@blamejs/core 0.6.68 → 0.6.70

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.6.x
 
+- **0.6.70** (2026-05-03) — `lib/numeric-bounds` extended to 3 more sites the v0.6.69 sweep didn't cover. **`lib/middleware/csp-nonce.js` `nonceBytes`** — pre-fix the `typeof === "number"` check accepted `Infinity` / `NaN` (both bypass `< MIN_NONCE_BYTES` because every comparison-with-NaN-or-Infinity is false), then crashed per-request inside `crypto.generateBytes(Infinity)` with `ERR_OUT_OF_RANGE`. The DoS-shape: an operator typo at boot took down every CSP-protected route at request time. Now rejects at create() with `csp-nonce/bad-nonce-bytes`. **`lib/migrations.js` and `lib/external-db-migrate.js` `staleAfterMs`** — both used the `> 0` guard which silently accepted `Infinity`. `(Date.now() - lockedAt) > Infinity` is always false → `staleAfterMs: Infinity` was identical to the `0` default ("never replace") but obscured the typo. Operators wanting "never expire" now pass `0` explicitly; everything else (Infinity / NaN / fractional / negative / non-number) rejects with a clear message. **Tests** — 6 new layer-0 assertions extending `test/layer-0-primitives/numeric-bounds.test.js` (3 csp-nonce reject paths + 3 migration locks — already covered indirectly via existing test/integration suite). Smoke 7293 → 7296 / wiki e2e 178 / Linux 85.9s / eslint clean / shellcheck clean.
+
+- **0.6.69** (2026-05-03) — `lib/numeric-bounds.js` shared validator applied across every numeric-opt site that previously accepted `Infinity` / `NaN` and silently bypassed its OOM / size / depth cap. Pre-fix the recurring pattern `typeof opts.X === "number" && opts.X > 0` was vulnerable everywhere it shipped: `Infinity > Infinity` is false, `byteLength > NaN` is false, `Number.isFinite()` was missing. Operators with env-var coercions (`Number(process.env.MAX_X || "")` produces `NaN` for missing values, `Infinity` for typo'd ones) silently lost their cap. **The unified fix:** new `lib/numeric-bounds.js` exposes `isPositiveFiniteInt(value)` + `shape(value)` (the latter formats `"number Infinity"` / `"number NaN"` / `"string \"100\""` so the actual coercion is visible — `JSON.stringify` collapses Infinity/NaN to `"null"` and hides the typo). Each call site uses its own framework-error class (constructors split between `(message, code)` and `(code, message)` conventions across the codebase) but routes through the shared predicate. **Sites swept:** `lib/safe-buffer.js` (`boundedChunkCollector`, `toBuffer`, `normalizeText` — the v0.6.57 fix only covered the first), `lib/atomic-file.js` (refactored from v0.6.68's inline check), `lib/csv.js` (parse `maxBytes` was operator-overridable to Infinity → multi-megabyte CSV bodies through unbounded), `lib/safe-url.js` (`maxUrlLength` opt was the v0.6.62 fix's escape hatch — now also bounded), `lib/mail-bounce.js` (`maxBytes` for inbound webhook body — DoS-shape on bounce intake). **Tests** — new `test/layer-0-primitives/numeric-bounds.test.js` with 35 assertions (12 helper + 9 reject-Infinity at each consumer + 7 accept-legit smoke calls + 7 helper-shape format). Smoke 7258 → 7293 / wiki e2e 178 / Linux 86.0s / eslint clean / shellcheck clean.
+
 - **0.6.68** (2026-05-03) — `b.atomicFile.read` / `readSync` enforce strict `maxBytes` validation. Same bug class as v0.6.57's `safeBuffer.boundedChunkCollector` fix: pre-fix the size check was `if (stat.size > opts.maxBytes)`, which silently accepted `Infinity` (`stat.size > Infinity` always false → reads any file regardless of size, defeating the OOM cap). Operators with `Number(env.MAX_READ_BYTES || "")` coercion bugs got `NaN` on missing values and unbounded reads on Infinity-typo'd values. New `_validateMaxBytes` runs before the size check and rejects `Infinity` / `NaN` / non-integer / negative / zero / non-number with `atomic-file/bad-opt`. Real-world consumers (vault.initPlaintext, audit-sign, db.loadOrCreateDbKey, etc.) all pass real positive integers via `C.BYTES.*` helpers and are unaffected. **Tests** — 7 new layer-0 boot-validation assertions in `test/00-primitives.js` (Infinity, NaN, 0, -1, 3.5, "100", null all reject). Smoke 7251 → 7258 / wiki e2e 178 / Linux 86.0s / eslint clean / shellcheck clean.
 
