@blamejs/core 0.18.34 → 0.18.36

package/CHANGELOG.md

@@ -8,6 +8,71 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.36 (2026-08-18) — **Six constant-time comparisons told you which candidate matched, by how long they took.** A comparison that runs in constant time answers one question without leaking anything. A loop of them that stops at the first match answers a second question nobody asked: how far down the list the match was. Six places in the framework compared a presented value against a list of candidates and returned as soon as one matched, so the response time reported the match's position — which deny-list entry a certificate hit, which verifier's nonce a token carried, where in a key rotation the sender currently sits.
+
+Every one of them returned the correct answer. The defect is only in how long it took, which is why no test caught it and why the guard that replaces them is structural.
+
+**Upgrade if you use `b.crypto.isCertRevoked`, `b.webhookHmac.verify`, `b.standardWebhooks.verify`, `b.httpMessageSignature.verify`, `b.eat` nonce verification, or the DPoP nonce middleware.** No API changes, no configuration changes — the comparisons simply stop reporting position. **Added:** *b.crypto.timingSafeEqualAny(presented, candidates)* — Returns `true` when `presented` equals any entry of `candidates`, comparing against every entry whatever the outcome. The loop has no `break` and no `return` inside it, and folds each result into an accumulator rather than writing `matched || compare(...)` — that short-circuits the call away once something matches, which is the early exit wearing different syntax.
+
+A candidate that is neither a Buffer nor a string counts as a non-match rather than throwing, because a deny list assembled from operator configuration should not fail the request on one malformed row. The presented value and the array itself are entry-tier: passing the wrong shape is a caller bug that would otherwise answer `false` for every input. **Fixed:** *b.auth.totp gains a drift-window and replay suite* — Fixing the drift loop exposed that nothing tested it. TOTP had assertions elsewhere, but `driftSteps` and `lastUsedStep` appeared in none of them — so the window's width, which step `verify()` reports, and the replay guard were all unverified.
+
+The new suite pins them against RFC 6238's Appendix B vectors, driven through the verify-only SHA-1 path an operator migrating from a legacy authenticator actually uses. It asserts that every step in the window verifies and reports its OWN step rather than the current one — reporting the current step would quietly make `lastUsedStep` replay-tracking useless — that a step outside the window is refused and the same code is accepted once the window widens, that a replayed step is refused while the next step still works, and that a malformed token reads as no-match while a misconfigured verifier still throws. · *Four NIST SP 800-53 control mappings corrected* — `docs/cis-sqlite-equivalent.md` maps the framework's posture to Revision 5 and cited three enhancements that Revision 5 withdrew: `AU-8(1)` for time-source synchronisation, now `SC-45(1)`; `IA-2(11)` for step-up authentication, now `IA-2(6)`; and `CP-2(8)` for recovery objectives, now folded into `CP-2`.
+
+The fourth was a live enhancement claimed for a mechanism that does not meet it. `AU-9(1)` requires audit trails written to hardware-enforced write-once media; the framework's WORM tables are a database trigger refusing UPDATE and DELETE. That is software enforcement, and an assessor would reject the mapping. The row now cites `AU-9` and says what a deployment claiming the enhancement has to add underneath. **Security:** *Six multi-candidate comparisons no longer leak the matching candidate's position* — Each of these compared a presented value against a list and exited on the first hit:
+
+- `b.crypto.isCertRevoked` — which entry of the deny list the certificate's fingerprint matched. Its own docstring promised the opposite: "every comparison runs through `crypto.timingSafeEqual` so the answer doesn't leak which entry matched", above a loop that returned inside itself.
+- `b.eat` nonce verification — which verifier's nonce an attestation token carried, under a comment reading "Constant-time compare against each candidate".
+- The DPoP nonce middleware — whether a client presented the current or the previous nonce, which locates it in the rotation window. Its comment claimed the compare existed "so server-issued nonce probing can't narrow the rolling-pair bytes via response-timing".
+- `b.webhookHmac.verify` and `b.standardWebhooks.verify` — the position of the matching signature in a multi-signature header, which tracks the sender's key rotation.
+- `b.httpMessageSignature.verify` — the position of the matching member in a `Content-Digest` header.
+
+All six now compare against every candidate. A length mismatch still short-circuits a single comparison and still leaks nothing: the lengths involved are digest and fingerprint sizes fixed by an algorithm, not secrets. · *Two more, found by checking loop scope instead of matching text* — The six above were found by reading code. Replacing the text pattern that guarded them with one that actually resolves loop bodies — brace matching over comment-stripped source — turned up two the pattern could not have seen, because neither exits with the `return true` it was looking for:
+
+- `b.auth.password` breach checking returned on the first HaveIBeenPwned range line that matched, so the response time reported WHERE in the range the hit was. The range is public; the position narrows the SHA-1 suffix, which is precisely the half of the hash that k-anonymity exists to withhold. Every line is now compared before the verdict.
+- `b.totp.verify` returned on the first drift step that matched, reporting the clock offset between authenticator and server through timing. Every step in the window is now compared, and the earliest match still wins.
+
+Neither is guarded by a `matched === null` condition on the comparison itself — that short-circuits the call away once something matches, which is the same early exit in different syntax.
+
+`b.network.dns.dane.matchCertificate` also exits on its first match and is deliberately left alone: it compares a TLSA record published in DNS against a digest of the certificate presented in the handshake. Both operands are public, so the iteration count reveals nothing an observer could not compute, and reporting which record matched is the function's contract. **Detectors:** *A detector can pin the shapes it must NOT refuse* — A `codebase-patterns` entry may now carry `fixtures: { fires, quiet }`, and a check runs them: every listed shape must fire, every listed shape must stay quiet. Nothing enforced that before, so a pattern's precision lived in whatever its author happened to try by hand — which is one direction, against the code the pattern was written for.
+
+The entry added in this release got both directions wrong before the fixtures existed. It refused a single negated comparison (`if (!timingSafeEqual(a, b)) return false; return true;` — one comparison, no position to leak), and separately refused a `.find()` locating a record by type merely because a comparison appeared nearby. Neither shape was visible from the code the pattern was aimed at. · *The live-integration runner no longer counts a file that asserted nothing as a pass* — The runner decided a file had passed from its exit status, then printed whatever `OK — <n> checks passed` line the file happened to emit. Four of the fifty integration files never emitted one, so their column was blank and nobody could tell the difference between a file that ran its assertions and a file whose `run()` resolved before reaching them. Between them those four carry 111 checks.
+
+Exit status alone cannot answer the question: a file that stops asserting exits 0 exactly like a file that passed. The runner now requires the count line and requires it to be greater than zero — `OK — 0 checks passed` matches the old pattern while verifying nothing — and the four silent files report their counts.
+
+A static check covers the same ground during the fast gates, since the runner needs the live backends to say anything. It reads the source with comment lines blanked: a commented-out success print contains every token the check looks for, and that is the likeliest way a file goes silent, so reading raw source would pass on exactly the state being guarded against. The same blanking now backs the fuzz-harness entry-point check, where a commented-out `module.exports.fuzz` would otherwise read as a wired harness. · *A constant-time compare in a loop may not exit early* — Two checks, split by what each can actually decide.
+
+A pattern covers the loop-free shape: two comparisons in sequence, each guarding its own early exit — the DPoP current/previous nonce pair. That is a sequence of tokens, so a pattern decides it exactly.
+
+Loop membership is decided by matching braces over comment-stripped source instead, because whether a comparison sits inside a particular loop body is a question about scope. Successive attempts to answer it with a pattern flagged an ordinary one-pair verifier that merely followed an unrelated loop — a text pattern stops at a brace in the first column, and loop bodies close indented — while missing `for await`, `do…while`, and brace-less single-statement bodies. Resolving the body outright covers all of them and found the two additional leaks above.
+
+A `continue` is not an early exit for this purpose: it skips a candidate that was never eligible and the loop still runs to the end, which is what `timingSafeEqualAny` does. Counting it flagged the primitive written to fix the defect.
+
+An ordinary one-pair verifier stays quiet in both checks — one comparison has no position to report.
+
+This one is the primary guard rather than the usual second line, and the reason is worth stating: every affected site produced the correct output, so no assertion on a return value could observe the defect, and a wall-clock measurement cannot assert it reliably under a parallel test runner. The property is structural — the loop must have no exit to take — so the check is structural too, and the fix routes through a primitive that cannot be talked into returning early rather than asking each loop to be reviewed.
+
