@blamejs/exceptd-skills 0.18.12 → 0.18.13

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.18.13 — 2026-06-22
+
+A correctness + robustness pass across the upstream data parsers, the validators, and the prefetch/feed paths.
+
+The OSV advisory importer keeps the HIGHEST CVSS vector and score when a record carries multiple same-version severity entries (e.g. an NVD base score alongside a CNA/vendor score), instead of whichever appeared first in the array — a 9.8 critical no longer imports as a 5.3 medium purely because of upstream array order, which previously also flipped the derived KEV-pending / active-exploitation / severity-word fields. The RSS/Atom feed tokenizer strips HTML in a single linear pass, so a malformed or hostile feed body with many unclosed `<` can no longer stall the refresh worker (the previous regex was quadratic on attacker-controlled text). An Atom `<link>` carrying element text is now selected by its `rel` the same way the attribute form is, so a non-`alternate` link cannot override the canonical `alternate`. `refresh --advisory <ghsa-id>` validates the full `GHSA-xxxx-xxxx-xxxx` token shape and URL-encodes it before building the request path.
+
+The playbook validator range-checks a partial `phase_overrides.direct.rwep_threshold` override and rejects an impossible calendar date (`2026-02-30`); the CVE-catalog validator reports an absent reference catalog as unvalidatable for ALL five reference families instead of flagging every `atlas_ref`/`cwe_ref` as unresolved; the RFC validator skips non-IETF references (CSAF, ISO) rather than reporting them as permanent drift; the version-pin validator no longer probes the two upstreams that publish no GitHub releases (reported as tracked elsewhere); the vendor inventory cross-check covers `.cjs`/`.mjs`/`.json`, not only `.js`; the package size-budget gate fails closed when `npm pack` omits the size field; and the disputed-CVE check reports the real local status. The skill linter flags a wrong-typed enum value and rejects an impossible `last_threat_review`, and the `d3fend_refs` frontmatter pattern accepts the `D3A-`/`D3F-` id families. `upstream-check` reports a clear error rather than `ok:true` with an undefined version when a fixture lacks dist-tags, and a non-parseable publish date yields a clear value instead of `NaN`. The prefetch index no longer resurrects entries a concurrent run pruned, `ttp-mapper` ignores inherited object keys, and the EPSS lookup returns not-found for an absent CVE instead of the first row.
+
 ## 0.18.12 — 2026-06-22
 
 A correctness pass across the CLI, the engine, scoring, the collectors, framework-gap reporting, signature verification, and the CWE-chain index.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-22T06:27:15.592Z",
+  "generated_at": "2026-06-22T13:09:57.368Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "d897efd048acdde209213af36857c5385c036a650096531408ca978590e38226",
+    "manifest.json": "04dc4d4026147da386256d462aec657b1746e9539f8d8dc3ed0ad522f437d765",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
     "data/attack-techniques.json": "53c6f248760eecb11a0354f74ab467a5814e95075a686b9b3bf18c34e2f7435e",

package/lib/auto-discovery.js

@@ -206,7 +206,16 @@ function extractNvdMetrics(payload) {
 
 function extractEpss(payload, id) {
   const data = Array.isArray(payload?.data) ? payload.data : [];
-  const row = data.find((r) => r?.cve === id) || data[0];
+  // Match the requested CVE id only. The prior `|| data[0]` fallback silently
+  // misattributed a DIFFERENT CVE's EPSS score into the draft whenever the
+  // requested id was absent from the payload — a single-row response for the
+  // wrong CVE (or a stale/mismatched sidecar) wrote that CVE's score under the
+  // discovered id. A non-matching payload now yields null (same
+  // null-mechanical-field behavior used when no cache exists). The only
+  // accepted fallback is a single-row, cve-less response shape (the requested
+  // id is implicit because the payload carries exactly one un-keyed row).
+  let row = data.find((r) => r?.cve === id);
+  if (!row && data.length === 1 && data[0]?.cve == null) row = data[0];
   if (!row) return null;
   return {
     score: row.epss != null ? Number(row.epss) : null,

