@blamejs/core 0.16.16 → 0.16.18

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.18 (2026-07-12) — **Refuse a stale FIDO metadata BLOB on the operator-fetch path, harden the GraphQL DoS-shape guard against escaped strings and malformed queries, parse POSIX leading-space octal in tar headers, and fix the FIDO certified-level, self-update 304, and swap-maxBytes paths — surfaced by covering previously-untested error and adversarial branches.** Covering untested error and adversarial branches across four security-relevant primitives surfaced seven defects, fixed at the root. The most serious: b.auth.fidoMds3.fetch() reimplemented the metadata-BLOB validation inline and omitted the stale-BLOB refusal the internal path enforced — so a signed-but-expired BLOB (nextUpdate in the past) was accepted and cached, letting an attacker who serves an ancient correctly-signed BLOB freeze an operator's revoked/compromised-authenticator list at a time of their choosing. Both paths now route through one _verifyBlobWithRoots source of truth, so no check can be present on one and missing on the other. The GraphQL query-shape guard (the pre-schema depth/alias DoS walker) miscounted on a string literal containing an escaped quote and on a brace-unbalanced malformed query, weakening the depth/alias limits it exists to enforce. The FIDO certified-level resolver lexically compared status reports and let an undated later report (a decertification or downgrade) lose to an earlier dated one, so a now-decertified authenticator could still read as certified. A tar reader misparsed POSIX leading-space-padded octal header fields to 0 (a size misparse desynced the block walker and rejected archives other tars extract). self-update's documented 304 If-None-Match fast-path was dead (it threw on every unchanged conditional poll), and selfUpdate.swap read an opts.maxBytes it never declared, so it could refuse a large binary that selfUpdate.verify accepted. **Fixed:** *b.auth.fidoMds3 certified-level honors an undated later decertification or downgrade* — _certifiedLevel compared status reports lexically and coerced a missing effectiveDate to an empty string, which sorts before any real date — so a later report with no effectiveDate (a NOT_FIDO_CERTIFIED decertification, or a downgrade/upgrade) always lost to an earlier dated grant, and certifiedLevel froze at the stale, higher historical value. A step-up policy reading certifiedLevel >= N could therefore accept a now-decertified authenticator. Reports without a comparable date now fall back to array order (append order = chronological), so a later decertification/downgrade wins. · *b.archive.read.tar parses POSIX leading-space-padded octal header fields* — A tar numeric header field (mode / uid / gid / size / mtime / checksum) that is left-padded with ASCII spaces — POSIX-legal, and emitted by star / BSD / Java / Perl tars — was misparsed to 0 because the octal reader treated a leading space as a field terminator. A misparsed size desynced the 512-byte block walker (it read the file body as the next header) and rejected an archive other tars extract cleanly. The reader now skips leading-space padding before reading octal digits. · *b.selfUpdate.poll returns a no-update result on a 304 Not Modified* — The documented If-None-Match / ETag fast-path was unreachable: poll delegated HTTP status handling to the HTTP client, which rejects every non-2xx (304 included) as an error before poll could inspect the status. A conditional poll that correctly received a 304 threw selfupdate/poll-failed instead of returning { available: false, statusCode: 304 }. The 304 (and the non-2xx) branch is now reached, so ETag-conditional polling works as documented. · *b.selfUpdate.swap accepts the maxBytes it re-reads under* — swap re-reads the newly-installed bytes to re-hash them (closing the verify→swap window) under an opts.maxBytes cap, but its option schema never declared maxBytes — so a caller who passed it was refused with selfupdate/bad-opts and swap always used the fixed 1 GiB default, which could refuse a large binary that selfUpdate.verify (which does declare maxBytes) accepted. swap now declares maxBytes (validated like verify's), so the two caps match; rollback, which re-reads nothing, still does not accept it. **Security:** *b.auth.fidoMds3.fetch refuses a stale (expired) metadata BLOB* — The operator-facing fetch path (which trusts caCertificate roots) reimplemented the metadata-BLOB parse and verify inline and omitted the stale-BLOB refusal that the default-roots path enforced, so a BLOB whose nextUpdate is already in the past was accepted and cached even though FIDO MDS3 §3.1.7 says it must not be trusted. An attacker serving an ancient, correctly-signed BLOB could pin an operator to a revoked/compromised-authenticator list frozen at that time. The JWS + x5c-chain verify, payload-shape checks, and stale-BLOB refusal now live in one _verifyBlobWithRoots helper that both the operator-fetch and default-roots paths route through, so the checks can never drift apart again. · *b.guardGraphql hardens the pre-schema DoS-shape walker against escaped strings and malformed queries* — The query-shape walker that enforces depth and alias limits before the query reaches a schema miscounted in two ways: it treated an escaped quote inside a valid GraphQL string literal as the string's terminator (desyncing its in-string state), and it popped its depth-indexed alias counter on every closing brace even for a brace-unbalanced malformed query (underflowing the counter). Both weakened the depth/alias caps the guard exists to enforce against a DoS-shaped query. The walker now tracks string escapes correctly and guards the alias-counter stack against imbalance.
+