+Its scope is deliberately narrow, and the boundary is recorded in the entry itself. A comparison inside a `.some` or `.find` callback is the same defect, and the check does not claim it: deciding whether a call sits inside a particular callback is a parsing question, and every attempt to answer it with a pattern either refused working code or missed a real shape. What it does cover — a positive comparison guarding an early exit — is the shape all six of these took. **References:** [NIST SP 800-53 Rev. 5 SC-45(1) — Synchronization with Authoritative Time Source](https://csf.tools/reference/nist-sp-800-53/r5/sc/sc-45/sc-45-1/) · [NIST SP 800-53 Rev. 5 AU-9(1) — Hardware Write-once Media](https://csf.tools/reference/nist-sp-800-53/r5/au/au-9/au-9-1/) · [RFC 9449 — OAuth 2.0 Demonstrating Proof of Possession (DPoP), nonce handling](https://www.rfc-editor.org/rfc/rfc9449.html) · [RFC 9421 — HTTP Message Signatures, Content-Digest verification](https://www.rfc-editor.org/rfc/rfc9421.html)
+
+- v0.18.35 (2026-08-18) — **Thirteen character policies the guards declared and did not apply, and two content guards that could not perform the repair they promised.** A guard's profile names a policy per character class — `reject`, `strip`, `audit`, `allow`. Thirteen of those settings across `b.guardEmail`, `b.guardXml`, `b.guardMarkdown`, `b.guardJson` and `b.guardYaml` resolved to something other than what they named, because the code decided by the finding's SEVERITY rather than by the policy. Severity is fixed per class — a bidi control is `critical` however it is configured — so a severity-gated decision refuses what an operator asked to record and, in a guard whose findings never reach `critical`, lets through what they asked to reject. Both directions were live at once.
+
+Every declared character policy now resolves to the action it names, and a family-wide test asserts it for all five classes across every content guard.
+
+**Read the behaviour changes below before upgrading if you rely on `b.guardEmail`, `b.guardXml.sanitize`, `b.guardMarkdown.sanitize` or `b.guardJson.parse`.** Two of them refuse more than before and three repair where they used to throw.
+
+`b.guardJson` and `b.guardYaml` were `KIND: "content"` — whose contract is serve / audit-only / sanitize / refuse — and declared `strip` in six policy cells each while exporting no `sanitize` at all. Twelve settings that no wiring could honour. Both now have one. **Added:** *b.guardJson.sanitize and b.guardYaml.sanitize* — Both guards are content guards whose contract includes a repair action, and both declared `strip` policies with nothing to perform them. `b.guardJson.sanitize` applies the character-strip policies and then re-serializes, which is the repair its gate already ran — now shared, so the two cannot drift. `b.guardYaml.sanitize` repairs at the character level only: removing an invisible or control character is a text edit needing no re-emit, which is why it is safe here when re-serializing a YAML document is not. The tag, alias and multi-document shapes have no faithful round-trip and refuse through their own policies. · *b.gateContract.throwOnRefusedDisposition(issues, cfg)* — The refusal step for a guard whose findings carry a policy. Throws on the first finding whose disposition is `refuse`, and hands whatever the guard leaves unclassified to `throwOnRefusalSeverity`, so a structural finding with no policy — a parse failure, an alias explosion, a blown cap — keeps the conservative severity answer rather than a free pass. Replaces the hand-rolled loop this release would otherwise have grown in three places. **Fixed:** *A declared character policy is the policy that runs* — `b.gateContract.charThreatDisposition` binds each of the five shared character classes to its own policy, and the guards that never routed through it fell back to a severity rule where `critical` and `high` both refuse. `b.guardYaml` and `b.guardEmail` now route through it, so `strip` repairs and `audit` records instead of both refusing.
+
+The same confusion sat one level down in the sanitize path. `b.guardXml` and `b.guardMarkdown` narrowed their refusal filter to `critical`, which catches a bidi control whatever its policy says — so `bidiPolicy: "strip"` threw from `sanitize()` while the gate, which bypasses that function precisely to avoid this, stripped the character and served the document. Two public entry points gave opposite answers for one setting. Refusal now comes from the policy in both.
+
+`b.guardJson.parse` refused any `critical` pre-parse finding, so `bidiPolicy: "audit"` refused the document rather than recording it; it also stripped control, zero-width and Tags characters under `strip` but never bidi, so that policy left the character in place and then refused it for being critical. Both are fixed. · *b.guardEmail refuses a bidi override and a null byte at `balanced`* — **Behaviour change.** These two cells declared `strip` and refused anyway, because both findings are critical and the refusal ran before the strip table. Of the two ways to make the declaration and the behaviour agree, this is the one that does not weaken a guard, and it is the right reading for a message: a bidi override reorders how an address or a subject line renders, which is the mechanism behind a spoofed sender, and a null byte truncates a header at whichever parser reads it first, so two halves of a message can disagree about where a field ends.
+
+Nothing that was accepted before is refused now — the profile text changed to match what the guard already did. Operators who set `bidiPolicy` or `nullBytePolicy` explicitly are unaffected. · *b.guardXml.sanitize, b.guardMarkdown.sanitize and b.guardJson.parse repair where they used to throw* — **Behaviour change.** Under `balanced` and `permissive` these declare `strip` or `audit` for the character classes, and all three now honour it: `sanitize()` returns the repaired document instead of raising, and `parse()` accepts a document carrying an audited character.
+
+A caller that treated the exception as "this input is dangerous" now receives a repaired value instead. That is what `strip` asks for, and it is what the corresponding gates already did — the sanitize functions were the outliers. Every class set to `reject` still refuses, verified per guard per profile. · *guardJson.parse enforces its byte ceiling before it strips anything* — `maxBytes` was checked at the end of `parse`, after the character-strip policies had already run — so a small document padded with several hundred zero-width, Tags or bidi characters shrank under the limit on the way through and was accepted. A 911-byte input passed a 16-byte cap. A resource cap that an attacker removes by sending MORE input is pointing the wrong way, so the ceiling now binds the input as received, before any strip mutates it.
+
+The hole was open for zero-width and Tags already; a `bidiPolicy: "strip"` pass added in this release made it reachable for a third class, which is how it was noticed. · *guardJson.sanitize repairs a mid-stream BOM under bomPolicy* — U+FEFF reached the strip table only as a zero-width character, and `parse` removed only a LEADING one — so with `bomPolicy: "strip"` and `zeroWidthPolicy: "allow"`, validation reported `bom-mid-stream` on a document `sanitize` then returned still carrying it. The repair follows the BOM's own policy now: `strip` removes it wherever it sits, `reject` refuses, `allow` keeps it. · *Vendored dependencies are current* — `@blamejs/pki` moves to 0.5.10, whose change is a spelling normalization across its documentation and source comments plus a gate that keeps them consistent. No functional change to the module, no lifecycle scripts, and its runtime dependency set stays empty. · *b.guardArchive drops four character policies it never read* — Every profile declared `bidiPolicy`, `controlPolicy`, `nullBytePolicy` and `zeroWidthPolicy`, and nothing in the guard consulted any of them — an operator passing `zeroWidthPolicy: "reject"` was configuring nothing and had no way to discover that. Entry-name character policy comes from `filenameProfile`, which routes the name through `b.guardFilename`; that is the setting to use, and it is unchanged. The four are removed rather than wired, because two spellings of one setting is how they come to disagree. **Detectors:** *A guard may only declare a policy it can perform, and must perform the one it declares* — Two family-wide invariants. The first is structural: for every registered guard, a policy that promises a repair requires a `sanitize` to perform it, and an `entries` guard — which cannot repair a hostile archive member — may not declare one at all. That is the check twelve unperformable settings shipped past.
+
+The second drives the gate: for every content guard, profile and character class, the action taken must be the action the policy names. It compares against a baseline of the same document without the character and judges only where the injected character is the lone new finding, so a document broken by the injection is not mistaken for a policy failure. All five classes are covered, with no exemptions. · *A failing check prints the diagnostic it built* — The shared test assertion accepted a third argument carrying the offending items, and discarded it at all 1829 call sites that passed one, so a failing gate printed its label and nothing else. It is now included, flattened to one line and bounded, for the same reason the error formatter is: the text can carry a fixture's bytes verbatim. The first run after the change named a third affected guard that the label alone had hidden. **References:** [CVE-2021-42574 — Trojan Source, bidirectional override characters](https://nvd.nist.gov/vuln/detail/CVE-2021-42574) · [Unicode Technical Report #36 — Unicode Security Considerations](https://www.unicode.org/reports/tr36/) · [Unicode Standard Annex #9 — Unicode Bidirectional Algorithm](https://www.unicode.org/reports/tr9/)
+
 - v0.18.34 (2026-08-17) — **Two policies the framework declared and did not apply: a wildcard registry's organizational domain, and a guard's refusal of invisible characters.** Eight guards resolved `zeroWidthPolicy: "reject"` under `profile: "strict"` and accepted a zero-width character anyway, because the shared scan was opt-in through an argument six callers never passed. `b.guardYaml`, `b.guardXml`, `b.guardMarkdown`, `b.guardShell`, `b.guardRegex`, `b.guardJsonpath`, `b.guardTemplate` and `b.guardJson` are affected, and `b.guardDomain` at every profile. The control table was also missing `U+007F`, contradicting the module's own predicate, and the zero-width table was missing `U+2061`-`U+2064`. **A strict profile now refuses input it previously served** — check that before upgrading if you validate operator-supplied text.
 
