@blamejs/core 0.18.45 → 0.18.47

package/CHANGELOG.md

@@ -8,6 +8,44 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.47 (2026-08-22) — **A misspelled character policy was accepted at boot and quietly meant something else.** `bidiPolicy: "rejct"` was accepted by every door the framework offers — the guard's own option resolver and the gate built from it — and then read leniently at runtime: the scan runs because the value is not `allow`, an issue is raised, and the disposition falls through to refuse. Nothing is let through, so it was never a hole; the operator simply asked for one disposition, got another, and was told nothing at the moment a boot error would have cost them a restart. Ninety-three settings across the guard family behaved that way. **Fixed:** *A character policy refuses a value outside its vocabulary* — The five character-threat policies every guard shares — `bidiPolicy`, `nullBytePolicy`, `controlPolicy`, `zeroWidthPolicy`, `tagsPolicy` — now accept only `allow`, `audit`, `audit-only`, `reject`, and `strip` where the guard can carry a repair out. Anything else is refused where options are resolved, which is boot, not the first request that trips the scan. Every entry point takes the check: the generated resolver, and the `gate()` and `validate()` of the guards that bind their own.
+
+The check is derived from each guard's own declared defaults rather than hand-listed per guard, for the same reason the size caps beside it are. Hand-listing is what produced the gap: `b.guardCountry` added this for its own three options after `{ reservedPolicy: "rejcet" }` served a reserved country code and reported success, and the other two hundred and fifty-nine policy options across the family never followed. A guard that declares its own vocabulary explicitly still wins, so that one is unchanged.
+
+Whether a guard can perform a repair is now DECLARED rather than inferred from whether it exports a `sanitize`. An identifier guard exports one that validates and throws — a UUID with a zero-width character in it is not a UUID, and there is nothing to repair — so inferring the capability let `b.guardRegex`, `b.guardJwt`, `b.guardShell` and `b.guardTemplate` accept `strip` at construction and then refuse at runtime, which is the same silent substitution. Guards that repair say so, and the claim is held from both ends: `b.gateContract.defineGuard` refuses a spec that declares repair without a `sanitize` — or a `sanitizeTransform` for one to be built from — and the family sweep separately checks that a guard claiming it actually removes the character, while one that does not claim it refuses the instruction.
+
+What this does not yet cover: the guard-specific policies — formula injection, homoglyphs, DOCTYPE, aliases, and the rest — still accept anything. Their vocabularies genuinely differ from one another, and the set a profile happens to select is not the set the code accepts, so inferring them would refuse values that work today. Each needs its own list, read from the guard rather than guessed. · *`audit-only` did not mean what `audit` means* — The two have been synonyms wherever a policy is turned into a disposition. The severity calculation recognised only the literal `audit`, so on the public validation path they disagreed: `zeroWidthPolicy: "audit"` returned a pass with a warning, while `audit-only` returned a failure with a high-severity issue. The same split affected the control-character and Unicode Tags policies.
+
+One predicate decides it now, in the module that owns the character scanning, and the disposition mapper asks the same one. Two spellings of a single setting is how they come to disagree; asking one question is how they stop. · *The DNSSEC algorithm table called RSASHA512 current* — RFC 9904 replaced RFC 8624 as the DNSSEC algorithm requirements, and it reads RSASHA512 as NOT RECOMMENDED for signing while still MUST for validation. `b.network.dns.classifyDnskeyAlgorithm(10)` reported it as `current`, so an operator asking which algorithm to sign a zone with got the opposite of what the current document says.
+
+It is not marked deprecated, and deliberately: validation remains mandatory, and a caller using that flag to decide whether to ACCEPT a zone must keep accepting it. One boolean cannot carry a requirement that differs between signing and validation, so the reason names both levels and the flag follows the side an operator can still choose.
+
+The citations moved with it — DSA, DSA-NSEC3-SHA1 and ECC-GOST to RFC 9904's Table 2, the DS digest vocabulary and GOST R 34.11-94 to Table 3, and RSAMD5 off RFC 6944, which had been obsoleted twice over, onto RFC 6725. Nothing asserted on algorithm 10 before, which is how a stale classification sat in a table everything else in the file kept current.
+
+- v0.18.46 (2026-08-22) — **A failing test reported the handle it leaked instead of the check that failed.** Thirty test files ran their assertions inside a `try` whose `finally` drained open handles. A throw from a `finally` replaces the error the body raised, so when a test failed and its skipped teardown left a socket behind, what surfaced was "a handle leaked" — the consequence — while the check that actually failed was discarded. That is the shape of failure that reads as an unexplained flake, and it was reachable in every suite that opens a server. **Fixed:** *A drain no longer replaces the failure it followed* — `try { ...tests... } finally { await drain() }` reads as correct. It is not. When the body throws, every teardown after the throw is skipped, so the drain finds the servers those teardowns would have closed and throws too — and a throw from a `finally` replaces the body's error. The run reports a leaked handle, which is true and useless: the check that failed is gone, and the leak looks like the bug.
+
+The drain now runs through one helper that keeps the body's error and appends the others to it, so a run that failed for a reason reports that reason, and a run that only leaked still reports the leak. Thirty files moved onto it.
+
