@blamejs/core 0.16.17 → 0.16.19

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.19 (2026-07-12) — **Close a family of entity- and whitespace-hidden dangerous-URL-scheme and CSS-injection bypasses across b.guardHtml / b.guardSvg / b.guardMarkdown behind one shared normalizer, bound a DNS decompression-pointer name bomb, refuse an ambiguous audit-anchor canonicalization, and stop an empty-string sealed field from crashing an AAD-table write.** Covering untested adversarial branches across the content guards, a DNS wire parser, the audit-log anchor, and the sealed-field codec surfaced a family of fail-open defects, fixed at the root. The most serious span the content-guard URL-scheme and CSS-injection denylists: a browser removes tab/lf/cr from anywhere in a URL and trims a leading/trailing control-or-space run before resolving the scheme, and character-reference-decodes a style attribute before the CSS parser sees it, so an entity-encoded tab, an entity-encoded leading space, an HTML named entity, or an entity-encoded CSS token could all navigate/execute while reading past a denylist that matched the raw bytes. b.guardHtml missed the whitespace normalization entirely and matched CSS against raw bytes; b.guardMarkdown decoded only numeric entities; b.guardSvg had a partial fix. All three now route their scheme and CSS-token checks through one pair of shared codepoint-class normalizers, so no guard can strip a different set of encodings than another. A DNS compression-pointer chain could decompress a single name past the RFC 1035 255-octet / label caps (a decompression-amplification DoS); the audit-log anchor's newline-delimited signed bytes let one signature validate for several different tip/previous-tip splits (defeating the linkage tamper-evidence); an SVG animation element permitted under a permissive profile lost its open tag; and an empty-string sealed column crashed an AAD-table insert. **Fixed:** *b.guardSvg preserves a profile-permitted safe animation element* — Under a permissive profile that allows animation, a safe animation element (for example an <animate> whose attributeName targets a visual property) had its open tag dropped while its end tag was still emitted, leaving an orphan close tag and silently stripping an element the profile permits. The sanitize path now affirmatively re-permits the safe-target case; an unsafe-target animation (attributeName=href and similar) is still dropped and neutralized. · *b.cryptoField.sealRow seals an empty-string field as a tamper-evident envelope* — sealRow dispatched every non-null value -- including an empty string -- to one of three envelope-seal branches that disagreed on empty plaintext: the plain and per-row-key branches handled it, but the AAD branch is fail-closed and threw, so a write to an AAD-sealed table whose sealed column held an empty string crashed the insert. An empty string now encodes to a non-empty typed marker before sealing, so it becomes a real authenticated envelope (never a bare plaintext empty string) that round-trips to an empty string on read. On the read side, a bare empty string found in an AAD-bound or per-row-key sealed column -- which after this change can only be an envelope-downgrade by a DB-write attacker -- fails closed (the cell is nulled and audited) instead of being accepted as a valid empty value, so the sealed-column tamper-evidence guarantee holds for empty values too. **Security:** *b.guardHtml / b.guardSvg / b.guardMarkdown refuse entity- and whitespace-hidden dangerous URL schemes* — The URL-scheme denylist on every URL-bearing attribute (href / xlink:href / markdown link, image, autolink, reference-definition) is resolved after normalizing the value the way a browser does: character-reference decoding (numeric AND the HTML5 named-entity ASCII subset browsers honor, e.g. &Tab; / &colon;), removing tab/lf/cr from anywhere, and trimming a leading/trailing C0-control-or-space run. Previously b.guardHtml stripped neither tab/lf/cr nor an entity-encoded leading space, and b.guardMarkdown decoded only numeric entities, so payloads such as java&#9;script:, java&Tab;script:, and &#32;javascript: resolved to an empty scheme and were served/rendered as safe while a browser executed them as javascript:. The normalization now lives in two shared codepoint-class primitives (b.codepointClass.decodeMarkupEntities and b.codepointClass.stripUrlSchemeWhitespace) that all three guards compose, so no guard can fold away a different set of encodings than another. · *b.guardHtml / b.guardSvg detect entity-encoded and whitespace-hidden CSS injection in style attributes* — A style attribute is HTML/XML character-reference-decoded before the CSS parser sees it, so width:ex&#x70;ression(, background:url(&#x6A;avascript:...), and behavior&colon;url(...) reach CSS as expression( / url(javascript:...) / behavior: with no literal danger token in the raw bytes. The CSS-danger check matched the raw attribute value, so these bypassed the denylist and were served verbatim (a stored CSS-injection XSS). Both guards now match the entity-decoded value AND fold the URL-scheme whitespace a browser strips inside url(...) (tab / lf / cr), so an entity-hidden tab in a CSS URL scheme (url(java&Tab;script:) reaching CSS as url(java<TAB>script:), which navigates as javascript:) can no longer defeat the contiguous javascript: pattern either. A plain (unencoded) dangerous style is still caught and a benign style is untouched. · *b.safeDns bounds a decompressed name across the whole compression-pointer chain* — readName tracked its per-name octet and label budgets per stack frame, so each compression-pointer jump restarted a fresh RFC 1035 255-octet / label budget and a pointer was charged as only its 2 on-wire bytes. A crafted pointer chain therefore decompressed a single name well past the advertised 255-octet / label caps (a decompression-amplification DoS on untrusted DNS responses). The octet and label accountants now thread through the whole pointer chain, so the composite decompressed name is bounded by the same caps that bound a single in-line name; independent names are still measured independently and no name that decompresses within the caps is newly rejected. · *b.auditSign refuses an anchor whose fields carry the record delimiter* — The chain-anchor signed bytes are a newline-delimited layout of format / counter / tipHash / prevTipHash / createdAt. A literal newline inside any operator-influenced string field (format / tipHash / prevTipHash) let content migrate across a field boundary without changing the signed bytes, so one signature was valid for several different { tipHash, prevTipHash } splits -- an attacker could rewrite a stored anchor's apparent tip/linkage while keeping verify() happy, defeating the prevTipHash linkage tamper-evidence. anchor() now refuses a delimiter-bearing field at sign time and verifyAnchor refuses one at verify time, so an ambiguous anchor can neither be minted nor accepted; every legitimate (delimiter-free) anchor is byte-identical and unaffected. **Detectors:** *Guard scheme extractors and CSS-danger checks must compose the shared normalizers* — Two structural checks assert that a content guard which resolves a URL scheme for a denylist routes the decoded value through b.codepointClass.stripUrlSchemeWhitespace, and that a guard's CSS-danger check matches the entity-decoded style value via b.codepointClass.decodeMarkupEntities -- so a future guard cannot silently fold away a narrower set of encodings than the browser and re-open the bypass class.
+
+- v0.16.18 (2026-07-12) — **Refuse a stale FIDO metadata BLOB on the operator-fetch path, harden the GraphQL DoS-shape guard against escaped strings and malformed queries, parse POSIX leading-space octal in tar headers, and fix the FIDO certified-level, self-update 304, and swap-maxBytes paths — surfaced by covering previously-untested error and adversarial branches.** Covering untested error and adversarial branches across four security-relevant primitives surfaced seven defects, fixed at the root. The most serious: b.auth.fidoMds3.fetch() reimplemented the metadata-BLOB validation inline and omitted the stale-BLOB refusal the internal path enforced — so a signed-but-expired BLOB (nextUpdate in the past) was accepted and cached, letting an attacker who serves an ancient correctly-signed BLOB freeze an operator's revoked/compromised-authenticator list at a time of their choosing. Both paths now route through one _verifyBlobWithRoots source of truth, so no check can be present on one and missing on the other. The GraphQL query-shape guard (the pre-schema depth/alias DoS walker) miscounted on a string literal containing an escaped quote and on a brace-unbalanced malformed query, weakening the depth/alias limits it exists to enforce. The FIDO certified-level resolver lexically compared status reports and let an undated later report (a decertification or downgrade) lose to an earlier dated one, so a now-decertified authenticator could still read as certified. A tar reader misparsed POSIX leading-space-padded octal header fields to 0 (a size misparse desynced the block walker and rejected archives other tars extract). self-update's documented 304 If-None-Match fast-path was dead (it threw on every unchanged conditional poll), and selfUpdate.swap read an opts.maxBytes it never declared, so it could refuse a large binary that selfUpdate.verify accepted. **Fixed:** *b.auth.fidoMds3 certified-level honors an undated later decertification or downgrade* — _certifiedLevel compared status reports lexically and coerced a missing effectiveDate to an empty string, which sorts before any real date — so a later report with no effectiveDate (a NOT_FIDO_CERTIFIED decertification, or a downgrade/upgrade) always lost to an earlier dated grant, and certifiedLevel froze at the stale, higher historical value. A step-up policy reading certifiedLevel >= N could therefore accept a now-decertified authenticator. Reports without a comparable date now fall back to array order (append order = chronological), so a later decertification/downgrade wins. · *b.archive.read.tar parses POSIX leading-space-padded octal header fields* — A tar numeric header field (mode / uid / gid / size / mtime / checksum) that is left-padded with ASCII spaces — POSIX-legal, and emitted by star / BSD / Java / Perl tars — was misparsed to 0 because the octal reader treated a leading space as a field terminator. A misparsed size desynced the 512-byte block walker (it read the file body as the next header) and rejected an archive other tars extract cleanly. The reader now skips leading-space padding before reading octal digits. · *b.selfUpdate.poll returns a no-update result on a 304 Not Modified* — The documented If-None-Match / ETag fast-path was unreachable: poll delegated HTTP status handling to the HTTP client, which rejects every non-2xx (304 included) as an error before poll could inspect the status. A conditional poll that correctly received a 304 threw selfupdate/poll-failed instead of returning { available: false, statusCode: 304 }. The 304 (and the non-2xx) branch is now reached, so ETag-conditional polling works as documented. · *b.selfUpdate.swap accepts the maxBytes it re-reads under* — swap re-reads the newly-installed bytes to re-hash them (closing the verify→swap window) under an opts.maxBytes cap, but its option schema never declared maxBytes — so a caller who passed it was refused with selfupdate/bad-opts and swap always used the fixed 1 GiB default, which could refuse a large binary that selfUpdate.verify (which does declare maxBytes) accepted. swap now declares maxBytes (validated like verify's), so the two caps match; rollback, which re-reads nothing, still does not accept it. **Security:** *b.auth.fidoMds3.fetch refuses a stale (expired) metadata BLOB* — The operator-facing fetch path (which trusts caCertificate roots) reimplemented the metadata-BLOB parse and verify inline and omitted the stale-BLOB refusal that the default-roots path enforced, so a BLOB whose nextUpdate is already in the past was accepted and cached even though FIDO MDS3 §3.1.7 says it must not be trusted. An attacker serving an ancient, correctly-signed BLOB could pin an operator to a revoked/compromised-authenticator list frozen at that time. The JWS + x5c-chain verify, payload-shape checks, and stale-BLOB refusal now live in one _verifyBlobWithRoots helper that both the operator-fetch and default-roots paths route through, so the checks can never drift apart again. · *b.guardGraphql hardens the pre-schema DoS-shape walker against escaped strings and malformed queries* — The query-shape walker that enforces depth and alias limits before the query reaches a schema miscounted in two ways: it treated an escaped quote inside a valid GraphQL string literal as the string's terminator (desyncing its in-string state), and it popped its depth-indexed alias counter on every closing brace even for a brace-unbalanced malformed query (underflowing the counter). Both weakened the depth/alias caps the guard exists to enforce against a DoS-shaped query. The walker now tracks string escapes correctly and guards the alias-counter stack against imbalance.
+
 - v0.16.17 (2026-07-12) — **Reject INI float literals that overflow to Infinity, return a verdict (not an exception) when a reverse-DNS lookup faults, wrap an async redirect-hook rejection like a sync throw, and refuse a fractional --max-rows — four defects surfaced by covering previously-untested error branches.** Covering previously-untested error and adversarial branches across four primitives surfaced four genuine defects, each fixed at the root. b.parsers.ini.parse coerced a value like `x = 1e999` straight to ±Infinity — its integer and hex branches already reject out-of-range numbers, but the float branch had no finiteness guard, so an overflowing float slipped through and could poison a downstream size cap or timeout; it is now rejected with ini/value-out-of-range. b.mail.iprev.verify threw an unhandled exception when the forward-confirm DNS lookup returned an error code outside the handful it enumerated (EREFUSED / ENOTIMP / …), even though its reverse-lookup path and every sibling (SPF/DKIM/DMARC/ARC) return a verdict for such faults; it now returns a temperror verdict, and — like those siblings — accepts an operator opts.dnsLookup resolver so the confirm path is resolvable offline. b.httpClient wrapped a synchronous onRedirect hook throw into a REDIRECT_ABORTED error but let an async hook rejection escape unwrapped; both now abort the redirect identically. And the blamejs audit verify-chain --max-rows flag accepted a fractional value (2.5), which truncated the chain walk mid-row and reported a nonsensical fractional count; it now requires a whole positive integer, matching its own error message. **Fixed:** *b.parsers.ini.parse rejects an overflowing float instead of coercing to Infinity* — A float literal that exceeds the representable range (e.g. `x = 1e999`) coerced to ±Infinity. The integer and hex coercion branches already reject out-of-range numbers via Number.isSafeInteger, but the float branch returned Number(raw) with no finiteness check — so an Infinity could flow into a downstream size cap or timeout, a denial-of-service vector. The float branch now rejects a non-finite result with ini/value-out-of-range; a large-but-finite float (1e308) and underflow (1e-999 → 0) still parse. · *b.mail.iprev.verify returns a temperror verdict on an un-enumerated reverse/forward DNS fault* — The forward-confirm DNS lookup's error handler enumerated a few transient codes and threw for anything else, so a resolver returning EREFUSED / ENOTIMP / EBADRESP produced an unhandled exception from the public API rather than a verdict. The reverse-lookup path and every sibling result type (SPF / DKIM / DMARC / ARC) return a verdict for a DNS-derived fault; the forward path now does too (temperror). iprev.verify also gains an operator opts.dnsLookup resolver, matching the dnsLookup contract the other types already honor, so the forward-confirm path is resolvable offline. · *b.httpClient aborts a redirect on an async onRedirect hook rejection* — A synchronous throw from the onRedirect hook was wrapped into a REDIRECT_ABORTED error, but an async hook that rejected let the rejection escape unwrapped — inconsistent handling for the same operator control point. An async onRedirect rejection now aborts the redirect with REDIRECT_ABORTED, identical to the synchronous throw. · *blamejs audit verify-chain --max-rows requires a whole positive integer* — The --max-rows flag validated only that the value was finite and >= 1, so a fractional value (2.5) was accepted and passed to the chain walk, where it truncated the verification mid-row and reported a fractional rowsVerified count — despite the flag's own error message promising a positive integer. It now rejects a non-integer value, matching the sibling --steps flag.
 