+- v0.16.17 (2026-07-12) — **Reject INI float literals that overflow to Infinity, return a verdict (not an exception) when a reverse-DNS lookup faults, wrap an async redirect-hook rejection like a sync throw, and refuse a fractional --max-rows — four defects surfaced by covering previously-untested error branches.** Covering previously-untested error and adversarial branches across four primitives surfaced four genuine defects, each fixed at the root. b.parsers.ini.parse coerced a value like `x = 1e999` straight to ±Infinity — its integer and hex branches already reject out-of-range numbers, but the float branch had no finiteness guard, so an overflowing float slipped through and could poison a downstream size cap or timeout; it is now rejected with ini/value-out-of-range. b.mail.iprev.verify threw an unhandled exception when the forward-confirm DNS lookup returned an error code outside the handful it enumerated (EREFUSED / ENOTIMP / …), even though its reverse-lookup path and every sibling (SPF/DKIM/DMARC/ARC) return a verdict for such faults; it now returns a temperror verdict, and — like those siblings — accepts an operator opts.dnsLookup resolver so the confirm path is resolvable offline. b.httpClient wrapped a synchronous onRedirect hook throw into a REDIRECT_ABORTED error but let an async hook rejection escape unwrapped; both now abort the redirect identically. And the blamejs audit verify-chain --max-rows flag accepted a fractional value (2.5), which truncated the chain walk mid-row and reported a nonsensical fractional count; it now requires a whole positive integer, matching its own error message. **Fixed:** *b.parsers.ini.parse rejects an overflowing float instead of coercing to Infinity* — A float literal that exceeds the representable range (e.g. `x = 1e999`) coerced to ±Infinity. The integer and hex coercion branches already reject out-of-range numbers via Number.isSafeInteger, but the float branch returned Number(raw) with no finiteness check — so an Infinity could flow into a downstream size cap or timeout, a denial-of-service vector. The float branch now rejects a non-finite result with ini/value-out-of-range; a large-but-finite float (1e308) and underflow (1e-999 → 0) still parse. · *b.mail.iprev.verify returns a temperror verdict on an un-enumerated reverse/forward DNS fault* — The forward-confirm DNS lookup's error handler enumerated a few transient codes and threw for anything else, so a resolver returning EREFUSED / ENOTIMP / EBADRESP produced an unhandled exception from the public API rather than a verdict. The reverse-lookup path and every sibling result type (SPF / DKIM / DMARC / ARC) return a verdict for a DNS-derived fault; the forward path now does too (temperror). iprev.verify also gains an operator opts.dnsLookup resolver, matching the dnsLookup contract the other types already honor, so the forward-confirm path is resolvable offline. · *b.httpClient aborts a redirect on an async onRedirect hook rejection* — A synchronous throw from the onRedirect hook was wrapped into a REDIRECT_ABORTED error, but an async hook that rejected let the rejection escape unwrapped — inconsistent handling for the same operator control point. An async onRedirect rejection now aborts the redirect with REDIRECT_ABORTED, identical to the synchronous throw. · *blamejs audit verify-chain --max-rows requires a whole positive integer* — The --max-rows flag validated only that the value was finite and >= 1, so a fractional value (2.5) was accepted and passed to the chain walk, where it truncated the verification mid-row and reported a fractional rowsVerified count — despite the flag's own error message promising a positive integer. It now rejects a non-integer value, matching the sibling --steps flag.
+
 - v0.16.16 (2026-07-12) — **Build the data-subject-request ticket store's SQL through the shared b.sql query builder instead of hand-assembled statements, and add a static check that keeps db-handle primitives composing b.sql.** A maintainability change with no behavior difference for operators. The b.dsr ticket store built its reads and writes by concatenating table and column names into SQL strings passed to db.prepare, re-implementing the identifier quoting and sealed-field handling that b.sql — the same builder b.db.from() uses — already provides. That hand-rolled shape is how b.tenant.quota's storage query drifted from the query builder and accrued a run of parity defects fixed in 0.16.15 (reserved-word names, schema-qualified names, sealed-column filtering). The store's DML now composes b.sql (its schema DDL, which is not a b.sql concern, stays as direct statements), so its SQL cannot diverge from the builder. A new codebase-patterns check flags any db-handle primitive that passes an inline SELECT / INSERT / UPDATE / DELETE string literal to db.prepare / runSql, directing it to compose b.sql instead, so this class of drift cannot recur. **Changed:** *b.dsr ticket store composes b.sql for its reads and writes* — The data-subject-request ticket store (insert / get / list / update / delete / purge and the legacy re-seal backfill) now builds its DML with the b.sql query builder — sql.select / insert / update / delete(table, { dialect, quoteName }).…toSql() — and prepares the resulting statement, rather than concatenating identifiers into SQL strings by hand. This removes a hand-rolled identifier-quoting surface that could drift from what b.db.from() accepts. Schema provisioning (CREATE TABLE / INDEX, ALTER, PRAGMA) is not a b.sql concern and remains as direct statements. One behavior change: on a store backed by a vault, a ticket payload is AEAD-sealed and base64-encoded (~4/3 expansion) before it is bound, and the bound cell must fit the query builder's 64 MiB per-value ceiling — so the payload is now capped at an expansion-safe plaintext size (~48 MiB) and a larger ticket is refused with dsr/ticket-too-large (route large access/portability exports through chunked storage rather than one giant sealed cell). Plaintext stores keep the full 64 MiB limit. When a vault is first enabled on a table that already holds an over-cap legacy plaintext row, the one-time re-seal backfill still migrates that row's subject columns and derived hashes — so it stays findable by subject lookup and erasable by the data-subject erasure purge — and leaves only the over-cap payload plaintext (still under the read ceiling, DB-encrypted at rest, and removed when the row is erased), rather than failing provisioning with a query-builder error. **Detectors:** *Static check: db-handle primitives must compose b.sql for DML* — A new codebase-patterns check flags any primitive holding a db handle that runs DML by passing an inline SELECT / INSERT / UPDATE / DELETE string literal to db.prepare / runSql — the shape that lets a query drift from b.sql's identifier quoting and sealed-field rewrite (the b.tenant.quota storage defect class). It directs authors to build the query with b.sql and prepare the resulting string. DDL and PRAGMA (not b.sql verbs) and queries already built through a b.sql variable are out of scope.
 
