@blamejs/core 0.6.67 → 0.6.69

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.6.x
 
+- **0.6.69** (2026-05-03) — `lib/numeric-bounds.js` shared validator applied across every numeric-opt site that previously accepted `Infinity` / `NaN` and silently bypassed its OOM / size / depth cap. Pre-fix the recurring pattern `typeof opts.X === "number" && opts.X > 0` was vulnerable everywhere it shipped: `Infinity > Infinity` is false, `byteLength > NaN` is false, `Number.isFinite()` was missing. Operators with env-var coercions (`Number(process.env.MAX_X || "")` produces `NaN` for missing values, `Infinity` for typo'd ones) silently lost their cap. **The unified fix:** new `lib/numeric-bounds.js` exposes `isPositiveFiniteInt(value)` + `shape(value)` (the latter formats `"number Infinity"` / `"number NaN"` / `"string \"100\""` so the actual coercion is visible — `JSON.stringify` collapses Infinity/NaN to `"null"` and hides the typo). Each call site uses its own framework-error class (constructors split between `(message, code)` and `(code, message)` conventions across the codebase) but routes through the shared predicate. **Sites swept:** `lib/safe-buffer.js` (`boundedChunkCollector`, `toBuffer`, `normalizeText` — the v0.6.57 fix only covered the first), `lib/atomic-file.js` (refactored from v0.6.68's inline check), `lib/csv.js` (parse `maxBytes` was operator-overridable to Infinity → multi-megabyte CSV bodies through unbounded), `lib/safe-url.js` (`maxUrlLength` opt was the v0.6.62 fix's escape hatch — now also bounded), `lib/mail-bounce.js` (`maxBytes` for inbound webhook body — DoS-shape on bounce intake). **Tests** — new `test/layer-0-primitives/numeric-bounds.test.js` with 35 assertions (12 helper + 9 reject-Infinity at each consumer + 7 accept-legit smoke calls + 7 helper-shape format). Smoke 7258 → 7293 / wiki e2e 178 / Linux 86.0s / eslint clean / shellcheck clean.
+
+- **0.6.68** (2026-05-03) — `b.atomicFile.read` / `readSync` enforce strict `maxBytes` validation. Same bug class as v0.6.57's `safeBuffer.boundedChunkCollector` fix: pre-fix the size check was `if (stat.size > opts.maxBytes)`, which silently accepted `Infinity` (`stat.size > Infinity` always false → reads any file regardless of size, defeating the OOM cap). Operators with `Number(env.MAX_READ_BYTES || "")` coercion bugs got `NaN` on missing values and unbounded reads on Infinity-typo'd values. New `_validateMaxBytes` runs before the size check and rejects `Infinity` / `NaN` / non-integer / negative / zero / non-number with `atomic-file/bad-opt`. Real-world consumers (vault.initPlaintext, audit-sign, db.loadOrCreateDbKey, etc.) all pass real positive integers via `C.BYTES.*` helpers and are unaffected. **Tests** — 7 new layer-0 boot-validation assertions in `test/00-primitives.js` (Infinity, NaN, 0, -1, 3.5, "100", null all reject). Smoke 7251 → 7258 / wiki e2e 178 / Linux 86.0s / eslint clean / shellcheck clean.
+
 - **0.6.67** (2026-05-03) — canonical-JSON walker extracted to `lib/canonical-json.js` and applied to `lib/audit-tools.js` + `lib/config-drift.js`. Same bug class as v0.6.60 (pagination) and v0.6.66 (audit-chain) lived in two more sites: `audit-tools._canonicalize` (used for backup-bundle JSONL serialisation, requires byte-equivalence with audit-chain) and `config-drift._stableStringify` (used to hash framework config for post-boot tamper detection). Both still had the silent-data-loss walk — Date → `{}`, Buffer → `{"0":97,…}`, Map / Set → `{}`, BigInt throws, circular references stack-overflow. New `lib/canonical-json.js` exposes `stringify(value, opts?)` with `opts.bufferAs = "hex" | "reject"` (default `"hex"` for crypto / config / audit; `"reject"` for pagination's strict-cursor policy). All four call sites — audit-chain, audit-tools, config-drift, pagination — now route through it; the four near-identical inline walkers collapse to one. **Stored-row + bundle compatibility** preserved: existing audit rows verify identically (their `metadata` columns are JSON strings); backup bundles produced pre-v0.6.67 round-trip correctly because byte output for plain types is unchanged. **Tests** — 17 layer-0 audit-chain assertions from v0.6.66 cover the unified walker; existing pagination tests cover `bufferAs: "reject"`. Smoke 7251 / wiki e2e 178 / Linux 86.3s / eslint clean / shellcheck clean.
 