 - v0.16.16 (2026-07-12) — **Build the data-subject-request ticket store's SQL through the shared b.sql query builder instead of hand-assembled statements, and add a static check that keeps db-handle primitives composing b.sql.** A maintainability change with no behavior difference for operators. The b.dsr ticket store built its reads and writes by concatenating table and column names into SQL strings passed to db.prepare, re-implementing the identifier quoting and sealed-field handling that b.sql — the same builder b.db.from() uses — already provides. That hand-rolled shape is how b.tenant.quota's storage query drifted from the query builder and accrued a run of parity defects fixed in 0.16.15 (reserved-word names, schema-qualified names, sealed-column filtering). The store's DML now composes b.sql (its schema DDL, which is not a b.sql concern, stays as direct statements), so its SQL cannot diverge from the builder. A new codebase-patterns check flags any db-handle primitive that passes an inline SELECT / INSERT / UPDATE / DELETE string literal to db.prepare / runSql, directing it to compose b.sql instead, so this class of drift cannot recur. **Changed:** *b.dsr ticket store composes b.sql for its reads and writes* — The data-subject-request ticket store (insert / get / list / update / delete / purge and the legacy re-seal backfill) now builds its DML with the b.sql query builder — sql.select / insert / update / delete(table, { dialect, quoteName }).…toSql() — and prepares the resulting statement, rather than concatenating identifiers into SQL strings by hand. This removes a hand-rolled identifier-quoting surface that could drift from what b.db.from() accepts. Schema provisioning (CREATE TABLE / INDEX, ALTER, PRAGMA) is not a b.sql concern and remains as direct statements. One behavior change: on a store backed by a vault, a ticket payload is AEAD-sealed and base64-encoded (~4/3 expansion) before it is bound, and the bound cell must fit the query builder's 64 MiB per-value ceiling — so the payload is now capped at an expansion-safe plaintext size (~48 MiB) and a larger ticket is refused with dsr/ticket-too-large (route large access/portability exports through chunked storage rather than one giant sealed cell). Plaintext stores keep the full 64 MiB limit. When a vault is first enabled on a table that already holds an over-cap legacy plaintext row, the one-time re-seal backfill still migrates that row's subject columns and derived hashes — so it stays findable by subject lookup and erasable by the data-subject erasure purge — and leaves only the over-cap payload plaintext (still under the read ceiling, DB-encrypted at rest, and removed when the row is erased), rather than failing provisioning with a query-builder error. **Detectors:** *Static check: db-handle primitives must compose b.sql for DML* — A new codebase-patterns check flags any primitive holding a db handle that runs DML by passing an inline SELECT / INSERT / UPDATE / DELETE string literal to db.prepare / runSql — the shape that lets a query drift from b.sql's identifier quoting and sealed-field rewrite (the b.tenant.quota storage defect class). It directs authors to build the query with b.sql and prepare the resulting string. DDL and PRAGMA (not b.sql verbs) and queries already built through a b.sql variable are out of scope.

