@blamejs/core 0.16.6 → 0.16.7

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.7 (2026-07-06) — **Restore two APIs that silently didn't work — the Clear-Site-Data header helper and data-subject export — and correct five documentation examples, all surfaced by a new test that executes every JSDoc @example end-to-end.** The comment-block validator only ever PARSE-checked each documentation @example, so an example could compile and still be dead — calling a method that no longer exists, passing an option the API rejects, or misreading a return shape. A new test now EXECUTES every self-contained @example against the real framework, and on its first run it caught two genuine framework defects plus five stale examples. b.middleware.clearSiteData.headerValue (documented @status stable since 0.15.9) was unreachable: the middleware export was a bare factory that never carried the headerValue helper (nor KNOWN_TYPES / DEFAULT_TYPES), so calling it threw — it is now attached to the export, mirroring b.middleware.idempotencyKey. b.subject.export / b.subject.exportData returned undefined instead of the documented empty object when no data-subject tables are declared, so an operator running an export before tagging any subjectField column got undefined and crashed on the first property access — it now returns {}. Five @example blocks are corrected to runnable code (b.guardRegex.gate's return usage; the invalid title option on b.openapi.create / b.asyncapi.create, which belongs under info; b.retention.complianceFloor; b.safeSchema.object). No security surface changes. **Added:** *JSDoc @example execution validation* — A new test executes every self-contained JSDoc @example against the real framework — not just parse-checks it — so an example that references a renamed or removed method, passes an option the API rejects, or misreads a return shape now fails the suite instead of shipping as dead documentation. Examples with side effects (network, database, filesystem, long-lived work) or that abstract external setup are skipped; the executed set runs in a sandbox with a wall-clock ceiling. **Fixed:** *b.middleware.clearSiteData.headerValue is reachable again* — b.middleware.clearSiteData was exported as a bare factory function, so the advertised b.middleware.clearSiteData.headerValue(types, label?) — plus KNOWN_TYPES and DEFAULT_TYPES — were undefined off the export and threw a TypeError, even though the helper (documented stable since 0.15.9) existed on the module. Those members are now attached to the middleware export, so the documented call works. · *b.subject.export / exportData returns {} when no data-subject tables are declared* — On the no-subject-tables path, export returned the value of its internal audit-write helper — which has no return statement, i.e. undefined — instead of the documented empty dump. An operator running a data-subject export before tagging any subjectField column therefore received undefined and crashed on Object.keys(dump) / dump.<table>. It now returns {} as documented (export and exportData are the same function). · *Five documentation examples corrected to runnable code* — b.guardRegex.gate's example now uses the gate return value correctly; b.openapi.create and b.asyncapi.create examples move title/version under info (title is not a top-level option); and the b.retention.complianceFloor and b.safeSchema.object examples are made self-contained. These are documentation-only corrections.
+
 - v0.16.6 (2026-07-05) — **Repair the ClusterFuzzLite / OSS-Fuzz build script so its fuzz targets actually install the jazzer.js runtime and pair with their seed corpora.** This patch fixes the OSS-Fuzz / ClusterFuzzLite build script (.clusterfuzzlite/build.sh), which was latently broken: it compiled every fuzz/<name>.fuzz.js harness without first installing @jazzer.js/core, so the generated targets referenced a runtime that was never present and could not start, and it named each seed-corpus archive after the .fuzz.js-stripped base (guard-csv_seed_corpus.zip) rather than the compiled target (guard-csv.fuzz), so the fuzzing engine never associated a corpus with its target and bootstrapped from nothing. Both failures were silent because the compile step still exits 0 and the in-repo CI fuzz workflows invoke jazzer.js directly rather than through this script — the script is the OSS-Fuzz-upstream integration spec. The build script now installs the jazzer.js runtime into the project-root node_modules before compiling and names each corpus after its target, and a codebase-patterns check locks both invariants in. The build image's inline documentation is corrected (jazzer.js is not present in the base image; the CI workflows do not consume this image) and now records why the upstream path is still latent (the base image ships Node 20 / GLIBC 2.31, below the framework's Node 22+ and jazzer.js's GLIBC 2.38 needs). No shipped framework code changes; fuzz and build-image assets are dev-only and are not part of the published package. **Fixed:** *OSS-Fuzz / ClusterFuzzLite build script installs the jazzer.js runtime before compiling* — compile_javascript_fuzzer emits a runnable that executes <project>/node_modules/@jazzer.js/core at fuzz time from a wholesale copy of the source tree, so the runtime must exist in the project-root node_modules at compile time. The build script never ran an install, so @jazzer.js/core (declared in fuzz/package.json) was absent and every compiled target referenced a runtime that wasn't there. The script now installs it before the compile loop. · *Fuzz seed corpora are paired with their compiled target* — compile_javascript_fuzzer names each target after basename -s .js (keeping the .fuzz stem, e.g. guard-csv.fuzz), but the script zipped each seed corpus under the .fuzz.js-stripped base (guard-csv_seed_corpus.zip). The fuzzing engine pairs <target>_seed_corpus.zip, so no corpus was ever associated and targets started from an empty corpus. Each corpus is now named after its target. · *Build-image documentation corrected* — The build image's comments claimed jazzer.js was pre-installed in the base image and that the CI fuzz workflows consume this image; neither is true. The comments now state that build.sh installs jazzer.js and that the CI workflows invoke jazzer.js directly, and record that the OSS-Fuzz-upstream path remains latent until the base image advances to Node 24 / a newer GLIBC. **Detectors:** *Fuzz-build invariants checked in codebase-patterns* — A cross-artifact check asserts that .clusterfuzzlite/build.sh installs a jazzer.js runtime before compile_javascript_fuzzer and names each seed-corpus archive after the compiled target, so neither gap can silently reappear.
 