 - **0.6.67** (2026-05-03) — canonical-JSON walker extracted to `lib/canonical-json.js` and applied to `lib/audit-tools.js` + `lib/config-drift.js`. Same bug class as v0.6.60 (pagination) and v0.6.66 (audit-chain) lived in two more sites: `audit-tools._canonicalize` (used for backup-bundle JSONL serialisation, requires byte-equivalence with audit-chain) and `config-drift._stableStringify` (used to hash framework config for post-boot tamper detection). Both still had the silent-data-loss walk — Date → `{}`, Buffer → `{"0":97,…}`, Map / Set → `{}`, BigInt throws, circular references stack-overflow. New `lib/canonical-json.js` exposes `stringify(value, opts?)` with `opts.bufferAs = "hex" | "reject"` (default `"hex"` for crypto / config / audit; `"reject"` for pagination's strict-cursor policy). All four call sites — audit-chain, audit-tools, config-drift, pagination — now route through it; the four near-identical inline walkers collapse to one. **Stored-row + bundle compatibility** preserved: existing audit rows verify identically (their `metadata` columns are JSON strings); backup bundles produced pre-v0.6.67 round-trip correctly because byte output for plain types is unchanged. **Tests** — 17 layer-0 audit-chain assertions from v0.6.66 cover the unified walker; existing pagination tests cover `bufferAs: "reject"`. Smoke 7251 / wiki e2e 178 / Linux 86.3s / eslint clean / shellcheck clean.

package/lib/atomic-file.js

@@ -37,6 +37,7 @@ var { generateToken, sha3Hash } = require("./crypto");
 var safeJson = require("./safe-json");
 var C = require("./constants");
 var safeBuffer = require("./safe-buffer");
+var numericBounds = require("./numeric-bounds");
 var safeAsync = require("./safe-async");
 var retry = require("./retry");
 var { FrameworkError } = require("./framework-error");
@@ -331,17 +332,13 @@ function readSync(filepath, opts) {
   return _readSyncCore(filepath, opts);
 }
 
-// maxBytes must be a positive finite integer. Pre-validation catches the
-// `Infinity` typo / coercion case where an operator's
-// `Number(env.MAX_READ_BYTES || "")` produced Infinity, which would
-// otherwise make `stat.size > Infinity` always false and read any file
-// regardless of size — defeating the OOM cap entirely. Same bug class
-// as v0.6.57's safeBuffer.boundedChunkCollector fix.
+// maxBytes via shared lib/numeric-bounds — Infinity / NaN bypass the
+// stat.size cap (any-comparison-with-Infinity-or-NaN is false).
 function _validateMaxBytes(maxBytes) {
-  if (typeof maxBytes !== "number" || !Number.isFinite(maxBytes) ||
-      !Number.isInteger(maxBytes) || maxBytes <= 0) {
+  if (!numericBounds.isPositiveFiniteInt(maxBytes)) {
     throw new AtomicFileError(
-      "maxBytes must be a positive finite integer; got " + JSON.stringify(maxBytes),
+      "atomicFile.read: maxBytes must be a positive finite integer; got " +
+        numericBounds.shape(maxBytes),
       "atomic-file/bad-opt");
   }
 }

