@blamejs/core 0.16.37 → 0.16.38

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.38 (2026-07-16) — **Three fixes to data-subject scoping, break-glass grant limits, and idempotent-retry replay: a data-subject filter no longer matches every subject when it has no indexable key, a single-row break-glass grant can no longer be spent twice concurrently, and an idempotent retry returns its cached result under a vault.** b.dsr's subject-scoped ticket filter failed open: a subject carrying none of the indexable keys (email / subjectId) -- a phone-only, alias-only, or empty subject -- matched EVERY ticket instead of none, so listBySubject returned other subjects' tickets and the erasure-completion purge deleted them. Both ticket stores now fail closed. b.breakGlass's per-row grant limit could be exceeded under concurrency: two simultaneous unseals of a one-row grant against different rows both succeeded, because the claim was decided from a re-read of the shared counter that already reflected the other caller's increment; the claim is now decided from the atomic update's affected-row count. And b.agent.idempotency's putIfAbsent replay parsed the sealed result blob without unsealing it, so under a vault (the production default) every idempotent retry that landed on a completed key threw instead of returning the cached result -- and get() on a pending claim threw on a null result blob rather than reporting no cached result. **Fixed:** *Data-subject request filter fails closed when a subject has no indexable key* — b.dsr's subject-scoped ticket filter matched on the indexable keys email and subjectId. When the supplied subject carried neither -- a phone-only subject (a legitimate SMS-first identity), an alias-only subject, or an empty object -- the filter added no predicate and returned every ticket in the store instead of none. Through the exported API this meant listBySubject(subject) disclosed every subject's tickets, and the erasure-completion purge (which lists a subject's other tickets and deletes them) deleted every other subject's tickets. Both the in-memory and database ticket stores now fail closed: a subject filter that produces no usable predicate matches nothing, so an unindexable subject can neither read nor delete another subject's data. Filters that supply an indexable key are unchanged. · *A single-row break-glass grant can no longer be spent twice under concurrency* — b.breakGlass.unsealRow enforces a per-grant row limit with an atomic compare-and-increment (update the consumed counter where it is still below the cap). It then decided whether the caller won the slot by re-reading the counter and comparing it to the caller's own stale pre-value -- but a concurrent winner's increment is visible to the loser's re-read, so both callers saw a change and both proceeded, unsealing two rows under a one-row grant. The claim is now decided from the atomic update's affected-row count: exactly one caller's compare-and-increment modifies the row, and the loser (zero rows modified) is refused with grant-exhausted. The re-read is retained only for the audit's remaining-rows hint. · *Idempotent retries return their cached result under a vault, and a pending-claim read reports absent* — b.agent.idempotency seals the cached result at rest via b.cryptoField when a vault is configured (the production default). putIfAbsent's replay branch parsed the stored result blob as JSON without unsealing it first, so a retry that landed on an already-completed key threw a corrupt-result error instead of returning the cached result -- breaking the primitive's exactly-once replay guarantee exactly where operators run it. It now unseals before parsing, mirroring get(). Separately, get() on a pending claim (whose result blob is null because no result has been written yet) fed null to the JSON parser and threw the same corrupt-result error; it now reports no cached result, so a concurrent status check during another worker's in-flight claim no longer throws.
+
 - v0.16.37 (2026-07-16) — **Three fail-open / injection fixes: the age gate no longer admits a user whose age fails to compute, the query builder's OFFSET-without-LIMIT runs on every backend, and metrics exemplars can no longer carry an unsanitized value into the scrape stream.** Three defects, each in a class the framework treats as security-relevant. b.middleware.ageGate classified a non-finite age (a NaN or Infinity returned by getAge when a birth field fails to parse) as an adult -- admitting the request with none of the child-safety privacy defaults -- instead of treating an uncomputable age as unknown. b.sql (and b.db.from / b.db.collection over it) emitted a bare OFFSET with no LIMIT, which is valid only on Postgres and is a syntax error on SQLite -- the framework's own backend -- and MySQL, so a valid builder chain failed to run on two of three dialects. And b.metrics exemplars rendered their labels, value, and timestamp into the OpenMetrics scrape surface without the credential-scrub and numeric-coercion regular labels receive, so an operator-supplied exemplar could leak a credential-shaped label or inject a forged metric line through exemplar.value / exemplar.timestamp. **Fixed:** *Age gate treats a non-finite age as unknown, not as an adult* — b.middleware.ageGate now classifies a non-finite age (NaN or +/-Infinity, the shape getAge returns when a birth field fails to parse or date math goes wrong) as "unknown" rather than letting it fall through to "above-threshold". Because typeof NaN === "number" and every comparison against NaN is false, an uncomputable age previously bypassed the below-threshold branch and was admitted as a confirmed adult -- with none of the child-safety privacy defaults (Cache-Control: private, no-store; Referrer-Policy: no-referrer; the privacy-posture header) the unknown path applies. When the birth value is request-derived this is attacker-influenced. A non-finite age is now handled exactly like a null return: the request is classified unknown and the privacy defaults are applied. · *Query builder OFFSET without LIMIT runs on SQLite and MySQL, not only Postgres* — b.sql SELECT (and the b.db.from / b.db.collection consumers built on it) emitted a bare "OFFSET n" when .offset() was set without .limit(). A bare OFFSET is valid only on Postgres; SQLite (the framework's own node:sqlite backend) and MySQL both reject it as a syntax error, so a valid builder chain produced SQL that failed to prepare on two of the three supported dialects, including the default one. The builder now emits the dialect's unbounded-limit sentinel before the OFFSET -- SQLite LIMIT -1, MySQL the maximum unsigned BIGINT, Postgres LIMIT ALL -- so one query text runs unchanged across all three. Statements that set an explicit LIMIT are byte-for-byte unchanged. · *Metrics exemplars are sanitized on the scrape surface the same way regular labels are* — b.metrics histogram exemplars rendered their labels, value, and timestamp into the OpenMetrics /metrics exposition -- the same broadly-readable scrape surface regular labels reach -- without the sanitization regular labels receive. Exemplar label values bypassed the credential scrubber, so a credential-shaped value an operator attached to an exemplar (e.g. tapping a raw header alongside trace context) egressed in cleartext (CWE-532); and exemplar.value / exemplar.timestamp were appended to the exposition line raw, so a non-numeric operator-supplied value such as "1.0\n# forged 999" could inject a forged metric line. Exemplar labels now flow through the same credential scrubber as regular labels, and exemplar value and timestamp are coerced to a finite number (value falling back to the observed value, timestamp to none) at store time, so only sanitized labels and bare numbers ever reach the wire. Trace context (trace_id / span_id) and numeric values pass through unchanged.
 