package/lib/cve-regression-watcher.js

@@ -228,7 +228,11 @@ function findRegressionCandidates(diffs, catalog, opts) {
       const titleStr = (typeof d.title === 'string' && d.title) ? d.title
         : (typeof d.first_title === 'string' && d.first_title) ? d.first_title
         : '';
-      if (titleStr) slot.titles.push(titleStr);
+      // Dedupe titles before pushing — mirrors the content-only branch.
+      // Without this, duplicate titles across feeds (a common multi-feed
+      // surfacing pattern) consume distinct slots and evict genuinely
+      // distinct titles from the 5-cap below.
+      if (titleStr && !slot.titles.includes(titleStr)) slot.titles.push(titleStr);
       // Merge content signals — the strongest signal wins.
       Object.assign(slot.signals, signals);
       continue;

package/lib/job-queue.js

@@ -34,8 +34,15 @@ class TokenBucket {
     if (elapsed <= 0) return;
     const add = elapsed / this.refillIntervalMs;
     if (add >= 1) {
-      this.tokens = Math.min(this.capacity, this.tokens + Math.floor(add));
-      this.lastRefill = now;
+      const whole = Math.floor(add);
+      this.tokens = Math.min(this.capacity, this.tokens + whole);
+      // Advance lastRefill by the time the whole tokens we just granted
+      // consumed, NOT to `now`. Snapping to `now` discards the sub-interval
+      // remainder (`elapsed % refillIntervalMs`), so the bucket refills
+      // slightly slower than the configured rate and under-utilizes the
+      // budget over many refills. Crediting only the consumed time keeps
+      // the long-run refill rate exactly tokens/windowMs.
+      this.lastRefill += whole * this.refillIntervalMs;
     }
   }
   tryTake() {

package/lib/lint-skills.js

@@ -117,6 +117,26 @@ const ATLAS_ID_RE = /^AML\.T\d{4}(\.\d{3})?$/;
 const ATTACK_ID_RE = /^T\d{4}(\.\d{3})?$/;
 const SEMVER_RE = /^\d+\.\d+\.\d+$/;
 const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+
+/*
+ * Strict ISO calendar-date check. ISO_DATE_RE only proves the SHAPE
+ * (YYYY-MM-DD); Date.parse() silently rolls non-calendar dates over —
+ * 2026-02-30 becomes 2026-03-02, 2026-04-31 becomes 2026-05-01 — so a
+ * malformed review date would pass the staleness gate against a date that
+ * never existed. Round-trip through Date.UTC and require every component to
+ * survive unchanged, which rejects the rollovers while accepting real dates.
+ */
+function isStrictIsoCalendarDate(s) {
+  if (typeof s !== 'string' || !ISO_DATE_RE.test(s)) return false;
+  const [y, m, d] = s.split('-').map((n) => parseInt(n, 10));
+  if (m < 1 || m > 12 || d < 1 || d > 31) return false;
+  const dt = new Date(Date.UTC(y, m - 1, d));
+  return (
+    dt.getUTCFullYear() === y &&
+    dt.getUTCMonth() + 1 === m &&
+    dt.getUTCDate() === d
+  );
+}
 const KEBAB_RE = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 const JSON_FILENAME_RE = /^[A-Za-z0-9._-]+\.json$/;
 
@@ -293,8 +313,17 @@ function schemaConstraintErrors(fm, schema) {
     if (!(field in fm)) continue;
     const value = fm[field];
 
-    if (Array.isArray(spec.enum) && typeof value === 'string') {
-      if (!spec.enum.includes(value)) {
+    // An enum constraint must reject a wrong-typed value, not skip it. The
+    // earlier `typeof value === 'string'` guard silently passed any non-string
+    // (e.g. `discovery_mode: [standalone]` parsed as an array, or a number),
+    // letting a malformed field bypass validation entirely. Flag the type
+    // mismatch first; only run the membership check on an actual string.
+    if (Array.isArray(spec.enum)) {
+      if (typeof value !== 'string') {
+        errors.push(
+          `frontmatter.${field} must be a string (one of ${JSON.stringify(spec.enum)}), got ${Array.isArray(value) ? 'array' : typeof value}`,
+        );
+      } else if (!spec.enum.includes(value)) {
         errors.push(
           `frontmatter.${field} "${value}" is not one of ${JSON.stringify(spec.enum)}`,
         );
@@ -433,10 +462,9 @@ function validateFrontmatter(fm, skillName) {
   }
 
