@blamejs/core 0.6.59 → 0.6.61

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.6.x
 
+- **0.6.61** (2026-05-03) — `b.safeSchema.string().email()` enforces RFC 5321 §4.5.3.1.3's 254-character cap on the address. Pre-fix the validator was the regex-only `/^[^\s@]+@[^\s@]+\.[^\s@]+$/`, which accepts arbitrarily long matching strings — an operator chaining `.email()` on a request body was open to a DoS shape (50 KB email passes validation, downstream DB writes / log lines unbounded). Now `.email()` rejects with `string/email-too-long` at 255+ chars before the regex even runs, with a message naming the RFC. Operators with a legitimate non-RFC reason for longer addresses skip `.email()` and chain `.regex(custom)` directly. **Tests** — 4 new layer-0 assertions: 254-char address accepts, 255 / 500 char addresses reject, error code `string/email-too-long` exposed for operator handler routing. Smoke 7211 → 7215 / wiki e2e 178 / Linux 85.8s / eslint clean / shellcheck clean.
+
+- **0.6.60** (2026-05-03) — `b.pagination.encodeCursor` correctness fixes for non-plain types in cursor state. The `_canonicalize` walker did `if (typeof === "object") Object.keys(...)`, which silently lost data on three classes of input: **Date** silently encoded as `{}` (Date instances have no own enumerable keys); **Buffer / Uint8Array** silently encoded as `{"0":97,"1":98,…}` (indexed-key serialisation); **circular references** stack-overflowed instead of throwing a clean error. After encode → decode the operator's data was either gone or unrecognisable. The fix: Date now serialises to its ISO string (matches stdlib `JSON.stringify` semantics — round-trips through encode/decode as the ISO string operators expect); Buffer / Uint8Array / Map / Set / RegExp throw `pagination/bad-state` with a message naming the offending constructor and pointing operators at the right conversion (`"convert to a plain primitive (string / number / iso-string) first"`); circular references throw `pagination/bad-state` cleanly via WeakSet cycle detection. **Tests** — 7 new layer-0 assertions: Date round-trip preserved, all 5 non-plain types reject cleanly, circular reference rejects without stack overflow. Smoke 7204→7211 / wiki e2e 178 / Linux 85.3s / eslint clean / shellcheck clean.
+
 - **0.6.59** (2026-05-03) — HTTP/2 session teardown deduplication + http-client sweep. v0.6.58's inline `session.close() + session.destroy()` block in `lib/log-stream-otlp-grpc.js` was the right fix for the OTLP-gRPC sink hang, but the same bug class lives in `lib/http-client.js` — the h2 transport pool had 5 call sites running the bare `session.close()` (`_resetTransports`, the ALPN-fallback path, the h2 connect-error path, the h2c connect-error path, the idle-timeout handler, and `_resetForTest`) all of which leak the underlying TCP socket on idle / error / fallback paths in exactly the same way. New `lib/http2-teardown.js` exports `tearDownH2Session(session)` which performs the close()-then-destroy() routine; `lib/http-client.js` and `lib/log-stream-otlp-grpc.js` both import it. The OTLP-gRPC v0.6.58 inline block is removed in favour of the shared helper. **Tests** — verified in a node:24-alpine docker container: smoke 7204 checks in 85.3 seconds. Wiki e2e 178 / eslint clean / shellcheck clean.
 
 - **0.6.58** (2026-05-03) — `b.logStream` OTLP-gRPC sink hang fix that has been silently breaking the npm-publish gate since v0.6.38. The sink's `close()` was calling `session.close()` (HTTP/2 *graceful* close — waits for in-flight streams before freeing the socket) but never `session.destroy()`. The graceful close completed but the underlying TCP socket stayed connected, blocking the test fixture's `server.close()` indefinitely on Linux CI runners. Same bug also added ~120 seconds of lingering latency to every local smoke run on Windows (smoke 196s → 76s after fix). The fix calls `session.close()` then `session.destroy()`; by the time we reach close(), all buffered records have been flushed via the awaited `inflightPromise` + final `_doExport`, so destroy() is structurally safe. **Operator impact** — the npm registry has been stuck at v0.6.37 since 2026-05-02; every tag from v0.6.38 → v0.6.57 timed out at the publish workflow's smoke step. With this fix the publish should reach `npm publish`. No layer-0 or integration test changes — the existing `log-stream-otlp-grpc.test.js` round-trip was passing locally because tests use small batches and the lingering socket happens to terminate before the test driver's overall timeout, but it was leaving the process unable to exit cleanly until the OS-level TCP timeout fired. Smoke 7204 / wiki e2e 178 / integration 16 files / eslint clean / shellcheck clean.