 - v0.16.5 (2026-07-03) — **Correctness fixes across the ReDoS guard, Base32 codec, HTTP multipart builder, SAML encrypted-assertion decryption, and the OAuth device grant — several restore advertised functionality that was silently non-working, plus a multipart header-injection fix.** This patch fixes a batch of correctness and security defects, several of which restore advertised behaviour that never actually worked. The ReDoS guard (b.guardRegex) no longer false-rejects LINEAR patterns that use a quantified non-capturing group (`(?:…)?`, `(?:…)*`) or an optional quantified group (`(X+)?`, `(?:X+)?`) — those repeat the group at most once and are not catastrophic; the detector now correctly requires the OUTER quantifier to be unbounded, so operator regex screening and b.selfUpdate asset patterns that use an optional SemVer suffix work again while genuine `(a+)+` shapes are still refused. The Base32 decoder now rejects NON-CANONICAL input (a final symbol whose unused low bits are non-zero — previously two distinct strings decoded to the same bytes, a malleability problem for the TOTP secrets and identifiers Base32 backs) and impossible symbol counts (1/3/6 mod 8 that silently produced a truncated buffer). The HTTP multipart/form-data builder now refuses CR/LF/NUL in a field name, filename, or content-type, closing a part-header-injection / form-part-forgery path. Two SAML EncryptedAssertion decryption paths that were completely dead — ML-KEM-1024 key transport and XChaCha20-Poly1305 content — are fixed (they referenced crypto entry points that were never exported, so the framework's advertised PQC-first / AEAD SAML encryption always failed and misreported the cause as a wrong-key or tag-mismatch error). The OAuth device grant now works against spec-compliant identity providers (its poll aborted on the first `authorization_pending`, which RFC 8628 delivers as an HTTP 400 the client was rejecting before reading), and a static (non-discovery) OAuth client can now use introspection, dynamic registration, and device authorization by configuring those endpoints. Smaller fixes round it out: the HTTP client's default error carries statusCode/permanent; the CLI dev server's repeatable flags accumulate; DANE and MTA-STS failures are scoped correctly per RFC; and typed errors replace raw TypeErrors on a couple of malformed-input paths. **Fixed:** *HTTP client default error carries statusCode and permanent* — request() fell back to the base FrameworkError when no explicit opts.errorClass was passed, so error.statusCode and error.permanent were undefined on the default path despite the documented default of HttpClientError. The default is now HttpClientError, so those fields are populated for every consumer. · *Static OAuth clients can configure introspection / registration / device-authorization endpoints* — create() never read opts.introspectionEndpoint / registrationEndpoint / deviceAuthorizationEndpoint into its static-endpoint set, so introspectToken / registerClient / deviceAuthorization resolved those endpoints only via OIDC discovery — a static (non-discovery) client could not use them, even though introspectToken's own error told operators to set the endpoint on create(). Those three endpoints are now honored from static config. · *CLI dev server repeatable flags accumulate* — `blamejs dev --arg / --watch / --ignore` are documented repeatable, but the argument parser overwrote each on repeat, so only the last occurrence survived — only the last --watch directory was monitored, only the last --ignore applied, and the child received only the last --arg. Repeated occurrences of these flags now accumulate as documented. · *DANE per-recipient failure isolation and MTA-STS testing-mode handling* — A DANE-enforce TLSA-lookup failure threw out of the entire deliver() batch instead of failing just the one recipient; it now fails that recipient and lets the rest proceed. And an MTA-STS policy published in `testing` mode was hard-bounced under the default enforce posture, violating RFC 8461 §5.2 (testing mode is report-only); a testing-mode policy