@blamejs/core 0.16.18 → 0.16.20

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.20 (2026-07-12) — **Make the ClamAV scan-verdict classifier fail closed on a coalesced infected+clean reply, refuse a session under a strict device-binding threshold when the anomaly score can't be computed, guard the MessageFormat select renderer against prototype-chain keys, and reject a non-canonical webhook timestamp.** Covering untested adversarial branches across the mail scanner, the session device-binding verifier, the i18n message renderer, and the webhook verifier surfaced a set of fail-open and correctness defects, fixed at the root. The mail scanner's ClamAV INSTREAM reply classifier tested the benign OK token before the malign FOUND token, so a reply carrying both (a coalesced or stale-then-fresh reply on a reused connection) resolved to clean and delivered an infected message; the classifier now tests FOUND, then ERROR, then OK, so a malign signal always dominates and only an OK with no FOUND/ERROR is clean. Session verification under a strict maxAnomalyScore device-binding policy admitted a relocated device whenever no decisive anomaly score could be produced (no scorer supplied, or a scorer that threw or returned a non-finite value) -- it now fails closed, matching the unreadable-binding discipline. The ICU-style MessageFormat select renderer looked up an end-user-supplied select value with a bare object index, so a value naming an Object.prototype member (__proto__ / constructor / toString) returned an inherited member and either rendered garbage or threw a render-time DoS; every case lookup is now own-property only. And the webhook verifier accepted any string that Number() maps to the signed timestamp (scientific, trailing .0, hex, leading zero/plus), making the authenticated t= field malleable; it now requires the canonical decimal. **Fixed:** *b.webhook verifier rejects a non-canonical authenticated timestamp* — The verifier parsed the authenticated t= field with Number() and validated only the post-coercion integer, then re-composed the signed string from that integer -- so any string Number() maps to the same value (scientific 1.7e9, a trailing .0, hex 0x..., a leading zero/plus/whitespace) re-canonicalized into the identical signed string and verified, making the authenticated timestamp field malleable. The verifier now also requires the raw bytes to equal the canonical decimal the signer emits, the same strict digits-only parse the Stripe-compatible verifier already applied; the only legitimate producer (b.webhook.signer) emits the canonical form, so there is no interop cost. · *b.i18n.dir honors a custom RTL language configured in any case* — dir() folds the requested locale's primary subtag to lower case before the RTL-membership test, but a custom rtlLanguages list was stored verbatim, so an operator-supplied entry like "AR" or "CKB" never matched the lower-cased lookup and the language rendered left-to-right. The configured list is now folded to lower case the same way the lookup is, so a custom RTL entry matches regardless of case. · *b.i18n.t resolves a leaf shadowed by a namespace in a more-specific locale* — The fallback-chain lookup returned the first locale where the dotted key resolved to any non-undefined value, including a nested namespace object -- so a namespace at that path in the requested locale halted the chain and shadowed a real translation leaf defined in a fallback locale, leaking the raw key into the UI (and has() reported false). The lookup now treats only a renderable leaf (a string or a plural-shaped object) as a hit and keeps walking the chain past a namespace object, so a leaf in a fallback locale resolves. **Security:** *b.mail.scan fails closed on a coalesced infected+clean ClamAV reply* — The ClamAV INSTREAM reply classifier tested the benign `stream: OK` token before the malign `... FOUND` token, so a reply that carried both -- a coalesced or stale-then-fresh reply on a reused connection, or an intermediary that concatenates two responses -- resolved to a clean verdict and delivered an infected message (a scan bypass). The classifier is a security verdict, so it now tests FOUND (infected) first, then ERROR (do-not-deliver), then OK (clean); an unrecognized shape is still an error. A reply containing a FOUND signal can no longer be downgraded to clean by an adjacent OK token. · *b.session.verify fails closed under a strict anomaly threshold when the score can't be computed* — Under the strict maxAnomalyScore device-binding policy, verify() only assigned a fingerprint anomaly score when the supplied scorer returned a finite number. With no scorer (the option is documented as pairing with one but is omittable), or a scorer that threw or returned a non-finite value, the score stayed null and the refusal guard (score present AND above threshold) was false, so verify RETURNED a session bound to one device when presented from another. An uncomputable anomaly score on genuine fingerprint drift now fails closed (verify returns null), matching the fail-closed discipline the unreadable-binding branch already applied; the legitimate path (a finite score at or below the threshold admits, with the score surfaced) is unchanged. · *b.i18n MessageFormat select renderer guards against prototype-chain keys* — The ICU-style MessageFormat select renderer resolved a case with a bare object index on an end-user-supplied select value, so a value naming an Object.prototype member -- __proto__ / constructor / toString / hasOwnProperty / valueOf -- returned a truthy INHERITED member, bypassing the `other` fallback: an inherited value with no length rendered as empty (silent output corruption), and an inherited function threw when rendered as a non-array (a request-level DoS). Every select/plural case lookup is now own-property only, so an attacker-supplied select value that names a prototype member falls through to the `other` case. **Detectors:** *MessageFormat case lookups must be own-property* — A structural check asserts that the MessageFormat renderer resolves a select/plural case through the own-property helper rather than a bare object index, so an end-user-supplied select value can never reach the prototype chain and re-open the corruption/DoS class.
+
+- v0.16.19 (2026-07-12) — **Close a family of entity- and whitespace-hidden dangerous-URL-scheme and CSS-injection bypasses across b.guardHtml / b.guardSvg / b.guardMarkdown behind one shared normalizer, bound a DNS decompression-pointer name bomb, refuse an ambiguous audit-anchor canonicalization, and stop an empty-string sealed field from crashing an AAD-table write.** Covering untested adversarial branches across the content guards, a DNS wire parser, the audit-log anchor, and the sealed-field codec surfaced a family of fail-open defects, fixed at the root. The most serious span the content-guard URL-scheme and CSS-injection denylists: a browser removes tab/lf/cr from anywhere in a URL and trims a leading/trailing control-or-space run before resolving the scheme, and character-reference-decodes a style attribute before the CSS parser sees it, so an entity-encoded tab, an entity-encoded leading space, an HTML named entity, or an entity-encoded CSS token could all navigate/execute while reading past a denylist that matched the raw bytes. b.guardHtml missed the whitespace normalization entirely and matched CSS against raw bytes; b.guardMarkdown decoded only numeric entities; b.guardSvg had a partial fix. All three now route their scheme and CSS-token checks through one pair of shared codepoint-class normalizers, so no guard can strip a different set of encodings than another. A DNS compression-pointer chain could decompress a single name past the RFC 1035 255-octet / label caps (a decompression-amplification DoS); the audit-log anchor's newline-delimited signed bytes let one signature validate for several different tip/previous-tip splits (defeating the linkage tamper-evidence); an SVG animation element permitted under a permissive profile lost its open tag; and an empty-string sealed column crashed an AAD-table insert. **Fixed:** *b.guardSvg preserves a profile-permitted safe animation element* — Under a permissive profile that allows animation, a safe animation element (for example an <animate> whose attributeName targets a visual property) had its open tag dropped while its end tag was still emitted, leaving an orphan close tag and silently stripping an element the profile permits. The sanitize path now affirmatively re-permits the safe-target case; an unsafe-target animation (attributeName=href and similar) is still dropped and neutralized. · *b.cryptoField.sealRow seals an empty-string field as a tamper-evident envelope* — sealRow dispatched every non-null value -- including an empty string -- to one of three envelope-seal branches that disagreed on empty plaintext: the plain and per-row-key branches handled it, but the AAD branch is fail-closed and threw, so a write to an AAD-sealed table whose sealed column held an empty string crashed the insert. An empty string now encodes to a non-empty typed marker before sealing, so it becomes a real authenticated envelope (never a bare plaintext empty string) that round-trips to an empty string on read. On the read side, a bare empty string found in an AAD-bound or per-row-key sealed column -- which after this change can only be an envelope-downgrade by a DB-write attacker -- fails closed (the cell is nulled and audited) instead of being accepted as a valid empty value, so the sealed-column tamper-evidence guarantee holds for empty values too. **Security:** *b.guardHtml / b.guardSvg / b.guardMarkdown refuse entity- and whitespace-hidden dangerous URL schemes* — The URL-scheme denylist on every URL-bearing attribute (href / xlink:href / markdown link, image, autolink, reference-definition) is resolved after normalizing the value the way a browser does: character-reference decoding (numeric AND the HTML5 named-entity ASCII subset browsers honor, e.g. &Tab; / &colon;), removing tab/lf/cr from anywhere, and trimming a leading/trailing C0-control-or-space run. Previously b.guardHtml stripped neither tab/lf/cr nor an entity-encoded leading space, and b.guardMarkdown decoded only numeric entities, so payloads such as java&#9;script:, java&Tab;script:, and &#32;javascript: resolved to an empty scheme and were served/rendered as safe while a browser executed them as javascript:. The normalization now lives in two shared codepoint-class primitives (b.codepointClass.decodeMarkupEntities and b.codepointClass.stripUrlSchemeWhitespace) that all three guards compose, so no guard can fold away a different set of encodings than another. · *b.guardHtml / b.guardSvg detect entity-encoded and whitespace-hidden CSS injection in style attributes* — A style attribute is HTML/XML character-reference-decoded before the CSS parser sees it, so width:ex&#x70;ression(, background:url(&#x6A;avascript:...), and behavior&colon;url(...) reach CSS as expression( / url(javascript:...) / behavior: with no literal danger token in the raw bytes. The CSS-danger check matched the raw attribute value, so these bypassed the denylist and were served verbatim (a stored CSS-injection XSS). Both guards now match the entity-decoded value AND fold the URL-scheme whitespace a browser strips inside url(...) (tab / lf / cr), so an entity-hidden tab in a CSS URL scheme (url(java&Tab;script:) reaching CSS as url(java<TAB>script:), which navigates as javascript:) can no longer defeat the contiguous javascript: pattern either. A plain (unencoded) dangerous style is still caught and a benign style is untouched. · *b.safeDns bounds a decompressed name across the whole compression-pointer chain* — readName tracked its per-name octet and label budgets per stack frame, so each compression-pointer jump restarted a fresh RFC 1035 255-octet / label budget and a pointer was charged as only its 2 on-wire bytes. A crafted pointer chain therefore decompressed a single name well past the advertised 255-octet / label caps (a decompression-amplification DoS on untrusted DNS responses). The octet and label accountants now thread through the whole pointer chain, so the composite decompressed name is bounded by the same caps that bound a single in-line name; independent names are still measured independently and no name that decompresses within the caps is newly rejected. · *b.auditSign refuses an anchor whose fields carry the record delimiter* — The chain-anchor signed bytes are a newline-delimited layout of format / counter / tipHash / prevTipHash / createdAt. A literal newline inside any operator-influenced string field (format / tipHash / prevTipHash) let content migrate across a field boundary without changing the signed bytes, so one signature was valid for several different { tipHash, prevTipHash } splits -- an attacker could rewrite a stored anchor's apparent tip/linkage while keeping verify() happy, defeating the prevTipHash linkage tamper-evidence. anchor() now refuses a delimiter-bearing field at sign time and verifyAnchor refuses one at verify time, so an ambiguous anchor can neither be minted nor accepted; every legitimate (delimiter-free) anchor is byte-identical and unaffected. **Detectors:** *Guard scheme extractors and CSS-danger checks must compose the shared normalizers* — Two structural checks assert that a content guard which resolves a URL scheme for a denylist routes the decoded value through b.codepointClass.stripUrlSchemeWhitespace, and that a guard's CSS-danger check matches the entity-decoded style value via b.codepointClass.decodeMarkupEntities -- so a future guard cannot silently fold away a narrower set of encodings than the browser and re-open the bypass class.
+
 - v0.16.18 (2026-07-12) — **Refuse a stale FIDO metadata BLOB on the operator-fetch path, harden the GraphQL DoS-shape guard against escaped strings and malformed queries, parse POSIX leading-space octal in tar headers, and fix the FIDO certified-level, self-update 304, and swap-maxBytes paths — surfaced by covering previously-untested error and adversarial branches.** Covering untested error and adversarial branches across four security-relevant primitives surfaced seven defects, fixed at the root. The most serious: b.auth.fidoMds3.fetch() reimplemented the metadata-BLOB validation inline and omitted the stale-BLOB refusal the internal path enforced — so a signed-but-expired BLOB (nextUpdate in the past) was accepted and cached, letting an attacker who serves an ancient correctly-signed BLOB freeze an operator's revoked/compromised-authenticator list at a time of their choosing. Both paths now route through one _verifyBlobWithRoots source of truth, so no check can be present on one and missing on the other. The GraphQL query-shape guard (the pre-schema depth/alias DoS walker) miscounted on a string literal containing an escaped quote and on a brace-unbalanced malformed query, weakening the depth/alias limits it exists to enforce. The FIDO certified-level resolver lexically compared status reports and let an undated later report (a decertification or downgrade) lose to an earlier dated one, so a now-decertified authenticator could still read as certified. A tar reader misparsed POSIX leading-space-padded octal header fields to 0 (a size misparse desynced the block walker and rejected archives other tars extract). self-update's documented 304 If-None-Match fast-path was dead (it threw on every unchanged conditional poll), and selfUpdate.swap read an opts.maxBytes it never declared, so it could refuse a large binary that selfUpdate.verify accepted. **Fixed:** *b.auth.fidoMds3 certified-level honors an undated later decertification or downgrade* — _certifiedLevel compared status reports lexically and coerced a missing effectiveDate to an empty string, which sorts before any real date — so a later report with no effectiveDate (a NOT_FIDO_CERTIFIED decertification, or a downgrade/upgrade) always lost to an earlier dated grant, and certifiedLevel froze at the stale, higher historical value. A step-up policy reading certifiedLevel >= N could therefore accept a now-decertified authenticator. Reports without a comparable date now fall back to array order (append order = chronological), so a later decertification/downgrade wins. · *b.archive.read.tar parses POSIX leading-space-padded octal header fields* — A tar numeric header field (mode / uid / gid / size / mtime / checksum) that is left-padded with ASCII spaces — POSIX-legal, and emitted by star / BSD / Java / Perl tars — was misparsed to 0 because the octal reader treated a leading space as a field terminator. A misparsed size desynced the 512-byte block walker (it read the file body as the next header) and rejected an archive other tars extract cleanly. The reader now skips leading-space padding before reading octal digits. · *b.selfUpdate.poll returns a no-update result on a 304 Not Modified* — The documented If-None-Match / ETag fast-path was unreachable: poll delegated HTTP status handling to the HTTP client, which rejects every non-2xx (304 included) as an error before poll could inspect the status. A conditional poll that correctly received a 304 threw selfupdate/poll-failed instead of returning { available: false, statusCode: 304 }. The 304 (and the non-2xx) branch is now reached, so ETag-conditional polling works as documented. · *b.selfUpdate.swap accepts the maxBytes it re-reads under* — swap re-reads the newly-installed bytes to re-hash them (closing the verify→swap window) under an opts.maxBytes cap, but its option schema never declared maxBytes — so a caller who passed it was refused with selfupdate/bad-opts and swap always used the fixed 1 GiB default, which could refuse a large binary that selfUpdate.verify (which does declare maxBytes) accepted. swap now declares maxBytes (validated like verify's), so the two caps match; rollback, which re-reads nothing, still does not accept it. **Security:** *b.auth.fidoMds3.fetch refuses a stale (expired) metadata BLOB* — The operator-facing fetch path (which trusts caCertificate roots) reimplemented the metadata-BLOB parse and verify inline and omitted the stale-BLOB refusal that the default-roots path enforced, so a BLOB whose nextUpdate is already in the past was accepted and cached even though FIDO MDS3 §3.1.7 says it must not be trusted. An attacker serving an ancient, correctly-signed BLOB could pin an operator to a revoked/compromised-authenticator list frozen at that time. The JWS + x5c-chain verify, payload-shape checks, and stale-BLOB refusal now live in one _verifyBlobWithRoots helper that both the operator-fetch and default-roots paths route through, so the checks can never drift apart again. · *b.guardGraphql hardens the pre-schema DoS-shape walker against escaped strings and malformed queries* — The query-shape walker that enforces depth and alias limits before the query reaches a schema miscounted in two ways: it treated an escaped quote inside a valid GraphQL string literal as the string's terminator (desyncing its in-string state), and it popped its depth-indexed alias counter on every closing brace even for a brace-unbalanced malformed query (underflowing the counter). Both weakened the depth/alias caps the guard exists to enforce against a DoS-shaped query. The walker now tracks string escapes correctly and guards the alias-counter stack against imbalance.
 