+Six of those thirty had their own cleanup — destroying a keep-alive agent, closing websocket clients and the sockets an upgrade detached from the server, resetting module state — sitting in the same `finally`. They were the worse instance rather than the exception: more throwable work in the place that replaces the failure. The helper took an optional teardown so their work runs inside the structure that preserves the error, instead of those six taking an exemption.
+
+One file drained fifty-six times, once per section. A drain is a leak VERDICT rather than cleanup, so that was fifty-six places a real assertion failure could surface as a leak. Its sections now clean up and the verdict is taken once, at the end, where nothing is left to mask. The trade is that a leak there is reported against the file rather than the section; what the drain names is the surviving handles with their addresses and states, which is the attribution that matters. · *The helper that makes that promise is now tested* — Thirty files rely on "the body's error wins", and nothing checked it. A helper can stop doing the one thing it exists for while every suite using it still passes, because the suites only exercise it on the path where nothing goes wrong.
+
+It is now driven directly: a body that throws, a teardown that throws after it, both throwing at once, a teardown that throws when the body passed, and a body that throws a string rather than an Error — which used to lose the appended note entirely, since assigning to a property of a primitive is a silent no-op outside strict mode.
+
+The suite was confirmed to fail against the behaviour it forbids before it was kept. · *Two ways the failure-preserving helper could still lose the failure* — A thrown `null` was not a failure. Both helpers decided whether something had failed by asking whether the value it threw was truthy, so `throw null`, `throw ""` and `throw 0` read as passes: the drain helper returned normally, and the polling helper dropped "last predicate threw" from its timeout message, leaving "the condition never came true" where the truth was "the condition could not be evaluated". Both now track whether a throw happened as its own flag, separate from what was thrown.
+
+And annotating an error could destroy it, or be invisible. When a run fails and its teardown fails after, the second failure is appended to the first — by mutating the error's message. An error can refuse to be mutated: a frozen one, or a `message` defined non-writable. That assignment throws, and the throw escapes from the annotator and replaces the failure it was called to annotate. Appending is now attempted and, when refused, the same information is carried in a new error that keeps the original as its cause.
+
+The note also has to reach the place anybody reads. A runner prints `.stack`, not `.message`, and a stack string is formatted once on first read and then cached — so an error that some assertion or logger had already touched carried a stack headed by the original message, and the appended note never appeared. The note now goes on the stack as well, guarded on whether it is already there rather than on whether the stack was cached, so it lands exactly once.
+
+All of it is the swallowing this release is about, one level further in: the helper that exists to stop a failure being lost had several ways of its own to lose one. · *A polling timeout blamed an exception the predicate had stopped raising* — The polling helper names the last exception in its timeout message, which is the difference between "the condition never came true" and "the condition could not be evaluated". It reported whatever had most recently been thrown, including from a poll many rounds earlier — so a predicate that raised while the thing it watches was still settling, and then answered cleanly, blamed the timeout on an exception it had stopped raising.
+
+A throw during polling is not the verdict. The predicate is being asked repeatedly precisely because the state is still settling, so the loop now treats a throw as "not yet" and keeps nothing from it. The diagnostic speaks for one attempt — the one at the deadline — and answers the question worth asking: was the predicate still failing to evaluate when the wait gave up?
+
+The timeout diagnostic now has its own tests, which is what surfaced this: whether the helper eventually returns is exercised by every suite that polls, and the message it produces when it does not was exercised by none of them. · *Two test files said they were outside the smoke run* — Both carried a header stating they were not part of the smoke surface. The runner takes every `*.test.js` under the layer directory, and the only opt-out is a `STANDALONE_ONLY` marker in the first two kilobytes, which neither file carries — so both have been running all along. A comment that says a failure here will not block is the kind that gets believed. **Detectors:** *A handle drain may not sit in a `finally`* — The shape is refused wherever it reappears. It matches both spellings — a direct call and a local wrapper — because a word boundary alone misses the underscore-prefixed form, which is exactly how six of the thirty files went uncounted when the population was first measured.
+
+Anchored on the `finally` and the drain together and tempered so it cannot cross a function-closing brace; the quantifier is a backstop far above any real `finally` body rather than the precision mechanism. It was confirmed firing on all thirty before any of them were converted, and silent after the last one.
+
 - v0.18.45 (2026-08-21) — **`b.publicSuffix` returned names that cannot exist — a 64-octet label, and `ex*ample.com`.** `canonicalDomain` is where the framework decides what a domain IS, and two kinds of non-domain got through it. A label longer than the 63 octets RFC 1035 allows came back as an organizational domain, and 17 of 31 non-LDH characters survived because `domainToASCII` maps a name without validating it as a host. Both answers then travelled: into DMARC alignment, cookie-domain comparisons and residency routing, where a name no resolver will ever return is compared against one that exists. **Changed:** *Vendored `@blamejs/pki` 0.5.23 to 0.5.25* — The toolkit behind `b.mtlsCa` and `b.auth.passkey`. Two releases land together.
 