package/lib/archive-tar.js

@@ -175,10 +175,20 @@ function _writeString(buf, value, offset, width) {
 
 function _readOctal(buf, offset, width) {
   // Read an octal-encoded field. Terminator may be space or NUL.
+  //
+  // POSIX permits numeric fields to be LEFT-padded with spaces (as well as
+  // zeros) — star, BSD tar, and several Java/Perl tar libraries emit them,
+  // and GNU tar / libarchive skip them. Treating a leading space as a
+  // terminator silently misreads such a field as 0 (a parser-differential:
+  // the reader would disagree with every other tar on the same bytes, and a
+  // misread size desyncs the block walker). Skip leading-space padding first;
+  // a space or NUL AFTER the digits still terminates the field.
+  var i = 0;
+  while (i < width && buf[offset + i] === 0x20) i += 1;                              // ASCII space (0x20) leading padding per POSIX numeric field
   var s = "";
-  for (var i = 0; i < width; i += 1) {
+  for (; i < width; i += 1) {
     var c = buf[offset + i];
-    if (c === 0x20 || c === 0) break;                                                // ASCII space (0x20) + NUL (0x00) field terminators
+    if (c === 0x20 || c === 0) break;                                                // ASCII space (0x20) + NUL (0x00) field terminators after digits
     if (c < 0x30 || c > 0x37) {                                                      // ASCII '0' (0x30) .. '7' (0x37) octal digits
       throw new TarError("archive-tar/bad-octal",
         "non-octal byte 0x" + c.toString(16) + " at offset " + (offset + i));        // radix=16 for diagnostic hex format

package/lib/audit-sign.js

@@ -204,6 +204,24 @@ function _computeFingerprint(publicKeyPem) {
 // untouched). Changing this invalidates every prior anchor.
 var ANCHOR_FORMAT = "blamejs-chain-anchor-v1";
 
+// The anchor signed-bytes layout below is newline-delimited, so a literal
+// newline inside any operator-influenced string field (format / tipHash /
+// prevTipHash) would let content migrate across a field boundary WITHOUT
+// changing the signed bytes: two different { tipHash, prevTipHash } splits
+// collide on one signature, so a signature minted for one split verifies for a
+// different split. That defeats the "prevTipHash is bound into the signature"
+// linkage guarantee — an attacker could rewrite the apparent tip / linkage of a
+// stored anchor while keeping verify() happy. counter + createdAt are numbers
+// (String() of a finite number can never contain the delimiter), so only the
+// three string fields need guarding. Reject the delimiter at BOTH sign time
+// (so no ambiguous signature is ever minted) and verify time (so a pre-existing
+// or hand-crafted ambiguous anchor is refused, not accepted). The wire format
+// stays byte-identical for every legitimate (delimiter-free) anchor.
+var ANCHOR_FIELD_DELIMITER = "\n";
+function _containsAnchorDelimiter(s) {
+  return typeof s === "string" && s.indexOf(ANCHOR_FIELD_DELIMITER) !== -1;
+}
+
 // Build the canonical signed bytes for one anchor. Fixed multi-line layout (no
 // JSON serializer quirks). prevTipHash IS part of the signed payload, so the
 // link between consecutive anchors is tamper-evident — an attacker cannot
@@ -878,10 +896,20 @@ function _normalizeTip(tip, fnLabel) {
     throw _err("ANCHOR_BAD_TIPHASH",
       "auditSign." + fnLabel + ": tip.tipHash must be a non-empty string");
   }
+  if (_containsAnchorDelimiter(tip.tipHash)) {
+    throw _err("ANCHOR_BAD_TIPHASH",
+      "auditSign." + fnLabel + ": tip.tipHash must not contain a newline (the anchor " +
+      "record delimiter — it would make the signed bytes ambiguous)");
+  }
   if (tip.prevTipHash != null && typeof tip.prevTipHash !== "string") {
     throw _err("ANCHOR_BAD_PREV",
       "auditSign." + fnLabel + ": tip.prevTipHash, when present, must be a string");
   }
+  if (_containsAnchorDelimiter(tip.prevTipHash)) {
+    throw _err("ANCHOR_BAD_PREV",
+      "auditSign." + fnLabel + ": tip.prevTipHash must not contain a newline (the anchor " +
+      "record delimiter — it would make the signed bytes ambiguous)");
+  }
   return {
     counter:     counter,
     tipHash:     tip.tipHash,
@@ -916,7 +944,9 @@ function _normalizeTip(tip, fnLabel) {
  * that key store (not fully store-free) — keep the history with the anchors.
  *
  * Throws `AuditSignError` (`ANCHOR_BAD_TIP` / `ANCHOR_BAD_COUNTER` /
- * `ANCHOR_BAD_TIPHASH` / `ANCHOR_BAD_PREV`) on a malformed tip;
+ * `ANCHOR_BAD_TIPHASH` / `ANCHOR_BAD_PREV` / `ANCHOR_BAD_FORMAT`) on a malformed
+ * tip — including any `format` / `tipHash` / `prevTipHash` that carries a
+ * newline, which would make the signed bytes ambiguous;
  * `audit-sign/not-initialized` when `init()` has not been awaited.
  *
  * @opts
@@ -934,6 +964,11 @@ function anchor(tip, opts) {
   _requireInit();
   opts = opts || {};
   var t = _normalizeTip(tip, "anchor");
+  if (_containsAnchorDelimiter(opts.format)) {
+    throw _err("ANCHOR_BAD_FORMAT",
+      "auditSign.anchor: opts.format must not contain a newline (the anchor " +
+      "record delimiter — it would make the signed bytes ambiguous)");
+  }
   var format = (typeof opts.format === "string" && opts.format.length > 0) ? opts.format : ANCHOR_FORMAT;
   var createdAt = (typeof opts.createdAt === "number" && isFinite(opts.createdAt)) ? opts.createdAt : Date.now();
   var payload = anchorPayload(t.counter, t.tipHash, t.prevTipHash, createdAt, format);
@@ -962,6 +997,17 @@ function _verifyOneAnchor(a) {
   if (typeof a.counter !== "number" || !isFinite(a.counter)) {
     return { ok: false, reason: "anchor counter is not a finite number" };
   }
+  // Fail closed on a delimiter-bearing field: the newline-delimited signed
+  // bytes are ambiguous when format / tipHash / prevTipHash carries the
+  // delimiter, so ONE signature can be valid for several different logical
+  // { tipHash, prevTipHash } splits. Refuse rather than accept the ambiguity —
+  // a legitimate anchor is delimiter-free (anchor() rejects a newline field at
+  // sign time), so this only ever rejects a hand-crafted / boundary-shifted one.
+  if (_containsAnchorDelimiter(a.tipHash) ||
+      _containsAnchorDelimiter(a.format) ||
+      _containsAnchorDelimiter(a.prevTipHash)) {
+    return { ok: false, reason: "anchor field contains the record delimiter (ambiguous canonicalization)" };
+  }
   var pub = getPublicKeyByFingerprint(a.publicKeyFingerprint);
   if (!pub) {
     return { ok: false, reason: "no audit-signing key on record for this anchor's fingerprint" };