 - v0.16.17 (2026-07-12) — **Reject INI float literals that overflow to Infinity, return a verdict (not an exception) when a reverse-DNS lookup faults, wrap an async redirect-hook rejection like a sync throw, and refuse a fractional --max-rows — four defects surfaced by covering previously-untested error branches.** Covering previously-untested error and adversarial branches across four primitives surfaced four genuine defects, each fixed at the root. b.parsers.ini.parse coerced a value like `x = 1e999` straight to ±Infinity — its integer and hex branches already reject out-of-range numbers, but the float branch had no finiteness guard, so an overflowing float slipped through and could poison a downstream size cap or timeout; it is now rejected with ini/value-out-of-range. b.mail.iprev.verify threw an unhandled exception when the forward-confirm DNS lookup returned an error code outside the handful it enumerated (EREFUSED / ENOTIMP / …), even though its reverse-lookup path and every sibling (SPF/DKIM/DMARC/ARC) return a verdict for such faults; it now returns a temperror verdict, and — like those siblings — accepts an operator opts.dnsLookup resolver so the confirm path is resolvable offline. b.httpClient wrapped a synchronous onRedirect hook throw into a REDIRECT_ABORTED error but let an async hook rejection escape unwrapped; both now abort the redirect identically. And the blamejs audit verify-chain --max-rows flag accepted a fractional value (2.5), which truncated the chain walk mid-row and reported a nonsensical fractional count; it now requires a whole positive integer, matching its own error message. **Fixed:** *b.parsers.ini.parse rejects an overflowing float instead of coercing to Infinity* — A float literal that exceeds the representable range (e.g. `x = 1e999`) coerced to ±Infinity. The integer and hex coercion branches already reject out-of-range numbers via Number.isSafeInteger, but the float branch returned Number(raw) with no finiteness check — so an Infinity could flow into a downstream size cap or timeout, a denial-of-service vector. The float branch now rejects a non-finite result with ini/value-out-of-range; a large-but-finite float (1e308) and underflow (1e-999 → 0) still parse. · *b.mail.iprev.verify returns a temperror verdict on an un-enumerated reverse/forward DNS fault* — The forward-confirm DNS lookup's error handler enumerated a few transient codes and threw for anything else, so a resolver returning EREFUSED / ENOTIMP / EBADRESP produced an unhandled exception from the public API rather than a verdict. The reverse-lookup path and every sibling result type (SPF / DKIM / DMARC / ARC) return a verdict for a DNS-derived fault; the forward path now does too (temperror). iprev.verify also gains an operator opts.dnsLookup resolver, matching the dnsLookup contract the other types already honor, so the forward-confirm path is resolvable offline. · *b.httpClient aborts a redirect on an async onRedirect hook rejection* — A synchronous throw from the onRedirect hook was wrapped into a REDIRECT_ABORTED error, but an async hook that rejected let the rejection escape unwrapped — inconsistent handling for the same operator control point. An async onRedirect rejection now aborts the redirect with REDIRECT_ABORTED, identical to the synchronous throw. · *blamejs audit verify-chain --max-rows requires a whole positive integer* — The --max-rows flag validated only that the value was finite and >= 1, so a fractional value (2.5) was accepted and passed to the chain walk, where it truncated the verification mid-row and reported a fractional rowsVerified count — despite the flag's own error message promising a positive integer. It now rejects a non-integer value, matching the sibling --steps flag.

