@blamejs/core 0.16.17 → 0.16.18

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.18 (2026-07-12) — **Refuse a stale FIDO metadata BLOB on the operator-fetch path, harden the GraphQL DoS-shape guard against escaped strings and malformed queries, parse POSIX leading-space octal in tar headers, and fix the FIDO certified-level, self-update 304, and swap-maxBytes paths — surfaced by covering previously-untested error and adversarial branches.** Covering untested error and adversarial branches across four security-relevant primitives surfaced seven defects, fixed at the root. The most serious: b.auth.fidoMds3.fetch() reimplemented the metadata-BLOB validation inline and omitted the stale-BLOB refusal the internal path enforced — so a signed-but-expired BLOB (nextUpdate in the past) was accepted and cached, letting an attacker who serves an ancient correctly-signed BLOB freeze an operator's revoked/compromised-authenticator list at a time of their choosing. Both paths now route through one _verifyBlobWithRoots source of truth, so no check can be present on one and missing on the other. The GraphQL query-shape guard (the pre-schema depth/alias DoS walker) miscounted on a string literal containing an escaped quote and on a brace-unbalanced malformed query, weakening the depth/alias limits it exists to enforce. The FIDO certified-level resolver lexically compared status reports and let an undated later report (a decertification or downgrade) lose to an earlier dated one, so a now-decertified authenticator could still read as certified. A tar reader misparsed POSIX leading-space-padded octal header fields to 0 (a size misparse desynced the block walker and rejected archives other tars extract). self-update's documented 304 If-None-Match fast-path was dead (it threw on every unchanged conditional poll), and selfUpdate.swap read an opts.maxBytes it never declared, so it could refuse a large binary that selfUpdate.verify accepted. **Fixed:** *b.auth.fidoMds3 certified-level honors an undated later decertification or downgrade* — _certifiedLevel compared status reports lexically and coerced a missing effectiveDate to an empty string, which sorts before any real date — so a later report with no effectiveDate (a NOT_FIDO_CERTIFIED decertification, or a downgrade/upgrade) always lost to an earlier dated grant, and certifiedLevel froze at the stale, higher historical value. A step-up policy reading certifiedLevel >= N could therefore accept a now-decertified authenticator. Reports without a comparable date now fall back to array order (append order = chronological), so a later decertification/downgrade wins. · *b.archive.read.tar parses POSIX leading-space-padded octal header fields* — A tar numeric header field (mode / uid / gid / size / mtime / checksum) that is left-padded with ASCII spaces — POSIX-legal, and emitted by star / BSD / Java / Perl tars — was misparsed to 0 because the octal reader treated a leading space as a field terminator. A misparsed size desynced the 512-byte block walker (it read the file body as the next header) and rejected an archive other tars extract cleanly. The reader now skips leading-space padding before reading octal digits. · *b.selfUpdate.poll returns a no-update result on a 304 Not Modified* — The documented If-None-Match / ETag fast-path was unreachable: poll delegated HTTP status handling to the HTTP client, which rejects every non-2xx (304 included) as an error before poll could inspect the status. A conditional poll that correctly received a 304 threw selfupdate/poll-failed instead of returning { available: false, statusCode: 304 }. The 304 (and the non-2xx) branch is now reached, so ETag-conditional polling works as documented. · *b.selfUpdate.swap accepts the maxBytes it re-reads under* — swap re-reads the newly-installed bytes to re-hash them (closing the verify→swap window) under an opts.maxBytes cap, but its option schema never declared maxBytes — so a caller who passed it was refused with selfupdate/bad-opts and swap always used the fixed 1 GiB default, which could refuse a large binary that selfUpdate.verify (which does declare maxBytes) accepted. swap now declares maxBytes (validated like verify's), so the two caps match; rollback, which re-reads nothing, still does not accept it. **Security:** *b.auth.fidoMds3.fetch refuses a stale (expired) metadata BLOB* — The operator-facing fetch path (which trusts caCertificate roots) reimplemented the metadata-BLOB parse and verify inline and omitted the stale-BLOB refusal that the default-roots path enforced, so a BLOB whose nextUpdate is already in the past was accepted and cached even though FIDO MDS3 §3.1.7 says it must not be trusted. An attacker serving an ancient, correctly-signed BLOB could