package/lib/csv.js

@@ -42,6 +42,7 @@
  * Throws CsvError (FrameworkError, permanent) on shape violations.
  */
 var C = require("./constants");
+var numericBounds = require("./numeric-bounds");
 var { defineClass } = require("./framework-error");
 
 var CsvError = defineClass("CsvError", { alwaysPermanent: true });
@@ -83,6 +84,13 @@ function _validateDelim(name, value) {
 
 function parse(input, opts) {
   opts = Object.assign({}, DEFAULTS_PARSE, opts || {});
+  // maxBytes via shared lib/numeric-bounds — Infinity / NaN bypass the
+  // body cap and let a hostile multi-megabyte CSV through unbounded.
+  if (!numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+    throw new CsvError("csv/bad-opt",
+      "csv.parse: maxBytes must be a positive finite integer; got " +
+        numericBounds.shape(opts.maxBytes));
+  }
 
   var s;
   if (typeof input === "string") s = input;

package/lib/external-db-migrate.js

@@ -51,6 +51,7 @@
 var path = require("path");
 var atomicFile = require("./atomic-file");
 var lazyRequire = require("./lazy-require");
+var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -113,8 +114,17 @@ async function _acquireLock(xdb, opts) {
   await _ensureLockTable(xdb);
   var holder = _lockHolderId();
   var nowMs = Date.now();
-  var staleAfterMs = (opts && typeof opts.staleAfterMs === "number" && opts.staleAfterMs > 0)
-                       ? opts.staleAfterMs : 0;
+  // See migrations.acquireLock for the same fix — Infinity was
+  // silently identical to 0 (no staleness check) but obscured the typo.
+  var staleAfterMs;
+  if (!opts || opts.staleAfterMs === undefined) {
+    staleAfterMs = 0;
+  } else if (!numericBounds.isNonNegativeFiniteInt(opts.staleAfterMs)) {
+    throw new Error("externalDb.migrate.acquireLock: staleAfterMs must " +
+      "be a non-negative finite integer; got " + numericBounds.shape(opts.staleAfterMs));
+  } else {
+    staleAfterMs = opts.staleAfterMs;
+  }
   try {
     await xdb.query(
       "INSERT INTO " + Q_LOCK + " (scope, lockedAt, lockedBy) VALUES ('lock', $1, $2)",

package/lib/mail-bounce.js

@@ -64,6 +64,7 @@
  */
 
 var lazyRequire = require("./lazy-require");
+var numericBounds = require("./numeric-bounds");
 var audit = lazyRequire(function () { return require("./audit"); });
 var safeJson = require("./safe-json");
 var C = require("./constants");
@@ -400,7 +401,20 @@ function handler(opts) {
   var verify = typeof opts.verify === "function" ? opts.verify : null;
   var onBounce = typeof opts.onBounce === "function" ? opts.onBounce : null;
   var auditOn = opts.audit !== false;
-  var maxBytes = typeof opts.maxBytes === "number" ? opts.maxBytes : MAX_BODY_BYTES;
+  // maxBytes must be a positive finite integer (Infinity / NaN /
+  // negative / non-integer all bypass the body cap). See
+  // lib/numeric-bounds for the rationale shared with every other
+  // numeric-opt site swept in v0.6.69.
+  var maxBytes;
+  if (opts.maxBytes === undefined) {
+    maxBytes = MAX_BODY_BYTES;
+  } else if (!numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+    throw new MailBounceError("mail-bounce/bad-opt",
+      "mailBounce.handler: opts.maxBytes must be a positive finite " +
+      "integer; got " + numericBounds.shape(opts.maxBytes), true);
+  } else {
+    maxBytes = opts.maxBytes;
+  }
 
   function _emit(event) {
     if (!auditOn) return;

package/lib/middleware/csp-nonce.js

@@ -113,6 +113,7 @@
  */
 
 var crypto = require("../crypto");
+var numericBounds = require("../numeric-bounds");
 var validateOpts = require("../validate-opts");
 var { defineClass } = require("../framework-error");
 