 0.5.24 binds an ACME certificate download to the order that asked for it. The end-entity certificate that comes back must carry the public key the order's CSR asked to have certified, and its identifier set must equal the order's — its dNSName and iPAddress subject alternative names, with the subject common name read only where it asserts none. `downloadCertificate` now requires `expectedSpki`, `identifiers`, or both, and refuses a call supplying neither rather than returning a certificate nothing looked at. An identifier that maps to no certificate name is refused rather than dropped from the comparison, which is what let an order for a name plus one other identifier be satisfied by a certificate covering only the name.

package/lib/codepoint-class.js

@@ -207,6 +207,33 @@ function firstInRanges(text, ranges, from) {
 // The shape the detectors want: `{ index, char, codePoint }` for the first
 // codepoint of `text` in `ranges`, or null. `char` is the WHOLE codepoint,
 // which for an astral hit is a surrogate pair.
+/**
+ * @primitive  b.codepointClass.isAuditPolicy
+ * @signature  b.codepointClass.isAuditPolicy(policy)
+ * @since      0.18.47
+ * @status     stable
+ * @related    b.gateContract.policyDisposition, b.gateContract.charPolicyEnums
+ *
+ * Whether a policy value asks for an AUDIT — reporting the finding rather than
+ * refusing or repairing. `audit-only` is the framework's own synonym for
+ * `audit`, and this is the one place that decides so.
+ *
+ * It exists because the two spellings disagreed. The disposition mapper treated
+ * them as the same thing while the severity calculation recognised only the
+ * literal `audit`, so `zeroWidthPolicy: "audit-only"` produced a high-severity
+ * issue and a failed validation where `audit` produced a warning and a pass.
+ * Two spellings of one setting is how they come to disagree; asking one
+ * predicate is how they stop.
+ *
+ * @example
+ *   b.codepointClass.isAuditPolicy("audit");       // → true
+ *   b.codepointClass.isAuditPolicy("audit-only");  // → true
+ *   b.codepointClass.isAuditPolicy("reject");      // → false
+ */
+function isAuditPolicy(policy) {
+  return policy === "audit" || policy === "audit-only";
+}
+
 function _firstHit(text, ranges) {
   var i = firstInRanges(text, ranges);
   if (i === -1) return null;
@@ -817,7 +844,7 @@ function detectCharThreats(text, opts, codePrefix) {
         // reported, so the audit setting did nothing an operator could
         // observe except the thing they asked it not to do.
         severity: opts.controlPolicy === "reject" ? "high"
-                : opts.controlPolicy === "audit"  ? "warn" : "high",
+                : isAuditPolicy(opts.controlPolicy) ? "warn" : "high",
         ruleId: codePrefix + ".control",
         location: ctrlMatch.index,
         // DEL is a control character here but is not in the C0 block, so the
@@ -849,7 +876,7 @@ function detectCharThreats(text, opts, codePrefix) {
       issues.push({
         kind: "zero-width",
         severity: opts.zeroWidthPolicy === "reject" ? "critical"
-                : opts.zeroWidthPolicy === "audit"  ? "warn" : "high",
+                : isAuditPolicy(opts.zeroWidthPolicy) ? "warn" : "high",
         ruleId: codePrefix + ".zero-width",
         location: zwMatch.index,
         snippet: "zero-width / invisible-formatting char U+" +
@@ -877,7 +904,7 @@ function detectCharThreats(text, opts, codePrefix) {
       issues.push({
         kind: "unicode-tags",
         severity: tagsPolicy === "reject" ? "critical"
-                : tagsPolicy === "audit"  ? "warn" : "high",
+                : isAuditPolicy(tagsPolicy) ? "warn" : "high",
         ruleId: codePrefix + ".unicode-tags",
         location: tagMatch.index,
         snippet: "Unicode Tags block char U+" +
@@ -1724,6 +1751,7 @@ module.exports = {
   hex4:              hex4,
   charClass:         charClass,
   inRanges:          inRanges,
+  isAuditPolicy:     isAuditPolicy,
   firstInRanges:     firstInRanges,
   stripRanges:       stripRanges,
   replaceRanges:     replaceRanges,