pin an operator to a revoked/compromised-authenticator list frozen at that time. The JWS + x5c-chain verify, payload-shape checks, and stale-BLOB refusal now live in one _verifyBlobWithRoots helper that both the operator-fetch and default-roots paths route through, so the checks can never drift apart again. · *b.guardGraphql hardens the pre-schema DoS-shape walker against escaped strings and malformed queries* — The query-shape walker that enforces depth and alias limits before the query reaches a schema miscounted in two ways: it treated an escaped quote inside a valid GraphQL string literal as the string's terminator (desyncing its in-string state), and it popped its depth-indexed alias counter on every closing brace even for a brace-unbalanced malformed query (underflowing the counter). Both weakened the depth/alias caps the guard exists to enforce against a DoS-shaped query. The walker now tracks string escapes correctly and guards the alias-counter stack against imbalance.
+
 - v0.16.17 (2026-07-12) — **Reject INI float literals that overflow to Infinity, return a verdict (not an exception) when a reverse-DNS lookup faults, wrap an async redirect-hook rejection like a sync throw, and refuse a fractional --max-rows — four defects surfaced by covering previously-untested error branches.** Covering previously-untested error and adversarial branches across four primitives surfaced four genuine defects, each fixed at the root. b.parsers.ini.parse coerced a value like `x = 1e999` straight to ±Infinity — its integer and hex branches already reject out-of-range numbers, but the float branch had no finiteness guard, so an overflowing float slipped through and could poison a downstream size cap or timeout; it is now rejected with ini/value-out-of-range. b.mail.iprev.verify threw an unhandled exception when the forward-confirm DNS lookup returned an error code outside the handful it enumerated (EREFUSED / ENOTIMP / …), even though its reverse-lookup path and every sibling (SPF/DKIM/DMARC/ARC) return a verdict for such faults; it now returns a temperror verdict, and — like those siblings — accepts an operator opts.dnsLookup resolver so the confirm path is resolvable offline. b.httpClient wrapped a synchronous onRedirect hook throw into a REDIRECT_ABORTED error but let an async hook rejection escape unwrapped; both now abort the redirect identically. And the blamejs audit verify-chain --max-rows flag accepted a fractional value (2.5), which truncated the chain walk mid-row and reported a nonsensical fractional count; it now requires a whole positive integer, matching its own error message. **Fixed:** *b.parsers.ini.parse rejects an overflowing float instead of coercing to Infinity* — A float literal that exceeds the representable range (e.g. `x = 1e999`) coerced to ±Infinity. The integer and hex coercion branches already reject out-of-range numbers via Number.isSafeInteger, but the float branch returned Number(raw) with no finiteness check — so an Infinity could flow into a downstream size cap or timeout, a denial-of-service vector. The float branch now rejects a non-finite result with ini/value-out-of-range; a large-but-finite float (1e308) and underflow (1e-999 → 0) still parse. · *b.mail.iprev.verify returns a temperror verdict on an un-enumerated reverse/forward DNS fault* — The forward-confirm DNS lookup's error handler enumerated a few transient codes and threw for anything else, so a resolver returning EREFUSED / ENOTIMP / EBADRESP produced an unhandled exception from the public API rather than a verdict. The reverse-lookup path and every sibling result type (SPF / DKIM / DMARC / ARC) return a verdict for a DNS-derived fault; the forward path now does too (temperror). iprev.verify also gains an operator opts.dnsLookup resolver, matching the dnsLookup contract the other types already honor, so the forward-confirm path is resolvable offline. · *b.httpClient aborts a redirect on an async onRedirect hook rejection* — A synchronous throw from the onRedirect hook was wrapped into a REDIRECT_ABORTED error, but an async hook that rejected let the rejection escape unwrapped — inconsistent handling for the same operator control point. An async onRedirect rejection now aborts the redirect with REDIRECT_ABORTED, identical to the synchronous throw. · *blamejs audit verify-chain --max-rows requires a whole positive integer* — The --max-rows flag validated only that the value was finite and >= 1, so a fractional value (2.5) was accepted and passed to the chain walk, where it truncated the verification mid-row and reported a fractional rowsVerified count — despite the flag's own error message promising a positive integer. It now rejects a non-integer value, matching the sibling --steps flag.
 
