@blamejs/core 0.6.64 → 0.6.66

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.6.x
 
+- **0.6.66** (2026-05-03) — `b.auditChain.canonicalize` deep-walks values and rejects non-plain types instead of silently round-tripping garbage. Same bug class as the v0.6.60 pagination canonicalize fix: pre-fix the walker did `Object.keys(row).map(...)` and JSON.stringify'd whatever fell through, which silently encoded **Map / Set / RegExp** as `{}`, **Symbol / function** as missing keys, **BigInt** as a thrown `Do not know how to serialize` mid-emit (DoS-shape on any operator routing bigint IDs into audit metadata), and **circular references** as the unwrapped JSON.stringify error message. The post-fix walker: BigInt → decimal string (no data loss for large account IDs / 64-bit counters from external-DB drivers); Date → ISO string (already worked via JSON.stringify but now explicit before the recursive walk); Map / Set / RegExp / Symbol / function reject with a clear constructor-name message; circular refs detected via WeakSet and rejected as a framework error. Walks recursively so nested structures (`{ a: [BigInt(1), BigInt(2)] }`, `{ a: { b: Uint8Array(…) } }`) all serialise correctly. **Stored-row compat** — existing audit rows verify identically because their stored `metadata` columns are already JSON strings; the change only affects EMIT-time serialisation. **Tests** — 17 new layer-0 assertions in `test/00-primitives.js`. Smoke 7234 → 7251 / wiki e2e 178 / Linux 86.1s / eslint clean / shellcheck clean.
+
+- **0.6.65** (2026-05-03) — `b.scheduler.parseCron` rejects step values exceeding the field's range. Pre-fix `*/99999 * * * *` was silently accepted and degenerated to "minute 0 of every hour" (because the for-loop adding values stopped at the first iteration when `step > range`); an operator typing the typo got a once-per-hour schedule when they probably meant once per N minutes. Now `_parseCronField` rejects with `scheduler/invalid-cron` when `step > (range.max - range.min + 1)`. The bound is inclusive so `*/60 * * * *` (= "minute 0 of every hour" written with a redundant explicit step) still accepts. **Tests** — 4 new layer-0 assertions: `*/60` accepts, `*/61` rejects, `*/99999` rejects (the silent-degenerate case), `* */25 * * *` rejects (step > 24-hour range). Smoke 7230 → 7234 / wiki e2e 178 / Linux 86.9s / eslint clean / shellcheck clean.
+
 - **0.6.64** (2026-05-03) — `b.credentialHash.verify` now enforces the same 16-byte minimum payload that `hash()` enforces. Pre-fix the asymmetry was a real risk: `hash()` refused to *create* a hash shorter than 16 bytes (`length < 16` rejected with `credential-hash/bad-opt`), but `verify()` silently accepted any payload length, including 1-byte payloads where the collision space is **256** — a hand-crafted envelope `{ magic, algoId, SHAKE256(targetPassword, 1)[0] }` would verify against the target password in microseconds. A storage bug or attacker tampering that truncated the stored envelope produced a verifiable but catastrophically weak hash; an attacker with DB write access who couldn't replace the hash outright could *truncate* it to a nearly-cleartext-equivalent value. Both ends now refuse short payloads symmetrically via the new `SHAKE256_MIN_LENGTH = 16` constant; verify returns false (with `payload-too-short` observability label) when the envelope's payload is < 16 bytes. Legitimate truncation that keeps the payload ≥ 16 bytes still verifies (the framework's design intentionally supports XOF variable-length digests via `params: { length: N }`); the bound only refuses hashes too short to provide meaningful collision resistance. **Tests** — 4 new layer-0 assertions on `b.credentialHash.verify` (1-byte attack envelope rejected, 15-byte rejected, 16-byte accepts, hash() rejects length 15). Smoke 7226 → 7230 / wiki e2e 178 / Linux 86.5s / eslint clean / shellcheck clean.
 
 - **0.6.63** (2026-05-03) — `b.parsers.toml.parse` enforces `maxDepth` on dotted-key paths. Pre-fix the parser walked arbitrarily deep table headers (`[a.b.c.d.e…]`) without applying the existing `maxDepth` (which only ran inside `_parseValue` for inline tables / arrays); a 10,000-segment path built a tree deep enough to stack-overflow the recursive `_normalize` walker post-parse. An attacker submitting a malicious TOML config to `b.config` would crash the framework at boot or whenever the file was reloaded. Now `_parseDottedKey` rejects a path with more than `maxDepth` segments via the same `toml/too-deep` error code already used for value-side depth. **Tests** — 4 new layer-0 assertions: 99-segment path under default depth accepts, 150-segment path rejects with `toml/too-deep`, 10K-segment path rejects (no stack overflow), `maxDepth: 1000` opt allows a 500-segment path. Smoke 7222 → 7226 / wiki e2e 178 / Linux 85.6s / eslint clean / shellcheck clean.