 - v0.16.36 (2026-07-16) — **DKIM simple header canonicalization now signs and verifies the DKIM-Signature header verbatim, so simple-canon signatures round-trip and interoperate.** b.mail.dkim's simple header canonicalization (c=simple/... in a signature) signs and verifies each header exactly as it appears on the wire, per RFC 6376 §3.4.1. Two defects broke that for the DKIM-Signature header itself: the signer canonicalized the header UNFOLDED while emitting it FOLDED on the wire, and the verifier prefixed a spurious extra space to the parsed header value. Together they meant a simple-header-canonicalization signature never matched the bytes that were signed -- neither the framework's own signatures nor an RFC-compliant peer's would verify under simple canon. The signer now canonicalizes and emits the same folded header (appending the signature to the folded, b-emptied form), and the verifier canonicalizes the parsed header verbatim, so a simple-canon signature round-trips and is byte-compatible with other implementations. Relaxed canonicalization, the common default, is unchanged. Separately, a supply-chain gate now fails the build if a vendored component in lib/vendor/MANIFEST.json has no attribution entry in NOTICE. **Added:** *b.safeBuffer.byteLengthOfIfMeasurable — measure a value's byte length, or null when it is not a byte carrier* — byteLengthOfIfMeasurable(value) returns the byte length of a string, Buffer, or Uint8Array, and null for anything else (a plain Array, an array-like object, a number, null). It is the safe way to cap the size of an untrusted metadata bag whose byte field may be any shape: measure the cap only when the value is measurable, rather than gating byteLengthOf (which throws on a non-byte-carrier) on a hand-rolled length check that admits array-likes and crashes. The image and PDF content guards now compose it for their byte caps instead of each vetting the type inline. **Fixed:** *DKIM simple header canonicalization signs and verifies the DKIM-Signature header verbatim* — Under simple header canonicalization (RFC 6376 §3.4.1) the DKIM-Signature header is signed and verified byte-for-byte as it appears on the wire, including its folding. b.mail.dkim canonicalized the header UNFOLDED when computing the signature but emitted it FOLDED on the wire, and the verifier prepended an extra space to the parsed header value before canonicalizing -- so the bytes signed never matched the bytes verified. A simple-header-canonicalization signature therefore never verified, whether produced by the framework or by an RFC-compliant peer. The signer now canonicalizes the folded, b-emptied header and builds the wire header by appending the signature to it, and the verifier canonicalizes the parsed (folded) header verbatim -- including the DKIM-Signature field name exactly as it appears on the wire, so a peer that signs a lowercase dkim-signature: field name also verifies -- so a simple-canon signature round-trips and interoperates. This was fail-closed -- a broken simple-canon signature was reported as a verification failure, never a false pass -- and relaxed canonicalization (the common default, which normalizes folding and whitespace on both sides) was and remains correct. **Detectors:** *Every vendored component in the manifest must be attributed in NOTICE* — A gate fails the build when a component recorded in lib/vendor/MANIFEST.json has no attribution entry in the NOTICE file. Third-party components ship with their license and attribution obligations; this catches a vendored library or data file added to the manifest without its NOTICE entry before the package is published, rather than after a downstream scanner flags the omission.