 - v0.16.16 (2026-07-12) — **Build the data-subject-request ticket store's SQL through the shared b.sql query builder instead of hand-assembled statements, and add a static check that keeps db-handle primitives composing b.sql.** A maintainability change with no behavior difference for operators. The b.dsr ticket store built its reads and writes by concatenating table and column names into SQL strings passed to db.prepare, re-implementing the identifier quoting and sealed-field handling that b.sql — the same builder b.db.from() uses — already provides. That hand-rolled shape is how b.tenant.quota's storage query drifted from the query builder and accrued a run of parity defects fixed in 0.16.15 (reserved-word names, schema-qualified names, sealed-column filtering). The store's DML now composes b.sql (its schema DDL, which is not a b.sql concern, stays as direct statements), so its SQL cannot diverge from the builder. A new codebase-patterns check flags any db-handle primitive that passes an inline SELECT / INSERT / UPDATE / DELETE string literal to db.prepare / runSql, directing it to compose b.sql instead, so this class of drift cannot recur. **Changed:** *b.dsr ticket store composes b.sql for its reads and writes* — The data-subject-request ticket store (insert / get / list / update / delete / purge and the legacy re-seal backfill) now builds its DML with the b.sql query builder — sql.select / insert / update / delete(table, { dialect, quoteName }).…toSql() — and prepares the resulting statement, rather than concatenating identifiers into SQL strings by hand. This removes a hand-rolled identifier-quoting surface that could drift from what b.db.from() accepts. Schema provisioning (CREATE TABLE / INDEX, ALTER, PRAGMA) is not a b.sql concern and remains as direct statements. One behavior change: on a store backed by a vault, a ticket payload is AEAD-sealed and base64-encoded (~4/3 expansion) before it is bound, and the bound cell must fit the query builder's 64 MiB per-value ceiling — so the payload is now capped at an expansion-safe plaintext size (~48 MiB) and a larger ticket is refused with dsr/ticket-too-large (route large access/portability exports through chunked storage rather than one giant sealed cell). Plaintext stores keep the full 64 MiB limit. When a vault is first enabled on a table that already holds an over-cap legacy plaintext row, the one-time re-seal backfill still migrates that row's subject columns and derived hashes — so it stays findable by subject lookup and erasable by the data-subject erasure purge — and leaves only the over-cap payload plaintext (still under the read ceiling, DB-encrypted at rest, and removed when the row is erased), rather than failing provisioning with a query-builder error. **Detectors:** *Static check: db-handle primitives must compose b.sql for DML* — A new codebase-patterns check flags any primitive holding a db handle that runs DML by passing an inline SELECT / INSERT / UPDATE / DELETE string literal to db.prepare / runSql — the shape that lets a query drift from b.sql's identifier quoting and sealed-field rewrite (the b.tenant.quota storage defect class). It directs authors to build the query with b.sql and prepare the resulting string. DDL and PRAGMA (not b.sql verbs) and queries already built through a b.sql variable are out of scope.

package/lib/archive-tar.js

@@ -175,10 +175,20 @@ function _writeString(buf, value, offset, width) {
 
 function _readOctal(buf, offset, width) {
   // Read an octal-encoded field. Terminator may be space or NUL.
+  //
+  // POSIX permits numeric fields to be LEFT-padded with spaces (as well as
+  // zeros) — star, BSD tar, and several Java/Perl tar libraries emit them,
+  // and GNU tar / libarchive skip them. Treating a leading space as a
+  // terminator silently misreads such a field as 0 (a parser-differential:
+  // the reader would disagree with every other tar on the same bytes, and a
+  // misread size desyncs the block walker). Skip leading-space padding first;
+  // a space or NUL AFTER the digits still terminates the field.
+  var i = 0;
+  while (i < width && buf[offset + i] === 0x20) i += 1;                              // ASCII space (0x20) leading padding per POSIX numeric field
   var s = "";
-  for (var i = 0; i < width; i += 1) {
+  for (; i < width; i += 1) {
     var c = buf[offset + i];
-    if (c === 0x20 || c === 0) break;                                                // ASCII space (0x20) + NUL (0x00) field terminators
+    if (c === 0x20 || c === 0) break;                                                // ASCII space (0x20) + NUL (0x00) field terminators after digits
     if (c < 0x30 || c > 0x37) {                                                      // ASCII '0' (0x30) .. '7' (0x37) octal digits
       throw new TarError("archive-tar/bad-octal",
         "non-octal byte 0x" + c.toString(16) + " at offset " + (offset + i));        // radix=16 for diagnostic hex format