   if ('last_threat_review' in fm) {
-    if (typeof fm.last_threat_review !== 'string' || !ISO_DATE_RE.test(fm.last_threat_review) ||
-        !Number.isFinite(Date.parse(fm.last_threat_review + 'T00:00:00Z'))) {
+    if (!isStrictIsoCalendarDate(fm.last_threat_review)) {
       errors.push(
-        `frontmatter.last_threat_review "${fm.last_threat_review}" is not a valid ISO date (YYYY-MM-DD). A structurally ISO but non-calendar value (e.g. 2026-13-99) is rejected so a malformed date cannot slip past the staleness gate.`,
+        `frontmatter.last_threat_review "${fm.last_threat_review}" is not a valid ISO date (YYYY-MM-DD). A structurally ISO but non-calendar value (e.g. 2026-13-99 or a rollover like 2026-02-30) is rejected so a malformed date cannot slip past the staleness gate.`,
       );
     } else {
       // v0.13.0: Hard Rule #8 forcing function — refuse skills whose
@@ -1044,6 +1072,7 @@ module.exports = {
   MIN_SECTION_BODY_WORDS,
   validateFrontmatter,
   schemaConstraintErrors,
+  isStrictIsoCalendarDate,
   FRONTMATTER_SCHEMA,
 };
 

package/lib/prefetch.js

@@ -738,8 +738,10 @@ async function prefetch(options = {}) {
             current.entries[entryKey(item.source, item.id)] = meta;
             return current;
           });
-          // Mirror the entry into the in-memory idx for callers that read
-          // it later in this run (e.g. the final saveIndex merge).
+          // Mirror the entry into the in-memory idx snapshot so any
+          // later in-run freshness check sees this entry as fresh. The
+          // authoritative on-disk write already happened under the lock
+          // above; this is the in-memory copy only.
           idx.entries[entryKey(item.source, item.id)] = meta;
         } catch (lockErr) {
           // Lock failure OR rename-inside-lock failure — unlink the staged
@@ -763,11 +765,17 @@ async function prefetch(options = {}) {
 
   await Promise.all(jobPromises);
   await queue.drain();
-  idx.generated_at = new Date().toISOString();
-  // v0.12.12 C2: saveIndex now merges under lock with whatever is on disk
-  // (another concurrent prefetch's entries). Without the merge, a sibling
-  // run's writes would be silently overwritten here at the end of our run.
-  await saveIndex(opts.cacheDir, idx);
+  // Each fetched entry was already persisted to the on-disk index under
+  // lock during the run (the per-entry withIndexLock above), so the final
+  // write only needs to stamp generated_at. Re-merging the whole
+  // start-of-run `idx` snapshot here would RESURRECT entries a concurrent
+  // run pruned between our snapshot and now — partially defeating the
+  // concurrency fix the per-entry lock provides. Bump generated_at on the
+  // CURRENT on-disk index under lock instead, touching nothing else.
+  await withIndexLock(opts.cacheDir, (current) => {
+    current.generated_at = new Date().toISOString();
+    return current;
+  });
 
   // Sign the freshly-written _index.json with the Ed25519 private key
   // (.keys/private.pem). The signature is a sidecar `_index.json.sig`;

package/lib/schemas/skill-frontmatter.schema.json

@@ -87,9 +87,9 @@
       "type": "array",
       "items": {
         "type": "string",
-        "pattern": "^D3-[A-Z]+$"
+        "pattern": "^D3[AF]?-[A-Z0-9]+(?:-[A-Z0-9]+)*$"
       },
-      "description": "Optional. MITRE D3FEND defensive technique IDs the skill maps to. Each must resolve in data/d3fend-catalog.json."
+      "description": "Optional. MITRE D3FEND defensive technique IDs the skill maps to, across the D3-, D3A- (analysis), and D3F- (offensive/forensic) namespaces. Each must resolve in data/d3fend-catalog.json."
     },
     "dlp_refs": {
       "type": "array",