package/lib/auth/fido-mds3.js

@@ -344,12 +344,16 @@ function _parseNextUpdate(s) {
   return d;
 }
 
-// Internal verify-blob helper used by both fetch (live HTTP) and the
-// fetch-with-injected-body test path. Operator-facing surface goes
-// through fetch().
-function _verifyAndParseBlob(token) {
+// Single source of truth for the BLOB-trust decision: JWS + x5c-chain verify
+// against the supplied trust roots, payload-shape validation, AND the
+// stale-BLOB refusal. fetch() (operator-supplied roots via caCertificate) and
+// _verifyAndParseBlob (default vendored roots) BOTH route here so no check can
+// ever be present on one path but missing on the other. The stale-refusal used
+// to live only in this helper's caller-inlined twin, so the operator-facing
+// fetch path silently accepted (and cached) a signed-but-expired BLOB; keeping
+// one body closes that class.
+function _verifyBlobWithRoots(token, rootPems) {
   var jws = _parseJws(token);
-  var rootPems = _resolveRoots(undefined);
   var chain = _validateChain(jws.header.x5c, rootPems);
   _verifyJws(jws, chain[0]);
   var payload = jws.payload;
@@ -366,19 +370,19 @@ function _verifyAndParseBlob(token) {
     throw new FidoMds3Error("fido-mds3/bad-payload",
       "BLOB payload 'nextUpdate' missing or not YYYY-MM-DD: " + payload.nextUpdate);
   }
-  // Stale-BLOB refusal — FIDO MDS3 §3.1.7 says clients SHOULD refresh
-  // by nextUpdate; a BLOB whose nextUpdate is already in the past is
-  // not safe to trust even though its cert chain still validates.
-  // Pre-v0.9.2 the staleness was floored to MIN_CACHE_TTL_MS in
-  // _ttlFromNextUpdate but the BLOB itself was still served from
-  // cache; an attacker serving an ancient signed-but-expired BLOB
-  // could keep operators on a revoked-authenticator-list-frozen-at-X.
-  // Refuse at parse time so neither fetch nor cache lookup honors it.
+  // Stale-BLOB refusal (FIDO MDS3 section 3.1.7): clients SHOULD refresh by
+  // nextUpdate; a BLOB whose nextUpdate is already in the past is not safe to
+  // trust even though its cert chain still validates. Flooring the staleness to
+  // MIN_CACHE_TTL_MS in _ttlFromNextUpdate is not enough on its own -- the BLOB
+  // itself must be refused, or an attacker serving an ancient signed-but-
+  // expired BLOB keeps operators pinned to a revoked-authenticator list frozen
+  // at that time. Refuse at parse time so neither fetch nor a cache lookup ever
+  // honors it.
   if (nextUpdate.getTime() < Date.now()) {
     throw new FidoMds3Error("fido-mds3/blob-stale",
       "BLOB payload nextUpdate \"" + payload.nextUpdate +
-      "\" is in the past — refusing to trust a stale metadata BLOB " +
-      "(FIDO MDS3 §3.1.7)");
+      "\" is in the past -- refusing to trust a stale metadata BLOB " +
+      "(FIDO MDS3 section 3.1.7)");
   }
   return {
     entries:     payload.entries,
@@ -388,6 +392,13 @@ function _verifyAndParseBlob(token) {
   };
 }
 
+// Internal verify-blob helper used by tests to exercise the verifier against
+// the DEFAULT vendored MDS3 trust roots without standing up a real HTTPS
+// endpoint. Operator-facing surface goes through fetch().
+function _verifyAndParseBlob(token) {
+  return _verifyBlobWithRoots(token, _resolveRoots(undefined));
+}
+
 // ---- public surface ----
 
 /**
@@ -481,39 +492,22 @@ async function fetch(opts) {   // allow:raw-outbound-http-framework-internal —
     }
     var token = rsp.body.toString("ascii").trim();
 
-    var jws = _parseJws(token);
-    var chain = _validateChain(jws.header.x5c, rootPems);
-    _verifyJws(jws, chain[0]);
-    var payload = jws.payload;
-    if (!payload || !Array.isArray(payload.entries)) {
-      throw new FidoMds3Error("fido-mds3/bad-payload",
-        "BLOB payload missing 'entries' array");
-    }
-    if (typeof payload.no !== "number" || !isFinite(payload.no)) {
-      throw new FidoMds3Error("fido-mds3/bad-payload",
-        "BLOB payload missing or non-numeric 'no'");
-    }
-    var nextUpdate = _parseNextUpdate(payload.nextUpdate);
-    if (!nextUpdate) {
-      throw new FidoMds3Error("fido-mds3/bad-payload",
-        "BLOB payload 'nextUpdate' missing or not YYYY-MM-DD: " + payload.nextUpdate);
-    }
-    var record = {
-      entries:     payload.entries,
-      no:          payload.no,
-      nextUpdate:  nextUpdate,
-      url:         url,
-      legalHeader: payload.legalHeader,
-    };
+    // Route the trust decision through the shared verifier so this operator-
+    // facing path enforces the identical checks (chain verify, payload shape,
+    // AND the stale-BLOB refusal) as the internal helper -- fetch previously
+    // reimplemented the parse inline and omitted the stale check, silently
+    // accepting and caching an ancient signed-but-expired BLOB.
+    var record = _verifyBlobWithRoots(token, rootPems);
+    record.url = url;
     // Re-assert TTL based on the BLOB's nextUpdate (overrides the
     // wrap-call's safe-minimum seed).
-    try { await c.set(cacheKey, record, _ttlFromNextUpdate(nextUpdate)); }
+    try { await c.set(cacheKey, record, _ttlFromNextUpdate(record.nextUpdate)); }
     catch (_e) { /* cache.set best-effort */ }
     try { audit().safeEmit({
       action:   "auth.fido_mds3.fetch",
       outcome:  "success",
-      metadata: { url: url, no: payload.no, entries: payload.entries.length,
-                  nextUpdate: payload.nextUpdate },
+      metadata: { url: url, no: record.no, entries: record.entries.length,
+                  nextUpdate: record.nextUpdate.toISOString().slice(0, 10) },
     }); } catch (_e) { /* audit best-effort */ }
     return record;
   }, MIN_CACHE_TTL_MS);
@@ -577,18 +571,35 @@ function lookupAaguid(blob, aaguid) {
 function _certifiedLevel(statusReports) {
   if (!Array.isArray(statusReports)) return { level: 0, plus: false };
   var latest = null;
-  var latestDate = null;
+  var latestDate = null;   // null == no comparable date (missing / malformed)
   for (var i = 0; i < statusReports.length; i++) {
     var sr = statusReports[i];
     // Only certification-status reports move the level: a level grant, or its
     // explicit revocation (NOT_FIDO_CERTIFIED). Other statuses (UPDATE_AVAILABLE,
-    // REVOKED, …) are handled elsewhere and must not be read as a level. The
-    // status length is bounded before the regex test below — FIDO status tokens
+    // REVOKED, etc.) are handled elsewhere and must not be read as a level. The
+    // status length is bounded before the regex test below -- FIDO status tokens
     // are short enums; bounding input before any .test() is the convention.
     if (!sr || typeof sr.status !== "string" || sr.status.length > 64) continue;
     if (!CERT_LEVEL_RE.test(sr.status) && sr.status !== "NOT_FIDO_CERTIFIED") continue;
-    var d = typeof sr.effectiveDate === "string" ? sr.effectiveDate : "";
-    if (latest === null || d >= latestDate) {
+    // Only a well-formed calendar date is comparable. Reuse _parseNextUpdate
+    // (which already validates YYYY-MM-DD AND rejects impossible dates such as
+    // 2026-02-31) and compare epoch ms. A missing / malformed effectiveDate is
+    // "no comparable date" (null) and falls back to array order (append order,
+    // which the spec defines as chronological): the report later in the array
+    // is the more recent one. Coercing a missing date to "" and running it
+    // through a lexical compare made an undated report lose to EVERY earlier
+    // dated report, so a later decertification / downgrade / upgrade whose
+    // effectiveDate was absent never superseded the earlier grant -- freezing
+    // certifiedLevel at a stale value (an authenticator-assurance bypass: a
+    // decertified or downgraded authenticator kept reporting its prior level to
+    // step-up / risk policy).
+    var parsed = typeof sr.effectiveDate === "string" ? _parseNextUpdate(sr.effectiveDate) : null;
+    var d = parsed ? parsed.getTime() : null;
+    if (latest === null) { latest = sr; latestDate = d; continue; }
+    // sr is later in array order than the current latest. A missing/malformed
+    // date on EITHER side means array order decides -> sr (later) wins. Both
+    // dated -> the newer-or-equal date wins (sr, being later, takes ties).
+    if (d === null || latestDate === null || d >= latestDate) {
       latest = sr; latestDate = d;
     }
   }