package/lib/audit-sign.js

@@ -204,6 +204,24 @@ function _computeFingerprint(publicKeyPem) {
 // untouched). Changing this invalidates every prior anchor.
 var ANCHOR_FORMAT = "blamejs-chain-anchor-v1";
 
+// The anchor signed-bytes layout below is newline-delimited, so a literal
+// newline inside any operator-influenced string field (format / tipHash /
+// prevTipHash) would let content migrate across a field boundary WITHOUT
+// changing the signed bytes: two different { tipHash, prevTipHash } splits
+// collide on one signature, so a signature minted for one split verifies for a
+// different split. That defeats the "prevTipHash is bound into the signature"
+// linkage guarantee — an attacker could rewrite the apparent tip / linkage of a
+// stored anchor while keeping verify() happy. counter + createdAt are numbers
+// (String() of a finite number can never contain the delimiter), so only the
+// three string fields need guarding. Reject the delimiter at BOTH sign time
+// (so no ambiguous signature is ever minted) and verify time (so a pre-existing
+// or hand-crafted ambiguous anchor is refused, not accepted). The wire format
+// stays byte-identical for every legitimate (delimiter-free) anchor.
+var ANCHOR_FIELD_DELIMITER = "\n";
+function _containsAnchorDelimiter(s) {
+  return typeof s === "string" && s.indexOf(ANCHOR_FIELD_DELIMITER) !== -1;
+}
+
 // Build the canonical signed bytes for one anchor. Fixed multi-line layout (no
 // JSON serializer quirks). prevTipHash IS part of the signed payload, so the
 // link between consecutive anchors is tamper-evident — an attacker cannot
@@ -878,10 +896,20 @@ function _normalizeTip(tip, fnLabel) {
     throw _err("ANCHOR_BAD_TIPHASH",
       "auditSign." + fnLabel + ": tip.tipHash must be a non-empty string");
   }
+  if (_containsAnchorDelimiter(tip.tipHash)) {
+    throw _err("ANCHOR_BAD_TIPHASH",
+      "auditSign." + fnLabel + ": tip.tipHash must not contain a newline (the anchor " +
+      "record delimiter — it would make the signed bytes ambiguous)");
+  }
   if (tip.prevTipHash != null && typeof tip.prevTipHash !== "string") {
     throw _err("ANCHOR_BAD_PREV",
       "auditSign." + fnLabel + ": tip.prevTipHash, when present, must be a string");
   }
+  if (_containsAnchorDelimiter(tip.prevTipHash)) {
+    throw _err("ANCHOR_BAD_PREV",
+      "auditSign." + fnLabel + ": tip.prevTipHash must not contain a newline (the anchor " +
+      "record delimiter — it would make the signed bytes ambiguous)");
+  }
   return {
     counter:     counter,
     tipHash:     tip.tipHash,
@@ -916,7 +944,9 @@ function _normalizeTip(tip, fnLabel) {
  * that key store (not fully store-free) — keep the history with the anchors.
  *
  * Throws `AuditSignError` (`ANCHOR_BAD_TIP` / `ANCHOR_BAD_COUNTER` /
- * `ANCHOR_BAD_TIPHASH` / `ANCHOR_BAD_PREV`) on a malformed tip;
+ * `ANCHOR_BAD_TIPHASH` / `ANCHOR_BAD_PREV` / `ANCHOR_BAD_FORMAT`) on a malformed
+ * tip — including any `format` / `tipHash` / `prevTipHash` that carries a
+ * newline, which would make the signed bytes ambiguous;
  * `audit-sign/not-initialized` when `init()` has not been awaited.
  *
  * @opts
@@ -934,6 +964,11 @@ function anchor(tip, opts) {
   _requireInit();
   opts = opts || {};
   var t = _normalizeTip(tip, "anchor");
+  if (_containsAnchorDelimiter(opts.format)) {
+    throw _err("ANCHOR_BAD_FORMAT",
+      "auditSign.anchor: opts.format must not contain a newline (the anchor " +
+      "record delimiter — it would make the signed bytes ambiguous)");
+  }
   var format = (typeof opts.format === "string" && opts.format.length > 0) ? opts.format : ANCHOR_FORMAT;
   var createdAt = (typeof opts.createdAt === "number" && isFinite(opts.createdAt)) ? opts.createdAt : Date.now();
   var payload = anchorPayload(t.counter, t.tipHash, t.prevTipHash, createdAt, format);
@@ -962,6 +997,17 @@ function _verifyOneAnchor(a) {
   if (typeof a.counter !== "number" || !isFinite(a.counter)) {
     return { ok: false, reason: "anchor counter is not a finite number" };
   }
+  // Fail closed on a delimiter-bearing field: the newline-delimited signed
+  // bytes are ambiguous when format / tipHash / prevTipHash carries the
+  // delimiter, so ONE signature can be valid for several different logical
+  // { tipHash, prevTipHash } splits. Refuse rather than accept the ambiguity —
+  // a legitimate anchor is delimiter-free (anchor() rejects a newline field at
+  // sign time), so this only ever rejects a hand-crafted / boundary-shifted one.
+  if (_containsAnchorDelimiter(a.tipHash) ||
+      _containsAnchorDelimiter(a.format) ||
+      _containsAnchorDelimiter(a.prevTipHash)) {
+    return { ok: false, reason: "anchor field contains the record delimiter (ambiguous canonicalization)" };
+  }
   var pub = getPublicKeyByFingerprint(a.publicKeyFingerprint);
   if (!pub) {
     return { ok: false, reason: "no audit-signing key on record for this anchor's fingerprint" };

