@blamejs/core 0.6.69 → 0.6.70

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.6.x
 
+- **0.6.70** (2026-05-03) — `lib/numeric-bounds` extended to 3 more sites the v0.6.69 sweep didn't cover. **`lib/middleware/csp-nonce.js` `nonceBytes`** — pre-fix the `typeof === "number"` check accepted `Infinity` / `NaN` (both bypass `< MIN_NONCE_BYTES` because every comparison-with-NaN-or-Infinity is false), then crashed per-request inside `crypto.generateBytes(Infinity)` with `ERR_OUT_OF_RANGE`. The DoS-shape: an operator typo at boot took down every CSP-protected route at request time. Now rejects at create() with `csp-nonce/bad-nonce-bytes`. **`lib/migrations.js` and `lib/external-db-migrate.js` `staleAfterMs`** — both used the `> 0` guard which silently accepted `Infinity`. `(Date.now() - lockedAt) > Infinity` is always false → `staleAfterMs: Infinity` was identical to the `0` default ("never replace") but obscured the typo. Operators wanting "never expire" now pass `0` explicitly; everything else (Infinity / NaN / fractional / negative / non-number) rejects with a clear message. **Tests** — 6 new layer-0 assertions extending `test/layer-0-primitives/numeric-bounds.test.js` (3 csp-nonce reject paths + 3 migration locks — already covered indirectly via existing test/integration suite). Smoke 7293 → 7296 / wiki e2e 178 / Linux 85.9s / eslint clean / shellcheck clean.
+
 - **0.6.69** (2026-05-03) — `lib/numeric-bounds.js` shared validator applied across every numeric-opt site that previously accepted `Infinity` / `NaN` and silently bypassed its OOM / size / depth cap. Pre-fix the recurring pattern `typeof opts.X === "number" && opts.X > 0` was vulnerable everywhere it shipped: `Infinity > Infinity` is false, `byteLength > NaN` is false, `Number.isFinite()` was missing. Operators with env-var coercions (`Number(process.env.MAX_X || "")` produces `NaN` for missing values, `Infinity` for typo'd ones) silently lost their cap. **The unified fix:** new `lib/numeric-bounds.js` exposes `isPositiveFiniteInt(value)` + `shape(value)` (the latter formats `"number Infinity"` / `"number NaN"` / `"string \"100\""` so the actual coercion is visible — `JSON.stringify` collapses Infinity/NaN to `"null"` and hides the typo). Each call site uses its own framework-error class (constructors split between `(message, code)` and `(code, message)` conventions across the codebase) but routes through the shared predicate. **Sites swept:** `lib/safe-buffer.js` (`boundedChunkCollector`, `toBuffer`, `normalizeText` — the v0.6.57 fix only covered the first), `lib/atomic-file.js` (refactored from v0.6.68's inline check), `lib/csv.js` (parse `maxBytes` was operator-overridable to Infinity → multi-megabyte CSV bodies through unbounded), `lib/safe-url.js` (`maxUrlLength` opt was the v0.6.62 fix's escape hatch — now also bounded), `lib/mail-bounce.js` (`maxBytes` for inbound webhook body — DoS-shape on bounce intake). **Tests** — new `test/layer-0-primitives/numeric-bounds.test.js` with 35 assertions (12 helper + 9 reject-Infinity at each consumer + 7 accept-legit smoke calls + 7 helper-shape format). Smoke 7258 → 7293 / wiki e2e 178 / Linux 86.0s / eslint clean / shellcheck clean.
 
 - **0.6.68** (2026-05-03) — `b.atomicFile.read` / `readSync` enforce strict `maxBytes` validation. Same bug class as v0.6.57's `safeBuffer.boundedChunkCollector` fix: pre-fix the size check was `if (stat.size > opts.maxBytes)`, which silently accepted `Infinity` (`stat.size > Infinity` always false → reads any file regardless of size, defeating the OOM cap). Operators with `Number(env.MAX_READ_BYTES || "")` coercion bugs got `NaN` on missing values and unbounded reads on Infinity-typo'd values. New `_validateMaxBytes` runs before the size check and rejects `Infinity` / `NaN` / non-integer / negative / zero / non-number with `atomic-file/bad-opt`. Real-world consumers (vault.initPlaintext, audit-sign, db.loadOrCreateDbKey, etc.) all pass real positive integers via `C.BYTES.*` helpers and are unaffected. **Tests** — 7 new layer-0 boot-validation assertions in `test/00-primitives.js` (Infinity, NaN, 0, -1, 3.5, "100", null all reject). Smoke 7251 → 7258 / wiki e2e 178 / Linux 86.0s / eslint clean / shellcheck clean.