package/lib/codepoint-class.js

@@ -581,10 +581,95 @@ function decodeNumericEntities(s) {
   });
 }
 
+// The HTML5 named-entity ASCII subset a browser resolves inside URL and CSS
+// attribute contexts — the scheme/whitespace-significant characters an attacker
+// hides a payload behind (`java	script:` / `behavior:`). One table so
+// guard-html / guard-svg / guard-markdown decode the SAME set and cannot drift
+// (guard-markdown shipped without named-entity decoding at all, so `	` /
+// `
` slipped past its scheme denylist).
+var NAMED_ENTITY_ASCII = {
+  // Whitespace + control chars browsers strip inside URL schemes
+  Tab: "\t", NewLine: "\n",
+  // Scheme-significant punctuation
+  colon: ":", semi: ";", period: ".", sol: "/", bsol: "\\",
+  num: "#", excl: "!", quest: "?", lpar: "(", rpar: ")",
+  lsqb: "[", rsqb: "]", lcub: "{", rcub: "}",
+  // Quotes / brackets
+  quot: "\"", apos: "'", lt: "<", gt: ">",
+  // Misc ASCII
+  amp: "&", commat: "@", dollar: "$", percnt: "%",
+  ast: "*", plus: "+", lowbar: "_", hyphen: "-",
+  // Latin-1 space browsers treat as URL-strippable
+  nbsp: " ",
+};
+var NAMED_ENTITY_RE_G = /&([A-Za-z][A-Za-z0-9]+);/g;
+
+/**
+ * @primitive b.codepointClass.decodeMarkupEntities
+ * @signature b.codepointClass.decodeMarkupEntities(value)
+ * @since     0.16.19
+ * @status    stable
+ * @related   b.codepointClass.decodeNumericEntities, b.codepointClass.stripUrlSchemeWhitespace
+ *
+ * Decode the character references a browser resolves inside an attribute value
+ * -- numeric (hex/decimal, semicolon OPTIONAL) then the named-entity ASCII
+ * subset browsers honor in URL/CSS contexts -- and drop the C0 controls and
+ * zero-widths a payload hides behind. The single decoder every content guard
+ * routes a scheme / CSS-token danger check through, so a threat cannot slip
+ * past the guard that forgot to decode an encoding a sibling strips. Pair with
+ * `stripUrlSchemeWhitespace` for a URL-scheme check.
+ *
+ * @example
+ *   b.codepointClass.decodeMarkupEntities("ex&#x70;ression(");   // "expression("
+ *   b.codepointClass.decodeMarkupEntities("behavior&colon;");    // "behavior:"
+ */
+function decodeMarkupEntities(value) {
+  var s = decodeNumericEntities(String(value == null ? "" : value));
+  s = s.replace(NAMED_ENTITY_RE_G, function (m, name) {
+    if (Object.prototype.hasOwnProperty.call(NAMED_ENTITY_ASCII, name)) {
+      return NAMED_ENTITY_ASCII[name];
+    }
+    return m;
+  });
+  return s.replace(C0_CTRL_RE_G, "").replace(ZW_RE_G, "");
+}
+
+var URL_TAB_NEWLINE_RE_G = /[\t\n\r]/g;                              // URL tab/newline strip, not byte size
+// allow:dynamic-regex -- codepoints from a literal [0x00, 0x20] range (C0 controls + space)
+var URL_C0_SPACE_CC = charClass([[0x0000, 0x0020]]);
+var URL_C0_SPACE_TRIM_RE = new RegExp("^(?:[" + URL_C0_SPACE_CC + "])+|(?:[" + URL_C0_SPACE_CC + "])+$", "g");
+/**
+ * @primitive b.codepointClass.stripUrlSchemeWhitespace
+ * @signature b.codepointClass.stripUrlSchemeWhitespace(s)
+ * @since     0.16.19
+ * @status    stable
+ * @related   b.codepointClass.decodeMarkupEntities, b.codepointClass.decodeNumericEntities
+ *
+ * Fold away exactly the whitespace the WHATWG URL parser removes before it
+ * resolves a scheme: ASCII tab / LF / CR from ANYWHERE, plus a leading/trailing
+ * C0-control-or-space run. tab/lf/cr are excluded from the C0-control catalog
+ * and space is not a control, so a danger check that strips only C0/zero-width
+ * still lets `java<TAB>script:` or an entity-encoded leading space
+ * (`&#32;javascript:`) read as scheme-less. Run AFTER entity decoding; every
+ * guard that extracts a URL scheme for a denylist routes the decoded value
+ * through this.
+ *
+ * @example
+ *   b.codepointClass.stripUrlSchemeWhitespace("  javascript:x");   // "javascript:x"
+ */
+function stripUrlSchemeWhitespace(s) {
+  return String(s == null ? "" : s)
+    .replace(URL_TAB_NEWLINE_RE_G, "")
+    .replace(URL_C0_SPACE_TRIM_RE, "");
+}
+
 module.exports = {
   isForbiddenControlChar:  isForbiddenControlChar,
   firstControlCharOffset:  firstControlCharOffset,
   decodeNumericEntities:   decodeNumericEntities,
+  decodeMarkupEntities:    decodeMarkupEntities,
+  NAMED_ENTITY_ASCII:      NAMED_ENTITY_ASCII,
+  stripUrlSchemeWhitespace: stripUrlSchemeWhitespace,
   isAsciiAlnum:      isAsciiAlnum,
   isUnreserved:      isUnreserved,
   hex4:              hex4,

package/lib/crypto-field.js

@@ -89,6 +89,11 @@ var TYPED_SENTINEL = String.fromCharCode(0) + "bjsv1:";
 
 function _encodeTyped(value) {
   if (typeof value === "string") {
+    // "" encodes to a NON-empty typed marker so a sealed empty string is a real
+    // authenticated envelope, never a bare plaintext "": vault.aad.seal refuses
+    // empty plaintext, and a bare "" in a sealed cell is indistinguishable from a
+    // ciphertext a DB-write attacker downgraded to "".
+    if (value === "") return TYPED_SENTINEL + "E:";
     return value.indexOf(TYPED_SENTINEL) === 0 ? TYPED_SENTINEL + "S:" + value : value;
   }
   if (Buffer.isBuffer(value)) return TYPED_SENTINEL + "B:" + value.toString("base64");
@@ -102,6 +107,7 @@ function _decodeTyped(str) {
   var body = str.slice(TYPED_SENTINEL.length);
   var tag = body.slice(0, 2);
   var payload = body.slice(2);
+  if (tag === "E:") return "";
   if (tag === "B:") return Buffer.from(payload, "base64");
   if (tag === "J:") return safeJson.parse(payload);   // plaintext is AEAD-verified; safeJson blocks proto-pollution defensively
   if (tag === "S:") return payload;
@@ -1071,6 +1077,11 @@ function sealRow(table, row, opts) {
   //   - plain mode: vault.seal (idempotent — already-sealed pass through).
   for (var i = 0; i < s.sealedFields.length; i++) {
     var field = s.sealedFields[i];
+    // Skip only null / undefined (nothing to seal). An empty string IS sealed:
+    // _encodeTyped("") yields a non-empty typed marker (E:), so every branch
+    // produces a real authenticated envelope -- never a bare plaintext "" that a
+    // DB-write attacker could forge, or that a ciphertext could be silently
+    // downgraded to (unsealRow fails closed on a bare "" in an AAD/keyed cell).
     if (out[field] === undefined || out[field] === null) continue;
     if (kRow && field === residencyCol) continue;   // residency tag stays plaintext
     if (kRow) {
@@ -1216,6 +1227,27 @@ function unsealRow(table, row, actor, dbHandle) {
 
   for (var i = 0; i < s.sealedFields.length; i++) {
     var field = s.sealedFields[i];
+    // Post-seal, a legitimately-empty sealed value is a NON-empty authenticated
+    // envelope (see _encodeTyped "" -> E:), so a bare "" present in an AAD-bound
+    // or per-row-key sealed column is an envelope-downgrade tamper -- a DB-write
+    // attacker replacing a ciphertext with "". Fail closed (null the cell + audit),
+    // mirroring the plain-vault aad-downgrade refusal below; never surface it as a
+    // valid empty value. Plain-mode tables keep the lenient pass-through.
+    if (out[field] === "" && (s.aad || keyedTable)) {
+      out[field] = null;
+      try {
+        audit().safeEmit({
+          action:  "system.crypto.unseal_failed",
+          outcome: "failure",
+          metadata: {
+            table: table, field: field, rowId: out[s.rowIdField] || out._id || null,
+            shape: (s.aad ? "aad" : "row"),
+            reason: "empty-string cell in a sealed AAD/keyed column (envelope downgrade)",
+          },
+        });
+      } catch (_e) { /* drop-silent */ }
+      continue;
+    }
     if (out[field]) {
       // Per-cell envelope shape for audit metadata (operators write alert
       // rules off it): "row" = K_row cell, "aad" = vault.aad: cell on an