package/lib/auth/fido-mds3.js

@@ -344,12 +344,16 @@ function _parseNextUpdate(s) {
   return d;
 }
 
-// Internal verify-blob helper used by both fetch (live HTTP) and the
-// fetch-with-injected-body test path. Operator-facing surface goes
-// through fetch().
-function _verifyAndParseBlob(token) {
+// Single source of truth for the BLOB-trust decision: JWS + x5c-chain verify
+// against the supplied trust roots, payload-shape validation, AND the
+// stale-BLOB refusal. fetch() (operator-supplied roots via caCertificate) and
+// _verifyAndParseBlob (default vendored roots) BOTH route here so no check can
+// ever be present on one path but missing on the other. The stale-refusal used
+// to live only in this helper's caller-inlined twin, so the operator-facing
+// fetch path silently accepted (and cached) a signed-but-expired BLOB; keeping
+// one body closes that class.
+function _verifyBlobWithRoots(token, rootPems) {
   var jws = _parseJws(token);
-  var rootPems = _resolveRoots(undefined);
   var chain = _validateChain(jws.header.x5c, rootPems);
   _verifyJws(jws, chain[0]);
   var payload = jws.payload;
@@ -366,19 +370,19 @@ function _verifyAndParseBlob(token) {
     throw new FidoMds3Error("fido-mds3/bad-payload",
       "BLOB payload 'nextUpdate' missing or not YYYY-MM-DD: " + payload.nextUpdate);
   }
-  // Stale-BLOB refusal — FIDO MDS3 §3.1.7 says clients SHOULD refresh
-  // by nextUpdate; a BLOB whose nextUpdate is already in the past is
-  // not safe to trust even though its cert chain still validates.
-  // Pre-v0.9.2 the staleness was floored to MIN_CACHE_TTL_MS in
-  // _ttlFromNextUpdate but the BLOB itself was still served from
-  // cache; an attacker serving an ancient signed-but-expired BLOB
-  // could keep operators on a revoked-authenticator-list-frozen-at-X.
-  // Refuse at parse time so neither fetch nor cache lookup honors it.
+  // Stale-BLOB refusal (FIDO MDS3 section 3.1.7): clients SHOULD refresh by
+  // nextUpdate; a BLOB whose nextUpdate is already in the past is not safe to
+  // trust even though its cert chain still validates. Flooring the staleness to
+  // MIN_CACHE_TTL_MS in _ttlFromNextUpdate is not enough on its own -- the BLOB
+  // itself must be refused, or an attacker serving an ancient signed-but-
+  // expired BLOB keeps operators pinned to a revoked-authenticator list frozen
+  // at that time. Refuse at parse time so neither fetch nor a cache lookup ever
+  // honors it.
   if (nextUpdate.getTime() < Date.now()) {
     throw new FidoMds3Error("fido-mds3/blob-stale",
       "BLOB payload nextUpdate \"" + payload.nextUpdate +
-      "\" is in the past — refusing to trust a stale metadata BLOB " +
-      "(FIDO MDS3 §3.1.7)");
+      "\" is in the past -- refusing to trust a stale metadata BLOB " +
+      "(FIDO MDS3 section 3.1.7)");
   }
   return {
     entries:     payload.entries,
@@ -388,6 +392,13 @@ function _verifyAndParseBlob(token) {
   };
 }
 
+// Internal verify-blob helper used by tests to exercise the verifier against
+// the DEFAULT vendored MDS3 trust roots without standing up a real HTTPS
+// endpoint. Operator-facing surface goes through fetch().
+function _verifyAndParseBlob(token) {
+  return _verifyBlobWithRoots(token, _resolveRoots(undefined));
+}
+
 // ---- public surface ----
 