 - **0.6.66** (2026-05-03) — `b.auditChain.canonicalize` deep-walks values and rejects non-plain types instead of silently round-tripping garbage. Same bug class as the v0.6.60 pagination canonicalize fix: pre-fix the walker did `Object.keys(row).map(...)` and JSON.stringify'd whatever fell through, which silently encoded **Map / Set / RegExp** as `{}`, **Symbol / function** as missing keys, **BigInt** as a thrown `Do not know how to serialize` mid-emit (DoS-shape on any operator routing bigint IDs into audit metadata), and **circular references** as the unwrapped JSON.stringify error message. The post-fix walker: BigInt → decimal string (no data loss for large account IDs / 64-bit counters from external-DB drivers); Date → ISO string (already worked via JSON.stringify but now explicit before the recursive walk); Map / Set / RegExp / Symbol / function reject with a clear constructor-name message; circular refs detected via WeakSet and rejected as a framework error. Walks recursively so nested structures (`{ a: [BigInt(1), BigInt(2)] }`, `{ a: { b: Uint8Array(…) } }`) all serialise correctly. **Stored-row compat** — existing audit rows verify identically because their stored `metadata` columns are already JSON strings; the change only affects EMIT-time serialisation. **Tests** — 17 new layer-0 assertions in `test/00-primitives.js`. Smoke 7234 → 7251 / wiki e2e 178 / Linux 86.1s / eslint clean / shellcheck clean.

package/lib/atomic-file.js

@@ -37,6 +37,7 @@ var { generateToken, sha3Hash } = require("./crypto");
 var safeJson = require("./safe-json");
 var C = require("./constants");
 var safeBuffer = require("./safe-buffer");
+var numericBounds = require("./numeric-bounds");
 var safeAsync = require("./safe-async");
 var retry = require("./retry");
 var { FrameworkError } = require("./framework-error");
@@ -331,12 +332,24 @@ function readSync(filepath, opts) {
   return _readSyncCore(filepath, opts);
 }
 
+// maxBytes via shared lib/numeric-bounds — Infinity / NaN bypass the
+// stat.size cap (any-comparison-with-Infinity-or-NaN is false).
+function _validateMaxBytes(maxBytes) {
+  if (!numericBounds.isPositiveFiniteInt(maxBytes)) {
+    throw new AtomicFileError(
+      "atomicFile.read: maxBytes must be a positive finite integer; got " +
+        numericBounds.shape(maxBytes),
+      "atomic-file/bad-opt");
+  }
+}
+
 function _readSyncCore(filepath, opts) {
   if (!fs.existsSync(filepath)) {
     var e = new AtomicFileError("file not found: " + filepath, "atomic-file/not-found");
     e.code = "ENOENT";
     throw e;
   }
+  _validateMaxBytes(opts.maxBytes);
   var stat = fs.statSync(filepath);
   if (stat.size > opts.maxBytes) {
     throw new AtomicFileError(

package/lib/csv.js

@@ -42,6 +42,7 @@
  * Throws CsvError (FrameworkError, permanent) on shape violations.
  */
 var C = require("./constants");
+var numericBounds = require("./numeric-bounds");
 var { defineClass } = require("./framework-error");
 
 var CsvError = defineClass("CsvError", { alwaysPermanent: true });
@@ -83,6 +84,13 @@ function _validateDelim(name, value) {
 
 function parse(input, opts) {
   opts = Object.assign({}, DEFAULTS_PARSE, opts || {});
+  // maxBytes via shared lib/numeric-bounds — Infinity / NaN bypass the
+  // body cap and let a hostile multi-megabyte CSV through unbounded.
+  if (!numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+    throw new CsvError("csv/bad-opt",
+      "csv.parse: maxBytes must be a positive finite integer; got " +
+        numericBounds.shape(opts.maxBytes));
+  }
 
   var s;
   if (typeof input === "string") s = input;

package/lib/mail-bounce.js

@@ -64,6 +64,7 @@
  */
 
 var lazyRequire = require("./lazy-require");
+var numericBounds = require("./numeric-bounds");
 var audit = lazyRequire(function () { return require("./audit"); });
 var safeJson = require("./safe-json");
 var C = require("./constants");
@@ -400,7 +401,20 @@ function handler(opts) {
   var verify = typeof opts.verify === "function" ? opts.verify : null;
   var onBounce = typeof opts.onBounce === "function" ? opts.onBounce : null;
   var auditOn = opts.audit !== false;
-  var maxBytes = typeof opts.maxBytes === "number" ? opts.maxBytes : MAX_BODY_BYTES;
+  // maxBytes must be a positive finite integer (Infinity / NaN /
+  // negative / non-integer all bypass the body cap). See
+  // lib/numeric-bounds for the rationale shared with every other
+  // numeric-opt site swept in v0.6.69.
+  var maxBytes;
+  if (opts.maxBytes === undefined) {
+    maxBytes = MAX_BODY_BYTES;
+  } else if (!numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+    throw new MailBounceError("mail-bounce/bad-opt",
+      "mailBounce.handler: opts.maxBytes must be a positive finite " +
+      "integer; got " + numericBounds.shape(opts.maxBytes), true);
+  } else {
+    maxBytes = opts.maxBytes;
+  }
 
