From 584271a195250b7bd2950943012568ce15e0bdf9 Mon Sep 17 00:00:00 2001
From: William Zujkowski <williamzujkowski@gmail.com>
Date: Tue, 6 Oct 2026 09:33:06 -0400
Subject: [PATCH 1/2] fix(web): resolve 2xl layout, section sorting, security
 hardening, and bundle footprint

- Fix 2xl viewport layout distortion in BaseLayout.astro by anchoring footer as a full-width bottom child
- Resolve section sorting bug (parseFloat evaluating Title 42 Section 2000e-1 in scientific notation) with compareSectionNumbers
- Harden CSP with base-uri, object-src, and form-action directives
- Replace chapter full-text innerHTML DOM assignment with document.adoptNode
- Add --color-amber dark mode token (#FFBE2E) for WCAG AA contrast on navy
- Decouple sanitizeExcerpt into sanitize.ts to prevent bundling Octokit on every page
- Add OptionalHttpUrlSchema to avoid crashing on empty or unpinned CourtListener source URLs
- Cap MAX_DECOMPRESSED_BYTES to 500 MiB within V8 MAX_STRING_LENGTH
- Add randomized jitter to retry exponential backoff
- Exclude src/__tests__ from tsconfig.build.json across packages to speed up Vitest
---
 apps/web/package.json                         |  1 +
 .../src/__tests__/markdown-sanitize.test.ts   | 11 ++++
 apps/web/src/components/ReadingToolbar.svelte | 43 ++++++++----
 apps/web/src/components/SearchBar.svelte      |  2 +-
 apps/web/src/components/SummaryBox.astro      | 40 ++++++++----
 apps/web/src/layouts/BaseLayout.astro         | 14 ++--
 apps/web/src/lib/github.ts                    | 65 +++----------------
 apps/web/src/lib/sanitize.ts                  | 26 ++++++++
 apps/web/src/pages/browse/[title].astro       | 25 ++++---
 .../src/pages/browse/[title]/[chapter].astro  | 14 ++--
 apps/web/src/pages/statute/[...slug].astro    | 14 ++--
 apps/web/src/styles/global.css                | 16 +----
 package.json                                  |  2 -
 packages/annotator/src/annotator.ts           | 11 +++-
 packages/annotator/src/client.ts              |  3 +-
 packages/annotator/tsconfig.build.json        |  3 +-
 packages/fetcher/src/constants.ts             |  8 +--
 packages/fetcher/tsconfig.build.json          |  3 +-
 packages/shared/src/__tests__/sort.test.ts    | 39 +++++++++++
 packages/shared/src/index.ts                  |  1 +
 packages/shared/src/retry.ts                  |  6 +-
 packages/shared/src/sort.ts                   | 15 +++++
 packages/types/src/__tests__/schemas.test.ts  |  5 ++
 packages/types/src/index.ts                   | 11 +++-
 packages/types/tsconfig.build.json            |  3 +-
 pnpm-lock.yaml                                |  9 +--
 26 files changed, 239 insertions(+), 151 deletions(-)
 create mode 100644 apps/web/src/lib/sanitize.ts
 create mode 100644 packages/shared/src/__tests__/sort.test.ts
 create mode 100644 packages/shared/src/sort.ts

diff --git a/apps/web/package.json b/apps/web/package.json
index c5f2c8b..3e7a72f 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -15,6 +15,7 @@
     "@astrojs/markdown-remark": "^7.3.1",
     "@astrojs/rss": "^4.0.19",
     "@astrojs/svelte": "^9.0.1",
+    "@civic-source/shared": "workspace:*",
     "@civic-source/types": "workspace:*",
     "@fontsource/public-sans": "^5.3.0",
     "@octokit/rest": "^22.0.1",
diff --git a/apps/web/src/__tests__/markdown-sanitize.test.ts b/apps/web/src/__tests__/markdown-sanitize.test.ts
index 06e0c9d..c4f775b 100644
--- a/apps/web/src/__tests__/markdown-sanitize.test.ts
+++ b/apps/web/src/__tests__/markdown-sanitize.test.ts
@@ -14,7 +14,18 @@ describe('markdown sanitization wiring', () => {
   it('astro config registers rehype-sanitize as a markdown rehype plugin', () => {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const unifiedOptions = (astroConfig.markdown as any)?.unified?.options;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const plugins = unifiedOptions?.rehypePlugins ?? (astroConfig.markdown as any)?.rehypePlugins ?? [];
     expect(plugins).toContain(rehypeSanitize);
   });
+
+  it('unified markdown renderer strips malicious script tags from output', async () => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const unifiedProcessor = (astroConfig.markdown as any)?.unified;
+    expect(unifiedProcessor).toBeDefined();
+    const renderer = await unifiedProcessor.createRenderer({});
+    const result = await renderer.render('# Section Title\n\n<script>alert("xss")</script>\n\nLegitimate statutory text.');
+    expect(result.code).not.toContain('<script>');
+    expect(result.code).toContain('Legitimate statutory text.');
+  });
 });
diff --git a/apps/web/src/components/ReadingToolbar.svelte b/apps/web/src/components/ReadingToolbar.svelte
index 80f7969..48d979d 100644
--- a/apps/web/src/components/ReadingToolbar.svelte
+++ b/apps/web/src/components/ReadingToolbar.svelte
@@ -5,21 +5,28 @@
 