 `b.publicSuffix` ranked a matching exact rule above a matching wildcard rule. The Public Suffix List ranks by label count instead, so `x.kawasaki.jp` takes `*.kawasaki.jp` and not `jp` — and under the old order every name in such a registry collapsed onto the registry's own organizational domain. 275 of the list's 283 wildcard rules resolved that way. Anything deriving a boundary from that answer inherited it: DMARC relaxed alignment, cookie scope, same-site decisions. If you serve or accept mail from names under a wildcard registry, this changes what counts as aligned.

package/NOTICE

@@ -68,7 +68,7 @@ Used for:    FIPS 203 ML-KEM (ml_kem_512 / ml_kem_768 / ml_kem_1024),
              reference implementation.
 --------------------------------------------------------------------------------
 Component:   @blamejs/pki
-Version:     0.5.9
+Version:     0.5.10
 Source:      https://github.com/blamejs/pki
 License:     Apache-2.0
 Copyright:   Copyright (c) blamejs contributors

package/README.md

@@ -322,7 +322,7 @@ All runtime dependencies are committed to the repo — no transitive npm install
 | [`@noble/hashes`](https://github.com/paulmillr/noble-hashes) | 2.3.0 | [Paul Miller](https://github.com/paulmillr) | Browser (ESM) build only — SHAKE256 / SHA-3 / SHA-2 / HMAC / HKDF for the client half of a hybrid exchange. The server side reaches all of these through `node:crypto`, so there is no server bundle |
 | [`@noble/curves`](https://github.com/paulmillr/noble-curves) | 2.3.0 (bundles @noble/hashes 2.3.0) | [Paul Miller](https://github.com/paulmillr) | RFC 9497 Oblivious Pseudo-Random Function (OPRF / VOPRF / POPRF) over ristretto255 / P-256 / P-384 / P-521, behind `b.crypto.oprf` |
 | [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) | 0.7.0 (bundles @noble/hashes, @noble/curves, @noble/ciphers 2.3.0) | [Paul Miller](https://github.com/paulmillr) | Pure-JS FIPS 203 ML-KEM (`ml_kem_512` / `ml_kem_768` / `ml_kem_1024`), FIPS 204 ML-DSA (`ml_dsa_44/65/87`), FIPS 205 SLH-DSA (`slh_dsa_*`). First-class on both server-side and client-side via `b.pqcSoftware` — security-first defaults pin to the highest cat-5 levels (ML-KEM-1024, ML-DSA-87, SLH-DSA-SHAKE-256f); interoperable with Node's built-in WebCrypto ML-KEM that `b.crypto.encrypt` / `b.middleware.apiEncrypt` use. A browser (ESM) build ships beside it carrying the KEM suites only — a client half encapsulates and does not sign |
-| [`@blamejs/pki`](https://github.com/blamejs/pki) | 0.5.9 | [blamejs](https://github.com/blamejs) | Zero-dependency pure-JS X.509 / CRL / PKCS#12 / CSR / CMS toolkit backing `b.mtlsCa` — ML-DSA-87 (FIPS 204) post-quantum + ECDSA-P384 cert signing, PBMAC1 PKCS#12 packaging, chain validation (no openssl CLI) — and the WebAuthn attestation / assertion verification behind `b.auth.passkey` |
+| [`@blamejs/pki`](https://github.com/blamejs/pki) | 0.5.10 | [blamejs](https://github.com/blamejs) | Zero-dependency pure-JS X.509 / CRL / PKCS#12 / CSR / CMS toolkit backing `b.mtlsCa` — ML-DSA-87 (FIPS 204) post-quantum + ECDSA-P384 cert signing, PBMAC1 PKCS#12 packaging, chain validation (no openssl CLI) — and the WebAuthn attestation / assertion verification behind `b.auth.passkey` |
 | [`SecLists` 10k-most-common.txt](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt) | master snapshot | [Daniel Miessler / SecLists contributors](https://github.com/danielmiessler/SecLists) (CC-BY-3.0) | Top-10000 common-password dictionary read by `b.auth.password.policy()` for the NIST 800-63B §5.1.1.2 "previously breached" check |
 | [`prismjs`](https://prismjs.com/) | 1.30.0 | [Lea Verou + contributors](https://github.com/PrismJS/prism) | Syntax highlighting in the example wiki's code blocks (browser-side) |
 
@@ -346,7 +346,7 @@ Because when something breaks, `blame` should know exactly where it lives. We ow
 
 Every release passes a layered gate at `test/layer-0-primitives/codebase-patterns.test.js` that operates on lib/ source:
 
-- **Bug-class detectors** — raw byte / time literals, `JSON.parse` on operator input without size cap, numeric opts that silently accept `Infinity` / `NaN`, ReDoS-risky regex without length cap, hash / token compares without `timingSafeEqual`, raw `new URL` skipping the SSRF gate, `Math.random()` in security-sensitive paths, and a couple dozen others — each a bug class the framework already swept once and won't re-introduce.
+- **Bug-class detectors** — raw byte / time literals, `JSON.parse` on operator input without size cap, numeric opts that silently accept `Infinity` / `NaN`, ReDoS-risky regex without length cap, hash / token compares without `timingSafeEqual`, a constant-time compare in a loop that exits on the first match (which leaks the matching candidate's position however constant each comparison is), raw `new URL` skipping the SSRF gate, `Math.random()` in security-sensitive paths, and a couple dozen others — each a bug class the framework already swept once and won't re-introduce.
 - **Inline-shape catalog (n=1)** — every primitive that's been extracted (`validateOpts.requireNonEmptyString`, `safeAsync.makeScheduledFlush`, `dbSchema.runInTransaction`, etc.) registers the inline shape it replaced; new code that re-implements the shape fails the gate even if it's the only file matching.
 - **Cluster allowlist (n>=3)** — duplicate-block detection across files. Genuine new clusters get extracted; clusters that resist extraction (parser error class signature mismatches, framework-convention shapes, cross-domain coincidences) get an entry with a documented structural reason. No silent allowlisting.
 

package/lib/auth/password.js

@@ -460,6 +460,7 @@ function policy(opts) {
       var lines = bodyText.split(/\r?\n/);
       var goodLines = 0;
       var badLines = 0;
+      var breachedCount = null;
       for (var li = 0; li < lines.length; li++) {
         var line = lines[li].trim();
         if (line.length === 0) continue;
@@ -469,13 +470,21 @@ function policy(opts) {
         var count = parseInt(line.slice(colon + 1), 10);
         if (!isFinite(count)) { badLines += 1; continue; }
         goodLines += 1;
-        if (timingSafeEqual(Buffer.from(hashSuffix, "utf8"), Buffer.from(suffix, "utf8")) &&
-            count >= p.breachThreshold) {
-          return _fail("breached",
-            "plaintext appears in HaveIBeenPwned with count " + count +
-            " (threshold " + p.breachThreshold + ")");
+        // Compare against every line, then decide. Returning on the first match
+        // made the response time report WHERE in the range response the hit was,
+        // and the range is public — so that position narrows the suffix, which is
+        // the half of the password's SHA-1 that k-anonymity exists to keep back.
+        // The condition order matters too: `count >= threshold &&` first would
+        // skip the comparison on low-count lines and leak through that instead.
+        if (timingSafeEqual(Buffer.from(hashSuffix, "utf8"), Buffer.from(suffix, "utf8"))) {
+          if (count >= p.breachThreshold && breachedCount === null) breachedCount = count;
         }
       }
+      if (breachedCount !== null) {
+        return _fail("breached",
+          "plaintext appears in HaveIBeenPwned with count " + breachedCount +
+          " (threshold " + p.breachThreshold + ")");
+      }
       // If a hostile / poisoned mirror returned a response shaped like
       // HIBP but with mostly-unparseable counts, the original loop
       // skipped them silently and reported breachCheckCount=0 — i.e.

package/lib/crypto.js

@@ -570,6 +570,66 @@ function timingSafeEqual(a, b) {
   return nodeCrypto.timingSafeEqual(bufA, bufB);
 }
 