package/lib/codepoint-class.js

@@ -581,10 +581,95 @@ function decodeNumericEntities(s) {
   });
 }
 
+// The HTML5 named-entity ASCII subset a browser resolves inside URL and CSS
+// attribute contexts — the scheme/whitespace-significant characters an attacker
+// hides a payload behind (`java	script:` / `behavior:`). One table so
+// guard-html / guard-svg / guard-markdown decode the SAME set and cannot drift
+// (guard-markdown shipped without named-entity decoding at all, so `	` /
+// `
` slipped past its scheme denylist).
+var NAMED_ENTITY_ASCII = {
+  // Whitespace + control chars browsers strip inside URL schemes
+  Tab: "\t", NewLine: "\n",
+  // Scheme-significant punctuation
+  colon: ":", semi: ";", period: ".", sol: "/", bsol: "\\",
+  num: "#", excl: "!", quest: "?", lpar: "(", rpar: ")",
+  lsqb: "[", rsqb: "]", lcub: "{", rcub: "}",
+  // Quotes / brackets
+  quot: "\"", apos: "'", lt: "<", gt: ">",
+  // Misc ASCII
+  amp: "&", commat: "@", dollar: "$", percnt: "%",
+  ast: "*", plus: "+", lowbar: "_", hyphen: "-",
+  // Latin-1 space browsers treat as URL-strippable
+  nbsp: " ",
+};
+var NAMED_ENTITY_RE_G = /&([A-Za-z][A-Za-z0-9]+);/g;
+
+/**
+ * @primitive b.codepointClass.decodeMarkupEntities
+ * @signature b.codepointClass.decodeMarkupEntities(value)
+ * @since     0.16.19
+ * @status    stable
+ * @related   b.codepointClass.decodeNumericEntities, b.codepointClass.stripUrlSchemeWhitespace
+ *
+ * Decode the character references a browser resolves inside an attribute value
+ * -- numeric (hex/decimal, semicolon OPTIONAL) then the named-entity ASCII
+ * subset browsers honor in URL/CSS contexts -- and drop the C0 controls and
+ * zero-widths a payload hides behind. The single decoder every content guard
+ * routes a scheme / CSS-token danger check through, so a threat cannot slip
+ * past the guard that forgot to decode an encoding a sibling strips. Pair with
+ * `stripUrlSchemeWhitespace` for a URL-scheme check.
+ *
+ * @example
+ *   b.codepointClass.decodeMarkupEntities("ex&#x70;ression(");   // "expression("
+ *   b.codepointClass.decodeMarkupEntities("behavior&colon;");    // "behavior:"
+ */
+function decodeMarkupEntities(value) {
+  var s = decodeNumericEntities(String(value == null ? "" : value));
+  s = s.replace(NAMED_ENTITY_RE_G, function (m, name) {
+    if (Object.prototype.hasOwnProperty.call(NAMED_ENTITY_ASCII, name)) {
+      return NAMED_ENTITY_ASCII[name];
+    }
+    return m;
+  });
+  return s.replace(C0_CTRL_RE_G, "").replace(ZW_RE_G, "");
+}
+
+var URL_TAB_NEWLINE_RE_G = /[\t\n\r]/g;                              // URL tab/newline strip, not byte size
+// allow:dynamic-regex -- codepoints from a literal [0x00, 0x20] range (C0 controls + space)
+var URL_C0_SPACE_CC = charClass([[0x0000, 0x0020]]);
+var URL_C0_SPACE_TRIM_RE = new RegExp("^(?:[" + URL_C0_SPACE_CC + "])+|(?:[" + URL_C0_SPACE_CC + "])+$", "g");
+/**
+ * @primitive b.codepointClass.stripUrlSchemeWhitespace
+ * @signature b.codepointClass.stripUrlSchemeWhitespace(s)
+ * @since     0.16.19
+ * @status    stable
+ * @related   b.codepointClass.decodeMarkupEntities, b.codepointClass.decodeNumericEntities
+ *
+ * Fold away exactly the whitespace the WHATWG URL parser removes before it
+ * resolves a scheme: ASCII tab / LF / CR from ANYWHERE, plus a leading/trailing
+ * C0-control-or-space run. tab/lf/cr are excluded from the C0-control catalog
+ * and space is not a control, so a danger check that strips only C0/zero-width
+ * still lets `java<TAB>script:` or an entity-encoded leading space
+ * (`&#32;javascript:`) read as scheme-less. Run AFTER entity decoding; every
+ * guard that extracts a URL scheme for a denylist routes the decoded value
+ * through this.
+ *
+ * @example
+ *   b.codepointClass.stripUrlSchemeWhitespace("  javascript:x");   // "javascript:x"
+ */
+function stripUrlSchemeWhitespace(s) {
+  return String(s == null ? "" : s)
+    .replace(URL_TAB_NEWLINE_RE_G, "")
+    .replace(URL_C0_SPACE_TRIM_RE, "");
+}
+
 module.exports = {
   isForbiddenControlChar:  isForbiddenControlChar,
   firstControlCharOffset:  firstControlCharOffset,
   decodeNumericEntities:   decodeNumericEntities,
+  decodeMarkupEntities:    decodeMarkupEntities,
+  NAMED_ENTITY_ASCII:      NAMED_ENTITY_ASCII,
+  stripUrlSchemeWhitespace: stripUrlSchemeWhitespace,
   isAsciiAlnum:      isAsciiAlnum,
   isUnreserved:      isUnreserved,
   hex4:              hex4,

package/lib/crypto-field.js

@@ -89,6 +89,11 @@ var TYPED_SENTINEL = String.fromCharCode(0) + "bjsv1:";
 
 function _encodeTyped(value) {
   if (typeof value === "string") {
+    // "" encodes to a NON-empty typed marker so a sealed empty string is a real
+    // authenticated envelope, never a bare plaintext "": vault.aad.seal refuses
+    // empty plaintext, and a bare "" in a sealed cell is indistinguishable from a
+    // ciphertext a DB-write attacker downgraded to "".
+    if (value === "") return TYPED_SENTINEL + "E:";
     return value.indexOf(TYPED_SENTINEL) === 0 ? TYPED_SENTINEL + "S:" + value : value;
   }
   if (Buffer.isBuffer(value)) return TYPED_SENTINEL + "B:" + value.toString("base64");
@@ -102,6 +107,7 @@ function _decodeTyped(str) {
   var body = str.slice(TYPED_SENTINEL.length);
   var tag = body.slice(0, 2);
   var payload = body.slice(2);
+  if (tag === "E:") return "";
   if (tag === "B:") return Buffer.from(payload, "base64");
   if (tag === "J:") return safeJson.parse(payload);   // plaintext is AEAD-verified; safeJson blocks proto-pollution defensively
   if (tag === "S:") return payload;
@@ -1071,6 +1077,11 @@ function sealRow(table, row, opts) {
   //   - plain mode: vault.seal (idempotent — already-sealed pass through).
   for (var i = 0; i < s.sealedFields.length; i++) {
     var field = s.sealedFields[i];
+    // Skip only null / undefined (nothing to seal). An empty string IS sealed:
+    // _encodeTyped("") yields a non-empty typed marker (E:), so every branch
+    // produces a real authenticated envelope -- never a bare plaintext "" that a
+    // DB-write attacker could forge, or that a ciphertext could be silently
+    // downgraded to (unsealRow fails closed on a bare "" in an AAD/keyed cell).
     if (out[field] === undefined || out[field] === null) continue;
     if (kRow && field === residencyCol) continue;   // residency tag stays plaintext
     if (kRow) {
@@ -1216,6 +1227,27 @@ function unsealRow(table, row, actor, dbHandle) {
 
   for (var i = 0; i < s.sealedFields.length; i++) {
     var field = s.sealedFields[i];
+    // Post-seal, a legitimately-empty sealed value is a NON-empty authenticated
+    // envelope (see _encodeTyped "" -> E:), so a bare "" present in an AAD-bound
+    // or per-row-key sealed column is an envelope-downgrade tamper -- a DB-write
+    // attacker replacing a ciphertext with "". Fail closed (null the cell + audit),
+    // mirroring the plain-vault aad-downgrade refusal below; never surface it as a
+    // valid empty value. Plain-mode tables keep the lenient pass-through.
+    if (out[field] === "" && (s.aad || keyedTable)) {
+      out[field] = null;
+      try {
+        audit().safeEmit({
+          action:  "system.crypto.unseal_failed",
+          outcome: "failure",
+          metadata: {
+            table: table, field: field, rowId: out[s.rowIdField] || out._id || null,
+            shape: (s.aad ? "aad" : "row"),
+            reason: "empty-string cell in a sealed AAD/keyed column (envelope downgrade)",
+          },
+        });
+      } catch (_e) { /* drop-silent */ }
+      continue;
+    }
     if (out[field]) {
       // Per-cell envelope shape for audit metadata (operators write alert
       // rules off it): "row" = K_row cell, "aad" = vault.aad: cell on an

package/lib/guard-html.js

@@ -110,11 +110,6 @@ void observability;
 
 var _err = GuardHtmlError.factory;
 