package/lib/audit-chain.js

@@ -26,16 +26,55 @@ var ZERO_HASH = "0".repeat(128);
 // Canonicalize a row for hashing. Excludes the hash/nonce columns themselves
 // and any caller-specified columns. Sorted keys, JSON-encoded values; Buffer
 // values converted to hex for stable byte serialization.
+//
+// Deeply walks the value tree so non-plain types reject cleanly instead of
+// silently round-tripping as `{}` (Map / Set / RegExp), as `{"0":97,…}`
+// (Buffer / typed-array nested inside arrays / objects), or as missing
+// keys (Symbol / function). BigInt converts to its decimal string —
+// large account IDs / monotonic counters from external-DB drivers
+// frequently land as BigInt, and crashing the audit emit on those would
+// turn them into availability incidents. Circular refs throw a clean
+// framework Error rather than the raw JSON.stringify message.
+function _scrub(value, seen) {
+  if (value === null || typeof value === "undefined") return null;
+  var t = typeof value;
+  if (t === "string" || t === "boolean" || t === "number") return value;
+  if (t === "bigint") return String(value);
+  if (t === "symbol" || t === "function") {
+    throw new Error("audit-chain canonicalize: " + t + " value is not " +
+      "serialisable; convert to a string before emit");
+  }
+  if (Buffer.isBuffer(value))            return value.toString("hex");
+  if (value instanceof Uint8Array)       return Buffer.from(value).toString("hex");
+  if (value instanceof Date)             return value.toISOString();
+  // After the primitives + Buffer + Date, any remaining "object" must be
+  // a plain object or array. Map / Set / RegExp / class instances all
+  // reject with a clear constructor name in the error so operators see
+  // exactly which audit metadata field is the culprit.
+  if (value instanceof Map || value instanceof Set || value instanceof RegExp) {
+    throw new Error("audit-chain canonicalize: " + value.constructor.name +
+      " is not serialisable; convert to a plain primitive / array / object first");
+  }
+  seen = seen || new WeakSet();
+  if (seen.has(value)) {
+    throw new Error("audit-chain canonicalize: circular reference in audit row");
+  }
+  seen.add(value);
+  if (Array.isArray(value)) return value.map(function (v) { return _scrub(v, seen); });
+  var keys = Object.keys(value).sort();
+  var out = {};
+  for (var i = 0; i < keys.length; i++) {
+    out[keys[i]] = _scrub(value[keys[i]], seen);
+  }
+  return out;
+}
+
 function canonicalize(row, excludeKeys) {
   var ex = new Set(excludeKeys || []);
   var keys = Object.keys(row).filter(function (k) { return !ex.has(k); }).sort();
   var pairs = {};
   for (var i = 0; i < keys.length; i++) {
-    var v = row[keys[i]];
-    if (Buffer.isBuffer(v))                    v = v.toString("hex");
-    else if (v instanceof Uint8Array)          v = Buffer.from(v).toString("hex");
-    else if (v === undefined)                  v = null;
-    pairs[keys[i]] = v;
+    pairs[keys[i]] = _scrub(row[keys[i]]);
   }
   return JSON.stringify(pairs);
 }

package/lib/scheduler.js

@@ -123,6 +123,21 @@ function _parseCronField(text, range) {
         throw new SchedulerError("scheduler/invalid-cron",
           "bad step '" + stepStr + "' in cron field '" + range.name + "'", true);
       }
+      // Reject step > field-range, even though the for-loop below would
+      // silently produce a single-value schedule (e.g. `*/99999` for
+      // minutes degenerates to "minute 0 of every hour"). An operator
+      // typing `*/99999` clearly meant something else; silent acceptance
+      // hides the typo and produces a schedule that fires once per hour
+      // when the operator probably wanted once per N minutes for small N.
+      // The bound is `range.max - range.min + 1` so e.g. minutes (0-59)
+      // accepts step up to 60 (inclusive — `*/60` is "minute 0 of every
+      // hour" written with a redundant step).
+      var rangeSize = range.max - range.min + 1;
+      if (step > rangeSize) {
+        throw new SchedulerError("scheduler/invalid-cron",
+          "step '" + stepStr + "' exceeds field range (" + rangeSize +
+          ") in cron field '" + range.name + "'", true);
+      }
       part = part.slice(0, stepIdx);
     }
     var lo, hi;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.64",
+  "version": "0.6.66",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e636e4f9-23c0-41e8-8e78-f898e223c0e7",
+  "serialNumber": "urn:uuid:cfffbb8d-56d9-4859-af94-b238e781b705",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-03T14:18:03.806Z",
+    "timestamp": "2026-05-03T14:41:25.970Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.6.64",
+      "bom-ref": "@blamejs/core@0.6.66",
       "type": "library",
       "name": "blamejs",
-      "version": "0.6.64",
+      "version": "0.6.66",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.6.64",
+      "purl": "pkg:npm/%40blamejs/core@0.6.66",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.6.64",
+      "ref": "@blamejs/core@0.6.66",
       "dependsOn": []
     }
   ]