+/**
+ * @primitive b.crypto.timingSafeEqualAny
+ * @signature b.crypto.timingSafeEqualAny(presented, candidates)
+ * @since     0.18.36
+ * @status    stable
+ * @related   b.crypto.timingSafeEqual, b.crypto.isCertRevoked, b.crypto.spkiPinVerifier
+ *
+ * Returns `true` when `presented` equals any entry of `candidates`, comparing
+ * against EVERY entry whatever the outcome. A per-candidate compare in a loop
+ * that stops at the first match answers a second question nobody asked — how
+ * far down the list the match was — and the caller's own timing then reports
+ * it: matching the first pinned key returns sooner than matching the last, and
+ * matching nothing runs the whole list. That is a position oracle over a secret
+ * ordering, so this loop has no `break`, no `return` inside it, and folds each
+ * result into an accumulator instead.
+ *
+ * A length mismatch short-circuits a single comparison, and that leaks nothing:
+ * the lengths compared here are digest and fingerprint sizes fixed by an
+ * algorithm, not secrets. `presented` and each candidate may be a Buffer or a
+ * string; a candidate that is neither counts as a non-match rather than
+ * throwing, because a deny list assembled from operator config should not fail
+ * the request on one malformed row.
+ *
+ * Entry-tier on `presented` and on the array itself: a caller that passes the
+ * wrong shape has a bug, and the compare would otherwise silently answer
+ * `false` for every input.
+ *
+ * @example
+ *   var ok = b.crypto.timingSafeEqualAny(presentedKey, [primary, previous]);
+ *   // → true when it matches either, in the same time either way
+ */
+function timingSafeEqualAny(presented, candidates) {
+  if (!Buffer.isBuffer(presented) && typeof presented !== "string") {
+    throw new TypeError(
+      "crypto.timingSafeEqualAny: argument 'presented' must be a Buffer or " +
+      "string, got " + (presented === null ? "null" : typeof presented)
+    );
+  }
+  if (!Array.isArray(candidates)) {
+    throw new TypeError(
+      "crypto.timingSafeEqualAny: argument 'candidates' must be an array, got " +
+      (candidates === null ? "null" : typeof candidates)
+    );
+  }
+  var presentedBuf = Buffer.isBuffer(presented)
+    ? presented : Buffer.from(presented, "utf8");
+  var matched = false;
+  for (var i = 0; i < candidates.length; i += 1) {
+    var candidate = candidates[i];
+    if (!Buffer.isBuffer(candidate) && typeof candidate !== "string") continue;
+    var candidateBuf = Buffer.isBuffer(candidate)
+      ? candidate : Buffer.from(candidate, "utf8");
+    if (candidateBuf.length !== presentedBuf.length) continue;
+    // `matched ||` would short-circuit the call away once something matched,
+    // which is the early exit wearing a different syntax.
+    if (nodeCrypto.timingSafeEqual(presentedBuf, candidateBuf)) matched = true;
+  }
+  return matched;
+}
+
 // ===========================================================
 // Public API — built on core primitives
 // ===========================================================
@@ -2088,18 +2148,23 @@ function isCertRevoked(pemOrDer, denyList) {
   var fp = hashCertFingerprint(pemOrDer);
   var fpHex = Buffer.from(fp.hex, "hex");
   var fpColon = Buffer.from(fp.colon);
+  // The docstring above promises the answer does not leak which entry matched.
+  // It did: the loop returned inside itself, so a hit on the first deny-list
+  // row answered sooner than a hit on the last, and a miss ran the whole list.
+  // Split by form and route each half through timingSafeEqualAny, which has no
+  // exit to take. The two buckets are compared independently because the
+  // colon form and the hex form are different byte lengths.
+  var colonEntries = [];
+  var hexEntries = [];
   for (var i = 0; i < denyList.length; i++) {
     var entry = denyList[i];
     if (typeof entry !== "string" || entry.length === 0) continue;
-    var normalized = entry.indexOf(":") !== -1 ? entry.toUpperCase() : entry.toLowerCase();
-    var normalizedBuf = entry.indexOf(":") !== -1 ? Buffer.from(normalized) : Buffer.from(normalized, "hex");
-    var compareBuf  = entry.indexOf(":") !== -1 ? fpColon : fpHex;
-    if (normalizedBuf.length === compareBuf.length &&
-        nodeCrypto.timingSafeEqual(normalizedBuf, compareBuf)) {
-      return true;
-    }
+    if (entry.indexOf(":") !== -1) colonEntries.push(Buffer.from(entry.toUpperCase()));
+    else hexEntries.push(Buffer.from(entry.toLowerCase(), "hex"));
   }
-  return false;
+  var hitColon = timingSafeEqualAny(fpColon, colonEntries);
+  var hitHex = timingSafeEqualAny(fpHex, hexEntries);
+  return hitColon || hitHex;
 }
 
 // ---- RFC 7469 SubjectPublicKeyInfo pinning ----
@@ -2461,6 +2526,7 @@ module.exports = {
   kdf:                         kdf,
   // Comparison
   timingSafeEqual:             timingSafeEqual,
+  timingSafeEqualAny:          timingSafeEqualAny,
   // Cert fingerprint helpers
   hashCertFingerprint:         hashCertFingerprint,
   isCertRevoked:               isCertRevoked,

package/lib/eat.js

@@ -88,13 +88,17 @@ function _nonceMatches(claimValue, expected) {
   var exp = _toBuf(expected);
   if (!exp) return false;
   // eat_nonce may be a single byte string or an array of them (one per
-  // verifier). Constant-time compare against each candidate.
+  // verifier). Compare against every candidate: the loop this replaced said
+  // "constant-time compare against each candidate" and then returned on the
+  // first hit, so the time reported WHICH verifier's nonce matched — an
+  // ordering the relying party did not agree to publish.
   var candidates = Array.isArray(claimValue) ? claimValue : [claimValue];
+  var bufs = [];
   for (var i = 0; i < candidates.length; i++) {
     var c = _toBuf(candidates[i]);
-    if (c && c.length === exp.length && bCrypto.timingSafeEqual(c, exp)) return true;
+    if (c) bufs.push(c);
   }
-  return false;
+  return bCrypto.timingSafeEqualAny(exp, bufs);
 }
 
 /**

package/lib/gate-contract.js

@@ -1285,6 +1285,71 @@ function resolveProfileName(opts, postures, defaultProfile) {
   return opts.profile || postureProfile || defaultProfile;
 }
 
+/**
+ * @primitive  b.gateContract.throwOnRefusedDisposition
+ * @signature  b.gateContract.throwOnRefusedDisposition(issues, cfg)
+ * @since      0.18.35
+ * @status     stable
+ * @related    b.gateContract.throwOnRefusalSeverity, b.gateContract.charThreatDisposition, b.gateContract.defineGuard
+ *
+ * The refusal step for a guard whose findings carry a POLICY. Throws on the
+ * first issue the guard's `dispositionFor` resolves to `refuse`, and hands
+ * whatever it leaves unclassified to `throwOnRefusalSeverity`, so a kind with
+ * no policy keeps the conservative severity answer instead of a free pass.
+ *
+ * Severity is the wrong axis for these guards and quietly so. `bidi-override`
+ * and `null-byte` are stamped `critical` whatever their policy says, and
+ * `b.guardJson` has eight kinds that never reach `critical` at all — so a
+ * severity-gated refusal both refuses what the operator asked to record and
+ * lets through what they asked to reject, in the same guard. Policy first,
+ * severity only for what policy did not decide.
+ *
+ * @opts
+ *   dispositionFor: function,  // (issue, opts) -> "refuse"|"sanitize"|"audit"|null
+ *   opts:           object,    // resolved guard opts handed to dispositionFor
+ *   errorClass:     function,  // the guard's FrameworkError subclass; required
+ *   codePrefix:     string,    // error-code namespace; the `.refused` fallback
+ *   op:             string,    // operation name in the message (default "sanitize")
+ *   severities:     string[],  // severities that refuse an UNCLASSIFIED finding
+ *   skipKinds:      string[],  // kinds the caller already handled itself
+ *
+ * @example
+ *   b.gateContract.throwOnRefusedDisposition(detect(input, opts), {
+ *     dispositionFor: _gateDispositionFor, opts: opts,
+ *     errorClass: GuardYamlError, codePrefix: "yaml",
+ *   });
+ *   // throws on a class whose policy is "reject"; a class set to "strip" or
+ *   // "audit" passes through to the caller's transform
+ */
+function throwOnRefusedDisposition(issues, cfg) {
+  var unclassified = [];
+  for (var i = 0; i < issues.length; i += 1) {
+    var issue = issues[i];
+    if (cfg.skipKinds && cfg.skipKinds.indexOf(issue.kind) !== -1) continue;
+    var disp = typeof cfg.dispositionFor === "function"
+      ? cfg.dispositionFor(issue, cfg.opts || {}) : null;
+    if (disp === "refuse") {
+      throwOnRefusalSeverity([issue], {
+        errorClass: cfg.errorClass,
+        codePrefix: cfg.codePrefix,
+        op:         cfg.op,
+        // A policy refusal is the operator's choice, not an impact judgement,
+        // so it must fire whatever severity the finding happens to carry.
+        severities: [issue.severity],
+      });
+    }
+    if (disp !== "sanitize" && disp !== "audit") unclassified.push(issue);
+  }
+  if (unclassified.length) {
+    throwOnRefusalSeverity(unclassified, {
+      errorClass: cfg.errorClass,
+      codePrefix: cfg.codePrefix,
+      op:         cfg.op,
+      severities: cfg.severities,
+    });
+  }
+}
+
 /**
  * @primitive  b.gateContract.throwOnRefusalSeverity
  * @signature  b.gateContract.throwOnRefusalSeverity(issues, cfg)
@@ -2812,9 +2877,28 @@ function defineGuard(spec) {
                 issues[bi].snippet || "sanitize: input is not processable");
             }
           }
-          var throwOpts = { errorClass: ErrorClass, codePrefix: prefix };
-          if (sanitizeSeverities) throwOpts.severities = sanitizeSeverities;
-          throwOnRefusalSeverity(issues, throwOpts);
+          // A guard that classifies its findings by POLICY answers here with the
+          // policy, not with severity. Severity is the wrong axis for these:
+          // guard-json has eight finding kinds that are never `critical`
+          // (bom-leading, comment-block, hex-literal, nan-infinity,
+          // single-quoted-key, trailing-comma, numeric-precision-loss) and
+          // guard-yaml scores its octal ambiguity `high` even under `reject`.
+          // A severity filter narrowed to ["critical"] therefore lets a finding
+          // the operator asked to REFUSE fall past the check and into a
+          // transform that does not repair it — the caller gets the threat back
+          // with no error, which is the exact shape this refusal exists to stop.
+          // Policy decides what refuses; severity covers only what policy left
+          // unclassified. A guard that classifies nothing keeps the pure
+          // severity rule it always had.
+          var refuseOpts = { errorClass: ErrorClass, codePrefix: prefix };
+          if (sanitizeSeverities) refuseOpts.severities = sanitizeSeverities;
+          if (typeof spec.dispositionFor === "function") {
+            refuseOpts.dispositionFor = spec.dispositionFor;
+            refuseOpts.opts = resolved;
+            throwOnRefusedDisposition(issues, refuseOpts);
+          } else {
+            throwOnRefusalSeverity(issues, refuseOpts);
+          }
         }
         var out = spec.sanitizeTransform(subject, resolved);
         if (ampCapField) {
@@ -3256,6 +3340,7 @@ module.exports = {
   makeProfileResolver: makeProfileResolver,
   resolveProfileName: resolveProfileName,
   throwOnRefusalSeverity: throwOnRefusalSeverity,
+  throwOnRefusedDisposition: throwOnRefusedDisposition,
   badInputResultIfNotStringOrBuffer: badInputResultIfNotStringOrBuffer,
   aggregateIssues:    aggregateIssues,
   composeHooks:       composeHooks,