package/lib/gate-contract.js

@@ -2143,13 +2143,97 @@ function buildContentGate(spec) {
  *   b.gateContract.policyDisposition("audit-only");  // → "audit"
  *   b.gateContract.policyDisposition("rejet");       // → "refuse" (fail closed)
  */
+// The character-threat policies every guard in the family shares, and the
+// vocabulary each accepts. A value outside it is a typo, and a typo is a
+// CONFIG-TIME error: read leniently at runtime it takes whichever branch is not
+// the strict one — the scan runs because the value is not "allow", an issue is
+// raised, and policyDisposition falls through to "refuse". That fails closed,
+// so it is not a hole, but the operator asked for one disposition and silently
+// got another. This turns it into a boot error instead.
+//
+// `strip` is an instruction to repair, so it is legal only where the guard has
+// a `sanitize` to repair with — the same rule the family's performable-actions
+// invariant asserts. An `entries` guard has none by design: a hostile archive
+// member cannot be made safe.
+var CHAR_POLICY_KEYS = Object.freeze([
+  "bidiPolicy", "nullBytePolicy", "controlPolicy", "zeroWidthPolicy", "tagsPolicy",
+]);
+var CHAR_POLICY_BASE = Object.freeze(["allow", "audit", "audit-only", "reject"]);
+
+/**
+ * @primitive  b.gateContract.charPolicyEnums
+ * @signature  b.gateContract.charPolicyEnums(defaults, opts?)
+ * @since      0.18.47
+ * @status     stable
+ * @related    b.gateContract.resolveProfileAndPosture, b.gateContract.defineGuard
+ *
+ * The `enumOpts` entry for every character-threat policy present in `defaults`,
+ * so a guard binding its own resolver holds callers to the same vocabulary the
+ * generated one does. `opts.canRepair` adds `strip`, which is an instruction to
+ * repair and so legal only where the guard has a `sanitize` to perform it.
+ *
+ * Pass the result as `enumOpts` to `resolveProfileAndPosture`. A guard whose
+ * gate or validate binds its own resolver and omits this accepts a misspelled
+ * policy on that entry point while the generated path refuses it — the two
+ * doors disagreeing is how the check came to cover only one of them.
+ *
+ * @opts
+ *   canRepair:  boolean,   // default: false — adds `strip` to every entry
+ *
+ * @example
+ *   gateContract.resolveProfileAndPosture(opts, {
+ *     profiles:  PROFILES,
+ *     defaults:  DEFAULTS,
+ *     enumOpts:  gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }),
+ *   });
+ */
+function charPolicyEnums(defaults, opts) {
+  var canRepair = !!(opts && opts.canRepair);
+  var out = null;
+  for (var i = 0; i < CHAR_POLICY_KEYS.length; i += 1) {
+    var key = CHAR_POLICY_KEYS[i];
+    // `tagsPolicy` is usually ABSENT from a guard's defaults because it
+    // INHERITS from zeroWidthPolicy (resolveTagsPolicy reads one when the other
+    // is unset). It is still a supported inline override, so a guard exposing
+    // the inherited behaviour must hold a typo in it to the same vocabulary —
+    // keying only on presence left `{ tagsPolicy: "strp" }` unchecked on every
+    // guard that inherits, and the Tags detector then read the typo as a
+    // high-severity refusal instead of the promised boot error.
+    var governs = defaults && (typeof defaults[key] === "string" ||
+      (key === "tagsPolicy" && typeof defaults.zeroWidthPolicy === "string"));
+    if (!governs) continue;
+    if (!out) out = {};
+    out[key] = canRepair ? CHAR_POLICY_BASE.concat(["strip"]) : CHAR_POLICY_BASE.slice();
+  }
+  return out;
+}
+
+function _withCharPolicyEnums(defaults, spec) {
+  var declared = spec.enumOpts && typeof spec.enumOpts === "object" ? spec.enumOpts : null;
+  // DECLARED, not inferred from the presence of a `sanitize`. An identifier
+  // guard exports one that validates and throws — there is nothing to repair,
+  // the value either is a UUID or is not — so inferring the capability let
+  // guardRegex, guardJwt, guardShell and guardTemplate accept `strip` at
+  // construction and refuse at runtime, which is the silent substitution this
+  // check exists to stop. A guard says whether it can repair a character, and