package/lib/source-ghsa.js

@@ -246,8 +246,14 @@ async function fetchAdvisoryById(id, opts = {}) {
     if (!match) return { ok: false, error: `${id} not in fixture`, source: "fixture" };
     return { ok: true, advisories: [match], source: "fixture" };
   }
-  if (/^GHSA-/i.test(id)) {
-    return fetchAdvisories({ ...opts, path: `/advisories/${id.toLowerCase()}` });
+  // Validate the FULL GHSA token shape (GHSA-xxxx-xxxx-xxxx) before building the
+  // request path, and encodeURIComponent the segment — symmetric with the CVE
+  // branch below. A prefix-only `/^GHSA-/i` left the remainder unconstrained, so
+  // an operator-supplied id like `GHSA-aaaa/../../meta` survived verbatim into
+  // `/advisories/...` as path-control segments; the strict shape now routes a
+  // malformed id to the unrecognized-id error envelope instead.
+  if (/^GHSA-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}$/i.test(id)) {
+    return fetchAdvisories({ ...opts, path: `/advisories/${encodeURIComponent(id.toLowerCase())}` });
   }
   if (/^CVE-\d{4}-\d+$/i.test(id)) {
     return fetchAdvisories({ ...opts, path: `/advisories?cve_id=${encodeURIComponent(id.toUpperCase())}` });

package/lib/source-osv.js

@@ -542,6 +542,16 @@ function extractCvss(rec) {
   // back from v4 -> v3 if v4 fails to compute.
   const vectorsByVersion = new Map(); // version (number) -> vector string
   let bareScore = null;
+  // Computed score for a single CVSS vector string: its trailing /N.N score if
+  // present, else the derived CVSS 3.x base score, else null (e.g. an
+  // uncomputable v4 vector). Used to keep the HIGHEST-scoring vector per major
+  // version regardless of severity[] array order.
+  const vectorScore = (vec) => {
+    const tail = vec.match(/\/(\d+(?:\.\d+)?)$/);
+    if (tail) { const t = parseFloat(tail[1]); if (t >= 0 && t <= 10) return t; }
+    if (/^CVSS:3\./.test(vec)) { const c = cvss3BaseScore(vec); if (c != null) return c; }
+    return null;
+  };
   for (const s of sev) {
     if (s == null) continue;
     let raw = null;
@@ -554,15 +564,21 @@ function extractCvss(rec) {
     // Bare numeric score (no vector prefix).
     const num = parseFloat(v);
     if (!Number.isNaN(num) && num >= 0 && num <= 10 && !v.includes("/")) {
-      if (bareScore == null) bareScore = num;
+      // HIGHEST-wins, not first-wins: an OSV record legitimately carries
+      // multiple same-version severity entries (e.g. an NVD base score plus a
+      // CNA/vendor score) and the upstream array order is not guaranteed. A
+      // first-wins guard silently downgraded a 9.8 critical to a 5.3 medium
+      // purely because the lower score appeared earlier in severity[].
+      if (bareScore == null || num > bareScore) bareScore = num;
       continue;
     }
     const m = v.match(/^CVSS:(\d+\.\d+)/);
     if (!m) continue;
     const ver = parseFloat(m[1]);
-    // Keep the highest score within each major version.
+    // Keep the HIGHEST-scoring vector within each major version (same rationale
+    // as the bare-score path above). Compare computed scores, not array order.
     const prev = vectorsByVersion.get(ver);
-    if (!prev) vectorsByVersion.set(ver, v);
+    if (!prev || (vectorScore(v) ?? -1) > (vectorScore(prev) ?? -1)) vectorsByVersion.set(ver, v);
   }
   // Try versions in descending order. CVSS 4.0 derivation is not yet
   // implemented here — if v4 was the highest but can't be computed, walk

package/lib/ttp-mapper.js

@@ -5,7 +5,16 @@
  * and surfaces gaps where controls fail to cover attacker techniques.
  */
 
