucketLine += " # " + _renderLabels(ex.labels || {}) + " " + ex.value;
-          if (ex.timestamp) bucketLine += " " + ex.timestamp;
+          // Present-vs-missing on the coerced timestamp is `is a number`, not
+          // truthiness: _numericExemplarField stores a finite number or null,
+          // and the Unix epoch is a valid timestamp of 0 — a truthiness guard
+          // would silently drop it.
+          if (typeof ex.timestamp === "number") bucketLine += " " + ex.timestamp;
         }
         lines.push(bucketLine);
       }
@@ -644,9 +676,9 @@ function create(opts) {
             // arg; the registry only records what's passed in.
             if (exemplar && typeof exemplar === "object") {
               entry.exemplars[i] = {
-                labels:    exemplar.labels    || {},
-                value:     exemplar.value !== undefined ? exemplar.value : arg.value,
-                timestamp: exemplar.timestamp || null,
+                labels:    _redactLabelMap(exemplar.labels),
+                value:     _numericExemplarField(exemplar.value, arg.value),
+                timestamp: _numericExemplarField(exemplar.timestamp, null),
               };
             }
           }

package/lib/middleware/age-gate.js

@@ -140,7 +140,13 @@ function create(opts) {
     }
 
     var classification;
-    if (age === null || typeof age !== "number") classification = "unknown";
+    // A non-finite age (NaN from parseInt on a malformed birth field or
+    // date math, ±Infinity) is NOT a confirmed adult: typeof NaN === "number"
+    // and `NaN < consentRequired` is false, so without the isFinite guard the
+    // classifier fell through to "above-threshold" and dropped every privacy
+    // default for a user whose age simply failed to compute. Treat it as
+    // "unknown" (privacy headers applied), consistent with a null return.
+    if (age === null || typeof age !== "number" || !isFinite(age)) classification = "unknown";
     else if (consentRequired !== null && age < consentRequired) classification = "below-threshold";
     else classification = "above-threshold";
 

package/lib/sql.js

@@ -1760,7 +1760,21 @@ class SelectBuilder extends Builder {
     if (h.sql) { sql += " HAVING " + h.sql; for (var hi = 0; hi < h.params.length; hi++) params.push(h.params[hi]); }
 
     if (this._orderBy.length > 0) sql += " ORDER BY " + this._orderBy.join(", ");
-    if (this._limit !== null) sql += " LIMIT " + this._limit;
+    // OFFSET without LIMIT is valid only on Postgres; SQLite and MySQL both
+    // reject a bare OFFSET as a syntax error (there is no bare-OFFSET spelling
+    // for "skip N, return the rest" on those backends). Emit the dialect's
+    // unbounded-limit sentinel so one query text runs unchanged across all
+    // three: SQLite `LIMIT -1`, MySQL the max unsigned BIGINT, Postgres
+    // `LIMIT ALL`. When a real LIMIT is set the existing token is emitted
+    // untouched, so limit-present statements are byte-for-byte unchanged.
+    var limitToken = null;
+    if (this._limit !== null) {
+      limitToken = String(this._limit);
+    } else if (this._offset !== null) {
+      limitToken = dialect === "sqlite" ? "-1"
+        : (dialect === "mysql" ? "18446744073709551615" : "ALL");
+    }
+    if (limitToken !== null) sql += " LIMIT " + limitToken;
     if (this._offset !== null) sql += " OFFSET " + this._offset;
 
     if (this._lockMode !== null) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.36",
+  "version": "0.16.37",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e5683da5-8c6c-4bc9-84ad-1d58dcca68c4",
+  "serialNumber": "urn:uuid:b15701b8-cd2a-49f6-bbcd-c91646be481f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-16T17:16:56.426Z",
+    "timestamp": "2026-07-16T19:30:55.778Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.36",
+      "bom-ref": "@blamejs/core@0.16.37",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.36",
+      "version": "0.16.37",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.36",
+      "purl": "pkg:npm/%40blamejs/core@0.16.37",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.36",
+      "ref": "@blamejs/core@0.16.37",
       "dependsOn": []
     }
   ]