 /**
@@ -481,39 +492,22 @@ async function fetch(opts) {   // allow:raw-outbound-http-framework-internal —
     }
     var token = rsp.body.toString("ascii").trim();
 
-    var jws = _parseJws(token);
-    var chain = _validateChain(jws.header.x5c, rootPems);
-    _verifyJws(jws, chain[0]);
-    var payload = jws.payload;
-    if (!payload || !Array.isArray(payload.entries)) {
-      throw new FidoMds3Error("fido-mds3/bad-payload",
-        "BLOB payload missing 'entries' array");
-    }
-    if (typeof payload.no !== "number" || !isFinite(payload.no)) {
-      throw new FidoMds3Error("fido-mds3/bad-payload",
-        "BLOB payload missing or non-numeric 'no'");
-    }
-    var nextUpdate = _parseNextUpdate(payload.nextUpdate);
-    if (!nextUpdate) {
-      throw new FidoMds3Error("fido-mds3/bad-payload",
-        "BLOB payload 'nextUpdate' missing or not YYYY-MM-DD: " + payload.nextUpdate);
-    }
-    var record = {
-      entries:     payload.entries,
-      no:          payload.no,
-      nextUpdate:  nextUpdate,
-      url:         url,
-      legalHeader: payload.legalHeader,
-    };
+    // Route the trust decision through the shared verifier so this operator-
+    // facing path enforces the identical checks (chain verify, payload shape,
+    // AND the stale-BLOB refusal) as the internal helper -- fetch previously
+    // reimplemented the parse inline and omitted the stale check, silently
+    // accepting and caching an ancient signed-but-expired BLOB.
+    var record = _verifyBlobWithRoots(token, rootPems);
+    record.url = url;
     // Re-assert TTL based on the BLOB's nextUpdate (overrides the
     // wrap-call's safe-minimum seed).
-    try { await c.set(cacheKey, record, _ttlFromNextUpdate(nextUpdate)); }
+    try { await c.set(cacheKey, record, _ttlFromNextUpdate(record.nextUpdate)); }
     catch (_e) { /* cache.set best-effort */ }
     try { audit().safeEmit({
       action:   "auth.fido_mds3.fetch",
       outcome:  "success",
-      metadata: { url: url, no: payload.no, entries: payload.entries.length,
-                  nextUpdate: payload.nextUpdate },
+      metadata: { url: url, no: record.no, entries: record.entries.length,
+                  nextUpdate: record.nextUpdate.toISOString().slice(0, 10) },
     }); } catch (_e) { /* audit best-effort */ }
     return record;
   }, MIN_CACHE_TTL_MS);
@@ -577,18 +571,35 @@ function lookupAaguid(blob, aaguid) {
 function _certifiedLevel(statusReports) {
   if (!Array.isArray(statusReports)) return { level: 0, plus: false };
   var latest = null;
-  var latestDate = null;
+  var latestDate = null;   // null == no comparable date (missing / malformed)
   for (var i = 0; i < statusReports.length; i++) {
     var sr = statusReports[i];
     // Only certification-status reports move the level: a level grant, or its
     // explicit revocation (NOT_FIDO_CERTIFIED). Other statuses (UPDATE_AVAILABLE,
-    // REVOKED, …) are handled elsewhere and must not be read as a level. The
-    // status length is bounded before the regex test below — FIDO status tokens
+    // REVOKED, etc.) are handled elsewhere and must not be read as a level. The
+    // status length is bounded before the regex test below -- FIDO status tokens
     // are short enums; bounding input before any .test() is the convention.
     if (!sr || typeof sr.status !== "string" || sr.status.length > 64) continue;
     if (!CERT_LEVEL_RE.test(sr.status) && sr.status !== "NOT_FIDO_CERTIFIED") continue;
-    var d = typeof sr.effectiveDate === "string" ? sr.effectiveDate : "";
-    if (latest === null || d >= latestDate) {
+    // Only a well-formed calendar date is comparable. Reuse _parseNextUpdate
+    // (which already validates YYYY-MM-DD AND rejects impossible dates such as
+    // 2026-02-31) and compare epoch ms. A missing / malformed effectiveDate is
+    // "no comparable date" (null) and falls back to array order (append order,
+    // which the spec defines as chronological): the report later in the array
+    // is the more recent one. Coercing a missing date to "" and running it
+    // through a lexical compare made an undated report lose to EVERY earlier
+    // dated report, so a later decertification / downgrade / upgrade whose
+    // effectiveDate was absent never superseded the earlier grant -- freezing
+    // certifiedLevel at a stale value (an authenticator-assurance bypass: a
+    // decertified or downgraded authenticator kept reporting its prior level to
+    // step-up / risk policy).
+    var parsed = typeof sr.effectiveDate === "string" ? _parseNextUpdate(sr.effectiveDate) : null;
+    var d = parsed ? parsed.getTime() : null;
+    if (latest === null) { latest = sr; latestDate = d; continue; }
+    // sr is later in array order than the current latest. A missing/malformed
+    // date on EITHER side means array order decides -> sr (later) wins. Both
+    // dated -> the newer-or-equal date wins (sr, being later, takes ties).
+    if (d === null || latestDate === null || d >= latestDate) {
       latest = sr; latestDate = d;
     }
   }