+const hasOwn = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
+
 function map(controlId, gapCatalog) {
+  // hasOwnProperty guard: a bare gapCatalog[controlId] dereferences inherited
+  // Object.prototype members, so controlId='__proto__' / 'toString' /
+  // 'constructor' returned found:true for a key that is not a real catalog
+  // entry. Only own enumerable keys are catalog controls.
+  if (!gapCatalog || !hasOwn(gapCatalog, controlId)) {
+    return { control_id: controlId, found: false, message: 'Control not in gap catalog' };
+  }
   const entry = gapCatalog[controlId];
   if (!entry) return { control_id: controlId, found: false, message: 'Control not in gap catalog' };
   return {
@@ -47,6 +56,12 @@ function coverage(frameworkId, ttpId, gapCatalog, atlasCatalog) {
     return { ttp_id: ttpId, found: false, error: 'frameworkId required', partially_covered_by: null, not_covered_by: null };
   }
 
+  // hasOwnProperty guard: ttpId='__proto__' / 'toString' / 'constructor'
+  // would otherwise resolve to an inherited Object.prototype member and be
+  // treated as a real ATLAS technique. Only own keys are catalog techniques.
+  if (!atlasCatalog || !hasOwn(atlasCatalog, ttpId)) {
+    return { ttp_id: ttpId, found: false };
+  }
   const ttp = atlasCatalog[ttpId];
   if (!ttp) return { ttp_id: ttpId, found: false };
 

package/lib/upstream-check.js

@@ -47,7 +47,15 @@ async function fetchLatestPublished({ timeoutMs = REQUEST_TIMEOUT_MS, pkgName =
       const fs = require("fs");
       const fixture = JSON.parse(fs.readFileSync(process.env.EXCEPTD_REGISTRY_FIXTURE, "utf8"));
       const version = fixture["dist-tags"]?.latest || fixture.version;
-      const published = fixture.time?.[version] || fixture.time?.modified;
+      // Same guard the network branch applies: a fixture with neither
+      // dist-tags.latest nor a top-level version yields no freshness signal.
+      // Returning ok:true with version:undefined would let an undefined
+      // version leak into buildFreshnessReport's semver compare and the
+      // operator-facing hint. Degrade to an explicit offline refusal.
+      if (!version) {
+        return { ok: false, error: "fixture missing dist-tags.latest / version", source: "offline" };
+      }
+      const published = fixture.time?.[version] || fixture.time?.modified || null;
       return { ok: true, version, published_at: published, source: "fixture" };
     } catch (e) {
       return { ok: false, error: `fixture: ${e.message}`, source: "offline" };
@@ -120,8 +128,14 @@ function buildFreshnessReport({ localVersion, registry, localManifest }) {
     };
   }
   const cmp = semverCmp(localVersion, registry.version);
-  const daysBehind = registry.published_at
-    ? Math.max(0, Math.floor((Date.now() - new Date(registry.published_at).getTime()) / (24 * 3600 * 1000)))
+  // Parse the publish timestamp once and validate it. A non-empty but
+  // unparseable date string (e.g. a malformed registry `time` value) makes
+  // `new Date(...).getTime()` return NaN, which would otherwise propagate
+  // NaN into days_since_latest_publish. Degrade an unparseable date to the
+  // explicit null (signal-absent) branch instead of emitting NaN.
+  const publishedTs = registry.published_at ? new Date(registry.published_at).getTime() : NaN;
+  const daysBehind = Number.isFinite(publishedTs)
+    ? Math.max(0, Math.floor((Date.now() - publishedTs) / (24 * 3600 * 1000)))
     : null;
   // Manifest's last_threat_review (per-skill) — surface the most stale.
   let oldestReview = null;