-// ---- Codepoint catalog (shared via lib/codepoint-class) ----
-
-var C0_CTRL_RE_G  = codepointClass.C0_CTRL_RE_G;
-var ZW_RE_G       = codepointClass.ZW_RE_G;
-
 // ---- Tag denylists / allowlists ----
 
 // Always-dangerous tags. Active scripts, plugin embeds, form elements,
@@ -362,54 +357,21 @@ function escapeAttr(value) {
     .replace(/=/g, "=");
 }
 
-// HTML5 named entities that decode to ASCII codepoints — focused on
-// the entries browsers honor inside URL contexts (whitespace, control
-// chars, scheme-significant punctuation). The full WHATWG named-
-// character-reference table is ~2,231 entries; this is the
-// security-load-bearing subset documented in scheme-bypass writeups
-// (CVE-2026-30838 class). High-codepoint named entities (e.g. mathematical
-// symbols) don't affect URL scheme parsing, so they're omitted.
-var NAMED_ENTITY_ASCII = {
-  // Whitespace + control chars browsers strip inside URL schemes
-  Tab: "\t", NewLine: "\n",
-  // Scheme-significant punctuation
-  colon: ":", semi: ";", period: ".", sol: "/", bsol: "\\",
-  num: "#", excl: "!", quest: "?", lpar: "(", rpar: ")",
-  lsqb: "[", rsqb: "]", lcub: "{", rcub: "}",
-  // Quotes / brackets
-  quot: "\"", apos: "'", lt: "<", gt: ">",
-  // Misc ASCII
-  amp: "&", commat: "@", dollar: "$", percnt: "%",
-  ast: "*", plus: "+", lowbar: "_", hyphen: "-",
-  // Whitespace markers (codepoints in the ASCII / Latin-1 range that
-  // browsers treat as URL-strippable)
-  nbsp: " ",
-};
-
-// _normalizeUrl — peel off entity-encoded leading whitespace and
-// HTML/URL-encoded scheme prefix tricks, then return the lowercased
-// scheme. Returns "" if no scheme.
+// The named-entity ASCII table + entity decoder now live in codepoint-class
+// (NAMED_ENTITY_ASCII / decodeMarkupEntities), shared with guard-svg /
+// guard-markdown so all three decode the SAME browser-honored set and cannot
+// drift on which encoding a scheme / CSS-token danger check must fold away.
+// _extractScheme — decode entity-hidden scheme-prefix tricks, fold away the
+// whitespace the WHATWG URL parser would (tab/lf/cr anywhere + a leading/
+// trailing C0-control-or-space run — none of which the C0/zero-width strip
+// covers: tab/lf/cr are excluded from C0_CTRL_RANGES and space is not a
+// control), then return the lowercased scheme ("" if none). The shared
+// codepoint-class primitive keeps guard-html / guard-svg from drifting on which
+// whitespace to strip, so neither `java<TAB>script:` nor `&#32;javascript:` can
+// read as scheme-less.
 function _extractScheme(rawUrl) {
-  var s = String(rawUrl || "").trim();
-  // Decode HTML numeric entities (hex &#x..; and decimal &#..;, semicolon
-  // OPTIONAL) just enough to expose hidden schemes like &#x6A;avascript: or
-  // the browser-decoded no-semicolon form &#106avascript:. Shared decoder so
-  // guard-html / guard-svg / guard-markdown can't drift (see codepoint-class).
-  s = codepointClass.decodeNumericEntities(s);
-  // Decode HTML5 named entities that browsers honor inside URL
-  // contexts. Without this, payloads like `java&Tab;script:alert(1)`
-  // bypass the scheme allowlist (the literal `&Tab;` between `java`
-  // and `script:` doesn't match any denied scheme; the browser then
-  // decodes the entity, strips the tab, and executes javascript:).
-  s = s.replace(/&([A-Za-z][A-Za-z0-9]+);/g, function (m, name) {
-    if (Object.prototype.hasOwnProperty.call(NAMED_ENTITY_ASCII, name)) {
-      return NAMED_ENTITY_ASCII[name];
-    }
-    return m;
-  });
-  // Strip embedded whitespace + control chars + zero-widths the
-  // URL parser would tolerate.
-  s = s.replace(C0_CTRL_RE_G, "").replace(ZW_RE_G, "");
+  var s = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(String(rawUrl || "").trim()));
   var m = s.match(/^([A-Za-z][A-Za-z0-9+.-]*):/);
   return m ? m[1].toLowerCase() : "";
 }
@@ -443,8 +405,19 @@ function _isClobberGlobal(name) {
 }
 
 function _isCssDangerous(value) {
+  // A style attribute is HTML/XML character-reference-decoded before the CSS
+  // parser sees it, so `ex&#x70;ression(` reaches CSS as `expression(` and
+  // `behavior&colon;` as `behavior:`. Match against the decoded value — the same
+  // normalization the URL-scheme check performs — so an entity-encoded CSS
+  // payload can't be served verbatim past the danger patterns.
+  // Also fold the URL-scheme whitespace a browser strips inside url(...) -- tab /
+  // lf / cr -- so an entity-hidden tab in a CSS URL scheme (url(java&Tab;script:))
+  // cannot defeat the contiguous `javascript:` danger pattern, the same bypass the
+  // URL-scheme check folds away for href.
+  var decoded = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(value));
   for (var i = 0; i < CSS_DANGEROUS_PATTERNS.length; i += 1) {
-    if (CSS_DANGEROUS_PATTERNS[i].test(value)) return true;
+    if (CSS_DANGEROUS_PATTERNS[i].test(decoded)) return true;
   }
   return false;
 }

package/lib/guard-markdown.js

@@ -87,8 +87,6 @@ var INLINE_LINK_RE  = /(!?)\[([^\]\n]*)\]\(\s*([^)\s]+)\s*(?:"[^"]*")?\s*\)/g;
 var AUTOLINK_RE     = /<((?:[a-zA-Z][a-zA-Z0-9+.-]{0,32}):[^\s>]+)>/g;
 // Reference-link definition `[label]: url "title"`.
 var REF_DEF_RE      = /^\s{0,3}\[([^\]\n]+)\]:\s*([^\s]+)/gm;
-// HTML entity hex / decimal scheme bypass — decode and re-test.
-var HTML_ENTITY_NUM_RE = /&#(?:x([0-9a-f]+)|(\d+));?/gi;
 
 // Front-matter block (YAML triple-dash or TOML triple-plus).
 var FRONT_MATTER_YAML_RE = /^---\s*\n[\s\S]+?\n---\s*\n?/;
@@ -99,31 +97,20 @@ var DOCTYPE_INLINE_RE = /<!DOCTYPE\b/i;
 var CODE_FENCE_LANG_RE = /^(?:```|~~~)([^\n]*)\n/gm;
 var EMPH_RUN_RE = /[*_]{20,}/;                                                   // allow:regex-no-length-cap — character-class repeat is linear in input length
 