 - v0.16.15 (2026-07-11) — **Restore break-glass certificate key escrow, hand a failed production-security assertion its real diagnostic message, and make tenant storage-byte quotas actually enforce — three defects surfaced by broadening test coverage and fixed at the root.** Three primitives had defects that only a hostile or previously-untested path reached. b.cert key escrow — the optional break-glass path that seals a renewed private key to an operator's offline recipient — never worked: writeEscrow called a b.crypto method that does not exist, so any certificate configured with keyEscrow threw the moment renewal tried to seal the key. It now seals via b.crypto.encrypt (ML-KEM-1024, plus the P-384 hybrid leg when the recipient supplies an ecPublicKey) and the operator recovers the key offline with b.crypto.decrypt; the recipient accepts an ML-KEM-1024 public-key PEM string or a { publicKey, ecPublicKey } pair from b.crypto.generateEncryptionKeyPair(). b.security.assertProduction constructed its error with the code and message transposed, so a failed production-security assertion threw with a bare token (BAD_OPT / ASSERT_FAILED) as its .message and buried the human-readable explanation in .code — operators now get the full diagnostic where they read it. And b.tenant.quota storage-byte accounting was broken several ways: the per-tenant byte sum issued a query the builder rejects, so snapshot / assert / list always threw once a storage cap was set; it read rows through the auto-unsealing ORM, so a sealed column was measured as its small decrypted plaintext rather than the larger on-disk vault envelope (letting sealed-column tenants slip under the cap); when the tenant identifier itself was a sealed column, the plaintext lookup matched no rows at all and the cap silently counted zero; and BLOB columns (handed back as Uint8Array by node:sqlite) were stringified before measuring, roughly tripling their counted size and refusing writes far below the real cap. All are fixed — the sum now filters a sealed tenant id by its derived-hash blind index, reads the raw stored rows, and measures true on-disk byte lengths — so storage quotas enforce at the configured limit. **Fixed:** *b.cert break-glass key escrow seals the renewed key instead of throwing* — A certificate configured with keyEscrow forwarded the private key to writeEscrow, which called a b.crypto.encryptEnvelope method that does not exist — so escrow threw on every renewal and the break-glass recovery path was unusable. It now seals the key to the operator's offline recipient with b.crypto.encrypt: ML-KEM-1024 always, plus a P-384 hybrid leg when the recipient carries an ecPublicKey. The recipient accepts an ML-KEM-1024 public-key PEM string or a { publicKey, ecPublicKey } pair from b.crypto.generateEncryptionKeyPair(); the sealed key is never decrypted by the framework and is recovered offline with b.crypto.decrypt and the matching private key(s). · *b.security.assertProduction throws with the diagnostic in .message* — SecurityAssertError was constructed with its code and message arguments transposed, so a failed production-security assertion surfaced a bare token (BAD_OPT / ASSERT_FAILED) as its .message while the explanatory text — including the per-assertion failure list — landed in .code. Operators catching the error now read the full diagnostic in .message and the stable token in .code, as documented. · *b.tenant.quota enforces storage-byte caps at the configured limit* — The per-tenant storage-bytes accounting had several defects. It issued a query the query builder rejects (a literal '*' column), so snapshot / assert / list threw as soon as a storage cap was configured — the storage half of tenant quotas never ran against a real database. It read rows through the ORM, which auto-unseals sealed columns, so a sealed cell was measured as its small decrypted plaintext rather than the much larger vault envelope actually on disk — a tenant whose data lives in sealed columns could sail under the cap. When the tenant identifier column itself was sealed, the plaintext lookup compared against the on-disk envelope and matched no rows, so the cap silently counted zero for those tenants. And BLOB columns, which node:sqlite returns as a Uint8Array rather than a Node Buffer, were stringified before measuring: String(uint8array) is the decimal-joined bytes, roughly a 3x overcount that refused writes well below the real cap. The sum now filters a sealed tenant identifier by its derived-hash blind index (as the query builder does), reads the raw stored rows (no unseal), and counts text as its UTF-8 byte length and typed-array views by their true byte length, so a storage cap — including data in sealed columns — enforces at the limit operators set.

package/lib/archive-tar.js

@@ -175,10 +175,20 @@ function _writeString(buf, value, offset, width) {
 
 function _readOctal(buf, offset, width) {
   // Read an octal-encoded field. Terminator may be space or NUL.
+  //
+  // POSIX permits numeric fields to be LEFT-padded with spaces (as well as
+  // zeros) — star, BSD tar, and several Java/Perl tar libraries emit them,
+  // and GNU tar / libarchive skip them. Treating a leading space as a
+  // terminator silently misreads such a field as 0 (a parser-differential:
+  // the reader would disagree with every other tar on the same bytes, and a
+  // misread size desyncs the block walker). Skip leading-space padding first;
+  // a space or NUL AFTER the digits still terminates the field.
+  var i = 0;
+  while (i < width && buf[offset + i] === 0x20) i += 1;                              // ASCII space (0x20) leading padding per POSIX numeric field
   var s = "";
-  for (var i = 0; i < width; i += 1) {
+  for (; i < width; i += 1) {
     var c = buf[offset + i];
-    if (c === 0x20 || c === 0) break;                                                // ASCII space (0x20) + NUL (0x00) field terminators
+    if (c === 0x20 || c === 0) break;                                                // ASCII space (0x20) + NUL (0x00) field terminators after digits
     if (c < 0x30 || c > 0x37) {                                                      // ASCII '0' (0x30) .. '7' (0x37) octal digits
       throw new TarError("archive-tar/bad-octal",
         "non-octal byte 0x" + c.toString(16) + " at offset " + (offset + i));        // radix=16 for diagnostic hex format