   function _emit(event) {
     if (!auditOn) return;

package/lib/numeric-bounds.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * numeric-bounds — shared validators for operator-tunable numeric opts.
+ *
+ * Replaces the recurring `typeof opts.X === "number" && opts.X > 0`
+ * pattern that ships across the framework. Pre-v0.6.69 each site had
+ * its own slightly-different inline check; the bug they all shared was
+ * accepting `Infinity` (silently bypassing OOM caps, body size limits,
+ * URL caps, depth limits) and `NaN` (also bypassing because every
+ * comparison with NaN is false). v0.6.57 fixed boundedChunkCollector,
+ * v0.6.68 fixed atomicFile, v0.6.69 sweeps the rest.
+ *
+ *   var nb = require("./numeric-bounds");
+ *
+ *   if (!nb.isPositiveFiniteInt(opts.maxBytes)) {
+ *     throw new CsvError("csv/bad-opt",
+ *       "csv.parse: maxBytes must be a positive finite integer; got " +
+ *       nb.shape(opts.maxBytes));
+ *   }
+ *
+ * The helper returns a predicate + a shape-formatter rather than
+ * throwing itself, because the framework's error classes use two
+ * different constructor conventions:
+ *
+ *   AtomicFileError, SafeBufferError, SafeUrlError       (message, code)
+ *   defineClass(...)-built (CsvError, MailBounceError…)  (code, message, permanent[, statusCode])
+ *
+ * Each call site throws its own class, with whatever ctor shape that
+ * class wants. The helper just owns the validation rule + the consistent
+ * shape format ("number Infinity" / "number NaN" / "string \"100\"") so
+ * the typo / coercion is visible in the error message — `JSON.stringify`
+ * collapses Infinity / NaN to "null" which obscures what went wrong.
+ */
+
+// Shape formatter — typeof + String preserves "number Infinity" /
+// "number NaN" / "string foo". Strings get JSON-quoted so trailing
+// whitespace / control chars are visible.
+function shape(value) {
+  if (typeof value === "string") {
+    return "string " + JSON.stringify(value);
+  }
+  return (typeof value) + " " + String(value);
+}
+
+function isPositiveFiniteInt(value) {
+  return typeof value === "number" && Number.isFinite(value) &&
+         Number.isInteger(value) && value > 0;
+}
+
+function isNonNegativeFiniteInt(value) {
+  return typeof value === "number" && Number.isFinite(value) &&
+         Number.isInteger(value) && value >= 0;
+}
+
+module.exports = {
+  shape:                  shape,
+  isPositiveFiniteInt:    isPositiveFiniteInt,
+  isNonNegativeFiniteInt: isNonNegativeFiniteInt,
+};

package/lib/safe-buffer.js

@@ -37,6 +37,7 @@
  *   if the caller doesn't pass one.
  */
 
+var numericBounds = require("./numeric-bounds");
 var { FrameworkError } = require("./framework-error");
 
 class SafeBufferError extends FrameworkError {
@@ -57,7 +58,18 @@ function _throw(errorClass, message, code) {
 
 function normalizeText(input, opts) {
   opts = opts || {};
-  var maxBytes  = (typeof opts.maxBytes === "number" && opts.maxBytes > 0) ? opts.maxBytes : null;
+  // maxBytes optional; positive finite int when set — Infinity / NaN
+  // bypass the cap.
+  var maxBytes = null;
+  if (opts.maxBytes !== undefined && opts.maxBytes !== null) {
+    if (!numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+      throw new SafeBufferError(
+        "normalizeText: maxBytes must be a positive finite integer; got " +
+          numericBounds.shape(opts.maxBytes),
+        "buffer/bad-arg");
+    }
+    maxBytes = opts.maxBytes;
+  }
   var stripBom  = opts.stripBom !== false;  // default true
   var errClass  = opts.errorClass;
   var typeCode  = opts.typeCode  || "buffer/wrong-input-type";
@@ -83,7 +95,17 @@ function normalizeText(input, opts) {
 