package/lib/validate-cve-catalog.js

@@ -384,8 +384,16 @@ function main() {
   const schema = readJson(SCHEMA_PATH);
   const catalog = readJson(CATALOG_PATH);
   const lessons = readJson(LESSONS_PATH);
-  const atlas = fs.existsSync(ATLAS_PATH) ? readJson(ATLAS_PATH) : {};
-  const cwe = fs.existsSync(CWE_PATH) ? readJson(CWE_PATH) : {};
+  // All five reference catalogs default to null when absent so the
+  // "cannot validate — catalog absent" branch in additionalChecks fires
+  // uniformly for every ref family. atlas/cwe previously defaulted to {},
+  // which built an EMPTY Set (never null) — so an absent atlas/cwe catalog
+  // silently FLAGGED every ref as unresolved (false positive) instead of
+  // surfacing the catalog-absent warning, the asymmetric opposite of how
+  // attack/d3fend/framework behaved. Uniform null makes the absence
+  // observable rather than misclassified.
+  const atlas = fs.existsSync(ATLAS_PATH) ? readJson(ATLAS_PATH) : null;
+  const cwe = fs.existsSync(CWE_PATH) ? readJson(CWE_PATH) : null;
   const attack = fs.existsSync(ATTACK_PATH) ? readJson(ATTACK_PATH) : null;
   const d3fend = fs.existsSync(D3FEND_PATH) ? readJson(D3FEND_PATH) : null;
   const frameworks = fs.existsSync(FRAMEWORK_GAPS_PATH)
@@ -393,8 +401,12 @@ function main() {
     : null;
 
   const ctx = {
-    atlasKeys: new Set(Object.keys(atlas).filter((k) => !k.startsWith('_'))),
-    cweKeys: new Set(Object.keys(cwe).filter((k) => !k.startsWith('_'))),
+    atlasKeys: atlas
+      ? new Set(Object.keys(atlas).filter((k) => !k.startsWith('_')))
+      : null,
+    cweKeys: cwe
+      ? new Set(Object.keys(cwe).filter((k) => !k.startsWith('_')))
+      : null,
     attackKeys: attack
       ? new Set(Object.keys(attack).filter((k) => !k.startsWith('_')))
       : null,

package/lib/validate-package.js

@@ -150,8 +150,15 @@ function main() {
     }
   }
 
-  // Size budget
-  if (typeof packInfo.size === "number" && packInfo.size > SIZE_BUDGET_BYTES) {
+  // Size budget. An absent/non-numeric `size` field is NOT a pass — it means
+  // the gate cannot evaluate the budget at all. Fail loudly instead of
+  // silently skipping (the absent-field-fails-open class, symmetric with the
+  // license_sha256 / vendored_sha256 guards in validate-vendor.js): a future
+  // npm-pack output shape change that drops or renames `size` must not turn the
+  // size budget into a no-op.
+  if (typeof packInfo.size !== "number") {
+    issues.push(`npm pack output missing numeric size — cannot enforce size budget`);
+  } else if (packInfo.size > SIZE_BUDGET_BYTES) {
     issues.push(`tarball size ${(packInfo.size / 1024 / 1024).toFixed(2)} MB exceeds budget ${(SIZE_BUDGET_BYTES / 1024 / 1024).toFixed(0)} MB`);
   }
 