package/lib/agent-idempotency.js

@@ -249,9 +249,18 @@ async function _putIfAbsent(store, method, actorId, key, putOpts, ttlMs, maxResu
   if (existing.status === "pending") {
     return { alreadyClaimed: true, pending: true, firstAt: existing.firstAt };
   }
-  // Completed cached result.
+  // Completed cached result. Unseal the result blob when a vault is
+  // configured — put() sealed it at rest via b.cryptoField, so parsing the
+  // raw sealed cell as JSON would throw. Mirrors _get's unseal path (same
+  // seal-table, same unseal call-site shape); vault-less / pre-sealing rows
+  // carry plain JSON and pass through unchanged.
+  var unsealed = existing;
+  if (vault().isInitialized()) {
+    _ensureSealTable();
+    unsealed = cryptoField().unsealRow(SEAL_TABLE, existing);
+  }
   var result;
-  try { result = safeJson.parse(existing.resultBlob, { maxBytes: maxResultBytes }); }
+  try { result = safeJson.parse(unsealed.resultBlob, { maxBytes: maxResultBytes }); }
   catch (e) {
     throw new AgentIdempotencyError("agent-idempotency/corrupt-result",
       "putIfAbsent: cached result failed to parse — " + (e && e.message ? e.message : String(e)));
@@ -280,6 +289,13 @@ async function _get(store, method, actorId, key, auditImpl, ttlMs, maxResultByte
       { method: method, actorIdHash: _truncHash(_actorIdHash(actorId)) });
     return null;
   }
+  // A pending row (claimed via putIfAbsent, no result written yet) carries a
+  // null resultBlob — there is no cached result to return. Report absent
+  // rather than feeding null to safeJson.parse, which throws corrupt-result.
+  // get() is a public status-check path and putIfAbsent produces pending rows,
+  // so a concurrent claim must not turn a peer's get() into a spurious throw;
+  // a later put() replaces the pending row with the completed result.
+  if (row.resultBlob === null || row.resultBlob === undefined) return null;
   // Unseal the result blob into a copy (when a vault is configured;
   // vault-less or pre-sealing rows are plain JSON and used as-is). The
   // original sealed `row` is preserved so the replay-count re-put below