no longer blocks delivery. · *external-db validates defaultBackend and enforces the pool min floor* — init() did not validate that opts.defaultBackend named a registered backend, so a typo surfaced as an opaque TypeError at the first query instead of a typed config-time error; it is now validated at init. The pool `min` (documented as a floor on idle clients) was never enforced; the reaper now respects it. · *mail-bounce returns a typed error for a null SES SNS message* — An SES SNS notification whose Message field is JSON literal `null` dereferenced null and threw a raw TypeError (also risking an internal-message leak); it now throws the typed MailBounceError like the other malformed-input paths. **Security:** *b.guardRegex no longer false-rejects linear quantified-group patterns (#432, #429)* — The nested-quantifier ReDoS detector treated the `?` in a `(?:` group prefix as an inner quantifier and treated a bounded outer `?` / `{0,1}` as a dangerous outer quantifier, so it wrongly refused LINEAR patterns like `^(?:/page/\d+)?$`, `^foo(?:bar)*$`, `^(a+)?$`, and `(?:[-+][0-9A-Za-z.-]+)?`. The catastrophic class requires the OUTER quantifier to be unbounded (`*`/`+`/`{n,}`). The detector now relies solely on the paren-aware structural scanner, which requires an unbounded outer quantifier and does not miscount a group prefix — so genuine `(a+)+` / `((a)+)+` shapes stay refused while these linear ones are accepted. Consumers screening operator-supplied regexes (route rules, and b.selfUpdate asset patterns using an optional SemVer prerelease/build group) are no longer forced to rewrite valid input. · *Base32 decoder rejects non-canonical encodings and impossible lengths* — b.base32.decode discarded the final symbol's unused low bits without checking they were zero (RFC 4648 §3.5), so two distinct strings — e.g. `MY======` and `MZ======` — decoded to the same bytes (decoder malleability), and it silently accepted impossible symbol counts (1/3/6 mod 8) that can't represent whole bytes, returning a truncated buffer. Both are now refused (`base32/non-canonical`, `base32/bad-length`), giving a one-to-one mapping between a byte sequence and its Base32 string — important where the string is a key / secret / dedup handle (TOTP, identifiers). Valid input, including unpadded and loose-mode input, is unaffected. · *HTTP multipart/form-data builder refuses CR/LF/NUL in part-header values* — The multipart body builder interpolated the field name, file field, filename, and content-type onto `Content-Disposition:` / `Content-Type:` part-header lines without a control-character check, so an attacker controlling one of those values could smuggle a CRLF and inject additional part headers or forge form parts. CR, LF, and NUL in any of those values are now refused, matching the header-safety the mail-header sweep already applies to RFC 822 lines. · *SAML EncryptedAssertion ML-KEM-1024 and XChaCha20-Poly1305 decryption now work* — verifyResponse's post-quantum key-transport branch and its XChaCha20-Poly1305 content branch called crypto entry points that the crypto module never exported, so every ML-KEM-1024-wrapped or XChaCha20-Poly1305-encrypted SAML assertion failed with an internal TypeError that was re-reported as a key-unwrap or tag-mismatch error — the advertised PQC-first / AEAD SAML encryption was dead. Both paths now route through the exported envelope-open and packed-AEAD primitives, verified with a full encrypt→decrypt round trip. Fails closed (no auth bypass) either way. · *OAuth device grant polls correctly against spec-compliant providers* — pollDeviceCode issued its token request in the default buffering mode, so the HTTP client rejected the HTTP 400 that RFC 8628 §3.5 / RFC 6749 §5.2 use to carry `authorization_pending` / `slow_down` before the poll loop could read the OAuth error body — the grant aborted on the first poll (which is almost always `authorization_pending`, since the user hasn't approved yet). The request now resolves 4xx OAuth error responses so the pending / slow-down / terminal handling runs and the device grant completes.