package/lib/validate-playbooks.js

@@ -129,6 +129,25 @@ function typeOf(value) {
   return typeof value;
 }
 
+// Strict ISO calendar-date check for format:date fields. The shape regex alone
+// accepts impossible dates — `new Date('2026-02-30T00:00:00Z')` does NOT throw,
+// it silently rolls over to March 2 and reports a valid getTime() — so a
+// malformed _meta.last_threat_review or changelog `date` (2026-02-30,
+// 2026-13-40) would pass with only the YYYY-MM-DD shape test. Require the
+// parsed Y-M-D to round-trip back to the input components, mirroring
+// parseIsoDateStrict in lib/validate-catalog-meta.js.
+function isStrictIsoDate(value) {
+  if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(value)) return false;
+  const d = new Date(value + 'T00:00:00Z');
+  if (Number.isNaN(d.getTime())) return false;
+  const [y, m, day] = value.split('-').map(Number);
+  return (
+    d.getUTCFullYear() === y &&
+    d.getUTCMonth() + 1 === m &&
+    d.getUTCDate() === day
+  );
+}
+
 function typeMatches(value, expected) {
   if (Array.isArray(expected)) return expected.some((t) => typeMatches(value, t));
   const actual = typeOf(value);
@@ -185,7 +204,7 @@ function validate(value, schema, schemaName, pathStr) {
       }
     }
     if (schema.format === 'date') {
-      if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) {
+      if (!isStrictIsoDate(value)) {
         err(`${here}: value ${JSON.stringify(value)} is not an ISO date (YYYY-MM-DD)`);
       }
     }
@@ -669,6 +688,21 @@ function checkCrossRefs(playbook, ctx, playbookIds) {
   // the source is the base phase or a directive override.
   function checkRwepThreshold(rwepObj, pathPrefix) {
     const rwep = rwepObj || {};
+    // Range check is PER-KEY and independent of the others. A directive's
+    // phase_overrides.direct.rwep_threshold is a partial fragment the runner
+    // deep-merges, so it may carry only one of the three keys — gating the
+    // whole check on all-three-present let an out-of-range single-key override
+    // (e.g. {escalate: 150} or {close: -5}) ship unchecked and reach the
+    // runner. Validate each present numeric key on its own.
+    for (const k of ['close', 'monitor', 'escalate']) {
+      const v = rwep[k];
+      if (typeof v === 'number' && (v < 0 || v > 100)) {
+        err(`${pathPrefix}.${k}: ${v} outside 0..100`);
+      }
+    }
+    // Ordering is only meaningful when the full triple is present (a partial
+    // override inherits the missing edges from the base phase, so close <=
+    // monitor <= escalate can't be evaluated on the fragment alone).
     if (
       typeof rwep.close === 'number' &&
       typeof rwep.monitor === 'number' &&
@@ -679,15 +713,6 @@ function checkCrossRefs(playbook, ctx, playbookIds) {
           `${pathPrefix}: ordering violation — expected close <= monitor <= escalate, got close=${rwep.close} monitor=${rwep.monitor} escalate=${rwep.escalate}`,
         );
       }
-      for (const [k, v] of [
-        ['close', rwep.close],
-        ['monitor', rwep.monitor],
-        ['escalate', rwep.escalate],
-      ]) {
-        if (v < 0 || v > 100) {
-          err(`${pathPrefix}.${k}: ${v} outside 0..100`);
-        }
-      }
     }
   }
 

package/lib/validate-vendor.js

@@ -111,17 +111,23 @@ function main() {
   }
 
   // On-disk inventory cross-check (BJS-04): the loop above is one-directional
-  // (manifest → disk). A .js file PRESENT in vendor/blamejs/ but ABSENT from
-  // _PROVENANCE.json would ship in the tarball and be require()'d by lib code
-  // while NOTHING verifies its integrity — an unregistered or smuggled-in
-  // vendored module. Flag every on-disk .js that the manifest does not record.
+  // (manifest → disk). A loadable JS module PRESENT in vendor/blamejs/ but
+  // ABSENT from _PROVENANCE.json would ship in the tarball and be require()'d
+  // by lib code while NOTHING verifies its integrity — an unregistered or
+  // smuggled-in vendored module. Node executes `.js`, `.cjs`, and `.mjs` as
+  // code, so a `.cjs`/`.mjs` smuggled module carries the same arbitrary-code
+  // risk as a `.js` one — checking only `.js` let a renamed extension slip the
+  // gate. `.json`/`.node` are deliberately NOT swept here: `_PROVENANCE.json`
+  // itself lives in this directory and is the manifest, not a registered
+  // vendored module, so sweeping `.json` would false-positive on the manifest.
+  const LOADABLE_MODULE = /\.(c|m)?js$/;
   const registered = new Set(
     Object.values(prov.files || {}).map((info) => path.basename(info.vendored_path))
   );
   const vendorDir = path.join(ROOT, "vendor", "blamejs");
   try {
     for (const f of fs.readdirSync(vendorDir)) {
-      if (!f.endsWith(".js")) continue;
+      if (!LOADABLE_MODULE.test(f)) continue;
       if (!registered.has(f)) {
         issues.push(`unregistered vendored file: vendor/blamejs/${f} is on disk but absent from _PROVENANCE.json — its integrity is not verified`);
       }