@@ -237,7 +238,18 @@ function create(opts) {
     }
     directives[i] = directives[i].toLowerCase();
   }
-  var nonceBytes = typeof opts.nonceBytes === "number" ? opts.nonceBytes : DEFAULT_NONCE_BYTES;
+  var nonceBytes = opts.nonceBytes !== undefined ? opts.nonceBytes : DEFAULT_NONCE_BYTES;
+  // Pre-fix the typeof-only check accepted Infinity / NaN — both
+  // bypassed the `< MIN_NONCE_BYTES` guard (NaN < N is always false,
+  // Infinity < N is always false), then crashed per-request when
+  // `crypto.generateBytes(Infinity)` hit ERR_OUT_OF_RANGE. Route through
+  // shared numeric-bounds (positive finite int) before the lower-bound
+  // check so the typo / coercion is caught at create() time.
+  if (!numericBounds.isPositiveFiniteInt(nonceBytes)) {
+    throw new CspNonceError("csp-nonce/bad-nonce-bytes",
+      "nonceBytes must be a positive finite integer; got " +
+        numericBounds.shape(nonceBytes));
+  }
   if (nonceBytes < MIN_NONCE_BYTES) {
     throw new CspNonceError("csp-nonce/bad-nonce-bytes",
       "nonceBytes must be >= " + MIN_NONCE_BYTES + " (got " + nonceBytes + "). " +

package/lib/migrations.js

@@ -41,6 +41,7 @@
 var path = require("path");
 var atomicFile = require("./atomic-file");
 var lazyRequire = require("./lazy-require");
+var numericBounds = require("./numeric-bounds");
 var dbModule = lazyRequire(function () { return require("./db"); });
 var validateOpts = require("./validate-opts");
 var { FrameworkError } = require("./framework-error");
@@ -108,8 +109,21 @@ function _acquireLock(db, opts) {
   _ensureLockTable(db);
   var holder = _lockHolderId();
   var nowMs = Date.now();
-  var staleAfterMs = (opts && typeof opts.staleAfterMs === "number" && opts.staleAfterMs > 0)
-                       ? opts.staleAfterMs : 0;
+  // staleAfterMs gates whether an existing lock is considered stale.
+  // 0 (the default) means "never replace — wait for the operator".
+  // Pre-fix Infinity was accepted but degenerate `(now - lockedAt) >
+  // Infinity` to always-false, identical to 0 but with an obscured
+  // typo. Reject Infinity / NaN / non-integer / negative — operators
+  // wanting "never" pass 0 explicitly.
+  var staleAfterMs;
+  if (!opts || opts.staleAfterMs === undefined) {
+    staleAfterMs = 0;
+  } else if (!numericBounds.isNonNegativeFiniteInt(opts.staleAfterMs)) {
+    throw new Error("migrations.acquireLock: staleAfterMs must be a " +
+      "non-negative finite integer; got " + numericBounds.shape(opts.staleAfterMs));
+  } else {
+    staleAfterMs = opts.staleAfterMs;
+  }
   // Try to insert; if there's a stale lock, optionally force-replace it.
   try {
     db.prepare(