package/lib/guard-archive.js

@@ -113,9 +113,15 @@ var MAGIC_SIGNATURES = Object.freeze([
 
 // ---- Profile presets ----
 
+// Character-class policy for an entry NAME comes from `filenameProfile`, which
+// routes the name through b.guardFilename — this guard never reads a
+// bidi/control/null/zero-width policy of its own. It used to declare them in
+// every profile anyway, so an operator passing `zeroWidthPolicy` here was
+// configuring nothing and had no way to find that out. The declarations are
+// gone rather than wired, because `filenameProfile` is already the one place
+// that decides it and two spellings of the same setting is how they disagree.
 var PROFILES = Object.freeze({
   "strict": {
-    ...gateContract.CHAR_THREATS_REJECT_ALL,
     traversalPolicy:           "reject",
     absolutePathPolicy:        "reject",
     symlinkPolicy:             "reject",
@@ -134,10 +140,6 @@ var PROFILES = Object.freeze({
     maxNestedDepth:            0,             // recursion depth, not byte size
   },
   "balanced": {
-    bidiPolicy:                "reject",
-    controlPolicy:             "reject",
-    nullBytePolicy:            "reject",
-    zeroWidthPolicy:           "strip",
     traversalPolicy:           "reject",
     absolutePathPolicy:        "reject",
     symlinkPolicy:             "audit",       // allowed within extraction root
@@ -156,10 +158,6 @@ var PROFILES = Object.freeze({
     maxNestedDepth:            2,             // recursion depth, not byte size
   },
   "permissive": {
-    bidiPolicy:                "audit",
-    controlPolicy:             "strip",
-    nullBytePolicy:            "reject",
-    zeroWidthPolicy:           "strip",
     traversalPolicy:           "reject",
     absolutePathPolicy:        "reject",
     symlinkPolicy:             "audit",

package/lib/guard-email.js

@@ -368,9 +368,22 @@ var PROFILES = Object.freeze({
     mixedScriptPolicy:            "reject",
     displayNameSpoofPolicy:       "audit",
     bomPolicy:                    "strip",
-    bidiPolicy:                   "strip",
+    // Refuse, not strip. `sanitize` already refuses a bidi override here — the
+    // finding is critical and the refusal filter catches it before the strip
+    // table runs — so `strip` named a repair that never happened. Of the two
+    // ways to make the two agree, this is the one that does not weaken a
+    // guard: an override reorders how an address or a subject line RENDERS
+    // (CVE-2021-42574), which is the whole mechanism behind a spoofed sender,
+    // and a message is the surface where that gets acted on. The other content
+    // guards repair it at this profile; email refuses it.
+    bidiPolicy:                   "reject",
     controlPolicy:                "strip",
-    nullBytePolicy:               "strip",
+    // Refuse for the same reason, and by the same evidence: `sanitize` throws
+    // `email.null-byte` here rather than removing it, because the finding is
+    // critical. A NUL truncates a header at whichever parser reads it first,
+    // so the two halves of a message can disagree about where a field ends —
+    // that is a smuggling primitive, not a blemish to be edited out.
+    nullBytePolicy:               "reject",
     zeroWidthPolicy:              "strip",
     allowedScripts:               ["latin", "cyrillic", "greek"],
     maxLocalPartBytes:            LIMIT_LOCAL_PART,
@@ -1001,11 +1014,20 @@ function sanitize(input, opts) {
   if (typeof input !== "string") {
     throw _err("email.bad-input", "sanitize requires string input");
   }
-  // Critical shapes have no safe sanitization in email — throw on
-  // smuggling / CRLF injection / multi-@ / mixed-script.
+  // Shapes with no safe repair in email — smuggling / CRLF injection /
+  // multi-@ / mixed-script — refuse here. Which those are is decided by the
+  // operator's policy for the class, not by the finding's impact: bidi and
+  // null-byte are stamped `critical` whatever their policy says, so reading
+  // severity made `bidiPolicy: "audit"` throw instead of recording. A kind the
+  // disposition map does not classify keeps the conservative severity answer.
   var issues = _detectMessageIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues,
-    { errorClass: GuardEmailError, codePrefix: "email", severities: ["critical"] });
+  gateContract.throwOnRefusedDisposition(issues, {
+    dispositionFor: _gateDispositionFor,
+    opts:           opts,
+    errorClass:     GuardEmailError,
+    codePrefix:     "email",
+    severities:     ["critical"],
+  });
   // A character class set to "reject" is refused here rather than by the
   // severity filter above, which only refuses critical findings — a C0 control
   // scores high, so it would pass the filter, and the strip table below only
@@ -1048,17 +1070,25 @@ function sanitize(input, opts) {
  *     rv.action;            // → "serve"
  *   });
  */
+// _gateDispositionFor — the shared character classes answer from their own
+// policy; everything else returns null and takes the conservative severity
+// answer it always did. Deciding the whole finding vocabulary here would be a
+// second, silent policy change riding along with this one — the divergence
+// being fixed is that a profile asking to STRIP a control character refused the
+// message instead, and that is what this binds.
+function _gateDispositionFor(issue, opts) {
+  return gateContract.charThreatDisposition(issue, opts);
+}
+
 function gate(opts) {
   opts = _resolveOpts(opts);
-  return gateContract.buildGuardGate(
-    opts.name || "guardEmail:" + (opts.profile || "default"),
-    opts,
-    async function (ctx) {
-      var text = gateContract.extractBytesAsText(ctx);
-      if (!text) return { ok: true, action: "serve" };
-      var rv = validateMessage(text, opts);
-      return gateContract.severityDisposition(rv.issues);
-    });
+  return gateContract.buildContentGate({
+    name:     opts.name || "guardEmail:" + (opts.profile || "default"),
+    opts:     opts,
+    validate: validateMessage,
+    dispositionFor:   _gateDispositionFor,
+    produceSanitized: function (text, o) { return sanitize(text, o); },
+  });
 }
 
 // buildProfile / compliancePosture / loadRulePack are assembled by

package/lib/guard-json.js

@@ -863,6 +863,14 @@ function parse(input, opts) {
     throw _err("json.bad-input", "parse requires string input");
   }
   // Strip BOM if policy says strip.
+  // The byte ceiling binds the input the CALLER sent, before any strip shrinks
+  // it. safeJson.parse enforces maxBytes at the end of this function, by which
+  // point the strips below have already removed whatever the attacker padded
+  // with — so a small value plus 300 zero-width, Tags or bidi characters passed
+  // a 16-byte cap. The strip that made it reachable for bidi was added here;
+  // the same hole was already open for the other two classes, which is why the
+  // bound goes at the top rather than in front of one strip.
+  codepointClass.assertWithinMaxBytes(input, opts, _err, "json");
   if (opts.bomPolicy === "strip" && input.indexOf(BOM_CHAR) === 0) {
     input = input.slice(1);
   }
@@ -871,6 +879,13 @@ function parse(input, opts) {
   if (opts.controlPolicy === "strip") {
     input = codepointClass.stripRanges(input, codepointClass.CTRL_RANGES);
   }
+  // Bidi belongs in the same list. It was the one strip-able class this walk
+  // did not remove, so `bidiPolicy: "strip"` left the character in the source
+  // and the refusal below then threw on it for being critical — a strip policy
+  // that refused, in the one place a caller cannot see it happening.
+  if (opts.bidiPolicy === "strip") {
+    input = codepointClass.stripRanges(input, codepointClass.BIDI_RANGES);
+  }
   // Zero-width AND Unicode Tags. Tags follows the zero-width policy when the
   // guard names none of its own — a strip of one and not the other reports the
   // character as a threat in `validate` and then hands it back inside the
@@ -891,16 +906,19 @@ function parse(input, opts) {
       "(__proto__ / constructor / prototype)");
   }
   // Refuse on other critical pre-parse threats per policy.
-  var preIssues = _scanRawSource(input, opts);
-  for (var pi = 0; pi < preIssues.length; pi += 1) {
-    var issue = preIssues[pi];
-    if (issue.kind === "prototype-pollution-key") continue;            // handled above
-    if (issue.severity === "critical" ||
-        (issue.severity === "high" &&
-         opts[_policyKeyForRuleId(issue.ruleId)] === "reject")) {
-      throw _err(issue.ruleId, "guardJson.parse: " + issue.snippet);
-    }
-  }
+  // Refuse by the operator's POLICY for the class, not by the finding's impact.
+  // Severity is fixed at `critical` for bidi and null-byte whatever the policy
+  // says, so reading it here made `bidiPolicy: "audit"` refuse the document — a
+  // setting that asks to record something and refused it instead. A kind the
+  // disposition map does not classify keeps the conservative severity answer.
+  gateContract.throwOnRefusedDisposition(_scanRawSource(input, opts), {
+    dispositionFor: _gateDispositionFor,
+    opts:           opts,
+    errorClass:     GuardJsonError,
+    codePrefix:     "json",
+    op:             "parse",
+    skipKinds:      ["prototype-pollution-key"],   // refused above, with its own message
+  });
   // safeJson.parse strips POISONED_KEYS via the reviver pass; this is
   // the canonical strip path. allowProto=true preserves them for the
   // permissive/audit path.
@@ -1013,6 +1031,22 @@ function _gateDispositionFor(issue, opts) {
   }
 }
 