+  // the family sweep holds it to the claim.
+  var derived = charPolicyEnums(defaults, { canRepair: spec.charRepair === true });
+  if (!derived) return declared || null;
+  var out = declared ? Object.assign({}, declared) : {};
+  Object.keys(derived).forEach(function (key) {
+    if (declared && declared[key]) return;                // an explicit declaration wins
+    out[key] = derived[key];
+  });
+  return out;
+}
+
 var MITIGATION_POLICIES = Object.freeze({
   strip: true, "prefix-tab": true, "prefix-quote": true,
   "wrap-with-quotes-and-prefix": true, allowlist: true, redact: true, trim: true,
 });
 function policyDisposition(policy) {
   if (policy === "reject") return "refuse";
-  if (policy === "audit" || policy === "audit-only") return "audit";
+  if (codepointClass.isAuditPolicy(policy)) return "audit";
   if (MITIGATION_POLICIES[policy] === true) return "sanitize";
   return "refuse";
 }
@@ -3168,7 +3252,12 @@ function defineGuard(spec) {
       // validate() below.
       nonNegativeOpts:    _capKeys(defaults, spec.intOpts),
       // Options restricted to a fixed vocabulary, checked at the same funnel.
-      enumOpts:           spec.enumOpts || null,
+      // The character policies are derived rather than hand-listed, for the
+      // reason the caps above are: declared per guard, they were declared by
+      // one. guard-country wrote `enumOpts` for its own three opts after
+      // `{ reservedPolicy: "rejcet" }` served a reserved code and reported ok,
+      // and the other 259 policy opts across the family never followed.
+      enumOpts:           _withCharPolicyEnums(defaults, spec),
     });
   };
   if (typeof spec.detect === "function") {
@@ -3360,6 +3449,10 @@ function defineGuard(spec) {
   var out = {
     NAME:                spec.name,
     KIND:                spec.kind,
+    // Surfaced so a caller — and the family sweep — can ask whether `strip` is
+    // an instruction this guard can carry out, rather than inferring it from
+    // the presence of a `sanitize` that may only validate and throw.
+    CHAR_REPAIR:         spec.charRepair === true,
     // The options this guard DECLARES to be caps, where zero is refused. Every
     // other numeric option is derived from the defaults and held only to
     // "non-negative integer", because derivation cannot tell a cap from a
@@ -3379,6 +3472,20 @@ function defineGuard(spec) {
     out.EXTENSIONS = Object.freeze((spec.extensions || []).slice());
   }
   if (spec.integrationFixtures) out.INTEGRATION_FIXTURES = spec.integrationFixtures;
+  // A declaration has to be backed by something. `charRepair: true` says the
+  // guard can carry out `strip`, which puts that value in its character-policy
+  // vocabulary — so a spec that declares it without a `sanitize` (or a
+  // `sanitizeTransform` for one to be built from) would accept the instruction
+  // at boot and refuse it at runtime, which is the substitution the declaration
+  // was introduced to stop. Checked HERE rather than earlier because
+  // sanitizeTransform generates the sanitize further up, and checking before
+  // that would refuse a spec that does supply a repair path.
+  if (spec.charRepair === true && typeof spec.sanitize !== "function") {
+    throw ErrorClass.factory(prefix + ".bad-spec",
+      prefix + ": charRepair is declared but the guard has no sanitize — " +
+      "`strip` on a character policy is an instruction to repair, so declare a " +
+      "sanitize or a sanitizeTransform, or drop charRepair.");
+  }
   if (typeof spec.sanitize === "function") out.sanitize = spec.sanitize;
   out.gate = gateFn;
   // Error class exported under its own constructor name (GuardCsvError etc.)
@@ -3713,6 +3820,7 @@ module.exports = {
   // defineGuard: the cap keys to declare, derived from its defaults so the
   // list cannot drift away from them.
   capKeysOf:                capKeysOf,
+  charPolicyEnums:          charPolicyEnums,
   identitySanitize:         identitySanitize,
   ctxValueFrom:             ctxValueFrom,
   runIssueValidator:  runIssueValidator,