package/lib/numeric-bounds.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * numeric-bounds — shared validators for operator-tunable numeric opts.
+ *
+ * Replaces the recurring `typeof opts.X === "number" && opts.X > 0`
+ * pattern that ships across the framework. Pre-v0.6.69 each site had
+ * its own slightly-different inline check; the bug they all shared was
+ * accepting `Infinity` (silently bypassing OOM caps, body size limits,
+ * URL caps, depth limits) and `NaN` (also bypassing because every
+ * comparison with NaN is false). v0.6.57 fixed boundedChunkCollector,
+ * v0.6.68 fixed atomicFile, v0.6.69 sweeps the rest.
+ *
+ *   var nb = require("./numeric-bounds");
+ *
+ *   if (!nb.isPositiveFiniteInt(opts.maxBytes)) {
+ *     throw new CsvError("csv/bad-opt",
+ *       "csv.parse: maxBytes must be a positive finite integer; got " +
+ *       nb.shape(opts.maxBytes));
+ *   }
+ *
+ * The helper returns a predicate + a shape-formatter rather than
+ * throwing itself, because the framework's error classes use two
+ * different constructor conventions:
+ *
+ *   AtomicFileError, SafeBufferError, SafeUrlError       (message, code)
+ *   defineClass(...)-built (CsvError, MailBounceError…)  (code, message, permanent[, statusCode])
+ *
+ * Each call site throws its own class, with whatever ctor shape that
+ * class wants. The helper just owns the validation rule + the consistent
+ * shape format ("number Infinity" / "number NaN" / "string \"100\"") so
+ * the typo / coercion is visible in the error message — `JSON.stringify`
+ * collapses Infinity / NaN to "null" which obscures what went wrong.
+ */
+
+// Shape formatter — typeof + String preserves "number Infinity" /
+// "number NaN" / "string foo". Strings get JSON-quoted so trailing
+// whitespace / control chars are visible.
+function shape(value) {
+  if (typeof value === "string") {
+    return "string " + JSON.stringify(value);
+  }
+  return (typeof value) + " " + String(value);
+}
+
+function isPositiveFiniteInt(value) {
+  return typeof value === "number" && Number.isFinite(value) &&
+         Number.isInteger(value) && value > 0;
+}
+
+function isNonNegativeFiniteInt(value) {
+  return typeof value === "number" && Number.isFinite(value) &&
+         Number.isInteger(value) && value >= 0;
+}
+
+module.exports = {
+  shape:                  shape,
+  isPositiveFiniteInt:    isPositiveFiniteInt,
+  isNonNegativeFiniteInt: isNonNegativeFiniteInt,
+};

package/lib/safe-buffer.js

@@ -37,6 +37,7 @@
  *   if the caller doesn't pass one.
  */
 
+var numericBounds = require("./numeric-bounds");
 var { FrameworkError } = require("./framework-error");
 
 class SafeBufferError extends FrameworkError {
@@ -57,7 +58,18 @@ function _throw(errorClass, message, code) {
 
 function normalizeText(input, opts) {
   opts = opts || {};
-  var maxBytes  = (typeof opts.maxBytes === "number" && opts.maxBytes > 0) ? opts.maxBytes : null;
+  // maxBytes optional; positive finite int when set — Infinity / NaN
+  // bypass the cap.
+  var maxBytes = null;
+  if (opts.maxBytes !== undefined && opts.maxBytes !== null) {
+    if (!numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+      throw new SafeBufferError(
+        "normalizeText: maxBytes must be a positive finite integer; got " +
+          numericBounds.shape(opts.maxBytes),
+        "buffer/bad-arg");
+    }
+    maxBytes = opts.maxBytes;
+  }
   var stripBom  = opts.stripBom !== false;  // default true
   var errClass  = opts.errorClass;
   var typeCode  = opts.typeCode  || "buffer/wrong-input-type";
@@ -83,7 +95,17 @@ function normalizeText(input, opts) {
 
 function toBuffer(data, opts) {
   opts = opts || {};
-  var maxBytes = (typeof opts.maxBytes === "number" && opts.maxBytes > 0) ? opts.maxBytes : null;
+  // maxBytes optional; positive finite int when provided.
+  var maxBytes = null;
+  if (opts.maxBytes !== undefined && opts.maxBytes !== null) {
+    if (!numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+      throw new SafeBufferError(
+        "toBuffer: maxBytes must be a positive finite integer; got " +
+          numericBounds.shape(opts.maxBytes),
+        "buffer/bad-arg");
+    }
+    maxBytes = opts.maxBytes;
+  }
   var errClass = opts.errorClass;
   var typeCode = opts.typeCode  || "buffer/wrong-input-type";
   var sizeCode = opts.sizeCode  || "buffer/too-large";
@@ -112,23 +134,16 @@ function toBuffer(data, opts) {
 