package/lib/guard-regex.js

@@ -484,12 +484,12 @@ function _sanitizeTransform(input) {
  * @example
  *   var gate = b.guardRegex.gate({ profile: "strict" });
  *
- *   gate({ identifier: "(a+)+b" }).then(function (rv) {
+ *   gate.check({ identifier: "(a+)+b" }).then(function (rv) {
  *     rv.ok;                                           // → false
  *     rv.action;                                       // → "refuse"
  *   });
  *
- *   gate({ identifier: "^[a-z]+$" }).then(function (rv) {
+ *   gate.check({ identifier: "^[a-z]+$" }).then(function (rv) {
  *     rv.action;                                       // → "serve"
  *   });
  */

package/lib/middleware/asyncapi-serve.js

@@ -94,7 +94,7 @@ var audit         = lazyRequire(function () { return require("../audit"); });
  * @example
  *   var b = require("@blamejs/core");
  *   var app = b.router.create();
- *   var aapi = b.asyncapi.create({ title: "events", version: "1.0.0" });
+ *   var aapi = b.asyncapi.create({ info: { title: "events", version: "1.0.0" } });
  *   app.use(b.middleware.asyncapiServe({
  *     document:      aapi,
  *     pathJson:      "/asyncapi.json",

package/lib/middleware/index.js

@@ -120,7 +120,11 @@ module.exports = {
   tracePropagate:        tracePropagate.create,
   tusUpload:        tusUpload.create,
   webAppManifest:   webAppManifest.create,
-  clearSiteData:    clearSiteData.create,
+  clearSiteData:    Object.assign(clearSiteData.create, {
+    headerValue:   clearSiteData.headerValue,
+    KNOWN_TYPES:   clearSiteData.KNOWN_TYPES,
+    DEFAULT_TYPES: clearSiteData.DEFAULT_TYPES,
+  }),
   nel:              nel.create,
   speculationRules: speculationRules.create,
   protectedResourceMetadata: protectedResourceMetadata.create,

package/lib/middleware/openapi-serve.js

@@ -100,7 +100,7 @@ var audit         = lazyRequire(function () { return require("../audit"); });
  * @example
  *   var b = require("@blamejs/core");
  *   var app = b.router.create();
- *   var doc = b.openapi.create({ title: "api", version: "1.0.0" });
+ *   var doc = b.openapi.create({ info: { title: "api", version: "1.0.0" } });
  *   app.use(b.middleware.openapiServe({
  *     document:     doc,
  *     pretty:       true,

package/lib/retention.js

@@ -623,7 +623,7 @@ var COMPLIANCE_RETENTION_FLOOR_MS = Object.freeze({
  * matched). Throws on an unknown posture so config-time typos surface.
  *
  * @example
- *   var ttl = b.retention.complianceFloor("hipaa", b.C.TIME.days(180));
+ *   var ttl = b.retention.complianceFloor("hipaa", b.constants.TIME.days(180));
  *   // → 189216000000 (HIPAA's 6-year floor wins over the 180-day candidate)
  *
  *   var sox = b.retention.complianceFloor("sox", 0);

package/lib/safe-schema.js

@@ -996,8 +996,11 @@ function unknown() { return any(); }
  *   // → "object/unknown-key"
  *
  *   // Prototype-pollution attempt rejected even with passthrough.
+ *   // A hostile __proto__ only becomes an own key through JSON input;
+ *   // object-literal `__proto__:` sets the prototype instead.
  *   var loose = user.passthrough();
- *   var report = loose.safeParse({ email: "a@b.com", age: 30, __proto__: { admin: true } });
+ *   var hostile = JSON.parse('{ "email": "a@b.com", "age": 30, "__proto__": { "admin": true } }');
+ *   var report = loose.safeParse(hostile);
  *   report.ok;
  *   // → false
  *   report.errors[0].code;

package/lib/subject.js

@@ -133,7 +133,12 @@ function exportData(subjectId, opts) {
 
   var tables = db()._getSubjectTables();
   if (tables.length === 0) {
-    return _writeAudit("subject.export", subjectId, "success", { reason: opts.reason || null }, {});
+    // No subjectField-tagged tables: still audit, but return the documented
+    // empty dump ({}) — _writeAudit returns undefined, so returning its value
+    // (with a vestigial 5th arg) silently handed callers `undefined`, crashing
+    // `Object.keys(dump)` / `dump.<table>` before any table is even declared.
+    _writeAudit("subject.export", subjectId, "success", { reason: opts.reason || null });
+    return {};
   }
 
   var dump = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.6",
+  "version": "0.16.7",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:58bdc6e3-f682-4982-908d-0f427322f002",
+  "serialNumber": "urn:uuid:580b20a9-97cb-4f54-a69f-6fb69758a9a1",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-06T05:51:57.162Z",
+    "timestamp": "2026-07-06T09:00:10.983Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.6",
+      "bom-ref": "@blamejs/core@0.16.7",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.6",
+      "version": "0.16.7",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.6",
+      "purl": "pkg:npm/%40blamejs/core@0.16.7",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.6",
+      "ref": "@blamejs/core@0.16.7",
       "dependsOn": []
     }
   ]