+// _sanitizeTransform — the repair itself, shared by the gate's sanitize action
+// and the public `sanitize` the factory generates. One body so the two cannot
+// drift into repairing different things.
+function _sanitizeTransform(text, opts) {
+  var subject = text;
+  // BOM is repaired under its OWN policy. The strip table reaches U+FEFF only
+  // as a zero-width character, and `parse` removes only a LEADING one — so with
+  // `bomPolicy: "strip"` and `zeroWidthPolicy: "allow"` nothing removed a
+  // mid-stream BOM, and validate reported `bom-mid-stream` on a document this
+  // function then handed back carrying it.
+  if (gateContract.policyDisposition(opts.bomPolicy) === "sanitize") {
+    subject = codepointClass.stripRanges(subject, [0xFEFF]);
+  }
+  return JSON.stringify(parse(codepointClass.applyCharStripPolicies(subject, opts), opts));
+}
+
 function gate(opts) {
   opts = _resolveOpts(opts);
   return gateContract.buildContentGate({
@@ -1027,9 +1061,7 @@ function gate(opts) {
     // __proto__ / comments / NaN / trailing commas per the active policy. Under a
     // reject policy the finding is already refuse-disposition, so this is not
     // reached for that class.
-    produceSanitized: function (text, o) {
-      return JSON.stringify(parse(codepointClass.applyCharStripPolicies(text, o), o));
-    },
+    produceSanitized: _sanitizeTransform,
   });
 }
 
@@ -1069,6 +1101,17 @@ module.exports = gateContract.defineGuard({
   intOpts:     ["maxBytes", "maxDepth", "maxKeysPerObject", "maxArrayLength",
                 "maxStringLength", "maxTotalNodes"],
   gate:        gate,
+  // The same two-pass repair the gate already runs, exposed as the public
+  // `sanitize` every content guard owes: char-strip policies remove the
+  // classes set to a mitigation, then a parse + re-serialize drops
+  // __proto__ / comments / NaN / trailing commas per the active policy.
+  // Refusal is decided by `dispositionFor` rather than by severity, because
+  // eight of this guard's finding kinds never reach `critical` — a severity
+  // filter would hand back a document carrying a finding the operator set to
+  // `reject`. Without a sanitize the profiles declared six strip policies the
+  // guard could not perform, and the gate refused instead of repairing.
+  sanitizeTransform: _sanitizeTransform,
+  dispositionFor:    _gateDispositionFor,
   extra: {
     _gateDispositionForTest: _gateDispositionFor,
     parse:          parse,

package/lib/guard-markdown.js

@@ -976,7 +976,12 @@ module.exports = gateContract.defineGuard({
   integrationFixtures: INTEGRATION_FIXTURES,
   detect:             _detectIssues,
   sanitizeTransform:  _sanitizeTransform,
-  sanitizeSeverities: ["critical"],
+  dispositionFor:     _gateDispositionFor,
+  // No sanitizeSeverities — refusal comes from `dispositionFor` and each
+  // finding's own policy. This guard's gate already documents why it passes the
+  // raw strip transform rather than this function: the severity filter refused
+  // a critical bidi control even under `bidiPolicy: "strip"`, turning a
+  // policy-selected repair into a refusal. With policy deciding, the two agree.
   intOpts:            ["maxBytes", "maxLines", "maxLinks", "maxImages", "maxAutolinks",
                        "maxRefDefs", "maxListDepth", "maxBlockquoteDepth"],
   gate:        gate,

package/lib/guard-xml.js

@@ -745,7 +745,16 @@ var _guard = module.exports = gateContract.defineGuard({
   integrationFixtures: INTEGRATION_FIXTURES,
   detect:             _detectIssues,
   sanitizeTransform:  _sanitizeTransform,
-  sanitizeSeverities: ["critical"],
+  dispositionFor:     _gateDispositionFor,
+  // No sanitizeSeverities: refusal is decided by `dispositionFor`, which reads
+  // each finding's own policy. The severity filter this replaces refused every
+  // critical finding, and a bidi control is critical whatever its policy says —
+  // so `bidiPolicy: "strip"` threw here while the gate, which bypasses this
+  // function precisely to avoid that, stripped it. Two public entry points gave
+  // opposite answers for one setting. The structural shapes still refuse, now
+  // because DOCTYPE / ENTITY / external-entity resolve to `refuse` by policy,
+  // and the capped shapes (element / depth / numeric-char-ref) keep the
+  // conservative severity answer through the unclassified fallback.
   intOpts:            ["maxBytes", "maxDepth", "maxElements", "maxAttrsPerElement",
                        "maxAttrValueBytes", "maxNumericCharRefs"],
   gate:        gate,

package/lib/guard-yaml.js

@@ -656,14 +656,17 @@ function parse(input, opts) {
   });
 }
 
-// The gate is the standard serve -> audit-only -> refuse chain (content
-// kind, reading ctx.bytes); it is assembled by gateContract.defineGuard's
-// default gate below. YAML sanitize is intentionally not offered — there's
-// no safe re-emit for tag-injection / alias-explosion shapes; the only
-// correct response is refusal, which the default chain (no sanitize action)
-// matches exactly. Its "guardYaml:<profile>" gate name and
-// serve/audit-only/refuse decisions are identical to the hand-written gate
-// this replaced.
+// The gate is the standard serve -> audit-only -> sanitize -> refuse chain
+// (content kind, reading ctx.bytes), assembled by gateContract.defineGuard
+// below with this guard's own disposition map.
+//
+// `sanitize` repairs at the CHARACTER level only. That distinction is what the
+// "YAML cannot be sanitized" reading missed: there is indeed no safe re-emit
+// for a tag-injection or alias-explosion shape, and those still refuse through
+// their own policies — but removing an invisible or control character is a text
+// edit that never re-serializes the document, so a profile asking to strip one
+// can be honoured. Withholding the repair entirely meant six declared strip
+// policies did nothing except refuse.
 
 // buildProfile / compliancePosture / loadRulePack are assembled by
 // gateContract.defineGuard below; their wiki sections render from the
@@ -689,9 +692,49 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // buildProfile / compliancePosture / loadRulePack wiring, plus the
 // per-guard inspection surface (validate) and YAML extras
 // (parse / DANGEROUS_TAG_PREFIXES / SAFE_CORE_TAGS) passed through
-// verbatim. The gate is the factory default serve/audit-only/refuse chain
-// (content kind, no sanitize action — there's no safe re-emit for
-// tag-injection / alias-explosion shapes).
+// verbatim. The gate is the factory chain for a content guard, dispatching on
+// this guard's own disposition map, with a character-level sanitize.
+
+// _gateDispositionFor — bind each finding to the operator's policy for it.
+// Without this the gate fell back to severity, where `critical` and `high` both
+// refuse, so a profile asking to strip a character class refused the document
+// instead and an `audit` setting refused it too.
+function _gateDispositionFor(issue, opts) {
+  var shared = gateContract.charThreatDisposition(issue, opts);
+  if (shared) return shared;
+  switch (issue.kind) {
+    case "core-tag":
+    case "custom-tag":
+    case "dangerous-tag":        return gateContract.policyDisposition(opts.tagPolicy);
+    case "alias-disabled":       return gateContract.policyDisposition(opts.aliasPolicy);
+    case "duplicate-key":        return gateContract.policyDisposition(opts.duplicateKeyPolicy);
+    case "leading-zero-octal":   return gateContract.policyDisposition(opts.leadingZeroPolicy);
+    case "merge-key":            return gateContract.policyDisposition(opts.mergeKeyPolicy);
+    case "multi-document":       return gateContract.policyDisposition(opts.multiDocPolicy);
+    case "norway-implicit-bool": return gateContract.policyDisposition(opts.norwayPolicy);
+    // An alias explosion, a blown anchor cap, an oversized document and a
+    // document that does not parse carry no policy and admit no repair. They
+    // are left unclassified on purpose: the caller then applies the
+    // conservative severity answer, which refuses them.
+    default:                     return null;
+  }
+}
+
+// _sanitizeTransform — repair at the CHARACTER level only. Stripping an
+// invisible or control character is a text edit that needs no re-emit, which is
+// why it is safe here when re-serializing a YAML document is not: the tag,
+// alias and multi-document shapes have no faithful round-trip, and they refuse
+// upstream through their own policies rather than being rewritten.
+function _sanitizeTransform(input, opts) {
+  // scrubCharThreats, not a bare applyCharStripPolicies: the strip table
+  // removes only the classes set to `strip`, so calling it alone would hand a
+  // `reject` class back unrepaired and unreported. The factory's generated
+  // sanitize already bounds and asserts before this runs, but a transform whose
+  // safety depends on its caller is one refactor away from being wrong — this
+  // owns the whole ordering itself and is correct however it is reached.
+  return codepointClass.scrubCharThreats(input, opts, _err, "yaml");
+}
+
 module.exports = gateContract.defineGuard({
   name:        "yaml",
   kind:        "content",
@@ -705,6 +748,8 @@ module.exports = gateContract.defineGuard({
   detect:      _detectIssues,
   intOpts:     ["maxBytes", "maxDepth", "maxAnchors", "maxAliasDepth",
                 "maxDocuments", "maxNodes", "maxScalarLength"],
+  dispositionFor:    _gateDispositionFor,
+  sanitizeTransform: _sanitizeTransform,
   extra: {
     parse:                  parse,
     DANGEROUS_TAG_PREFIXES: DANGEROUS_TAG_PREFIXES,