package/lib/guard-graphql.js

@@ -165,7 +165,8 @@ function _measureQueryShape(query) {
   var depth = 0;
   var inString = false;
   var inComment = false;
-  var aliasCounts = [0];                                                         // per-depth alias counter
+  var escapeNext = false;                                                        // inside a string, the previous char was an unescaped backslash
+  var aliasStack = [0];                                                          // per-selection-set alias counter (top of stack = current set)
   for (var i = 0; i < query.length; i += 1) {
     var c = query.charAt(i);
     if (inComment) {
@@ -173,7 +174,18 @@ function _measureQueryShape(query) {
       continue;
     }
     if (inString) {
-      if (c === '"' && query.charAt(i - 1) !== "\\") inString = false;
+      // Escaped-quote handling must track the backslash RUN, not just the
+      // single preceding char. `"\\"` is a complete string (its backslash is
+      // itself escaped), so a naive `charAt(i - 1) !== "\\"` test reads the
+      // closing quote as escaped, leaves the walker stuck in-string, and
+      // blinds it to every following brace / colon — silently under-counting
+      // depth and alias breadth so a depth-bomb or alias-bomb rides through as
+      // shape-clean (a fail-open DoS-measurement bypass on valid GraphQL).
+      // Toggle on each backslash: a closing quote ends the string only after
+      // an EVEN run (escapeNext false).
+      if (escapeNext) { escapeNext = false; continue; }
+      if (c === "\\") { escapeNext = true; continue; }
+      if (c === '"') inString = false;
       continue;
     }
     if (c === '"') { inString = true; continue; }
@@ -181,28 +193,35 @@ function _measureQueryShape(query) {
     if (c === "{") {
       depth += 1;
       if (depth > maxDepth) maxDepth = depth;
-      aliasCounts.push(0);
+      aliasStack.push(0);
     } else if (c === "}") {
       // Capture the current selection-set's alias count before popping
       // — otherwise we lose the per-block max when the block closes.
-      var current = aliasCounts[aliasCounts.length - 1] || 0;
+      var current = aliasStack[aliasStack.length - 1] || 0;
       if (current > maxAliases) maxAliases = current;
       depth -= 1;
-      aliasCounts.pop();
+      // Never pop the base counter: an unbalanced leading `}` would otherwise
+      // desync the stack from `depth`, and a subsequent `depth`-indexed
+      // increment lands on an absent slot (`undefined + 1 === NaN`), poisoning
+      // every later comparison so an alias-bomb reads as clean.
+      if (aliasStack.length > 1) aliasStack.pop();
       if (depth < 0) depth = 0;
     } else if (c === ":") {
-      // Alias indicator — `alias: field`. Increment the current depth's
-      // counter when the char before `:` looks like an identifier.
+      // Alias / argument indicator — `alias: field` / `field(arg: value)`.
+      // Increment the CURRENT selection-set's counter (top of stack) when the
+      // char before `:` looks like an identifier. Using the stack top rather
+      // than a `depth` index keeps counting correct even when a malformed
+      // brace run has decoupled `depth` from the stack length.
       var prev = i > 0 ? query.charAt(i - 1) : "";
-      if (/[A-Za-z0-9_]/.test(prev) && depth > 0) {
-        aliasCounts[depth] += 1;
+      if (/[A-Za-z0-9_]/.test(prev) && aliasStack.length > 1) {
+        aliasStack[aliasStack.length - 1] += 1;
       }
     }
   }
   // Final sweep covers any unclosed selection-sets (operator-supplied
   // syntactically-invalid queries).
-  for (var ai = 0; ai < aliasCounts.length; ai += 1) {
-    if (aliasCounts[ai] > maxAliases) maxAliases = aliasCounts[ai];
+  for (var ai = 0; ai < aliasStack.length; ai += 1) {
+    if (aliasStack[ai] > maxAliases) maxAliases = aliasStack[ai];
   }
   return { maxDepth: maxDepth, maxAliases: maxAliases };
 }

package/lib/guard-html.js

@@ -110,11 +110,6 @@ void observability;
 
 var _err = GuardHtmlError.factory;
 
-// ---- Codepoint catalog (shared via lib/codepoint-class) ----
-
-var C0_CTRL_RE_G  = codepointClass.C0_CTRL_RE_G;
-var ZW_RE_G       = codepointClass.ZW_RE_G;
-
 // ---- Tag denylists / allowlists ----
 
 // Always-dangerous tags. Active scripts, plugin embeds, form elements,
@@ -362,54 +357,21 @@ function escapeAttr(value) {
     .replace(/=/g, "=");
 }
 
-// HTML5 named entities that decode to ASCII codepoints — focused on
-// the entries browsers honor inside URL contexts (whitespace, control
-// chars, scheme-significant punctuation). The full WHATWG named-
-// character-reference table is ~2,231 entries; this is the
-// security-load-bearing subset documented in scheme-bypass writeups
-// (CVE-2026-30838 class). High-codepoint named entities (e.g. mathematical
-// symbols) don't affect URL scheme parsing, so they're omitted.
-var NAMED_ENTITY_ASCII = {
-  // Whitespace + control chars browsers strip inside URL schemes
-  Tab: "\t", NewLine: "\n",
-  // Scheme-significant punctuation
-  colon: ":", semi: ";", period: ".", sol: "/", bsol: "\\",
-  num: "#", excl: "!", quest: "?", lpar: "(", rpar: ")",
-  lsqb: "[", rsqb: "]", lcub: "{", rcub: "}",
-  // Quotes / brackets
-  quot: "\"", apos: "'", lt: "<", gt: ">",
-  // Misc ASCII
-  amp: "&", commat: "@", dollar: "$", percnt: "%",
-  ast: "*", plus: "+", lowbar: "_", hyphen: "-",
-  // Whitespace markers (codepoints in the ASCII / Latin-1 range that
-  // browsers treat as URL-strippable)
-  nbsp: " ",
-};
-
-// _normalizeUrl — peel off entity-encoded leading whitespace and
-// HTML/URL-encoded scheme prefix tricks, then return the lowercased
-// scheme. Returns "" if no scheme.
+// The named-entity ASCII table + entity decoder now live in codepoint-class
+// (NAMED_ENTITY_ASCII / decodeMarkupEntities), shared with guard-svg /
+// guard-markdown so all three decode the SAME browser-honored set and cannot
+// drift on which encoding a scheme / CSS-token danger check must fold away.
+// _extractScheme — decode entity-hidden scheme-prefix tricks, fold away the
+// whitespace the WHATWG URL parser would (tab/lf/cr anywhere + a leading/
+// trailing C0-control-or-space run — none of which the C0/zero-width strip
+// covers: tab/lf/cr are excluded from C0_CTRL_RANGES and space is not a
+// control), then return the lowercased scheme ("" if none). The shared
+// codepoint-class primitive keeps guard-html / guard-svg from drifting on which
+// whitespace to strip, so neither `java<TAB>script:` nor `&#32;javascript:` can
+// read as scheme-less.
 function _extractScheme(rawUrl) {
-  var s = String(rawUrl || "").trim();
-  // Decode HTML numeric entities (hex &#x..; and decimal &#..;, semicolon
-  // OPTIONAL) just enough to expose hidden schemes like &#x6A;avascript: or
-  // the browser-decoded no-semicolon form &#106avascript:. Shared decoder so
-  // guard-html / guard-svg / guard-markdown can't drift (see codepoint-class).
-  s = codepointClass.decodeNumericEntities(s);
-  // Decode HTML5 named entities that browsers honor inside URL
-  // contexts. Without this, payloads like `java&Tab;script:alert(1)`
-  // bypass the scheme allowlist (the literal `&Tab;` between `java`
-  // and `script:` doesn't match any denied scheme; the browser then
-  // decodes the entity, strips the tab, and executes javascript:).
-  s = s.replace(/&([A-Za-z][A-Za-z0-9]+);/g, function (m, name) {
-    if (Object.prototype.hasOwnProperty.call(NAMED_ENTITY_ASCII, name)) {
-      return NAMED_ENTITY_ASCII[name];
-    }
-    return m;
-  });
-  // Strip embedded whitespace + control chars + zero-widths the
-  // URL parser would tolerate.
-  s = s.replace(C0_CTRL_RE_G, "").replace(ZW_RE_G, "");
+  var s = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(String(rawUrl || "").trim()));
   var m = s.match(/^([A-Za-z][A-Za-z0-9+.-]*):/);
   return m ? m[1].toLowerCase() : "";
 }
@@ -443,8 +405,19 @@ function _isClobberGlobal(name) {
 }
 
 function _isCssDangerous(value) {
+  // A style attribute is HTML/XML character-reference-decoded before the CSS
+  // parser sees it, so `ex&#x70;ression(` reaches CSS as `expression(` and
+  // `behavior&colon;` as `behavior:`. Match against the decoded value — the same
+  // normalization the URL-scheme check performs — so an entity-encoded CSS
+  // payload can't be served verbatim past the danger patterns.
+  // Also fold the URL-scheme whitespace a browser strips inside url(...) -- tab /
+  // lf / cr -- so an entity-hidden tab in a CSS URL scheme (url(java&Tab;script:))
+  // cannot defeat the contiguous `javascript:` danger pattern, the same bypass the
+  // URL-scheme check folds away for href.
+  var decoded = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(value));
   for (var i = 0; i < CSS_DANGEROUS_PATTERNS.length; i += 1) {
-    if (CSS_DANGEROUS_PATTERNS[i].test(value)) return true;
+    if (CSS_DANGEROUS_PATTERNS[i].test(decoded)) return true;
   }
   return false;
 }

package/lib/guard-markdown.js

@@ -87,8 +87,6 @@ var INLINE_LINK_RE  = /(!?)\[([^\]\n]*)\]\(\s*([^)\s]+)\s*(?:"[^"]*")?\s*\)/g;
 var AUTOLINK_RE     = /<((?:[a-zA-Z][a-zA-Z0-9+.-]{0,32}):[^\s>]+)>/g;
 // Reference-link definition `[label]: url "title"`.
 var REF_DEF_RE      = /^\s{0,3}\[([^\]\n]+)\]:\s*([^\s]+)/gm;
-// HTML entity hex / decimal scheme bypass — decode and re-test.
-var HTML_ENTITY_NUM_RE = /&#(?:x([0-9a-f]+)|(\d+));?/gi;
 