package/lib/external-db-migrate.js

@@ -51,6 +51,7 @@
 var path = require("path");
 var atomicFile = require("./atomic-file");
 var lazyRequire = require("./lazy-require");
+var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -113,8 +114,17 @@ async function _acquireLock(xdb, opts) {
   await _ensureLockTable(xdb);
   var holder = _lockHolderId();
   var nowMs = Date.now();
-  var staleAfterMs = (opts && typeof opts.staleAfterMs === "number" && opts.staleAfterMs > 0)
-                       ? opts.staleAfterMs : 0;
+  // See migrations.acquireLock for the same fix — Infinity was
+  // silently identical to 0 (no staleness check) but obscured the typo.
+  var staleAfterMs;
+  if (!opts || opts.staleAfterMs === undefined) {
+    staleAfterMs = 0;
+  } else if (!numericBounds.isNonNegativeFiniteInt(opts.staleAfterMs)) {
+    throw new Error("externalDb.migrate.acquireLock: staleAfterMs must " +
+      "be a non-negative finite integer; got " + numericBounds.shape(opts.staleAfterMs));
+  } else {
+    staleAfterMs = opts.staleAfterMs;
+  }
   try {
     await xdb.query(
       "INSERT INTO " + Q_LOCK + " (scope, lockedAt, lockedBy) VALUES ('lock', $1, $2)",

package/lib/middleware/csp-nonce.js

@@ -113,6 +113,7 @@
  */
 
 var crypto = require("../crypto");
+var numericBounds = require("../numeric-bounds");
 var validateOpts = require("../validate-opts");
 var { defineClass } = require("../framework-error");
 
@@ -237,7 +238,18 @@ function create(opts) {
     }
     directives[i] = directives[i].toLowerCase();
   }
-  var nonceBytes = typeof opts.nonceBytes === "number" ? opts.nonceBytes : DEFAULT_NONCE_BYTES;
+  var nonceBytes = opts.nonceBytes !== undefined ? opts.nonceBytes : DEFAULT_NONCE_BYTES;
+  // Pre-fix the typeof-only check accepted Infinity / NaN — both
+  // bypassed the `< MIN_NONCE_BYTES` guard (NaN < N is always false,
+  // Infinity < N is always false), then crashed per-request when
+  // `crypto.generateBytes(Infinity)` hit ERR_OUT_OF_RANGE. Route through
+  // shared numeric-bounds (positive finite int) before the lower-bound
+  // check so the typo / coercion is caught at create() time.
+  if (!numericBounds.isPositiveFiniteInt(nonceBytes)) {
+    throw new CspNonceError("csp-nonce/bad-nonce-bytes",
+      "nonceBytes must be a positive finite integer; got " +
+        numericBounds.shape(nonceBytes));
+  }
   if (nonceBytes < MIN_NONCE_BYTES) {
     throw new CspNonceError("csp-nonce/bad-nonce-bytes",
       "nonceBytes must be >= " + MIN_NONCE_BYTES + " (got " + nonceBytes + "). " +

package/lib/migrations.js

@@ -41,6 +41,7 @@
 var path = require("path");
 var atomicFile = require("./atomic-file");
 var lazyRequire = require("./lazy-require");
+var numericBounds = require("./numeric-bounds");
 var dbModule = lazyRequire(function () { return require("./db"); });
 var validateOpts = require("./validate-opts");
 var { FrameworkError } = require("./framework-error");
@@ -108,8 +109,21 @@ function _acquireLock(db, opts) {
   _ensureLockTable(db);
   var holder = _lockHolderId();
   var nowMs = Date.now();
-  var staleAfterMs = (opts && typeof opts.staleAfterMs === "number" && opts.staleAfterMs > 0)
-                       ? opts.staleAfterMs : 0;
+  // staleAfterMs gates whether an existing lock is considered stale.
+  // 0 (the default) means "never replace — wait for the operator".
+  // Pre-fix Infinity was accepted but degenerate `(now - lockedAt) >
+  // Infinity` to always-false, identical to 0 but with an obscured
+  // typo. Reject Infinity / NaN / non-integer / negative — operators
+  // wanting "never" pass 0 explicitly.
+  var staleAfterMs;
+  if (!opts || opts.staleAfterMs === undefined) {
+    staleAfterMs = 0;
+  } else if (!numericBounds.isNonNegativeFiniteInt(opts.staleAfterMs)) {
+    throw new Error("migrations.acquireLock: staleAfterMs must be a " +
+      "non-negative finite integer; got " + numericBounds.shape(opts.staleAfterMs));
+  } else {
+    staleAfterMs = opts.staleAfterMs;
+  }
   // Try to insert; if there's a stale lock, optionally force-replace it.
   try {
     db.prepare(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.69",
+  "version": "0.6.70",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:99ad68c2-f813-40dc-8f9e-0cda46f62feb",
+  "serialNumber": "urn:uuid:82655a7f-a10b-4642-942a-226f5b1f76bb",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-03T15:21:23.088Z",
+    "timestamp": "2026-05-03T15:29:33.757Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.6.69",
+      "bom-ref": "@blamejs/core@0.6.70",
       "type": "library",
       "name": "blamejs",
-      "version": "0.6.69",
+      "version": "0.6.70",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.6.69",
+      "purl": "pkg:npm/%40blamejs/core@0.6.70",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.6.69",
+      "ref": "@blamejs/core@0.6.70",
       "dependsOn": []
     }
   ]