package/lib/auth/fido-mds3.js

@@ -344,12 +344,16 @@ function _parseNextUpdate(s) {
   return d;
 }
 
-// Internal verify-blob helper used by both fetch (live HTTP) and the
-// fetch-with-injected-body test path. Operator-facing surface goes
-// through fetch().
-function _verifyAndParseBlob(token) {
+// Single source of truth for the BLOB-trust decision: JWS + x5c-chain verify
+// against the supplied trust roots, payload-shape validation, AND the
+// stale-BLOB refusal. fetch() (operator-supplied roots via caCertificate) and
+// _verifyAndParseBlob (default vendored roots) BOTH route here so no check can
+// ever be present on one path but missing on the other. The stale-refusal used
+// to live only in this helper's caller-inlined twin, so the operator-facing
+// fetch path silently accepted (and cached) a signed-but-expired BLOB; keeping
+// one body closes that class.
+function _verifyBlobWithRoots(token, rootPems) {
   var jws = _parseJws(token);
-  var rootPems = _resolveRoots(undefined);
   var chain = _validateChain(jws.header.x5c, rootPems);
   _verifyJws(jws, chain[0]);
   var payload = jws.payload;
@@ -366,19 +370,19 @@ function _verifyAndParseBlob(token) {
     throw new FidoMds3Error("fido-mds3/bad-payload",
       "BLOB payload 'nextUpdate' missing or not YYYY-MM-DD: " + payload.nextUpdate);
   }
-  // Stale-BLOB refusal — FIDO MDS3 §3.1.7 says clients SHOULD refresh
-  // by nextUpdate; a BLOB whose nextUpdate is already in the past is
-  // not safe to trust even though its cert chain still validates.
-  // Pre-v0.9.2 the staleness was floored to MIN_CACHE_TTL_MS in
-  // _ttlFromNextUpdate but the BLOB itself was still served from
-  // cache; an attacker serving an ancient signed-but-expired BLOB
-  // could keep operators on a revoked-authenticator-list-frozen-at-X.
-  // Refuse at parse time so neither fetch nor cache lookup honors it.
+  // Stale-BLOB refusal (FIDO MDS3 section 3.1.7): clients SHOULD refresh by
+  // nextUpdate; a BLOB whose nextUpdate is already in the past is not safe to
+  // trust even though its cert chain still validates. Flooring the staleness to
+  // MIN_CACHE_TTL_MS in _ttlFromNextUpdate is not enough on its own -- the BLOB
+  // itself must be refused, or an attacker serving an ancient signed-but-
+  // expired BLOB keeps operators pinned to a revoked-authenticator list frozen
+  // at that time. Refuse at parse time so neither fetch nor a cache lookup ever
+  // honors it.
   if (nextUpdate.getTime() < Date.now()) {
     throw new FidoMds3Error("fido-mds3/blob-stale",
       "BLOB payload nextUpdate \"" + payload.nextUpdate +
-      "\" is in the past — refusing to trust a stale metadata BLOB " +
-      "(FIDO MDS3 §3.1.7)");
+      "\" is in the past -- refusing to trust a stale metadata BLOB " +
+      "(FIDO MDS3 section 3.1.7)");
   }
   return {
     entries:     payload.entries,
@@ -388,6 +392,13 @@ function _verifyAndParseBlob(token) {
   };
 }
 
+// Internal verify-blob helper used by tests to exercise the verifier against
+// the DEFAULT vendored MDS3 trust roots without standing up a real HTTPS
+// endpoint. Operator-facing surface goes through fetch().
+function _verifyAndParseBlob(token) {
+  return _verifyBlobWithRoots(token, _resolveRoots(undefined));
+}
+
 // ---- public surface ----
 
 /**
@@ -481,39 +492,22 @@ async function fetch(opts) {   // allow:raw-outbound-http-framework-internal —
     }
     var token = rsp.body.toString("ascii").trim();
 