 function toBuffer(data, opts) {
   opts = opts || {};
-  var maxBytes = (typeof opts.maxBytes === "number" && opts.maxBytes > 0) ? opts.maxBytes : null;
+  // maxBytes optional; positive finite int when provided.
+  var maxBytes = null;
+  if (opts.maxBytes !== undefined && opts.maxBytes !== null) {
+    if (!numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+      throw new SafeBufferError(
+        "toBuffer: maxBytes must be a positive finite integer; got " +
+          numericBounds.shape(opts.maxBytes),
+        "buffer/bad-arg");
+    }
+    maxBytes = opts.maxBytes;
+  }
   var errClass = opts.errorClass;
   var typeCode = opts.typeCode  || "buffer/wrong-input-type";
   var sizeCode = opts.sizeCode  || "buffer/too-large";
@@ -112,23 +134,16 @@ function toBuffer(data, opts) {
 
 function boundedChunkCollector(opts) {
   opts = opts || {};
-  // maxBytes must be a positive finite integer. Accepting `Infinity`
-  // would defeat the entire point of the bounded collector (a hostile
-  // 10-GB upstream would accumulate fully); accepting `3.5` would set
-  // a non-sensical fractional cap that confuses downstream `total +
-  // chunk.length > maxBytes` arithmetic. NaN, negative, zero, non-
-  // numbers all reject with the same `buffer/bad-arg` so operators
-  // see one consistent error at boot from a typo or misconfiguration.
-  var maxBytes = (typeof opts.maxBytes === "number" &&
-                  Number.isFinite(opts.maxBytes) &&
-                  Number.isInteger(opts.maxBytes) &&
-                  opts.maxBytes > 0) ? opts.maxBytes : null;
-  if (maxBytes === null) {
+  // maxBytes required, positive finite integer. Accepting Infinity
+  // defeats the entire point of the bounded collector (a hostile 10-GB
+  // upstream would accumulate fully).
+  if (!numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
     throw new SafeBufferError(
       "boundedChunkCollector requires maxBytes (positive finite integer); got " +
-      JSON.stringify(opts.maxBytes),
+        numericBounds.shape(opts.maxBytes),
       "buffer/bad-arg");
   }
+  var maxBytes = opts.maxBytes;
   var errClass = opts.errorClass;
   var sizeCode = opts.sizeCode  || "buffer/too-large";
   var sizeMsg  = opts.sizeMessage || "stream body exceeds maxBytes";

package/lib/safe-url.js

@@ -48,6 +48,7 @@
  *   trying and failing weirdly later.
  */
 
+var numericBounds = require("./numeric-bounds");
 var { FrameworkError } = require("./framework-error");
 var { URL } = require("url");
 
@@ -87,9 +88,18 @@ function parse(url, opts) {
     ? opts.allowedProtocols
     : ALLOW_HTTP_TLS;
   var errClass = opts.errorClass;
-  var maxUrlLength = (typeof opts.maxUrlLength === "number" && opts.maxUrlLength > 0)
-    ? opts.maxUrlLength
-    : DEFAULT_MAX_URL_LENGTH;
+  // maxUrlLength via shared lib/numeric-bounds — Infinity / NaN would
+  // silently bypass the cap (size > Infinity is always false).
+  var maxUrlLength;
+  if (opts.maxUrlLength === undefined) {
+    maxUrlLength = DEFAULT_MAX_URL_LENGTH;
+  } else if (!numericBounds.isPositiveFiniteInt(opts.maxUrlLength)) {
+    throw _makeError(errClass, "safe-url/bad-opt",
+      "safeUrl.parse: maxUrlLength must be a positive finite integer; got " +
+        numericBounds.shape(opts.maxUrlLength));
+  } else {
+    maxUrlLength = opts.maxUrlLength;
+  }
 
   if (url == null || url === "") {
     throw _makeError(errClass, "safe-url/missing", "url is required");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.67",
+  "version": "0.6.69",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:28be00e0-fbc9-4324-9213-5bfe704f8667",
+  "serialNumber": "urn:uuid:99ad68c2-f813-40dc-8f9e-0cda46f62feb",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-03T14:50:38.247Z",
+    "timestamp": "2026-05-03T15:21:23.088Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.6.67",
+      "bom-ref": "@blamejs/core@0.6.69",
       "type": "library",
       "name": "blamejs",
-      "version": "0.6.67",
+      "version": "0.6.69",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.6.67",
+      "purl": "pkg:npm/%40blamejs/core@0.6.69",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.6.67",
+      "ref": "@blamejs/core@0.6.69",
       "dependsOn": []
     }
   ]