@blamejs/core 0.18.10 → 0.18.11

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.11 (2026-08-03) — **A static file that is a symlink at the final path component now fails closed with a clean 404 instead of an uncaught error; broader DNS, field-crypto, and static-server coverage.** The static server refuses a symlink at the final path component (its O_NOFOLLOW TOCTOU defense) — but that refusal now falls back to a clean 404 / NOT_FOUND rather than propagating an uncaught error that hung the request or surfaced a raw ELOOP from staticServe.integrity(). Alongside the fix, error and edge branches of b.network.dns, b.cryptoField, and b.staticServe come under explicit test. **Changed:** *Error- and edge-path tests for the DNS, field-crypto, and static-server primitives* — b.network.dns (DoH oversized-body handling, DoT mid-query connection reset and socket reuse, cache expiry, system-resolver error paths), b.cryptoField (tampered / relocated / downgraded cell fail-closed nulling, key-row AAD and rowId resolution, unseal rate-cap configuration, on-read upgrade branches), and b.staticServe (integrity and confinement edge cases, idle-timeout teardown, the final-component symlink refusal above) now have explicit tests for their boundary branches. An unused internal date-formatting helper was removed. **Fixed:** *A final-component symlink (or a mid-hash read error) on a static file fails closed with a clean 404* — When computing a served file's SRI and ETag, the static server opens it with O_NOFOLLOW so a symlink swapped in at the final path component after the in-root check cannot be followed (a TOCTOU / CWE-22 / CWE-367 defense). On POSIX that open raises ELOOP for a symlinked target — the common atomic-deploy pattern where a stable name links to a hashed file (latest.js pointing at app.<hash>.js). That error, and any read error mid-hash, previously propagated uncaught: the middleware request hung with no response, and staticServe.integrity() threw a raw ELOOP instead of its documented NOT_FOUND. It now falls back exactly as a read error does — the middleware returns 404 (falls through) and integrity() throws NOT_FOUND. The symlink is still not served; the refusal is just clean. Windows is unaffected (O_NOFOLLOW is a no-op there).
+
 - v0.18.10 (2026-08-03) — **Encrypted-at-rest boot fails closed on a truncated db.enc instead of silently starting fresh over it; broader SAML and database test coverage.** A database running encrypted at rest whose db.enc snapshot is truncated below a valid envelope (an interrupted external copy or backup restore, a full tmpfs, filesystem corruption) no longer boots onto a fresh empty database that the next flush would persist over the corrupt copy — it now fails closed so the operator can restore from backup. Alongside the fix, adversarial and edge branches of b.auth.saml and b.db come under explicit test, and the vendored @blamejs/pki toolkit is refreshed. **Changed:** *Verification- and edge-path tests for the SAML SP and database primitives* — b.auth.saml (the XML-signature Reference handling with no URI or no Transforms, a foreign-namespace Conditions element failing closed to no-audience-restriction, RSA-OAEP SHA-384/SHA-512 key transport with AES-128-GCM assertion decryption, ed25519 sign/verify dispatch, and the single-logout build/parse paths) and b.db (encrypted-boot key and envelope fallbacks, the truncated-snapshot refusal above, flush-to-disk after close, the audit-chain rollback check against a non-empty log, and the boot-time NTP check thresholds) now have explicit tests for their boundary branches. · *Vendored @blamejs/pki refreshed to 0.3.29* — The vendored @blamejs/pki toolkit that backs the mutual-TLS CA engine (X.509 / CRL / PKCS#12 signing) is refreshed from 0.3.28 to 0.3.29. The upstream change is in that toolkit's ACME client and Retry-After parser, which the CA engine does not call, so there is no behaviour change to the certificate-authority surface — this is a supply-chain currency refresh. **Fixed:** *Encrypted boot fails closed on a truncated db.enc rather than starting fresh over it* — When a database is encrypted at rest and its durable db.enc snapshot exists but is too short to be a valid AEAD envelope — a truncation from an interrupted external copy or backup restore, a full tmpfs, or filesystem corruption — boot silently opened a fresh empty database. The next flush or close then persisted that empty database over the corrupt-but-present snapshot, masking the corruption and destroying the operator's chance to recover. Boot now fails closed with db/enc-truncated; restore db.enc from backup, or remove it to intentionally start empty. A valid snapshot is always written atomically and is never this short, so no healthy deployment is affected. **Detectors:** *Truncated db.enc must fail closed, not start fresh* — A source guard keeps the encrypted-boot path throwing on an under-length db.enc rather than returning to open a fresh database — so a truncated durable snapshot can never again be silently overwritten by the next flush.
 