package/lib/guard-graphql.js

@@ -165,7 +165,8 @@ function _measureQueryShape(query) {
   var depth = 0;
   var inString = false;
   var inComment = false;
-  var aliasCounts = [0];                                                         // per-depth alias counter
+  var escapeNext = false;                                                        // inside a string, the previous char was an unescaped backslash
+  var aliasStack = [0];                                                          // per-selection-set alias counter (top of stack = current set)
   for (var i = 0; i < query.length; i += 1) {
     var c = query.charAt(i);
     if (inComment) {
@@ -173,7 +174,18 @@ function _measureQueryShape(query) {
       continue;
     }
     if (inString) {
-      if (c === '"' && query.charAt(i - 1) !== "\\") inString = false;
+      // Escaped-quote handling must track the backslash RUN, not just the
+      // single preceding char. `"\\"` is a complete string (its backslash is
+      // itself escaped), so a naive `charAt(i - 1) !== "\\"` test reads the
+      // closing quote as escaped, leaves the walker stuck in-string, and
+      // blinds it to every following brace / colon — silently under-counting
+      // depth and alias breadth so a depth-bomb or alias-bomb rides through as
+      // shape-clean (a fail-open DoS-measurement bypass on valid GraphQL).
+      // Toggle on each backslash: a closing quote ends the string only after
+      // an EVEN run (escapeNext false).
+      if (escapeNext) { escapeNext = false; continue; }
+      if (c === "\\") { escapeNext = true; continue; }
+      if (c === '"') inString = false;
       continue;
     }
     if (c === '"') { inString = true; continue; }
@@ -181,28 +193,35 @@ function _measureQueryShape(query) {
     if (c === "{") {
       depth += 1;
       if (depth > maxDepth) maxDepth = depth;
-      aliasCounts.push(0);
+      aliasStack.push(0);
     } else if (c === "}") {
       // Capture the current selection-set's alias count before popping
       // — otherwise we lose the per-block max when the block closes.
-      var current = aliasCounts[aliasCounts.length - 1] || 0;
+      var current = aliasStack[aliasStack.length - 1] || 0;
       if (current > maxAliases) maxAliases = current;
       depth -= 1;
-      aliasCounts.pop();
+      // Never pop the base counter: an unbalanced leading `}` would otherwise
+      // desync the stack from `depth`, and a subsequent `depth`-indexed
+      // increment lands on an absent slot (`undefined + 1 === NaN`), poisoning
+      // every later comparison so an alias-bomb reads as clean.
+      if (aliasStack.length > 1) aliasStack.pop();
       if (depth < 0) depth = 0;
     } else if (c === ":") {
-      // Alias indicator — `alias: field`. Increment the current depth's
-      // counter when the char before `:` looks like an identifier.
+      // Alias / argument indicator — `alias: field` / `field(arg: value)`.
+      // Increment the CURRENT selection-set's counter (top of stack) when the
+      // char before `:` looks like an identifier. Using the stack top rather
+      // than a `depth` index keeps counting correct even when a malformed
+      // brace run has decoupled `depth` from the stack length.
       var prev = i > 0 ? query.charAt(i - 1) : "";
-      if (/[A-Za-z0-9_]/.test(prev) && depth > 0) {
-        aliasCounts[depth] += 1;
+      if (/[A-Za-z0-9_]/.test(prev) && aliasStack.length > 1) {
+        aliasStack[aliasStack.length - 1] += 1;
       }
     }
   }
   // Final sweep covers any unclosed selection-sets (operator-supplied
   // syntactically-invalid queries).
-  for (var ai = 0; ai < aliasCounts.length; ai += 1) {
-    if (aliasCounts[ai] > maxAliases) maxAliases = aliasCounts[ai];
+  for (var ai = 0; ai < aliasStack.length; ai += 1) {
+    if (aliasStack[ai] > maxAliases) maxAliases = aliasStack[ai];
   }
   return { maxDepth: maxDepth, maxAliases: maxAliases };
 }