-    var jws = _parseJws(token);
-    var chain = _validateChain(jws.header.x5c, rootPems);
-    _verifyJws(jws, chain[0]);
-    var payload = jws.payload;
-    if (!payload || !Array.isArray(payload.entries)) {
-      throw new FidoMds3Error("fido-mds3/bad-payload",
-        "BLOB payload missing 'entries' array");
-    }
-    if (typeof payload.no !== "number" || !isFinite(payload.no)) {
-      throw new FidoMds3Error("fido-mds3/bad-payload",
-        "BLOB payload missing or non-numeric 'no'");
-    }
-    var nextUpdate = _parseNextUpdate(payload.nextUpdate);
-    if (!nextUpdate) {
-      throw new FidoMds3Error("fido-mds3/bad-payload",
-        "BLOB payload 'nextUpdate' missing or not YYYY-MM-DD: " + payload.nextUpdate);
-    }
-    var record = {
-      entries:     payload.entries,
-      no:          payload.no,
-      nextUpdate:  nextUpdate,
-      url:         url,
-      legalHeader: payload.legalHeader,
-    };
+    // Route the trust decision through the shared verifier so this operator-
+    // facing path enforces the identical checks (chain verify, payload shape,
+    // AND the stale-BLOB refusal) as the internal helper -- fetch previously
+    // reimplemented the parse inline and omitted the stale check, silently
+    // accepting and caching an ancient signed-but-expired BLOB.
+    var record = _verifyBlobWithRoots(token, rootPems);
+    record.url = url;
     // Re-assert TTL based on the BLOB's nextUpdate (overrides the
     // wrap-call's safe-minimum seed).
-    try { await c.set(cacheKey, record, _ttlFromNextUpdate(nextUpdate)); }
+    try { await c.set(cacheKey, record, _ttlFromNextUpdate(record.nextUpdate)); }
     catch (_e) { /* cache.set best-effort */ }
     try { audit().safeEmit({
       action:   "auth.fido_mds3.fetch",
       outcome:  "success",
-      metadata: { url: url, no: payload.no, entries: payload.entries.length,
-                  nextUpdate: payload.nextUpdate },
+      metadata: { url: url, no: record.no, entries: record.entries.length,
+                  nextUpdate: record.nextUpdate.toISOString().slice(0, 10) },
     }); } catch (_e) { /* audit best-effort */ }
     return record;
   }, MIN_CACHE_TTL_MS);
@@ -577,18 +571,35 @@ function lookupAaguid(blob, aaguid) {
 function _certifiedLevel(statusReports) {
   if (!Array.isArray(statusReports)) return { level: 0, plus: false };
   var latest = null;
-  var latestDate = null;
+  var latestDate = null;   // null == no comparable date (missing / malformed)
   for (var i = 0; i < statusReports.length; i++) {
     var sr = statusReports[i];
     // Only certification-status reports move the level: a level grant, or its
     // explicit revocation (NOT_FIDO_CERTIFIED). Other statuses (UPDATE_AVAILABLE,
-    // REVOKED, …) are handled elsewhere and must not be read as a level. The
-    // status length is bounded before the regex test below — FIDO status tokens
+    // REVOKED, etc.) are handled elsewhere and must not be read as a level. The
+    // status length is bounded before the regex test below -- FIDO status tokens
     // are short enums; bounding input before any .test() is the convention.
     if (!sr || typeof sr.status !== "string" || sr.status.length > 64) continue;
     if (!CERT_LEVEL_RE.test(sr.status) && sr.status !== "NOT_FIDO_CERTIFIED") continue;
-    var d = typeof sr.effectiveDate === "string" ? sr.effectiveDate : "";
-    if (latest === null || d >= latestDate) {
+    // Only a well-formed calendar date is comparable. Reuse _parseNextUpdate
+    // (which already validates YYYY-MM-DD AND rejects impossible dates such as
+    // 2026-02-31) and compare epoch ms. A missing / malformed effectiveDate is
+    // "no comparable date" (null) and falls back to array order (append order,
+    // which the spec defines as chronological): the report later in the array
+    // is the more recent one. Coercing a missing date to "" and running it
+    // through a lexical compare made an undated report lose to EVERY earlier
+    // dated report, so a later decertification / downgrade / upgrade whose
+    // effectiveDate was absent never superseded the earlier grant -- freezing
+    // certifiedLevel at a stale value (an authenticator-assurance bypass: a
+    // decertified or downgraded authenticator kept reporting its prior level to
+    // step-up / risk policy).
+    var parsed = typeof sr.effectiveDate === "string" ? _parseNextUpdate(sr.effectiveDate) : null;
+    var d = parsed ? parsed.getTime() : null;
+    if (latest === null) { latest = sr; latestDate = d; continue; }
+    // sr is later in array order than the current latest. A missing/malformed
+    // date on EITHER side means array order decides -> sr (later) wins. Both
+    // dated -> the newer-or-equal date wins (sr, being later, takes ties).
+    if (d === null || latestDate === null || d >= latestDate) {
       latest = sr; latestDate = d;
     }
   }

package/lib/cli.js

@@ -713,7 +713,14 @@ async function _runAudit(args, ctx) {
     var tableV = args.flags.table ? String(args.flags.table) : "audit_log";
     var maxRows = args.flags["max-rows"];
     var maxRowsN = maxRows === undefined ? undefined : Number(maxRows);
-    if (maxRowsN !== undefined && (!Number.isFinite(maxRowsN) || maxRowsN < 1)) {
+    // Positive-INTEGER validation, mirroring `migrate down --steps`: reject
+    // NaN/Infinity, < 1, AND any fractional value. The message promises "a
+    // positive integer", so a value like 2.5 must be refused here at the
+    // entry point rather than passed to verifyChain, where a fractional
+    // maxRows truncates the walk mid-chain and reports a nonsensical
+    // fractional rowsVerified (Math.min(rows.length, 2.5)).
+    if (maxRowsN !== undefined &&
+        (!Number.isFinite(maxRowsN) || maxRowsN < 1 || Math.floor(maxRowsN) !== maxRowsN)) {
       _writeLine(ctx.stderr, "blamejs audit verify-chain: --max-rows must be a positive integer");
       return 2;
     }