-function _decodeHtmlEntities(s) {
-  return s.replace(HTML_ENTITY_NUM_RE, function (match, hex, dec) {
-    var code = hex !== undefined ? parseInt(hex, 16) : parseInt(dec, 10);       // parseInt radix args (16 hex / 10 decimal)
-    if (!isFinite(code) || code < 0 || code > 0x10ffff) return match;            // Unicode codepoint range
-    try { return String.fromCodePoint(code); } catch (_e) { return match; }
-  });
-}
 
 function _isDangerousUrl(url, opts) {
   if (typeof url !== "string") return null;
-  var s = url.trim();
-  s = _decodeHtmlEntities(s);
-  // Strip null + ASCII control chars from the URL — ` javascript:` works
-  // in some browsers because the leading control bytes are tolerated.
-  // Char-by-char filter avoids the no-control-regex lint surface; the
-  // codepoint catalog (< 0x20 or 0x7F) is the same shape as the
-  // codepointClass tables.
-  var stripped = "";
-  for (var ci = 0; ci < s.length; ci += 1) {
-    var cc = s.charCodeAt(ci);
-    if (cc > 0x1f && cc !== 0x7f) stripped += s.charAt(ci);                     // ASCII control range thresholds
-  }
-  s = stripped;
-  if (DANGEROUS_SCHEME_RE.test(s)) return s.match(/^[a-z]+/i)[0].toLowerCase(); // allow:regex-no-length-cap — `s` is a markdown URL token already bounded by the inline-link / autolink / ref-def matchers (which themselves run on input bounded by maxBytes)
-  if (FILE_SCHEME_RE.test(s) && opts.filePolicy !== "allow") return "file";     // allow:regex-no-length-cap — same bounded-URL-token reasoning
+  // Decode the entity-hidden scheme tricks a browser resolves -- numeric AND the
+  // named-entity ASCII subset (guard-markdown previously decoded numeric only, so
+  // `java&Tab;script:` / a `&colon;`-hidden scheme slipped past) -- then fold away
+  // the whitespace the WHATWG URL parser strips (tab/lf/cr anywhere + a leading/
+  // trailing C0-control-or-space run, so `&#32;javascript:` -> " javascript:" can't
+  // defeat the `^scheme:` anchor). Shared codepoint-class primitives keep
+  // guard-markdown / guard-html / guard-svg from drifting on which encodings to fold.
+  var s = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(url.trim()));
+  if (DANGEROUS_SCHEME_RE.test(s)) return s.match(/^[a-z]+/i)[0].toLowerCase(); // allow:regex-no-length-cap -- `s` is a markdown URL token already bounded by the inline-link / autolink / ref-def matchers (which themselves run on input bounded by maxBytes)
+  if (FILE_SCHEME_RE.test(s) && opts.filePolicy !== "allow") return "file";     // allow:regex-no-length-cap -- same bounded-URL-token reasoning
   return null;
 }
 

package/lib/guard-svg.js

@@ -122,11 +122,6 @@ void observability;
 
 var _err = GuardSvgError.factory;
 
-// ---- Codepoint catalog (shared via lib/codepoint-class) ----
-
-var C0_CTRL_RE_G  = codepointClass.C0_CTRL_RE_G;
-var ZW_RE_G       = codepointClass.ZW_RE_G;
-
 // ---- Tag classification ----
 
 // Always-dangerous SVG tags. Active scripts, namespace-shift escape
@@ -314,32 +309,20 @@ var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256
 // ---- Internal helpers ----
 
 
-// HTML5 named-entity ASCII subset — same shape as guard-html.
-// Browsers honor these inside URL contexts; without decoding them,
-// `java	script:` and friends bypass the scheme allowlist.
-var SVG_NAMED_ENTITY_ASCII = {
-  Tab: "\t", NewLine: "\n",
-  colon: ":", semi: ";", period: ".", sol: "/", bsol: "\\",
-  num: "#", excl: "!", quest: "?", lpar: "(", rpar: ")",
-  lsqb: "[", rsqb: "]", lcub: "{", rcub: "}",
-  quot: "\"", apos: "'", lt: "<", gt: ">",
-  amp: "&", commat: "@", dollar: "$", percnt: "%",
-  ast: "*", plus: "+", lowbar: "_", hyphen: "-",
-  nbsp: " ",
-};
+// The named-entity ASCII table + entity decoder live in codepoint-class
+// (NAMED_ENTITY_ASCII / decodeMarkupEntities), shared with guard-html /
+// guard-markdown so all three decode the SAME browser-honored set and cannot
+// drift on which encoding a scheme / CSS-token danger check must fold away.
 
 function _extractScheme(rawUrl) {
-  var s = String(rawUrl || "").trim();
-  // Numeric entities (hex/decimal, semicolon OPTIONAL) via the shared decoder
-  // so guard-html / guard-svg / guard-markdown can't drift (see codepoint-class).
-  s = codepointClass.decodeNumericEntities(s);
-  s = s.replace(/&([A-Za-z][A-Za-z0-9]+);/g, function (m, name) {
-    if (Object.prototype.hasOwnProperty.call(SVG_NAMED_ENTITY_ASCII, name)) {
-      return SVG_NAMED_ENTITY_ASCII[name];
-    }
-    return m;
-  });
-  s = s.replace(C0_CTRL_RE_G, "").replace(ZW_RE_G, "");
+  // Decode entities, then fold away exactly the whitespace the WHATWG URL parser
+  // would (tab/lf/cr anywhere + a leading/trailing C0-control-or-space run) via
+  // the shared codepoint-class primitive, so an entity-hidden tab or leading
+  // space (`java&Tab;script:` / `&#32;javascript:`) can't push the scheme past
+  // the `^[A-Za-z]` anchor and read as scheme-less. Shared with guard-html so
+  // the two can't drift on which whitespace to strip.
+  var s = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(String(rawUrl || "").trim()));
   var m = s.match(/^([A-Za-z][A-Za-z0-9+.-]*):/);
   return m ? m[1].toLowerCase() : "";
 }
@@ -355,8 +338,19 @@ function _isFragmentRef(rawUrl) {
 }
 
 function _isCssDangerous(value) {
+  // A style attribute is HTML/XML character-reference-decoded before the CSS
+  // parser sees it, so `ex&#x70;ression(` reaches CSS as `expression(` and
+  // `behavior&colon;` as `behavior:`. Match against the decoded value — the
+  // same normalization the URL-scheme check performs — so an entity-encoded
+  // CSS payload can't be served verbatim past the danger patterns.
+  // Also fold the URL-scheme whitespace a browser strips inside url(...) -- tab /
+  // lf / cr -- so an entity-hidden tab in a CSS URL scheme (url(java&Tab;script:))
+  // cannot defeat the contiguous `javascript:` danger pattern, the same bypass the
+  // URL-scheme check folds away for href.
+  var decoded = codepointClass.stripUrlSchemeWhitespace(
+    codepointClass.decodeMarkupEntities(value));
   for (var i = 0; i < CSS_DANGEROUS_PATTERNS.length; i += 1) {
-    if (CSS_DANGEROUS_PATTERNS[i].test(value)) return true;
+    if (CSS_DANGEROUS_PATTERNS[i].test(decoded)) return true;
   }
   return false;
 }
@@ -782,7 +776,12 @@ function _sanitize(input, opts) {
     }
     var allowed = !dangerousTags[tok.name] && allowedTags[tok.name];
     if (animationTags[tok.name] && opts.allowAnimation && allowedTags[tok.name]) {
-      // Animation element — re-check attributeName.
+      // Animation element under a profile that permits animation: allowed iff
+      // its attributeName is in the safe-targets allowlist. Every animation tag
+      // is in DANGEROUS_TAGS, so `allowed` is already false above — this branch
+      // must AFFIRMATIVELY re-permit the safe case, else the open tag is dropped
+      // while its (still-allowlisted) end tag is emitted, leaving an orphan
+      // close and silently stripping a profile-permitted element.
       var safeAnimation = true;
       (tok.attrs || []).forEach(function (a) {
         if (a.name.toLowerCase() === "attributename" &&
@@ -790,7 +789,7 @@ function _sanitize(input, opts) {
           safeAnimation = false;
         }
       });
-      if (!safeAnimation) allowed = false;
+      allowed = safeAnimation;
     }
     if (!allowed) {
       if (BODY_DROP[tok.name] && !tok.selfClosing) {

package/lib/i18n-messageformat.js

@@ -362,6 +362,17 @@ function _renderSequence(nodes, vars, locale, hashContext, depth) {
   return out;
 }
 