package/lib/guard-email.js

@@ -1118,6 +1118,7 @@ var INTEGRATION_FIXTURES = Object.freeze({
 module.exports = gateContract.defineGuard({
   name:        "email",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardEmailError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/guard-filename.js

@@ -1306,6 +1306,7 @@ var INTEGRATION_FIXTURES = Object.freeze({
 module.exports = gateContract.defineGuard({
   name:        "filename",
   kind:        "filename",
+  charRepair:  true,
   errorClass:  GuardFilenameError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/guard-html.js

@@ -983,6 +983,10 @@ var INTEGRATION_FIXTURES = Object.freeze({
 module.exports = gateContract.defineGuard({
   name:        "html",
   kind:        "content",
+  // sanitize rewrites the document, so `strip` on a character policy is an
+  // instruction this guard can carry out. Declared rather than inferred from
+  // the presence of a sanitize — an identifier guard has one that only throws.
+  charRepair:  true,
   errorClass:  GuardHtmlError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/guard-json.js

@@ -1086,6 +1086,7 @@ var INTEGRATION_FIXTURES = Object.freeze({
 module.exports = gateContract.defineGuard({
   name:        "json",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardJsonError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/guard-markdown.js

@@ -1905,6 +1905,7 @@ function render(source, opts) {
 module.exports = gateContract.defineGuard({
   name:        "markdown",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardMarkdownError,
   profiles:    PROFILES,
   base:        256,

package/lib/guard-svg.js

@@ -1008,6 +1008,7 @@ var INTEGRATION_FIXTURES = Object.freeze({
 var _guard = module.exports = gateContract.defineGuard({
   name:        "svg",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardSvgError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/guard-text.js

@@ -129,9 +129,13 @@ function _resolveOpts(opts) {
     defaults:           DEFAULTS,
     errorClass:         GuardTextError,
     errCodePrefix:      "text",
-    // Own resolver, own cap declaration — see guard-image.gate.
+    // Own resolver, own cap declaration — see guard-image.gate. The policy
+    // vocabulary comes with it for the same reason: a hand-bound resolver that
+    // omits it accepts `bidiPolicy: "rejct"` on gate() and validate() while the
+    // generated path refuses it.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
+    enumOpts:           gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }),
   });
 }
 
@@ -573,6 +577,7 @@ var INTEGRATION_FIXTURES = Object.freeze({
 module.exports = gateContract.defineGuard({
   name:        "text",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardTextError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/guard-xml.js

@@ -736,6 +736,7 @@ var INTEGRATION_FIXTURES = Object.freeze({
 var _guard = module.exports = gateContract.defineGuard({
   name:        "xml",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardXmlError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/guard-yaml.js