package/lib/http-message-signature.js

@@ -703,19 +703,23 @@ function verify(msg, opts) {
     // buried inside another member's value or parameters. Peer-supplied
     // sha-512 / sha-256 identifiers stay the operator's responsibility.
     var expectedDigest = contentDigest(m.body);           // "sha3-512=:<b64>:"
-    var matchedDigest  = false;
     var digestMembers  = structuredFields.splitTopLevel(presented, ",");
+    var offeredDigests = [];
     for (var di = 0; di < digestMembers.length; di++) {
       var member = digestMembers[di].trim();
       var deq = member.indexOf("=");
       if (deq < 1) continue;
       var dkv = structuredFields.parseKeyValuePiece(member);
       if (dkv.key !== "sha3-512") continue;
-      var memberCanonical = "sha3-512=" + dkv.value.trim();
-      // crypto.timingSafeEqual is the length-tolerant constant-time wrapper
-      // (returns false for unequal lengths without leaking via a length branch).
-      if (bCrypto.timingSafeEqual(memberCanonical, expectedDigest)) { matchedDigest = true; break; }
+      offeredDigests.push("sha3-512=" + dkv.value.trim());
     }
+    // Every offered member is compared. The `break` this replaced stopped at
+    // the first match, so a Content-Digest header whose first sha3-512 member
+    // matched answered sooner than one whose last did — the position of the
+    // matching member, reported by timing. timingSafeEqualAny is the
+    // length-tolerant constant-time compare (an unequal length is a non-match
+    // without a branch that leaks anything: digest lengths are fixed).
+    var matchedDigest = bCrypto.timingSafeEqualAny(expectedDigest, offeredDigests);
     if (!matchedDigest) {
       return { valid: false, reason: "content-digest-mismatch" };
     }

package/lib/middleware/dpop.js

@@ -114,12 +114,16 @@ function _nonceManager(rotateSec) {
       if (shutdown) return false;
       _maybeRotate();
       if (typeof n !== "string" || n.length === 0) return false;
-      // Constant-time compare so server-issued nonce probing can't
-      // narrow the rolling-pair bytes via response-timing — matches
-      // the timingSafeEqual discipline on the DPoP-proof nonce.
-      if (current && bCrypto.timingSafeEqual(n, current.nonce)) return true;
-      if (previous && bCrypto.timingSafeEqual(n, previous.nonce)) return true;
-      return false;
+      // Constant-time compare so server-issued nonce probing can't narrow the
+      // rolling-pair bytes via response-timing. Both halves of the pair are
+      // compared every time: returning on `current` answered a client holding
+      // the current nonce sooner than one holding the previous one, which
+      // reports where in the rotation window the caller sits — the property
+      // the comment above already claimed this had.
+      var accepted = [];
+      if (current) accepted.push(current.nonce);
+      if (previous) accepted.push(previous.nonce);
+      return bCrypto.timingSafeEqualAny(n, accepted);
     },
     // Hot-reload coexistence. Operators redeploying without
     // a clean process restart need a way to drain in-flight clients

package/lib/standard-webhooks.js

@@ -158,17 +158,19 @@ function verify(opts) {
   var toSign = id + "." + ts + "." + bodyBuf.toString("utf8");
   var expected = nodeCrypto.createHmac("sha256", opts.secret).update(toSign).digest("base64");
   // Multi-version: signature header is `v1,<sig> v2,<sig>` etc.
+  // Every v1 signature in the header is compared, with no break: stopping at
+  // the first match let the response time report the POSITION of the matching
+  // signature within a multi-version header, which is a property of the
+  // sender's key rotation and not something a verifier should hand back.
   var parts = sigHeader.split(" ");
-  var any = false;
+  var offered = [];
   for (var p = 0; p < parts.length; p += 1) {
     var pair = parts[p].split(",");
     if (pair.length !== 2) continue;
     if (pair[0] !== "v1") continue;
-    if (bCrypto.timingSafeEqual(Buffer.from(expected, "utf8"), Buffer.from(pair[1], "utf8"))) {
-      any = true;
-      break;
-    }
+    offered.push(Buffer.from(pair[1], "utf8"));
   }
+  var any = bCrypto.timingSafeEqualAny(Buffer.from(expected, "utf8"), offered);
   if (!any) {
     throw new StandardWebhooksError("standard-webhooks/bad-signature",
       "verify: no v1 signature matched");

package/lib/totp.js

@@ -282,6 +282,12 @@ function verify(secret, code, opts) {
   var userCode = String(code).replace(/[\s.\-_]/g, "").padStart(resolved.digits, "0");
   var userBuf = Buffer.from(userCode);
 
+  // Every step in the drift window is compared, even after one matches. Returning
+  // from inside the loop would make the response time report WHICH step matched,
+  // and that is the clock offset between the authenticator and the server — a
+  // value derived from the shared secret's timeline that a caller submitting
+  // codes can otherwise only guess at.
+  var matchedStep = null;
   for (var d = -resolved.driftSteps; d <= resolved.driftSteps; d++) {
     var step = currentStep + d;
     if (lastUsedStep !== null && step <= lastUsedStep) continue;     // reject replays at-or-below the last accepted step
@@ -293,11 +299,14 @@ function verify(secret, code, opts) {
     try { expected = _hotp(secret, step, resolved); }
     catch (_e) { return false; }
     var expectedBuf = Buffer.from(expected);
+    // The comparison is not guarded by `matchedStep === null` — that would
+    // short-circuit the call away once something matched, which is the early
+    // exit wearing a different syntax. The earliest match still wins.
     if (timingSafeEqual(expectedBuf, userBuf)) {
-      return step;
+      if (matchedStep === null) matchedStep = step;
     }
   }
-  return false;
+  return matchedStep === null ? false : matchedStep;
 }
 
 function uri(secret, account, opts) {

package/lib/vendor/MANIFEST.json

@@ -21,7 +21,7 @@
         "server": "sha256:f3325f480cb8eb814fcb0baaa19336cbbf2b993f48624c6aa9600ffd69d0be5e",
         "browser": "sha256:0ffd91540bcb586a29b56e52ee1c29df69097b50776beb4036a07558f7a4e12e"
       },
-      "refreshedAt": "2026-08-18T07:35:55.830Z"
+      "refreshedAt": "2026-08-18T14:13:33.454Z"
     },
     "@noble/hashes": {
       "version": "2.3.0",
@@ -48,7 +48,7 @@
       "hashes": {
         "browser": "sha256:dfe4b7ae3c9880e388c8da4b68f44742b229b53afacd1e674179527e33da62b0"
       },
-      "refreshedAt": "2026-08-18T07:35:55.830Z"
+      "refreshedAt": "2026-08-18T14:13:33.454Z"
     },
     "@noble/curves": {
       "version": "2.3.0",
@@ -70,7 +70,7 @@
       "hashes": {
         "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
       },
-      "refreshedAt": "2026-08-18T07:35:55.830Z",
+      "refreshedAt": "2026-08-18T14:13:33.454Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -114,7 +114,7 @@
         "server": "sha256:fab7ebe5737793862c473444f4ee5912f79dd1edec86683acbb4eecbca0f5892",
         "browser": "sha256:cae1d5bbdc7184b202b6ca68df6e1db7b0d0f668c77809ded189ca7f271accc9"
       },
-      "refreshedAt": "2026-08-18T07:35:55.830Z",
+      "refreshedAt": "2026-08-18T14:13:33.454Z",
       "components": {
         "@noble/hashes": {
           "url": "https://github.com/paulmillr/noble-hashes",
@@ -148,7 +148,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-18T07:35:55.830Z"
+      "refreshedAt": "2026-08-18T14:13:33.454Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -173,7 +173,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-18T07:35:55.830Z"
+      "refreshedAt": "2026-08-18T14:13:33.454Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -193,10 +193,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-18T07:35:55.830Z"
+      "refreshedAt": "2026-08-18T14:13:33.454Z"
     },
     "@blamejs/pki": {
-      "version": "0.5.9",
+      "version": "0.5.10",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -217,11 +217,11 @@
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
       "bundledAt": "2026-08-18T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.5.9:*:*:*:*:node.js:*:*",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.5.10:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:15cea20b7d6ac11427a0c3ca40a055fa057c9dc3fb304f3beb043ce3f82780aa"
+        "server": "sha256:c7c7b82d0c5cd604e726c52332de66ff06ffb7877d4a44720d8bbd746c5d6023"
       },
-      "refreshedAt": "2026-08-18T07:35:55.830Z"
+      "refreshedAt": "2026-08-18T14:13:33.454Z"
     }
   }
 }