package/lib/guard-graphql.js

@@ -165,7 +165,8 @@ function _measureQueryShape(query) {
   var depth = 0;
   var inString = false;
   var inComment = false;
-  var aliasCounts = [0];                                                         // per-depth alias counter
+  var escapeNext = false;                                                        // inside a string, the previous char was an unescaped backslash
+  var aliasStack = [0];                                                          // per-selection-set alias counter (top of stack = current set)
   for (var i = 0; i < query.length; i += 1) {
     var c = query.charAt(i);
     if (inComment) {
@@ -173,7 +174,18 @@ function _measureQueryShape(query) {
       continue;
     }
     if (inString) {
-      if (c === '"' && query.charAt(i - 1) !== "\\") inString = false;
+      // Escaped-quote handling must track the backslash RUN, not just the
+      // single preceding char. `"\\"` is a complete string (its backslash is
+      // itself escaped), so a naive `charAt(i - 1) !== "\\"` test reads the
+      // closing quote as escaped, leaves the walker stuck in-string, and
+      // blinds it to every following brace / colon — silently under-counting
+      // depth and alias breadth so a depth-bomb or alias-bomb rides through as
+      // shape-clean (a fail-open DoS-measurement bypass on valid GraphQL).
+      // Toggle on each backslash: a closing quote ends the string only after
+      // an EVEN run (escapeNext false).
+      if (escapeNext) { escapeNext = false; continue; }
+      if (c === "\\") { escapeNext = true; continue; }
+      if (c === '"') inString = false;
       continue;
     }
     if (c === '"') { inString = true; continue; }
@@ -181,28 +193,35 @@ function _measureQueryShape(query) {
     if (c === "{") {
       depth += 1;
       if (depth > maxDepth) maxDepth = depth;
-      aliasCounts.push(0);
+      aliasStack.push(0);
     } else if (c === "}") {
       // Capture the current selection-set's alias count before popping
       // — otherwise we lose the per-block max when the block closes.
-      var current = aliasCounts[aliasCounts.length - 1] || 0;
+      var current = aliasStack[aliasStack.length - 1] || 0;
       if (current > maxAliases) maxAliases = current;
       depth -= 1;
-      aliasCounts.pop();
+      // Never pop the base counter: an unbalanced leading `}` would otherwise
+      // desync the stack from `depth`, and a subsequent `depth`-indexed
+      // increment lands on an absent slot (`undefined + 1 === NaN`), poisoning
+      // every later comparison so an alias-bomb reads as clean.
+      if (aliasStack.length > 1) aliasStack.pop();
       if (depth < 0) depth = 0;
     } else if (c === ":") {
-      // Alias indicator — `alias: field`. Increment the current depth's
-      // counter when the char before `:` looks like an identifier.
+      // Alias / argument indicator — `alias: field` / `field(arg: value)`.
+      // Increment the CURRENT selection-set's counter (top of stack) when the
+      // char before `:` looks like an identifier. Using the stack top rather
+      // than a `depth` index keeps counting correct even when a malformed
+      // brace run has decoupled `depth` from the stack length.
       var prev = i > 0 ? query.charAt(i - 1) : "";
-      if (/[A-Za-z0-9_]/.test(prev) && depth > 0) {
-        aliasCounts[depth] += 1;
+      if (/[A-Za-z0-9_]/.test(prev) && aliasStack.length > 1) {
+        aliasStack[aliasStack.length - 1] += 1;
       }
     }
   }
   // Final sweep covers any unclosed selection-sets (operator-supplied
   // syntactically-invalid queries).
-  for (var ai = 0; ai < aliasCounts.length; ai += 1) {
-    if (aliasCounts[ai] > maxAliases) maxAliases = aliasCounts[ai];
+  for (var ai = 0; ai < aliasStack.length; ai += 1) {
+    if (aliasStack[ai] > maxAliases) maxAliases = aliasStack[ai];
   }
   return { maxDepth: maxDepth, maxAliases: maxAliases };
 }

package/lib/http-client.js

@@ -1358,14 +1358,21 @@ function _requestWithRedirects(opts, hopsLeft) {
           headersStripped: headersStripped,
           method:          nextMethod,
         });
+        function _redirectAborted(e) {
+          return Promise.reject(_makeError(opts.errorClass, "REDIRECT_ABORTED",
+            "onRedirect hook refused redirect: " + ((e && e.message) || String(e)), true));
+        }
         try {
           var hookResult = onRedirect(hookEvent);
           if (hookResult && typeof hookResult.then === "function") {
-            return hookResult.then(function () { return _continueFollow(); });
+            // An async hook's rejection must abort the follow with the SAME
+            // REDIRECT_ABORTED shape a sync throw produces — otherwise an
+            // operator who awaits inside the hook (or returns a rejected
+            // Promise) silently gets an un-coded raw rejection instead.
+            return hookResult.then(function () { return _continueFollow(); }, _redirectAborted);
           }
         } catch (e) {
-          return Promise.reject(_makeError(opts.errorClass, "REDIRECT_ABORTED",
-            "onRedirect hook refused redirect: " + ((e && e.message) || String(e)), true));
+          return _redirectAborted(e);
         }
       }
       return _continueFollow();

package/lib/mail-auth.js

@@ -197,7 +197,7 @@ async function _safeResolveMx(qname, operatorLookup) {
   return entries.map(function (e) { return e.exchange; });
 }
 