@@ -648,9 +648,12 @@ function parse(input, opts) {
     defaults:           DEFAULTS,
     errorClass:         GuardYamlError,
     errCodePrefix:      "yaml",
-    // Own resolver, own cap declaration — see guard-image.gate.
+    // Own resolver, own cap declaration — see guard-image.gate. The policy
+    // vocabulary comes with it: a hand-bound resolver that omits it accepts
+    // `bidiPolicy: "rejct"` here while the generated path refuses it.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
+    enumOpts:           gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }),
   });
   if (typeof input !== "string") {
     throw _err("yaml.bad-input", "parse requires string input");
@@ -797,9 +800,12 @@ function gate(opts) {
     defaults:           DEFAULTS,
     errorClass:         GuardYamlError,
     errCodePrefix:      "yaml",
-    // Own resolver, own cap declaration — see guard-image.gate.
+    // Own resolver, own cap declaration — see guard-image.gate. The policy
+    // vocabulary comes with it: a hand-bound resolver that omits it accepts
+    // `bidiPolicy: "rejct"` here while the generated path refuses it.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
+    enumOpts:           gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }),
   });
   return gateContract.buildContentGate({
     name:     opts.name || "guardYaml:" + (opts.profile || "default"),
@@ -813,6 +819,7 @@ function gate(opts) {
 module.exports = gateContract.defineGuard({
   name:        "yaml",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardYamlError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/network-dns.js

@@ -2086,8 +2086,13 @@ function isNullMx(mxRecords) {
  * Classify a DNSKEY / RRSIG algorithm number against the IANA DNS
  * Security Algorithm Numbers registry, flagging SHA-1-based and
  * other deprecated algorithms per RFC 9905 (Deprecating DNSSEC
- * SHA-1 Usage), RFC 8624 (Algorithm Implementation Requirements),
- * and RFC 6944 / RFC 6725 (RSAMD5 deprecation).
+ * SHA-1 Usage), RFC 9904 (Algorithm Implementation Requirements,
+ * which obsoletes RFC 8624), and RFC 6725 (RSAMD5 deprecation).
+ *
+ * `deprecated` answers "should this still be accepted", so it follows
+ * the VALIDATION requirement. Where a spelling differs between signing
+ * and validation — RSASHA512 is NOT RECOMMENDED to sign with but MUST
+ * still validate — the `reason` names both, since one boolean cannot.
  *
  * Returns `{ algorithm, name, deprecated, reason, known }` for any
  * IANA-assigned number; `known: false` for unassigned numbers
@@ -2123,18 +2128,22 @@ function isNullMx(mxRecords) {
 // auditing DNSSEC chain-of-trust evidence know they cannot validate
 // the entry against a public algorithm registry.
 var DNSKEY_ALGORITHMS = Object.freeze({
-  1:   { name: "RSAMD5",             deprecated: true,  reason: "MD5 broken (RFC 6944 §2.1, RFC 6725)" },
+  1:   { name: "RSAMD5",             deprecated: true,  reason: "MD5 broken; deprecated for zone signing (RFC 6725 §2.2)" },
   2:   { name: "DH",                 deprecated: true,  reason: "Diffie-Hellman key (RFC 2539) — never widely deployed; superseded by signature algorithms" },
-  3:   { name: "DSA",                deprecated: true,  reason: "DSA deprecated (RFC 8624 §3.1)" },
+  3:   { name: "DSA",                deprecated: true,  reason: "DSA MUST NOT be used for signing or validation (RFC 9904 Table 2)" },
   4:   { name: "Reserved",           deprecated: true,  reason: "Reserved (RFC 4034 §A.1) — not for production use" },
   5:   { name: "RSASHA1",            deprecated: true,  reason: "SHA-1 deprecated (RFC 9905 §3)" },
-  6:   { name: "DSA-NSEC3-SHA1",     deprecated: true,  reason: "SHA-1 deprecated (RFC 9905 §3); DSA deprecated (RFC 8624 §3.1)" },
+  6:   { name: "DSA-NSEC3-SHA1",     deprecated: true,  reason: "SHA-1 deprecated (RFC 9905 §3); DSA MUST NOT be used (RFC 9904 Table 2)" },
   7:   { name: "RSASHA1-NSEC3-SHA1", deprecated: true,  reason: "SHA-1 deprecated (RFC 9905 §3)" },
   8:   { name: "RSASHA256",          deprecated: false, reason: "current — RFC 5702" },                                  // IANA DNSKEY algorithm number
   9:   { name: "Reserved",           deprecated: true,  reason: "Reserved (RFC 5155) — not for production use" },
-  10:  { name: "RSASHA512",          deprecated: false, reason: "current — RFC 5702" },
+  // Not deprecated — validation is still MUST, so a caller deciding whether to
+  // ACCEPT a zone must keep accepting it. But it is NOT RECOMMENDED to sign
+  // with, and reporting it as plainly "current" answered a signing question
+  // with the opposite of what the current RFC says.
+  10:  { name: "RSASHA512",          deprecated: false, reason: "defined in RFC 5702; RFC 9904 Table 2 — signing NOT RECOMMENDED, validation MUST" },
   11:  { name: "Reserved",           deprecated: true,  reason: "Reserved (RFC 5155) — not for production use" },
-  12:  { name: "ECC-GOST",           deprecated: true,  reason: "deprecated (RFC 8624 §3.1)" },
+  12:  { name: "ECC-GOST",           deprecated: true,  reason: "MUST NOT be used for signing (RFC 9904 Table 2)" },
   13:  { name: "ECDSAP256SHA256",    deprecated: false, reason: "current — RFC 6605" },
   14:  { name: "ECDSAP384SHA384",    deprecated: false, reason: "current — RFC 6605" },
   15:  { name: "ED25519",            deprecated: false, reason: "current — RFC 8080" },
@@ -2173,15 +2182,19 @@ var DNSKEY_ALGORITHMS = Object.freeze({
  *   // → { digestType: 2, name: "SHA-256", deprecated: false, ... }
  */
 