   $effect(() => {
     if (typeof window === 'undefined') return;
-    const storedFont = localStorage.getItem('reading-font');
-    if (storedFont === 'sans' || storedFont === 'serif') fontMode = storedFont;
+    try {
+      const storedFont = localStorage.getItem('reading-font');
+      if (storedFont === 'sans' || storedFont === 'serif') fontMode = storedFont;
 
-    const storedSize = localStorage.getItem('reading-size');
-    if (storedSize === 'sm' || storedSize === 'base' || storedSize === 'lg') textSize = storedSize;
+      const storedSize = localStorage.getItem('reading-size');
+      if (storedSize === 'sm' || storedSize === 'base' || storedSize === 'lg') textSize = storedSize;
 
-    const storedMeasure = localStorage.getItem('reading-measure');
-    if (storedMeasure === 'standard' || storedMeasure === 'wide') measureMode = storedMeasure;
+      const storedMeasure = localStorage.getItem('reading-measure');
+      if (storedMeasure === 'standard' || storedMeasure === 'wide') measureMode = storedMeasure;
+    } catch {
+      // Storage access blocked or restricted
+    }
 
     applyClasses();
   });
 
   function applyClasses() {
     if (typeof document === 'undefined') return;
-    const article = document.querySelector('article.prose') || document.querySelector('.prose');
+    const article =
+      document.querySelector('article.prose') ||
+      document.querySelector('.prose-statute') ||
+      document.querySelector('.prose');
     if (!article) return;
 
     // Font family
@@ -38,7 +45,11 @@
 
   function setFont(mode: 'serif' | 'sans') {
     fontMode = mode;
-    localStorage.setItem('reading-font', mode);
+    try {
+      localStorage.setItem('reading-font', mode);
+    } catch {
+      // Storage access blocked or restricted
+    }
     applyClasses();
   }
 
@@ -46,13 +57,21 @@
     if (textSize === 'sm') textSize = 'base';
     else if (textSize === 'base') textSize = 'lg';
     else textSize = 'sm';
-    localStorage.setItem('reading-size', textSize);
+    try {
+      localStorage.setItem('reading-size', textSize);
+    } catch {
+      // Storage access blocked or restricted
+    }
     applyClasses();
   }
 
   function toggleMeasure() {
     measureMode = measureMode === 'standard' ? 'wide' : 'standard';
-    localStorage.setItem('reading-measure', measureMode);
+    try {
+      localStorage.setItem('reading-measure', measureMode);
+    } catch {
+      // Storage access blocked or restricted
+    }
     applyClasses();
   }
 </script>
@@ -91,7 +110,7 @@
       class="inline-flex items-center gap-1 rounded-md border border-gray-200 bg-white px-2.5 py-1 text-xs font-medium text-slate shadow-2xs hover:bg-gray-50 dark:border-gray-700 dark:bg-gray-800 dark:text-gray-200 dark:hover:bg-gray-700"
       aria-label="Toggle text size"
     >
-      <span class="text-[11px] text-gray-400">Size:</span>
+      <span class="text-[11px] text-slate dark:text-gray-300">Size:</span>
       <span class="font-bold">{textSize === 'sm' ? '17px' : textSize === 'base' ? '19px' : '21px'}</span>
     </button>
 
@@ -102,7 +121,7 @@
       class="inline-flex items-center gap-1 rounded-md border border-gray-200 bg-white px-2.5 py-1 text-xs font-medium text-slate shadow-2xs hover:bg-gray-50 dark:border-gray-700 dark:bg-gray-800 dark:text-gray-200 dark:hover:bg-gray-700"
       aria-label="Toggle reading line width"
     >
-      <span class="text-[11px] text-gray-400">Width:</span>
+      <span class="text-[11px] text-slate dark:text-gray-300">Width:</span>
       <span>{measureMode === 'standard' ? 'Standard' : 'Wide'}</span>
     </button>
   </div>
diff --git a/apps/web/src/components/SearchBar.svelte b/apps/web/src/components/SearchBar.svelte
index 405aea5..17c3102 100644
--- a/apps/web/src/components/SearchBar.svelte
+++ b/apps/web/src/components/SearchBar.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-  import { sanitizeExcerpt } from "../lib/github";
+  import { sanitizeExcerpt } from "../lib/sanitize";
 