-async function _safeReverse(ip) {
+async function _safeReverse(ip, operatorLookup) {
   // PTR query against the reverse-arpa name. IPv4: a.b.c.d.in-addr.arpa
   // (reversed octets); IPv6: nibble-reversed under ip6.arpa.
   var qname = _ipToReverseArpa(ip);
@@ -206,6 +206,30 @@ async function _safeReverse(ip) {
     err.code = "ENOTFOUND";
     throw err;
   }
+  // Operator-supplied resolver: the callback receives the reverse-arpa
+  // qname (the same name a real resolver queries) and returns the
+  // documented flat PTR-name array. Threading it here makes the iprev
+  // forward-confirm path operator-mockable, matching the dnsLookup
+  // contract every other type in this file already honors.
+  if (operatorLookup) {
+    var resp = await operatorLookup(qname, "PTR");
+    if (!Array.isArray(resp) || resp.length === 0) {
+      var perr = new Error("no PTR records for " + ip);
+      perr.code = "ENODATA";
+      throw perr;
+    }
+    var names = [];
+    for (var pi = 0; pi < resp.length; pi += 1) {
+      var nm = String(resp[pi]).replace(/\.$/, "");
+      if (nm.length > 0) names.push(nm);
+    }
+    if (names.length === 0) {
+      var perr2 = new Error("no PTR records for " + ip);
+      perr2.code = "ENODATA";
+      throw perr2;
+    }
+    return names;
+  }
   var r = await _getDefaultResolver().query(qname, "PTR");
   var out = [];
   for (var i = 0; i < r.rrs.length; i += 1) {
@@ -2864,13 +2888,22 @@ function dmarcBuildAggregateReport(report, opts) {
 // Authentication-Results header so downstream policies can react.
 //
 // Surface:
-//   await b.mail.iprev.verify(ip)
+//   await b.mail.iprev.verify(ip, opts?)
 //   → { result: "pass"|"fail"|"permerror"|"temperror",
 //       ptr, forward, fcrdns, ip }
 //
-// Returns "permerror" on bad-shape input (not an IP literal); returns
-// "temperror" on ENODATA / ENOTFOUND / lookup failure (the receiver
-// retries on transient DNS faults). Pure-DNS — no operator state.
+// Returns "permerror" on bad-shape input (not an IP literal, or a PTR
+// whose rdata isn't a valid DNS name). A definitive negative answer
+// (no PTR record, or the PTR forward-resolves to a set that omits the
+// connecting IP) is a "fail"; a transient resolver fault (SERVFAIL,
+// timeout, or any non-negative error code) is a "temperror" the
+// receiver retries on. Every path RETURNS a verdict object — the
+// primitive never throws on a message- or DNS-derived fault.
+//
+// DNS defaults to b.network.dns.resolver; an operator `opts.dnsLookup`
+// callback overrides it (same shape as the rest of this file — the PTR
+// query receives the reverse-arpa qname; the forward query the PTR
+// name), so a receiver can unit-test the forward-confirm decision.
 
 // RFC 8601 §3 — PTR result shape. The PTR rdata is an FQDN (1*labels).
 // Reject answers that aren't shaped as a DNS name: non-strings,
@@ -2897,7 +2930,10 @@ function _isValidPtrName(name) {
   return true;
 }
 
-async function iprevVerify(ip) {
+async function iprevVerify(ip, opts) {
+  opts = opts || {};
+  validateOpts(opts, ["dnsLookup"], "mail.iprev.verify");
+  var dnsLookup = opts.dnsLookup;
   if (typeof ip !== "string" || ip.length === 0) {
     return { result: "permerror", ip: ip || null,
              ptr: null, forward: [], fcrdns: false,
@@ -2910,7 +2946,7 @@ async function iprevVerify(ip) {
   }
 
   var ptrs;
-  try { ptrs = await _safeReverse(ip); }
+  try { ptrs = await _safeReverse(ip, dnsLookup); }
   catch (e) {
     var rcode = e && e.code;
     if (rcode === "ENOTFOUND" || rcode === "ENODATA") {
@@ -2942,7 +2978,7 @@ async function iprevVerify(ip) {
   var isV6 = net.isIPv6(ip);
   var forwardAddrs;
   try {
-    forwardAddrs = await _safeResolveA(ptr, isV6 ? 6 : 4);
+    forwardAddrs = await _safeResolveA(ptr, isV6 ? 6 : 4, dnsLookup);
   } catch (e) {
     var fcode = e && e.code;
     if (fcode === "ENOTFOUND" || fcode === "ENODATA") {
@@ -2950,23 +2986,32 @@ async function iprevVerify(ip) {
                ptr: ptr, forward: [], fcrdns: false,
                explanation: "no forward record for PTR " + ptr };
     }
-    if (fcode === "ETIMEOUT" || fcode === "ESERVFAIL") {
-      return { result: "temperror", ip: ip,
-               ptr: ptr, forward: [], fcrdns: false,
-               explanation: "forward lookup transient failure: " + fcode };
-    }
-    // Anything else — propagate as temperror; Node DNS surfaces some
-    // non-RFC error codes via the platform resolver. Permerror only
-    // for definitive negative answers above.
-    throw new MailAuthError("mail-auth/iprev-temperror",
-      "iprev.verify: forward lookup of " + ptr + " threw: " +
-      ((e && e.message) || String(e)));
+    // Every non-negative fault (SERVFAIL, timeout, or any other
+    // platform-resolver code) is transient — RETURN a temperror verdict,
+    // mirroring the reverse-lookup catch above. Throwing here broke the
+    // primitive's contract that every message/DNS-derived fault surfaces
+    // as a verdict object: a caller of the documented API got an
+    // exception on e.g. an EREFUSED forward fault. Only the definitive
+    // negative answers above (no forward record) are a "fail".
+    return { result: "temperror", ip: ip,
+             ptr: ptr, forward: [], fcrdns: false,
+             explanation: "forward lookup of " + ptr + " transient failure: " +
+                          (fcode || (e && e.message) || String(e)) };
   }
   var forward = Array.isArray(forwardAddrs) ? forwardAddrs.slice() : [];
-  var ipLc = ip.toLowerCase();
+  // RFC 8601 §3 forward-confirm match. An IPv6 address has many equivalent
+  // textual forms (compressed `2001:db8::1` vs expanded
+  // `2001:0db8:0:0:0:0:0:1`); the connecting literal and the AAAA rdata
+  // routinely differ. Compare the CANONICAL form (fixed-width hex nibbles)
+  // so an equivalent-but-differently-written IPv6 address still confirms.
+  // IPv4 has a single canonical dotted form, so a lowercased string compare
+  // is exact there.
+  var ipCanon = isV6 ? ipUtils.expandIpv6Hex(ip) : ip.toLowerCase();
   var fcrdns = false;
   for (var i = 0; i < forward.length; i += 1) {
-    if (String(forward[i]).toLowerCase() === ipLc) { fcrdns = true; break; }
+    var fwdStr = String(forward[i]);
+    var fwdCanon = isV6 ? ipUtils.expandIpv6Hex(fwdStr) : fwdStr.toLowerCase();
+    if (ipCanon && fwdCanon && fwdCanon === ipCanon) { fcrdns = true; break; }
   }
   return {
     result:      fcrdns ? "pass" : "fail",