package/lib/vendor/blamejs-pki.cjs

@@ -1,4 +1,4 @@
-// @blamejs/pki v0.5.9 — vendored (Apache-2.0). Zero-dep pure CJS.
+// @blamejs/pki v0.5.10 — vendored (Apache-2.0). Zero-dep pure CJS.
 // https://github.com/blamejs/pki  Exports: x509, crl, pkcs12, key, webcrypto, schema, csr, cms, ...
 // Backs lib/mtls-engine-default.js (PQC-capable CA + PKCS#12 engine).
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -141,7 +141,7 @@ var require_package = __commonJS({
   "node_modules/@blamejs/pki/package.json"(exports2, module2) {
     module2.exports = {
       name: "@blamejs/pki",
-      version: "0.5.9",
+      version: "0.5.10",
       description: "Pure-JavaScript PKI toolkit that owns its stack \u2014 X.509, ASN.1/DER, CMS, PQC-first.",
       license: "Apache-2.0",
       author: "blamejs contributors",
@@ -209,9 +209,11 @@ var require_package = __commonJS({
         test: "node test/smoke.js",
         lint: "eslint --max-warnings 0 .",
         fuzz: "npm ci --prefix fuzz && npx --prefix fuzz jazzer fuzz/asn1-der.fuzz.js -- -max_total_time=60",
-        gates: "node test/layer-0-primitives/codebase-patterns.test.js && node scripts/validate-source-comment-blocks.js && node scripts/check-api-snapshot.js",
+        gates: "node test/layer-0-primitives/codebase-patterns.test.js && node scripts/validate-source-comment-blocks.js && node scripts/check-api-snapshot.js && node scripts/check-spelling-consistency.js",
+        "check:spelling": "node scripts/check-spelling-consistency.js",
         coverage: "c8 --include=lib/** --include=index.js --reporter=text-summary --reporter=lcov node test/smoke.js",
         "check:prose": "node scripts/check-operator-prose.js",
+        "check:prose:all": `node -e "process.env.PKI_PROSE_CHECKS='all';var r=require('child_process').spawnSync(process.execPath,['scripts/check-operator-prose.js'],{stdio:'inherit'});if(r.error)throw r.error;process.exit(r.signal?1:r.status)"`,
         "check:swallows": "node scripts/check-swallow-coverage.js",
         "coverage:gated": "npm run coverage && npm run check:swallows",
         "coverage:unified": "node scripts/coverage-unified.js",
@@ -329,7 +331,7 @@ var require_constants = __commonJS({
       // is copied/tokenized so a hostile server cannot drive unbounded work parsing it
       // (CWE-770). 8 KiB clears any realistic multi-scheme Digest challenge.
       HTTP_AUTH_HEADER_MAX_BYTES: BYTES.kib(8),
-      // Deterministic-CBOR codec ceilings (RFC 8949), the DER neighbours' siblings:
+      // Deterministic-CBOR codec ceilings (RFC 8949), the DER neighbors' siblings:
       // a whole-document cap refused before the walk, a nesting cap, and a per-value
       // bignum ceiling the document cap can't provide. Unlike DER_MAX_INTEGER_BYTES,
       // the bignum cap carries NO +1 sign octet -- a CBOR tag-2/3 bignum body is pure
@@ -24533,7 +24535,7 @@ var require_path_validate = __commonJS({
       // The set of extension OIDs whose CRITICAL semantics this validator processes (RFC 5280 sec. 6.1).
       // Exposed so a linter can distinguish "processed" from "merely decoded" and stay consistent with
       // the path-validation verdict on a critical extension -- a decoder in certExtensionDecoders is NOT
-      // by itself proof the criticality is honoured. Both sets are frozen so a caller cannot mutate them.
+      // by itself proof the criticality is honored. Both sets are frozen so a caller cannot mutate them.
       PROCESSED_EXTENSIONS,
       // Extensions that ARE processed for an intermediate CA but are unprocessed on the target/leaf, so a
       // critical instance on the target fails closed (RFC 5280 sec. 6.1.5(f)) -- policyMappings is
@@ -25581,7 +25583,7 @@ var require_cmc_build = __commonJS({
       // The exchange binding (RFC 5272 sec. 6.6 / 6.4). First-class here because
       // pki.cmc.verify names these same three when checking the response: a builder
       // that made the caller hand-encode them while the verifier took them by name is
-      // the asymmetry that lets a request ship with no replay defence.
+      // the asymmetry that lets a request ship with no replay defense.
       transactionId: 1,
       senderNonce: 1,
       dataReturn: 1
@@ -26304,7 +26306,7 @@ var require_cmc_verify = __commonJS({
       if (!bound.boundToRequest && sent.allowUnbound !== true) {
         throw E(
           "cmc/unbound-response",
-          "nothing ties this response to a request. Pass what the request retained (`transactionId`, `senderNonce`, whose echo is the replay defence of RFC 5272 sec. 6.6, or `dataReturn`) so the echo can be checked, or `allowUnbound: true` to interpret a response that could be a replay of any earlier exchange with this CA"
+          "nothing ties this response to a request. Pass what the request retained (`transactionId`, `senderNonce`, whose echo is the replay defense of RFC 5272 sec. 6.6, or `dataReturn`) so the echo can be checked, or `allowUnbound: true` to interpret a response that could be a replay of any earlier exchange with this CA"
         );
       }
       return bound;
@@ -36973,7 +36975,7 @@ var require_webauthn_mds = __commonJS({
           tooLarge: "webauthn/too-large",
           badJson: "webauthn/bad-metadata-blob",
           // Every code the guard can raise is named. An omitted one falls back to the framework default
-          // and the module's own defences -- duplicate-member smuggling, the depth cap -- surface under
+          // and the module's own defenses -- duplicate-member smuggling, the depth cap -- surface under
           // a generic code no webauthn/* consumer can switch on.
           tooDeep: "webauthn/bad-metadata-blob",
           duplicateMember: "webauthn/bad-metadata-blob",

package/lib/webhook-hmac.js

@@ -197,17 +197,19 @@ function verify(opts) {
   var signed = Buffer.concat([Buffer.from(tsRaw + ".", "utf8"), bodyBuf]);
   var expected = bCrypto.hmac(secretBuf, signed, nodeAlg);
   var expectedBuf = Buffer.from(expected, "utf8");
-  var matched = false;
+  // Every offered signature is compared. The `break` this replaced ended the
+  // loop at the first match, so a header whose first signature matched
+  // answered sooner than one whose last did — the position of the sender's
+  // current key inside its rotation, reported by timing.
+  //
+  // timingSafeEqualAny applies the same length pre-check per candidate; a
+  // wrong-length candidate cannot be the digest (the hex length is fixed by
+  // the algorithm, and is not secret), so it leaks nothing.
+  var offeredBufs = [];
   for (var s = 0; s < sigs.length; s += 1) {
-    // timingSafeEqual requires equal-length inputs; a wrong-length candidate
-    // cannot be the digest (the hex length is fixed by the algorithm, and is
-    // not secret), so the length pre-check leaks nothing.
-    if (sigs[s].length === expected.length &&
-        bCrypto.timingSafeEqual(expectedBuf, Buffer.from(sigs[s], "utf8"))) {
-      matched = true;
-      break;
-    }
+    offeredBufs.push(Buffer.from(sigs[s], "utf8"));
   }
+  var matched = bCrypto.timingSafeEqualAny(expectedBuf, offeredBufs);
   if (!matched) {
     throw new WebhookHmacError("webhook-hmac/bad-signature",
       "verify: no '" + sigField + "' signature matched");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.34",
+  "version": "0.18.36",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2cb1fb20-caa4-410b-a394-4b3b992bb4b6",
+  "serialNumber": "urn:uuid:f384e0aa-ad27-4c4f-a0b0-eceb0cac068e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-18T10:34:21.920Z",
+    "timestamp": "2026-08-18T23:20:05.652Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.34",
+      "bom-ref": "@blamejs/core@0.18.36",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.34",
+      "version": "0.18.36",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.34",
+      "purl": "pkg:npm/%40blamejs/core@0.18.36",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.34",
+      "ref": "@blamejs/core@0.18.36",
       "dependsOn": []
     }
   ]