package/lib/pagination.js

@@ -108,13 +108,37 @@ var DEFAULT_MAX_LIMIT = 100;
 
 // Canonical JSON — sorted keys at every depth. Mirrors safe-schema /
 // audit-tools so verifier and producer hash exactly the same bytes.
-function _canonicalize(value) {
+//
+// Cursor state must contain only plain data (string, number, boolean,
+// null, plain object, array, Date). Buffer / typed-arrays / Map / Set /
+// RegExp are rejected because the prior `Object.keys` walk silently
+// serialised them as `{}` (Date) or `{"0":97,"1":98,…}` (Buffer) — the
+// operator's data round-tripped through encode/decode as garbage. Date
+// gets an explicit ISO-string conversion (matches stdlib JSON.stringify).
+// Circular references throw cleanly instead of stack-overflowing.
+function _canonicalize(value, seen) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return "[" + value.map(_canonicalize).join(",") + "]";
+  if (value instanceof Date) return JSON.stringify(value.toISOString());
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array ||
+      value instanceof Map  || value instanceof Set ||
+      value instanceof RegExp) {
+    throw new PaginationError("pagination/bad-state",
+      "cursor state cannot contain " + value.constructor.name +
+      "; convert to a plain primitive (string / number / iso-string) first");
+  }
+  seen = seen || new WeakSet();
+  if (seen.has(value)) {
+    throw new PaginationError("pagination/bad-state",
+      "cursor state contains a circular reference");
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    return "[" + value.map(function (v) { return _canonicalize(v, seen); }).join(",") + "]";
+  }
   var keys = Object.keys(value).sort();
   var parts = [];
   for (var i = 0; i < keys.length; i++) {
-    parts.push(JSON.stringify(keys[i]) + ":" + _canonicalize(value[keys[i]]));
+    parts.push(JSON.stringify(keys[i]) + ":" + _canonicalize(value[keys[i]], seen));
   }
   return "{" + parts.join(",") + "}";
 }

package/lib/safe-schema.js

@@ -404,6 +404,17 @@ function _stringMethods(schema, spec) {
   };
   schema.email = function () {
     return chain(function (v, p) {
+      // RFC 5321 §4.5.3.1.3 — max forward-path is 256 octets including
+      // angle brackets, so the address itself is bounded at 254 chars.
+      // Without this cap an operator chaining .email() on a request body
+      // is open to a DoS shape (50 KB email -> downstream DB writes
+      // unbounded string columns, log lines, etc.). Operators with a
+      // legitimate non-RFC reason for longer emails skip .email() and
+      // chain .regex(custom) directly.
+      if (v.length > 254) {
+        return _fail(p, "string/email-too-long",
+          "must be a valid email address (max 254 chars per RFC 5321)");
+      }
       return EMAIL_RE.test(v) ? { ok: true } :
         _fail(p, "string/email", "must be a valid email address");
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.59",
+  "version": "0.6.61",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f1dea294-4db6-4cb4-9820-6958e7939dac",
+  "serialNumber": "urn:uuid:4c584992-71fc-4053-b097-fe6dc1dbb573",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-03T13:30:21.472Z",
+    "timestamp": "2026-05-03T13:46:27.072Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.6.59",
+      "bom-ref": "@blamejs/core@0.6.61",
       "type": "library",
       "name": "blamejs",
-      "version": "0.6.59",
+      "version": "0.6.61",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.6.59",
+      "purl": "pkg:npm/%40blamejs/core@0.6.61",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.6.59",
+      "ref": "@blamejs/core@0.6.61",
       "dependsOn": []
     }
   ]