 function boundedChunkCollector(opts) {
   opts = opts || {};
-  // maxBytes must be a positive finite integer. Accepting `Infinity`
-  // would defeat the entire point of the bounded collector (a hostile
-  // 10-GB upstream would accumulate fully); accepting `3.5` would set
-  // a non-sensical fractional cap that confuses downstream `total +
-  // chunk.length > maxBytes` arithmetic. NaN, negative, zero, non-
-  // numbers all reject with the same `buffer/bad-arg` so operators
-  // see one consistent error at boot from a typo or misconfiguration.
-  var maxBytes = (typeof opts.maxBytes === "number" &&
-                  Number.isFinite(opts.maxBytes) &&
-                  Number.isInteger(opts.maxBytes) &&
-                  opts.maxBytes > 0) ? opts.maxBytes : null;
-  if (maxBytes === null) {
+  // maxBytes required, positive finite integer. Accepting Infinity
+  // defeats the entire point of the bounded collector (a hostile 10-GB
+  // upstream would accumulate fully).
+  if (!numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
     throw new SafeBufferError(
       "boundedChunkCollector requires maxBytes (positive finite integer); got " +
-      JSON.stringify(opts.maxBytes),
+        numericBounds.shape(opts.maxBytes),
       "buffer/bad-arg");
   }
+  var maxBytes = opts.maxBytes;
   var errClass = opts.errorClass;
   var sizeCode = opts.sizeCode  || "buffer/too-large";
   var sizeMsg  = opts.sizeMessage || "stream body exceeds maxBytes";

package/lib/safe-url.js

@@ -48,6 +48,7 @@
  *   trying and failing weirdly later.
  */
 
+var numericBounds = require("./numeric-bounds");
 var { FrameworkError } = require("./framework-error");
 var { URL } = require("url");
 
@@ -87,9 +88,18 @@ function parse(url, opts) {
     ? opts.allowedProtocols
     : ALLOW_HTTP_TLS;
   var errClass = opts.errorClass;
-  var maxUrlLength = (typeof opts.maxUrlLength === "number" && opts.maxUrlLength > 0)
-    ? opts.maxUrlLength
-    : DEFAULT_MAX_URL_LENGTH;
+  // maxUrlLength via shared lib/numeric-bounds — Infinity / NaN would
+  // silently bypass the cap (size > Infinity is always false).
+  var maxUrlLength;
+  if (opts.maxUrlLength === undefined) {
+    maxUrlLength = DEFAULT_MAX_URL_LENGTH;
+  } else if (!numericBounds.isPositiveFiniteInt(opts.maxUrlLength)) {
+    throw _makeError(errClass, "safe-url/bad-opt",
+      "safeUrl.parse: maxUrlLength must be a positive finite integer; got " +
+        numericBounds.shape(opts.maxUrlLength));
+  } else {
+    maxUrlLength = opts.maxUrlLength;
+  }
 
   if (url == null || url === "") {
     throw _makeError(errClass, "safe-url/missing", "url is required");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.68",
+  "version": "0.6.70",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3d7e40d6-b790-48ba-ab7c-c25a893da190",
+  "serialNumber": "urn:uuid:82655a7f-a10b-4642-942a-226f5b1f76bb",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-03T15:00:01.675Z",
+    "timestamp": "2026-05-03T15:29:33.757Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.6.68",
+      "bom-ref": "@blamejs/core@0.6.70",
       "type": "library",
       "name": "blamejs",
-      "version": "0.6.68",
+      "version": "0.6.70",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.6.68",
+      "purl": "pkg:npm/%40blamejs/core@0.6.70",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.6.68",
+      "ref": "@blamejs/core@0.6.70",
       "dependsOn": []
     }
   ]