package/lib/break-glass.js

@@ -1431,8 +1431,25 @@ async function unsealRow(grantHandle, table, rowId, opts) {
     .whereOp("expiresAt", ">", Date.now())
     .toSql();
   var updateRes = await clusterStorage.execute(incBuilt.sql, incBuilt.params);
-  // executeAll-style result; some backends return rowsAffected, others a count.
-  // Re-query to confirm the increment landed and get the post-increment counter.
+  // The atomic compare-and-increment IS the claim, and the count of rows it
+  // CHANGED is the only per-caller signal for whether THIS caller won the
+  // slot. `execute` returns rowCount = the rows the UPDATE modified
+  // (info.changes on local sqlite; the driver's affected-row count in cluster
+  // mode), so rowCount >= 1 means this caller's compare-and-increment landed
+  // and rowCount === 0 means it lost — the grant was exhausted / revoked /
+  // expired concurrently between the runtime checks above and this UPDATE.
+  //
+  // Do NOT infer the claim from a re-read of rowsConsumed against this
+  // caller's stale pre-value: a concurrent WINNER's increment is visible to
+  // the LOSER's re-read, so `post !== pre` is true for the loser too and both
+  // proceed — a double-claim that reads two rows under a maxRowsPerGrant:1
+  // grant, defeating row-by-row auth. The affected-row count is unambiguous.
+  if (!updateRes || Number(updateRes.rowCount) < 1) {
+    throw new BreakGlassError("breakglass/grant-exhausted",
+      "unsealRow: grant " + grantHandle.id + " was exhausted by a concurrent read", true);
+  }
+  // Re-query for the post-increment counter — used ONLY for the audit's
+  // rowsRemaining hint below, no longer for the claim decision.
   var postReadBuilt = sql.select("_blamejs_break_glass_grants", _sqlOpts())   // allow:hand-rolled-sql
     .columns(["rowsConsumed", "revokedAt", "expiresAt"])
     .where("_id", grantHandle.id)
@@ -1443,14 +1460,6 @@ async function unsealRow(grantHandle, table, rowId, opts) {
       "unsealRow: grant " + grantHandle.id + " disappeared during unseal", true);
   }
   var postRowsConsumed = Number(postRows[0].rowsConsumed);
-  // If the UPDATE didn't actually increment (race lost — another unseal
-  // exhausted the grant or it was revoked / expired between our check
-  // and the UPDATE), refuse this read.
-  if (postRowsConsumed === Number(grantRow.rowsConsumed)) {
-    throw new BreakGlassError("breakglass/grant-exhausted",
-      "unsealRow: grant " + grantHandle.id + " was exhausted by a concurrent read", true);
-  }
-  void updateRes;
   // policy was fetched above for the pin enforcement; reuse it for the
   // Model-A vs Model-B (cryptographic) unseal dispatch.
   var unsealedRow;

package/lib/dsr.js

@@ -920,8 +920,18 @@ function memoryTicketStore() {
         var t = entry[1];
         if (filter.status && t.status !== filter.status) continue;
         if (filter.subject) {
-          if (filter.subject.email && t.subject.email !== filter.subject.email) continue;
-          if (filter.subject.subjectId && t.subject.subjectId !== filter.subject.subjectId) continue;
+          // Fail closed: a subject filter must match on at least one of the
+          // store's indexable keys (email / subjectId). A subject carrying
+          // none of them — phone-only, alias-only, or an empty object —
+          // matches NOTHING, never every ticket. Fail-open here would make
+          // listBySubject leak other subjects' tickets and the erasure
+          // purge (list-by-subject → delete) destroy them.
+          var subj = filter.subject;
+          var tSubj = t.subject || {};
+          var applied = false;
+          if (subj.email) { applied = true; if (tSubj.email !== subj.email) continue; }
+          if (subj.subjectId) { applied = true; if (tSubj.subjectId !== subj.subjectId) continue; }
+          if (!applied) continue;
         }
         out.push(Object.assign({}, t));
       }
@@ -1257,11 +1267,13 @@ function dbTicketStore(opts) {
     if (!filter.subject) return;
     var vaulted = vault().isInitialized();
     if (vaulted) _ensureDsrSealTable();
+    var appliedAny = false;
     SUBJECT_FILTER_SPEC.forEach(function (spec) {
       var supplied = filter.subject[spec.key];
       if (!supplied) return;
       if (!vaulted) {
         qb.where(spec.plainCol, "=", supplied);
+        appliedAny = true;
         return;
       }
       // Vaulted: match BOTH the active keyed-MAC digest AND the legacy
@@ -1274,7 +1286,15 @@ function dbTicketStore(opts) {
       var values = cand && cand.values ? cand.values : [];
       if (values.length === 0) return;
       qb.whereIn(spec.hashCol, values);
+      appliedAny = true;
     });
+    // Fail closed: a subject filter that produced no usable predicate — a
+    // phone-only / alias-only / empty subject, or a vaulted key with no hash
+    // candidates — must match NOTHING, not every row. Without this, list({
+    // subject }) degrades to a full-table scan and both listBySubject (leak)
+    // and the erasure-completion purge (cross-subject delete) touch every
+    // subject's tickets.
+    if (!appliedAny) qb.whereRaw("1 = 0");
   }
 
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.37",
+  "version": "0.16.38",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:b15701b8-cd2a-49f6-bbcd-c91646be481f",
+  "serialNumber": "urn:uuid:d9b1b08c-4823-449d-bc92-12a4eb6cae3a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-16T19:30:55.778Z",
+    "timestamp": "2026-07-16T20:35:21.934Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.37",
+      "bom-ref": "@blamejs/core@0.16.38",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.37",
+      "version": "0.16.38",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.37",
+      "purl": "pkg:npm/%40blamejs/core@0.16.38",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.37",
+      "ref": "@blamejs/core@0.16.38",
       "dependsOn": []
     }
   ]