 - v0.18.9 (2026-08-02) — **Broader error- and edge-path test coverage for the CLI, mail, and HTTP-client primitives.** Error, edge, and fallback branches of b.cli, b.mail, and b.httpClient are now under explicit test. No behaviour changes: exercising every path confirmed each already behaves per its documented contract. One dead internal parameter on the HTTP-client cache path — never supplied by any caller — was removed. **Changed:** *Error- and edge-path tests for the CLI, mail, and HTTP-client primitives* — b.cli (the api-snapshot capture/compare load-error paths and the restore-apply round trip), b.mail (reverse-DNS forward-confirmation and failure fallbacks, SMTP UTF-8 and binary-MIME detection on edge inputs, AUTH LOGIN with an empty password, and audit-emit failures being swallowed without masking the delivery outcome), and b.httpClient (the HTTPS-connect failure classification and the HTTP/2 synchronous-request-throw path) now have explicit tests for their boundary branches. Behaviour is unchanged.

package/lib/static.js

@@ -243,21 +243,31 @@ async function _readMeta(root, candidate) {
   // chunk avoids re-reading the file.
   var sri = nodeCrypto.createHash("sha384");
   var sha3 = nodeCrypto.createHash("sha3-512");
-  await new Promise(function (resolve, reject) {
-    // The path is the confined output of `_assertInsideRoot(root, candidate)`
-    // above (lexical resolve + root-prefix containment). Open it O_NOFOLLOW and
-    // stream from that fd: lexical confinement still leaves a window where a
-    // symlink swapped in at the final component after the check would be
-    // followed by a plain createReadStream (CWE-22 / CWE-367); O_NOFOLLOW refuses
-    // it. The open throws synchronously on a symlink (ELOOP) / missing file —
-    // reject the hash promise so the caller falls back exactly as on a read error.
-    var s;
-    try { s = nodeFs.createReadStream(absPath, { fd: atomicFile.openNoFollowSync(absPath) }); }
-    catch (e) { reject(e); return; }
-    s.on("data", function (chunk) { sri.update(chunk); sha3.update(chunk); });
-    s.on("end", resolve);
-    s.on("error", reject);
-  });
+  try {
+    await new Promise(function (resolve, reject) {
+      // The path is the confined output of `_assertInsideRoot(root, candidate)`
+      // above (lexical resolve + root-prefix containment). Open it O_NOFOLLOW and
+      // stream from that fd: lexical confinement still leaves a window where a
+      // symlink swapped in at the final component after the check would be
+      // followed by a plain createReadStream (CWE-22 / CWE-367); O_NOFOLLOW refuses
+      // it. The open throws synchronously on a symlink (ELOOP) / missing file, and
+      // a read I/O error rejects mid-stream.
+      var s;
+      try { s = nodeFs.createReadStream(absPath, { fd: atomicFile.openNoFollowSync(absPath) }); }
+      catch (e) { reject(e); return; }
+      s.on("data", function (chunk) { sri.update(chunk); sha3.update(chunk); });
+      s.on("end", resolve);
+      s.on("error", reject);
+    });
+  } catch (_hashErr) {
+    // Fall back exactly as on the fsp.stat failure above: return null so the
+    // caller 404s / falls through. Without this the O_NOFOLLOW ELOOP (a
+    // final-component symlink — the atomic-deploy `latest.js -> app.<hash>.js`
+    // pattern on POSIX) or a mid-stream read error would propagate as an
+    // uncaught rejection — hanging the request from the middleware, or surfacing
+    // a raw ELOOP from integrity() instead of the documented NOT_FOUND.
+    return null;
+  }
   var sriDigest = sri.digest("base64");
   var sha3Hex = sha3.digest("hex");
 
@@ -512,10 +522,6 @@ function _parseRangeHeader(header, size) {
   return { start: start, end: end, length: end - start + 1 };
 }
 
-function _httpDate(date) {
-  return (date instanceof Date ? date : new Date(date)).toUTCString();
-}
-
 function _validateCreateOpts(opts) {
   // Declarative per-field validation. shape() runs requireObject(opts)
   // itself (same "opts must be an object" / BAD_OPT contract the inline

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.10",
+  "version": "0.18.11",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:52e564cd-e4bc-440f-bd6c-a12a68c4102e",
+  "serialNumber": "urn:uuid:64a46779-1870-427d-919a-0e19529a6497",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-03T20:26:23.786Z",
+    "timestamp": "2026-08-03T22:09:50.815Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.10",
+      "bom-ref": "@blamejs/core@0.18.11",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.10",
+      "version": "0.18.11",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.10",
+      "purl": "pkg:npm/%40blamejs/core@0.18.11",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.10",
+      "ref": "@blamejs/core@0.18.11",
       "dependsOn": []
     }
   ]