package/lib/self-update.js

@@ -378,6 +378,15 @@ async function poll(opts) {
       allowedHosts:     opts.allowedHosts,
       allowedProtocols: opts.allowedProtocols,
       allowInternal:    opts.allowInternal,
+      // poll() owns status handling — the branches below distinguish a 304
+      // If-None-Match "fast no-update" hit from a real non-2xx refusal and a
+      // 2xx feed to parse. Without always-resolve, httpClient.request rejects
+      // EVERY non-2xx (304 included) as HTTP_ERROR before poll can inspect
+      // res.statusCode, which made the documented conditional-poll fast-path
+      // and the selfupdate/poll-non-2xx branch dead code — a conditional poll
+      // that correctly received a 304 threw selfupdate/poll-failed instead of
+      // reporting "no update".
+      responseMode:     "always-resolve",
       errorClass:       SelfUpdateError,
     });
   } catch (e) {
@@ -630,6 +639,15 @@ function _validateSwapOpts(opts, label) {
           "selfUpdate.swap: opts.hashAlgo must be one of " + ALLOWED_HASH_ALGS.join(", "));
       }
     };
+    // swap re-reads the from-bytes to re-hash them (closing the verify->swap
+    // window); its cap must be declarable so it matches the maxBytes an
+    // operator passed to selfUpdate.verify for the same asset — otherwise swap
+    // would refuse a large binary that verify accepted. Optional; defaults to
+    // the same C.BYTES.gib(1) cap the body applies.
+    schema.maxBytes = function (value) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value,
+        "selfUpdate.swap: opts.maxBytes", SelfUpdateError, "selfupdate/bad-max-bytes");
+    };
   }
   schema.to       = { rule: "required-string", code: "selfupdate/bad-to",
                       label: "selfUpdate." + label + ": opts.to" };
@@ -696,6 +714,8 @@ async function _safeRollback(backupTo, to, hadOriginal) {
  *   backupTo:     string,   // required — backup path for the existing `to`
  *   expectedHash: string,   // required — the hash selfUpdate.verify returned
  *   hashAlgo:     string,   // sha3-512 (default) | sha-256 | sha-512 | shake256
+ *   maxBytes:     number,   // from-bytes re-hash cap (default 1 GiB) — set to
+ *                           //   the same value passed to selfUpdate.verify
  *
  * @example
  *   var v = await b.selfUpdate.verify({ assetPath, signaturePath, pubkeyPem });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.17",
+  "version": "0.16.18",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3e3c1217-5f8b-4f16-b9f5-bea246e83437",
+  "serialNumber": "urn:uuid:1786ee2a-259a-4966-b764-11772b484854",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-12T06:26:29.484Z",
+    "timestamp": "2026-07-12T08:00:39.980Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.17",
+      "bom-ref": "@blamejs/core@0.16.18",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.17",
+      "version": "0.16.18",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.17",
+      "purl": "pkg:npm/%40blamejs/core@0.16.18",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.17",
+      "ref": "@blamejs/core@0.16.18",
       "dependsOn": []
     }
   ]