 // Front-matter block (YAML triple-dash or TOML triple-plus).
 var FRONT_MATTER_YAML_RE = /^---\s*\n[\s\S]+?\n---\s*\n?/;
@@ -99,31 +97,20 @@ var DOCTYPE_INLINE_RE = /<!DOCTYPE\b/i;
 var CODE_FENCE_LANG_RE = /^(?:```|~~~)([^\n]*)\n/gm;
 var EMPH_RUN_RE = /[*_]{20,}/;                                                   // allow:regex-no-length-cap — character-class repeat is linear in input length
 
-function _decodeHtmlEntities(s) {
-  return s.replace(HTML_ENTITY_NUM_RE, function (match, hex, dec) {
-    var code = hex !== undefined ? parseInt(hex, 16) : parseInt(dec, 10);       // parseInt radix args (16 hex / 10 decimal)
-    if (!isFinite(code) || code < 0 || code > 0x10ffff) return match;            // Unicode codepoint range
-    try { return String.fromCodePoint(code); } catch (_e) { return match; }
-  });
-}
 
 function _isDangerousUrl(url, opts) {
   if (typeof url !== "string") return null;
-  var s = url.trim();
-  s = _decodeHtmlEntities(s);
-  // Strip null + ASCII control chars from the URL — ` javascript:` works
-  // in some browsers because the leading control bytes are tolerated.
-  // Char-by-char filter avoids the no-control-regex lint surface; the
-  // codepoint catalog (< 0x20 or 0x7F) is the same shape as the
-  // codepointClass tables.
-  var stripped = "";
-  for (var ci = 0; ci < s.length; ci += 1) {
-    var cc = s.charCodeAt(ci);
-    if (cc > 0x1f && cc !== 0x7f) stripped += s.charAt(ci);                     // ASCII control range thresholds
-  }
-  s = stripped;
-  if (DANGEROUS_SCHEME_RE.test(s)) return s.match(/^[a-z]+/i)[0].toLowerCase(); // allow:regex-no-length-cap — `s` is a markdown URL token already bounded by the inline-link / autolink / ref-def matchers (which themselves run on input bounded by maxBytes)
-  if (FILE_SCHEME_RE.test(s) && opts.filePolicy !== "allow") return "file";     // allow:regex-no-length-cap — same bounded-URL-token reasoning
+  // Decode the entity-hidden scheme tricks a browser resolves -- numeric AND the
+  // named-entity ASCII subset (guard-markdown previously decoded numeric only, so
+  // `java&Tab;script:` / a `&colon;`-hidden scheme slipped past) -- then fold away
+  // the whitespace the WHATWG URL parser strips (tab/lf/cr anywhere + a leading/
+  // trailing C0-control-or-space run, so `&#32;javascript:` -> " javascript:" can't
+  // defeat the `^scheme:` anchor). Shared codepoint-class primitives keep
+  // guard-markdown / guard-html / guard-svg from drifting on which encodings to fold.
+  var s = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(url.trim()));
+  if (DANGEROUS_SCHEME_RE.test(s)) return s.match(/^[a-z]+/i)[0].toLowerCase(); // allow:regex-no-length-cap -- `s` is a markdown URL token already bounded by the inline-link / autolink / ref-def matchers (which themselves run on input bounded by maxBytes)
+  if (FILE_SCHEME_RE.test(s) && opts.filePolicy !== "allow") return "file";     // allow:regex-no-length-cap -- same bounded-URL-token reasoning
   return null;
 }
 

package/lib/guard-svg.js

@@ -122,11 +122,6 @@ void observability;
 
 var _err = GuardSvgError.factory;
 
-// ---- Codepoint catalog (shared via lib/codepoint-class) ----
-
-var C0_CTRL_RE_G  = codepointClass.C0_CTRL_RE_G;
-var ZW_RE_G       = codepointClass.ZW_RE_G;
-
 // ---- Tag classification ----
 
 // Always-dangerous SVG tags. Active scripts, namespace-shift escape
@@ -314,32 +309,20 @@ var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256
 // ---- Internal helpers ----
 
 
-// HTML5 named-entity ASCII subset — same shape as guard-html.
-// Browsers honor these inside URL contexts; without decoding them,
-// `java	script:` and friends bypass the scheme allowlist.
-var SVG_NAMED_ENTITY_ASCII = {
-  Tab: "\t", NewLine: "\n",
-  colon: ":", semi: ";", period: ".", sol: "/", bsol: "\\",
-  num: "#", excl: "!", quest: "?", lpar: "(", rpar: ")",
-  lsqb: "[", rsqb: "]", lcub: "{", rcub: "}",
-  quot: "\"", apos: "'", lt: "<", gt: ">",
-  amp: "&", commat: "@", dollar: "$", percnt: "%",
-  ast: "*", plus: "+", lowbar: "_", hyphen: "-",
-  nbsp: " ",
-};
+// The named-entity ASCII table + entity decoder live in codepoint-class
+// (NAMED_ENTITY_ASCII / decodeMarkupEntities), shared with guard-html /
+// guard-markdown so all three decode the SAME browser-honored set and cannot
+// drift on which encoding a scheme / CSS-token danger check must fold away.
 
 function _extractScheme(rawUrl) {
-  var s = String(rawUrl || "").trim();
-  // Numeric entities (hex/decimal, semicolon OPTIONAL) via the shared decoder
-  // so guard-html / guard-svg / guard-markdown can't drift (see codepoint-class).
-  s = codepointClass.decodeNumericEntities(s);
-  s = s.replace(/&([A-Za-z][A-Za-z0-9]+);/g, function (m, name) {
-    if (Object.prototype.hasOwnProperty.call(SVG_NAMED_ENTITY_ASCII, name)) {
-      return SVG_NAMED_ENTITY_ASCII[name];
-    }
-    return m;
-  });
-  s = s.replace(C0_CTRL_RE_G, "").replace(ZW_RE_G, "");
+  // Decode entities, then fold away exactly the whitespace the WHATWG URL parser
+  // would (tab/lf/cr anywhere + a leading/trailing C0-control-or-space run) via
+  // the shared codepoint-class primitive, so an entity-hidden tab or leading
+  // space (`java&Tab;script:` / `&#32;javascript:`) can't push the scheme past
+  // the `^[A-Za-z]` anchor and read as scheme-less. Shared with guard-html so
+  // the two can't drift on which whitespace to strip.
+  var s = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(String(rawUrl || "").trim()));
   var m = s.match(/^([A-Za-z][A-Za-z0-9+.-]*):/);
   return m ? m[1].toLowerCase() : "";
 }
@@ -355,8 +338,19 @@ function _isFragmentRef(rawUrl) {
 }
 
 function _isCssDangerous(value) {
+  // A style attribute is HTML/XML character-reference-decoded before the CSS
+  // parser sees it, so `ex&#x70;ression(` reaches CSS as `expression(` and
+  // `behavior&colon;` as `behavior:`. Match against the decoded value — the
+  // same normalization the URL-scheme check performs — so an entity-encoded
+  // CSS payload can't be served verbatim past the danger patterns.
+  // Also fold the URL-scheme whitespace a browser strips inside url(...) -- tab /
+  // lf / cr -- so an entity-hidden tab in a CSS URL scheme (url(java&Tab;script:))
+  // cannot defeat the contiguous `javascript:` danger pattern, the same bypass the
+  // URL-scheme check folds away for href.
+  var decoded = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(value));
   for (var i = 0; i < CSS_DANGEROUS_PATTERNS.length; i += 1) {
-    if (CSS_DANGEROUS_PATTERNS[i].test(value)) return true;
+    if (CSS_DANGEROUS_PATTERNS[i].test(decoded)) return true;
   }
   return false;
 }
@@ -782,7 +776,12 @@ function _sanitize(input, opts) {
     }
     var allowed = !dangerousTags[tok.name] && allowedTags[tok.name];
     if (animationTags[tok.name] && opts.allowAnimation && allowedTags[tok.name]) {
-      // Animation element — re-check attributeName.
+      // Animation element under a profile that permits animation: allowed iff
+      // its attributeName is in the safe-targets allowlist. Every animation tag
+      // is in DANGEROUS_TAGS, so `allowed` is already false above — this branch
+      // must AFFIRMATIVELY re-permit the safe case, else the open tag is dropped
+      // while its (still-allowlisted) end tag is emitted, leaving an orphan
+      // close and silently stripping a profile-permitted element.
       var safeAnimation = true;
       (tok.attrs || []).forEach(function (a) {
         if (a.name.toLowerCase() === "attributename" &&
@@ -790,7 +789,7 @@ function _sanitize(input, opts) {
           safeAnimation = false;
         }
       });
-      if (!safeAnimation) allowed = false;
+      allowed = safeAnimation;
     }
     if (!allowed) {
       if (BODY_DROP[tok.name] && !tok.selfClosing) {