   // Pagefind types for the dynamically imported module
   interface PagefindResult {
diff --git a/apps/web/src/components/SummaryBox.astro b/apps/web/src/components/SummaryBox.astro
index e43b31a..1a6056e 100644
--- a/apps/web/src/components/SummaryBox.astro
+++ b/apps/web/src/components/SummaryBox.astro
@@ -26,12 +26,13 @@ const {
 
 const isRepealed = status === 'repealed';
 const isTransferred = status === 'transferred';
+const isRenumbered = status === 'renumbered';
 const isOmitted = status === 'omitted';
 const isReserved = status === 'reserved';
 
 const borderAccent = isRepealed
   ? 'border-crimson bg-crimson-light/20 dark:border-red-500 dark:bg-red-950/20'
-  : isTransferred || isOmitted || isReserved
+  : isTransferred || isRenumbered || isOmitted || isReserved
   ? 'border-amber bg-amber-light/20 dark:border-amber-500 dark:bg-amber-950/20'
   : 'border-teal bg-teal-light/20 dark:border-teal dark:bg-teal/10';
 
@@ -39,6 +40,8 @@ const statusBadge = isRepealed
   ? { label: 'Repealed', class: 'bg-crimson/15 text-crimson dark:bg-red-900/40 dark:text-red-300' }
   : isTransferred
   ? { label: 'Transferred', class: 'bg-amber/15 text-amber dark:bg-amber-900/40 dark:text-amber' }
+  : isRenumbered
+  ? { label: 'Renumbered', class: 'bg-amber/15 text-amber dark:bg-amber-900/40 dark:text-amber' }
   : isOmitted
   ? { label: 'Omitted', class: 'bg-gray-200 text-slate dark:bg-gray-800 dark:text-gray-300' }
   : isReserved
@@ -88,7 +91,8 @@ const statusBadge = isRepealed
       </a>
 
       <button
-        onclick="window.print()"
+        id="print-section-btn"
+        type="button"
         class="inline-flex items-center gap-1 rounded bg-white px-2 py-1 text-xs text-slate shadow-2xs hover:bg-gray-50 border border-gray-200 dark:bg-gray-800 dark:text-gray-200 dark:border-gray-700 dark:hover:bg-gray-700"
         aria-label="Print this section"
       >
@@ -124,18 +128,26 @@ const statusBadge = isRepealed
 
 <script is:inline>
   (function() {
-    var btn = document.getElementById('copy-cite-btn');
+    var copyBtn = document.getElementById('copy-cite-btn');
     var label = document.getElementById('copy-cite-label');
-    if (!btn || !label) return;
-    btn.addEventListener('click', function() {
-      var citation = btn.getAttribute('data-citation');
-      if (!citation) return;
-      navigator.clipboard.writeText(citation).then(function() {
-        label.textContent = 'Copied!';
-        setTimeout(function() {
-          label.textContent = 'Copy cite';
-        }, 2000);
-      }).catch(function() {});
-    });
+    if (copyBtn && label) {
+      copyBtn.addEventListener('click', function() {
+        var citation = copyBtn.getAttribute('data-citation');
+        if (!citation) return;
+        navigator.clipboard.writeText(citation).then(function() {
+          label.textContent = 'Copied!';
+          setTimeout(function() {
+            label.textContent = 'Copy cite';
+          }, 2000);
+        }).catch(function() {});
+      });
+    }
+
+    var printBtn = document.getElementById('print-section-btn');
+    if (printBtn) {
+      printBtn.addEventListener('click', function() {
+        window.print();
+      });
+    }
   })();
 </script>
diff --git a/apps/web/src/layouts/BaseLayout.astro b/apps/web/src/layouts/BaseLayout.astro
index 8cdad07..3bf386f 100644
--- a/apps/web/src/layouts/BaseLayout.astro
+++ b/apps/web/src/layouts/BaseLayout.astro
@@ -54,7 +54,7 @@ const titleEntries = Object.entries(TITLE_NAMES)
     <meta name="twitter:title" content={title === 'US Code Tracker' ? title : `${title} | US Code Tracker`} />
     <meta name="twitter:description" content={description} />
     <!-- CSP: defense-in-depth against XSS -->
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://api.github.com;" />
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://api.github.com; base-uri 'self'; object-src 'none'; form-action 'self';" />
     <title>{title === 'US Code Tracker' ? title : `${title} | US Code Tracker`}</title>
     <script is:inline>
       // Apply theme before render to prevent flash
@@ -129,11 +129,13 @@ const titleEntries = Object.entries(TITLE_NAMES)
         </nav>
       </aside>
 