-// DS digest-type vocabulary (RFC 4034 §5.1 + RFC 6605 §6 + RFC 8624
-// §3.2 + RFC 9558). Digest type 1 = SHA-1 is deprecated per RFC 9905
-// §4. Digest types 5 (GOST R 34.11-2012) and 6 (SM3) added by RFC
-// 9558. Reserved value 0 surfaced for completeness.
+// DS digest-type vocabulary (RFC 4034 §5.1 + RFC 6605 §6 + RFC 9904
+// Table 3 + RFC 9558). Digest type 1 = SHA-1 is deprecated per RFC 9905
+// §4 — RFC 9904 Table 3 spells it MUST NOT for delegation and MUST for
+// validation, so `deprecated` follows the delegation side here for the
+// same reason it follows validation in the DNSKEY table: that is the
+// side an operator can still choose. Digest types 5 (GOST R 34.11-2012)
+// and 6 (SM3) added by RFC 9558. Reserved value 0 surfaced for
+// completeness.
 var DS_DIGEST_TYPES = Object.freeze({
   0: { name: "Reserved",            deprecated: true,  reason: "Reserved (RFC 3658) — not for production use" },
   1: { name: "SHA-1",               deprecated: true,  reason: "SHA-1 deprecated (RFC 9905 §4)" },
   2: { name: "SHA-256",             deprecated: false, reason: "current — RFC 4509" },
-  3: { name: "GOST R 34.11-94",     deprecated: true,  reason: "deprecated (RFC 8624 §3.2; superseded by GOST 2012 in RFC 9558)" },
+  3: { name: "GOST R 34.11-94",     deprecated: true,  reason: "MUST NOT be used for delegation (RFC 9904 Table 3); superseded by GOST 2012 in RFC 9558" },
   4: { name: "SHA-384",             deprecated: false, reason: "current — RFC 6605 §6" },
   5: { name: "GOST R 34.11-2012",   deprecated: false, reason: "current — RFC 9558 §3" },
   6: { name: "SM3",                 deprecated: false, reason: "current — RFC 9558 §3 (Chinese national standard)" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.45",
+  "version": "0.18.47",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:0c868505-f25e-4aac-a3e5-9d64001e0f98",
+  "serialNumber": "urn:uuid:2b85824f-8c87-4b4e-9ee7-abfe05e1b852",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-22T05:10:30.712Z",
+    "timestamp": "2026-08-22T12:32:06.262Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.45",
+      "bom-ref": "@blamejs/core@0.18.47",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.45",
+      "version": "0.18.47",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.45",
+      "purl": "pkg:npm/%40blamejs/core@0.18.47",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.45",
+      "ref": "@blamejs/core@0.18.47",
       "dependsOn": []
     }
   ]