package/lib/xml-tokenizer.js

@@ -400,6 +400,7 @@ function parseFeedDetailed(xml) {
   let activeField = null;   // active field local-name
   let buffer = "";          // accumulator for current field text
   let linkRank = 0;         // rel-rank of the best <link> captured so far
+  let linkRel = null;       // rel of the link element currently open (for its element-text close)
 
   tokenize(xml, {
     rawTextElements: LEAF_FIELDS,
@@ -413,6 +414,10 @@ function parseFeedDetailed(xml) {
       if (FIELD_MAP[name]) {
         activeField = FIELD_MAP[name];
         buffer = "";
+        // Remember this link element's rel so its element-text close (below) is
+        // ranked the same way the attribute path is — a non-alternate link with
+        // text must not clobber a captured rel=alternate.
+        if (name === "link") linkRel = attrs ? attrs.rel : null;
         // Atom <link href="..."/> — rel-aware selection. Only let an
         // alternate / rel-absent link upgrade the captured value, and never
         // let a non-alternate rel (self/replies/edit) clobber an alternate
@@ -442,14 +447,19 @@ function parseFeedDetailed(xml) {
       if (!current) return;
       if (FIELD_MAP[name] && activeField === FIELD_MAP[name]) {
         const value = buffer.trim();
-        // RSS <link>...</link> — element text is authoritative (rank 2),
-        // unconditional. An empty element-text link falls back to whatever
-        // attribute capture onTagOpen already recorded.
+        // <link>...</link> element text — ranked by the link's rel, the SAME
+        // gate the attribute path uses, so a non-alternate (self/replies/edit)
+        // link with text cannot clobber a captured rel=alternate. RSS links
+        // carry no rel, and relRank(undefined) === 2, so RSS element-text links
+        // keep their previous authoritative rank. An empty element-text link
+        // falls back to whatever attribute capture onTagOpen already recorded.
         if (name === "link") {
-          if (value) {
+          const r = relRank(linkRel);
+          if (value && r > linkRank) {
             current.link = value;
-            linkRank = 2;
+            linkRank = r;
           }
+          linkRel = null;
         } else if (activeField === "body" || activeField === "title") {
           // Strip HTML tags from title + description / content / summary.
           // Many feeds embed inline HTML (<b>, <em>, <a>) in titles for
@@ -498,9 +508,27 @@ function parseFeed(xml, errors = null) {
 
 function stripHtml(s) {
   if (typeof s !== "string") return "";
-  // First strip tags, then collapse runs of whitespace including
-  // newlines. Entity decoding has already happened by this point.
-  return s.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+  // Single-pass tag strip. A backtracking /<[^>]+>/g is O(n^2) on
+  // attacker-controlled feed text with many '<' and no '>' (a ~150 KB
+  // <title>/<description> of bare '<' froze the refresh worker for seconds —
+  // a ReDoS-class DoS, since parseFeed() runs on network-fetched RSS/Atom
+  // bodies). Walk '<'..'>' instead, preserving the prior contract exactly: a
+  // real `<...>` becomes a space; a stray '<' with no closing '>' and an empty
+  // '<>' survive as literal text (the `[^>]+` quantifier required >=1 char, so
+  // neither matched). Then collapse whitespace as before.
+  let out = "";
+  let i = 0;
+  while (i < s.length) {
+    const lt = s.indexOf("<", i);
+    if (lt === -1) { out += s.slice(i); break; }
+    out += s.slice(i, lt);
+    const gt = s.indexOf(">", lt + 1);
+    if (gt === -1) { out += s.slice(lt); break; }       // stray '<' -> literal
+    if (gt === lt + 1) { out += "<>"; i = gt + 1; continue; } // empty '<>' is not a tag
+    out += " ";                                          // a real tag -> space
+    i = gt + 1;
+  }
+  return out.replace(/\s+/g, " ").trim();
 }
 
 module.exports = { tokenize, parseFeed, parseFeedDetailed, decodeEntities, localName, parseAttrs, stripHtml };