package/lib/parsers/safe-ini.js

@@ -132,7 +132,15 @@ function _coerceValue(raw) {
     return n;
   }
   if (/^-?\d+\.\d+([eE][+-]?\d+)?$/.test(raw) || /^-?\d+[eE][+-]?\d+$/.test(raw)) {
-    return Number(raw);
+    var f = Number(raw);
+    // Float overflow (e.g. 1e999) coerces to ±Infinity — the same
+    // never-silently-coerce refusal the integer/hex branches enforce with
+    // Number.isSafeInteger. An Infinity slipping into a downstream size cap
+    // or timeout is a live DoS, so an out-of-range float is rejected here.
+    if (!Number.isFinite(f)) {
+      throw _err("ini/value-out-of-range", "float exceeds representable range: " + raw);
+    }
+    return f;
   }
   return _unquote(raw);
 }

package/lib/self-update.js

@@ -378,6 +378,15 @@ async function poll(opts) {
       allowedHosts:     opts.allowedHosts,
       allowedProtocols: opts.allowedProtocols,
       allowInternal:    opts.allowInternal,
+      // poll() owns status handling — the branches below distinguish a 304
+      // If-None-Match "fast no-update" hit from a real non-2xx refusal and a
+      // 2xx feed to parse. Without always-resolve, httpClient.request rejects
+      // EVERY non-2xx (304 included) as HTTP_ERROR before poll can inspect
+      // res.statusCode, which made the documented conditional-poll fast-path
+      // and the selfupdate/poll-non-2xx branch dead code — a conditional poll
+      // that correctly received a 304 threw selfupdate/poll-failed instead of
+      // reporting "no update".
+      responseMode:     "always-resolve",
       errorClass:       SelfUpdateError,
     });
   } catch (e) {
@@ -630,6 +639,15 @@ function _validateSwapOpts(opts, label) {
           "selfUpdate.swap: opts.hashAlgo must be one of " + ALLOWED_HASH_ALGS.join(", "));
       }
     };
+    // swap re-reads the from-bytes to re-hash them (closing the verify->swap
+    // window); its cap must be declarable so it matches the maxBytes an
+    // operator passed to selfUpdate.verify for the same asset — otherwise swap
+    // would refuse a large binary that verify accepted. Optional; defaults to
+    // the same C.BYTES.gib(1) cap the body applies.
+    schema.maxBytes = function (value) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value,
+        "selfUpdate.swap: opts.maxBytes", SelfUpdateError, "selfupdate/bad-max-bytes");
+    };
   }
   schema.to       = { rule: "required-string", code: "selfupdate/bad-to",
                       label: "selfUpdate." + label + ": opts.to" };
@@ -696,6 +714,8 @@ async function _safeRollback(backupTo, to, hadOriginal) {
  *   backupTo:     string,   // required — backup path for the existing `to`
  *   expectedHash: string,   // required — the hash selfUpdate.verify returned
  *   hashAlgo:     string,   // sha3-512 (default) | sha-256 | sha-512 | shake256
+ *   maxBytes:     number,   // from-bytes re-hash cap (default 1 GiB) — set to
+ *                           //   the same value passed to selfUpdate.verify
  *
  * @example
  *   var v = await b.selfUpdate.verify({ assetPath, signaturePath, pubkeyPem });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.16",
+  "version": "0.16.18",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4536f3b2-ce54-4f57-930f-5250f9a34d41",
+  "serialNumber": "urn:uuid:1786ee2a-259a-4966-b764-11772b484854",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-12T04:34:36.482Z",
+    "timestamp": "2026-07-12T08:00:39.980Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.16",
+      "bom-ref": "@blamejs/core@0.16.18",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.16",
+      "version": "0.16.18",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.16",
+      "purl": "pkg:npm/%40blamejs/core@0.16.18",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.16",
+      "ref": "@blamejs/core@0.16.18",
       "dependsOn": []
     }
   ]