package/lib/safe-dns.js

@@ -357,14 +357,24 @@ function checkCnameChainDepth(depth, opts) {
   }
 }
 
-function _readName(state, pointerDepth) {
+function _readName(state, pointerDepth, acc) {
   if (pointerDepth > state.caps.maxPointerDepth) {
     throw new SafeDnsError("safe-dns/oversize-pointer-depth",
       "safeDns.readName: compression-pointer chain depth=" + pointerDepth +
       " exceeds maxPointerDepth=" + state.caps.maxPointerDepth + " (RFC 1035 §4.1.4 loop defense)");
   }
+  // Both per-name accountants — the decompressed octet count and the label
+  // count — thread through the WHOLE compression-pointer chain via `acc`. A
+  // pointer jump continues the same budget instead of restarting it, so the
+  // composite name a chain expands to is bounded by the same RFC 1035 §3.1
+  // 255-octet / §2.3.4 maxLabels caps that bound a single in-line name. When
+  // the accountants were frame-local, each jump began a fresh 255-octet /
+  // maxLabels budget, so a chain of N pointers decompressed to ~N x 255 octets
+  // and ~N x maxLabels labels past the advertised per-name caps — a
+  // decompression-amplification seam. `acc` is undefined for a top-level name
+  // (each is measured independently) and shared with every sub-read.
+  if (!acc) acc = { bytes: 0, labels: 0 };
   var labels = [];
-  var totalBytes = 0;
   var jumped = false;
   var afterPointerOff = -1;
   var off = state.off;
@@ -376,10 +386,10 @@ function _readName(state, pointerDepth) {
     var byte = state.buf[off];
     if (byte === 0) {
       off += 1;
-      totalBytes += 1;
-      if (totalBytes > DNS_MAX_NAME_BYTES) {
+      acc.bytes += 1;
+      if (acc.bytes > DNS_MAX_NAME_BYTES) {
         throw new SafeDnsError("safe-dns/oversize-name",
-          "safeDns.readName: wire-name=" + totalBytes + " bytes exceeds RFC 1035 cap=" +
+          "safeDns.readName: wire-name=" + acc.bytes + " bytes exceeds RFC 1035 cap=" +
           DNS_MAX_NAME_BYTES);
       }
       break;
@@ -394,20 +404,14 @@ function _readName(state, pointerDepth) {
         throw new SafeDnsError("safe-dns/truncated-name",
           "safeDns.readName: compression pointer offset past message end");
       }
-      // First compression pointer ends the in-line label walk
-      // (line break below). `jumped` can never already be true here;
-      // assign unconditionally per Codex code-quality review.
+      // First compression pointer ends the in-line label walk. The pointed-to
+      // tail continues accumulating into the SAME `acc`, so the composite
+      // decompressed name stays bounded by the per-name octet + label caps.
       afterPointerOff = off + 2;                                                                        // RFC 1035 §4.1.4 2-byte pointer width
       jumped = true;
       var subState = { off: ptrOff, buf: state.buf, caps: state.caps };
-      var tailName = _readName(subState, pointerDepth + 1);
+      var tailName = _readName(subState, pointerDepth + 1, acc);
       if (tailName.length) labels.push(tailName);
-      totalBytes += 2;                                                                                  // RFC 1035 §4.1.4 2-byte pointer width
-      if (totalBytes > DNS_MAX_NAME_BYTES) {
-        throw new SafeDnsError("safe-dns/oversize-name",
-          "safeDns.readName: composite name=" + totalBytes + " bytes exceeds RFC 1035 cap=" +
-          DNS_MAX_NAME_BYTES);
-      }
       break;
     }
     if (byte > DNS_MAX_LABEL_BYTES) {
@@ -419,15 +423,16 @@ function _readName(state, pointerDepth) {
         "safeDns.readName: label content past message end");
     }
     labels.push(state.buf.toString("ascii", off + 1, off + 1 + byte));
-    if (labels.length > state.caps.maxLabels) {
+    acc.labels += 1;
+    if (acc.labels > state.caps.maxLabels) {
       throw new SafeDnsError("safe-dns/oversize-labels",
-        "safeDns.readName: label count=" + labels.length + " exceeds maxLabels=" + state.caps.maxLabels);
+        "safeDns.readName: label count=" + acc.labels + " exceeds maxLabels=" + state.caps.maxLabels);
     }
     off += 1 + byte;
-    totalBytes += 1 + byte;
-    if (totalBytes > DNS_MAX_NAME_BYTES) {
+    acc.bytes += 1 + byte;
+    if (acc.bytes > DNS_MAX_NAME_BYTES) {
       throw new SafeDnsError("safe-dns/oversize-name",
-        "safeDns.readName: wire-name=" + totalBytes + " bytes exceeds RFC 1035 cap=" +
+        "safeDns.readName: wire-name=" + acc.bytes + " bytes exceeds RFC 1035 cap=" +
         DNS_MAX_NAME_BYTES);
     }
   }

package/lib/self-update.js

@@ -378,6 +378,15 @@ async function poll(opts) {
       allowedHosts:     opts.allowedHosts,
       allowedProtocols: opts.allowedProtocols,
       allowInternal:    opts.allowInternal,
+      // poll() owns status handling — the branches below distinguish a 304
+      // If-None-Match "fast no-update" hit from a real non-2xx refusal and a
+      // 2xx feed to parse. Without always-resolve, httpClient.request rejects
+      // EVERY non-2xx (304 included) as HTTP_ERROR before poll can inspect
+      // res.statusCode, which made the documented conditional-poll fast-path
+      // and the selfupdate/poll-non-2xx branch dead code — a conditional poll
+      // that correctly received a 304 threw selfupdate/poll-failed instead of
+      // reporting "no update".
+      responseMode:     "always-resolve",
       errorClass:       SelfUpdateError,
     });
   } catch (e) {
@@ -630,6 +639,15 @@ function _validateSwapOpts(opts, label) {
           "selfUpdate.swap: opts.hashAlgo must be one of " + ALLOWED_HASH_ALGS.join(", "));
       }
     };
+    // swap re-reads the from-bytes to re-hash them (closing the verify->swap
+    // window); its cap must be declarable so it matches the maxBytes an
+    // operator passed to selfUpdate.verify for the same asset — otherwise swap
+    // would refuse a large binary that verify accepted. Optional; defaults to
+    // the same C.BYTES.gib(1) cap the body applies.
+    schema.maxBytes = function (value) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value,
+        "selfUpdate.swap: opts.maxBytes", SelfUpdateError, "selfupdate/bad-max-bytes");
+    };
   }
   schema.to       = { rule: "required-string", code: "selfupdate/bad-to",
                       label: "selfUpdate." + label + ": opts.to" };
@@ -696,6 +714,8 @@ async function _safeRollback(backupTo, to, hadOriginal) {
  *   backupTo:     string,   // required — backup path for the existing `to`
  *   expectedHash: string,   // required — the hash selfUpdate.verify returned
  *   hashAlgo:     string,   // sha3-512 (default) | sha-256 | sha-512 | shake256
+ *   maxBytes:     number,   // from-bytes re-hash cap (default 1 GiB) — set to
+ *                           //   the same value passed to selfUpdate.verify
  *
  * @example
  *   var v = await b.selfUpdate.verify({ assetPath, signaturePath, pubkeyPem });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.17",
+  "version": "0.16.19",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3e3c1217-5f8b-4f16-b9f5-bea246e83437",
+  "serialNumber": "urn:uuid:eb1100d2-6fe5-42ed-8c45-8ecc67a610fa",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-12T06:26:29.484Z",
+    "timestamp": "2026-07-12T11:39:25.071Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.17",
+      "bom-ref": "@blamejs/core@0.16.19",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.17",
+      "version": "0.16.19",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.17",
+      "purl": "pkg:npm/%40blamejs/core@0.16.19",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.17",
+      "ref": "@blamejs/core@0.16.19",
       "dependsOn": []
     }
   ]