+// Own-property case lookup. A select value is operator/end-user supplied, so
+// String(sv) can be `__proto__` / `constructor` / `toString` / `hasOwnProperty`
+// etc. A bare `node.cases[key]` would then return a truthy INHERITED
+// Object.prototype member, bypassing the `other` fallback and either rendering
+// garbage (a proto value with no `.length`) or throwing on `_renderSequence` of
+// a non-array (a request DoS). Every case-map lookup goes through this so no key
+// can reach the prototype chain.
+function _ownCase(cases, key) {
+  return Object.prototype.hasOwnProperty.call(cases, key) ? cases[key] : undefined;
+}
+
 function _renderNode(node, vars, locale, hashContext, depth) {
   if (node.type === "literal") return node.value;
   if (node.type === "hash") {
@@ -381,18 +392,18 @@ function _renderNode(node, vars, locale, hashContext, depth) {
     }
     var adjusted = n - (node.offset || 0);
     var exact = "=" + n;
-    var caseBody = node.cases[exact];
+    var caseBody = _ownCase(node.cases, exact);
     if (!caseBody) {
       var pr = _pluralRules(locale, node.type === "ordinal" ? "ordinal" : "cardinal");
       var category = pr.select(adjusted);
-      caseBody = node.cases[category] || node.cases.other;
+      caseBody = _ownCase(node.cases, category) || _ownCase(node.cases, "other");
     }
     return _renderSequence(caseBody, vars, locale, adjusted, depth + 1);
   }
   if (node.type === "select") {
     var sv = vars[node.name];
     var key = (sv === undefined || sv === null) ? "other" : String(sv);
-    var body = node.cases[key] || node.cases.other;
+    var body = _ownCase(node.cases, key) || _ownCase(node.cases, "other");
     return _renderSequence(body, vars, locale, hashContext, depth + 1);
   }
   return "";

package/lib/i18n.js

@@ -250,12 +250,19 @@ function _validateRtlList(value) {
   if (!Array.isArray(value)) {
     throw _err("BAD_OPT", "i18n.create: rtlLanguages must be an array of language subtags");
   }
+  // dir() folds the requested locale's primary subtag to lower case before
+  // the membership test, so fold the configured list the same way. Language
+  // subtags are conventionally lower case but BCP 47 is case-insensitive;
+  // normalizing only the lookup side would silently drop RTL for an
+  // operator-supplied entry like "AR" or "CKB".
+  var normalized = [];
   for (var i = 0; i < value.length; i++) {
     if (typeof value[i] !== "string" || value[i].length === 0) {
       throw _err("BAD_OPT", "i18n.create: rtlLanguages[" + i + "] must be a non-empty string");
     }
+    normalized.push(value[i].toLowerCase());
   }
-  return new Set(value);
+  return new Set(normalized);
 }
 
 // ---- Translation tree validation ----
@@ -658,7 +665,14 @@ function create(opts) {
       _ensureLocaleLoaded(loc);
       if (!translations[loc]) continue;
       var v = _resolveKey(translations[loc], key);
-      if (v !== undefined) {
+      if (v === undefined) continue;
+      // Only a renderable leaf is a hit: a string, or a plural-shaped
+      // object. A nested namespace object at this path is not a
+      // translation value — skip it and keep walking the fallback chain so
+      // a leaf defined in a less-specific parent or fallback locale still
+      // resolves, instead of the namespace shadowing it and the raw key
+      // leaking into the UI.
+      if (typeof v === "string" || _isPluralShape(v)) {
         return { value: v, foundIn: loc };
       }
     }
@@ -717,14 +731,12 @@ function create(opts) {
     var raw;
     if (typeof found.value === "string") {
       raw = found.value;
-    } else if (_isPluralShape(found.value)) {
+    } else {
+      // Guaranteed plural-shaped: _lookupRaw only reports a hit for a
+      // renderable leaf (string or plural-shaped object), so a namespace
+      // object never reaches here — it is skipped during the chain walk.
       var count = (vars && typeof vars.count === "number") ? vars.count : 0;
       raw = _selectPlural(found.value, count, found.foundIn, callerOpts.ordinal === true);
-    } else {
-      // Operator stored a nested tree at this key but called t() against
-      // the namespace. Return the key-path as a missing-key signal.
-      _emitObs("i18n.missing", { locale: locale, key: key });
-      return key;
     }
 
     // ICU MessageFormat path — when the operator opts in via
@@ -767,14 +779,12 @@ function create(opts) {
     callerOpts = callerOpts || {};
     if (typeof key !== "string" || key.length === 0) return false;
     var locale = _resolveLocale(callerOpts.locale);
-    var found = _lookupRaw(key, locale);
-    if (found === null) return false;
-    // A nested namespace object (not plural-shaped) is NOT a resolvable
-    // translation value — has() should report false so callers can gate
+    // _lookupRaw only reports a hit for a renderable leaf (a string or a
+    // plural-shaped object); a nested namespace object is skipped during
+    // the chain walk. So has() correctly reports false for a namespace key
+    // yet true when a fallback locale supplies the leaf — callers can gate
     // "show this UI block only if translated" on leaf entries.
-    if (typeof found.value === "string") return true;
-    if (_isPluralShape(found.value)) return true;
-    return false;
+    return _lookupRaw(key, locale) !== null;
   }
 
   function formatNumber(value, formatOpts, callerOpts) {

package/lib/mail-scan.js

@@ -236,7 +236,7 @@ function create(opts) {
         return _failTo(auditImpl, e, ms);
       });
     }
-    return _scanClamavInstream(messageBytes).then(function (rv) {
+    return _scanClamavInstream(messageBytes, scanOpts).then(function (rv) {
       rv.durationMs = Date.now() - t0;
       _emitScanResult(auditImpl, rv);
       return rv;
@@ -339,9 +339,11 @@ function create(opts) {
     });
   }
 
-  function _scanClamavInstream(messageBytes) {
+  function _scanClamavInstream(messageBytes, scanOpts) {
     return new Promise(function (resolve, reject) {
-      var sock = net.createConnection({ host: opts.host, port: opts.port });
+      var sock = (scanOpts && scanOpts._socket && typeof scanOpts._socket.write === "function")
+        ? scanOpts._socket
+        : net.createConnection({ host: opts.host, port: opts.port });
       var collector = safeBuffer.boundedChunkCollector({
         maxBytes:   caps.maxResponseBytes,
         errorClass: MailScanError,
@@ -383,21 +385,26 @@ function create(opts) {
         var reply = collector.result().toString("utf8").replace(/[\r\n\0]+$/g, "");                // allow:regex-no-length-cap — trailing-trim anchored
         // ClamAV INSTREAM reply: "<id>: <verdict>" where verdict is
         // "stream: OK", "stream: <Sig.Name> FOUND", or "INSTREAM size
-        // limit exceeded. ERROR".
-        if (/stream:\s+OK\b/.test(reply)) {                                                        // allow:regex-no-length-cap — anchored to fixed token
+        // limit exceeded. ERROR". This is a security verdict classifier,
+        // so it is fail-closed: the malign FOUND signal is tested BEFORE
+        // the benign OK signal. A reply that carries both a FOUND token
+        // and an OK token (a coalesced / stale-then-fresh reply on a
+        // reused connection, or an intermediary that concatenates two
+        // responses) must resolve to "infected", never downgrade to
+        // "clean". An unrecognized shape is "error" (do-not-deliver), so
+        // the only path to "clean" is an OK with no FOUND / no ERROR.
+        var m = reply.match(/stream:\s+(.+?)\s+FOUND\b/);                                          // allow:regex-no-length-cap — anchored to fixed FOUND token
+        if (m) {
+          resolve({ verdict: "infected", threats: [m[1]] });
+        } else if (/ERROR/i.test(reply)) {                                                         // allow:regex-no-length-cap — anchored to fixed ERROR token
+          resolve({ verdict: "error", threats: [] });
+        } else if (/stream:\s+OK\b/.test(reply)) {                                                 // allow:regex-no-length-cap — anchored to fixed token
           resolve({ verdict: "clean", threats: [] });
         } else {
-          var m = reply.match(/stream:\s+(.+?)\s+FOUND\b/);                                        // allow:regex-no-length-cap — anchored to fixed FOUND token
-          if (m) {
-            resolve({ verdict: "infected", threats: [m[1]] });
-          } else if (/ERROR/i.test(reply)) {                                                       // allow:regex-no-length-cap — anchored to fixed ERROR token
-            resolve({ verdict: "error", threats: [] });
-          } else {
-            // Unrecognized reply shape — treat as error so the caller
-            // gets a definite "do not deliver" signal instead of a
-            // silent clean verdict.
-            resolve({ verdict: "error", threats: [] });
-          }
+          // Unrecognized reply shape — treat as error so the caller
+          // gets a definite "do not deliver" signal instead of a
+          // silent clean verdict.
+          resolve({ verdict: "error", threats: [] });
         }
       });
 

package/lib/safe-dns.js

@@ -357,14 +357,24 @@ function checkCnameChainDepth(depth, opts) {
   }
 }
 
-function _readName(state, pointerDepth) {
+function _readName(state, pointerDepth, acc) {
   if (pointerDepth > state.caps.maxPointerDepth) {
     throw new SafeDnsError("safe-dns/oversize-pointer-depth",
       "safeDns.readName: compression-pointer chain depth=" + pointerDepth +
       " exceeds maxPointerDepth=" + state.caps.maxPointerDepth + " (RFC 1035 §4.1.4 loop defense)");
   }
+  // Both per-name accountants — the decompressed octet count and the label
+  // count — thread through the WHOLE compression-pointer chain via `acc`. A
+  // pointer jump continues the same budget instead of restarting it, so the
+  // composite name a chain expands to is bounded by the same RFC 1035 §3.1
+  // 255-octet / §2.3.4 maxLabels caps that bound a single in-line name. When
+  // the accountants were frame-local, each jump began a fresh 255-octet /
+  // maxLabels budget, so a chain of N pointers decompressed to ~N x 255 octets
+  // and ~N x maxLabels labels past the advertised per-name caps — a
+  // decompression-amplification seam. `acc` is undefined for a top-level name
+  // (each is measured independently) and shared with every sub-read.
+  if (!acc) acc = { bytes: 0, labels: 0 };
   var labels = [];
-  var totalBytes = 0;
   var jumped = false;
   var afterPointerOff = -1;
   var off = state.off;
@@ -376,10 +386,10 @@ function _readName(state, pointerDepth) {
     var byte = state.buf[off];
     if (byte === 0) {
       off += 1;
-      totalBytes += 1;
-      if (totalBytes > DNS_MAX_NAME_BYTES) {
+      acc.bytes += 1;
+      if (acc.bytes > DNS_MAX_NAME_BYTES) {
         throw new SafeDnsError("safe-dns/oversize-name",
-          "safeDns.readName: wire-name=" + totalBytes + " bytes exceeds RFC 1035 cap=" +
+          "safeDns.readName: wire-name=" + acc.bytes + " bytes exceeds RFC 1035 cap=" +
           DNS_MAX_NAME_BYTES);
       }
       break;
@@ -394,20 +404,14 @@ function _readName(state, pointerDepth) {
         throw new SafeDnsError("safe-dns/truncated-name",
           "safeDns.readName: compression pointer offset past message end");
       }
-      // First compression pointer ends the in-line label walk
-      // (line break below). `jumped` can never already be true here;
-      // assign unconditionally per Codex code-quality review.
+      // First compression pointer ends the in-line label walk. The pointed-to
+      // tail continues accumulating into the SAME `acc`, so the composite
+      // decompressed name stays bounded by the per-name octet + label caps.
       afterPointerOff = off + 2;                                                                        // RFC 1035 §4.1.4 2-byte pointer width
       jumped = true;
       var subState = { off: ptrOff, buf: state.buf, caps: state.caps };
-      var tailName = _readName(subState, pointerDepth + 1);
+      var tailName = _readName(subState, pointerDepth + 1, acc);
       if (tailName.length) labels.push(tailName);
-      totalBytes += 2;                                                                                  // RFC 1035 §4.1.4 2-byte pointer width
-      if (totalBytes > DNS_MAX_NAME_BYTES) {
-        throw new SafeDnsError("safe-dns/oversize-name",
-          "safeDns.readName: composite name=" + totalBytes + " bytes exceeds RFC 1035 cap=" +
-          DNS_MAX_NAME_BYTES);
-      }
       break;
     }
     if (byte > DNS_MAX_LABEL_BYTES) {
@@ -419,15 +423,16 @@ function _readName(state, pointerDepth) {
         "safeDns.readName: label content past message end");
     }
     labels.push(state.buf.toString("ascii", off + 1, off + 1 + byte));
-    if (labels.length > state.caps.maxLabels) {
+    acc.labels += 1;
+    if (acc.labels > state.caps.maxLabels) {
       throw new SafeDnsError("safe-dns/oversize-labels",
-        "safeDns.readName: label count=" + labels.length + " exceeds maxLabels=" + state.caps.maxLabels);
+        "safeDns.readName: label count=" + acc.labels + " exceeds maxLabels=" + state.caps.maxLabels);
     }
     off += 1 + byte;
-    totalBytes += 1 + byte;
-    if (totalBytes > DNS_MAX_NAME_BYTES) {
+    acc.bytes += 1 + byte;
+    if (acc.bytes > DNS_MAX_NAME_BYTES) {
       throw new SafeDnsError("safe-dns/oversize-name",
-        "safeDns.readName: wire-name=" + totalBytes + " bytes exceeds RFC 1035 cap=" +
+        "safeDns.readName: wire-name=" + acc.bytes + " bytes exceeds RFC 1035 cap=" +
         DNS_MAX_NAME_BYTES);
     }
   }

package/lib/session.js

@@ -681,10 +681,18 @@ async function verify(token, verifyOpts) {
       if (verifyOpts.requireFingerprintMatch === true) {
         return null;
       }
-      if (typeof verifyOpts.maxAnomalyScore === "number" &&
-          fingerprintAnomalyScore !== null &&
-          fingerprintAnomalyScore > verifyOpts.maxAnomalyScore) {
-        return null;
+      if (typeof verifyOpts.maxAnomalyScore === "number") {
+        // Genuine drift under a declared strict anomaly threshold. Refuse when
+        // the computed score exceeds the threshold — AND when no decisive score
+        // could be produced (no scorer supplied, or the scorer threw / returned
+        // a non-finite value, leaving fingerprintAnomalyScore null). An
+        // uncomputable anomaly score on real drift must FAIL CLOSED, not be
+        // treated as "below threshold" and silently admit a relocated device.
+        // Same fail-closed discipline the unreadable-binding branch above applies.
+        if (fingerprintAnomalyScore === null ||
+            fingerprintAnomalyScore > verifyOpts.maxAnomalyScore) {
+          return null;
+        }
       }
     }
   }

package/lib/webhook.js

@@ -669,8 +669,18 @@ function verifier(opts) {
       throw _failure("MISSING_TIMESTAMP", "webhook: t= field missing from signature header", "missing-timestamp", ctxReq);
     }
     var ts = Number(parsed.t);
-    if (!numericBounds.isNonNegativeFiniteInt(ts)) {
-      throw _failure("BAD_TIMESTAMP", "webhook: t= field is not a non-negative integer, got " + JSON.stringify(parsed.t), "bad-timestamp", ctxReq);
+    // The authenticated timestamp is re-composed into the signed string from
+    // `ts` (the Number) below, so it must be the exact canonical decimal the
+    // signer emits (`String(Math.floor(now / 1000))`). Validating only the
+    // post-coercion value would accept every string Number() maps to the same
+    // integer — scientific ("1.7e9"), a trailing ".0", hex ("0x..."), a
+    // leading "0"/"+"/whitespace — each of which re-canonicalizes into the
+    // signed string and re-verifies, making the authenticated t= field
+    // malleable. Require the raw bytes to equal String(ts) so the sole
+    // canonical form the signer produces is the sole form accepted (matching
+    // the strict digits-only parse the Stripe verifier already applies).
+    if (!numericBounds.isNonNegativeFiniteInt(ts) || String(ts) !== parsed.t) {
+      throw _failure("BAD_TIMESTAMP", "webhook: t= field is not a canonical non-negative integer, got " + JSON.stringify(parsed.t), "bad-timestamp", ctxReq);
     }
     if (parsed.id === null || parsed.id.length === 0) {
       throw _failure("MISSING_ID", "webhook: id= field missing from signature header", "missing-id", ctxReq);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.18",
+  "version": "0.16.20",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1786ee2a-259a-4966-b764-11772b484854",
+  "serialNumber": "urn:uuid:4eff6a21-428a-4198-9028-b4137d2c90c5",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-12T08:00:39.980Z",
+    "timestamp": "2026-07-12T13:00:38.123Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.18",
+      "bom-ref": "@blamejs/core@0.16.20",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.18",
+      "version": "0.16.20",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.18",
+      "purl": "pkg:npm/%40blamejs/core@0.16.20",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.18",
+      "ref": "@blamejs/core@0.16.20",
       "dependsOn": []
     }
   ]