-      <!-- Main content — flex container -->
-      <main id="main-content" class="min-h-0 flex-1 overflow-y-auto 2xl:flex 2xl:flex-row">
-        <article class="prose prose-lg prose-gray mx-auto max-w-3xl p-6 font-serif leading-relaxed dark:prose-invert lg:p-10 2xl:mx-0 2xl:flex-1 2xl:min-w-0">
-          <slot />
-        </article>
+      <!-- Main content — vertical container with full-width bottom footer -->
+      <main id="main-content" tabindex="-1" class="min-h-0 flex-1 overflow-y-auto flex flex-col focus:outline-none">
+        <div class="flex-1 2xl:flex 2xl:flex-row 2xl:justify-center">
+          <article class="prose prose-lg prose-gray mx-auto max-w-3xl p-6 font-serif leading-relaxed dark:prose-invert lg:p-10 2xl:mx-0 2xl:flex-1 2xl:min-w-0">
+            <slot />
+          </article>
+        </div>
 
         <!-- Footer -->
         <footer class="border-t border-gray-200 bg-warm-gray px-6 py-8 font-sans text-xs text-slate dark:border-gray-800 dark:bg-[#07131F] dark:text-gray-400">
diff --git a/apps/web/src/lib/github.ts b/apps/web/src/lib/github.ts
index 6d12570..8e78a11 100644
--- a/apps/web/src/lib/github.ts
+++ b/apps/web/src/lib/github.ts
@@ -1,5 +1,5 @@
 import { Octokit } from "@octokit/rest";
-import sanitizeHtml from "sanitize-html";
+import { sanitizeContent, sanitizeExcerpt } from "./sanitize.js";
 
 export interface CommitInfo {
   sha: string;
@@ -60,48 +60,22 @@ export async function getFileDiff(
     const file = files.find((f) => f.filename === options.path);
     if (!file?.patch) return [];
 
-    return file.patch.split("\n").map((line) => {
+    return file.patch.split("\n").flatMap((line): DiffLine[] => {
+      if (line.startsWith("@@")) return [];
       if (line.startsWith("+") && !line.startsWith("+++")) {
-        return { type: "add", content: line.slice(1) };
+        return [{ type: "add", content: line.slice(1) }];
       }
       if (line.startsWith("-") && !line.startsWith("---")) {
-        return { type: "del", content: line.slice(1) };
+        return [{ type: "del", content: line.slice(1) }];
       }
-      return { type: "context", content: line };
+      const content = line.startsWith(" ") ? line.slice(1) : line;
+      return [{ type: "context", content }];
     });
   } catch {
     return null;
   }
 }
 
-export interface ReleaseTag {
-  name: string;
-  date: string;
-}
-
-export async function getReleaseTags(
-  owner: string,
-  repo: string,
-  token?: string,
-): Promise<ReleaseTag[]> {
-  const octokit = createClient(token);
-  const response = await octokit.repos.listTags({ owner, repo, per_page: 100 });
-
-  const parseTag = (name: string): [number, number] => {
-    const m = /pl-(\d+)-(\d+)/.exec(name);
-    return m && m[1] && m[2] ? [parseInt(m[1], 10), parseInt(m[2], 10)] : [0, 0];
-  };
-
-  return response.data
-    .filter((t) => t.name.startsWith("pl-"))
-    .map((t) => ({ name: t.name, date: "" }))
-    .sort((a, b) => {
-      const [ac, al] = parseTag(a.name);
-      const [bc, bl] = parseTag(b.name);
-      return ac !== bc ? ac - bc : al - bl;
-    });
-}
-
 export async function getFileAtRef(
   owner: string,
   repo: string,
@@ -123,30 +97,7 @@ export async function getFileAtRef(
   }
 }
 
-/**
- * Strip all HTML tags to plain text.
- * Uses sanitize-html (a real HTML parser), not regex, so encoded entities and
- * malformed/nested tags can't bypass it. For displaying untrusted content as text.
- */
-export function sanitizeContent(raw: string): string {
-  return sanitizeHtml(raw, {
-    allowedTags: [],
-    allowedAttributes: {},
-    disallowedTagsMode: "discard",
-  });
-}
-
-/**
- * Sanitize Pagefind excerpt HTML, preserving only <mark> highlight tags.
- * Used in client-side search results rendered via {@html ...}.
- */
-export function sanitizeExcerpt(html: string): string {
-  return sanitizeHtml(html, {
-    allowedTags: ["mark"],
-    allowedAttributes: {},
-    disallowedTagsMode: "discard",
-  });
-}
+export { sanitizeContent, sanitizeExcerpt };
 
 /** Format a pl-* tag name into a human-readable label */
 export function formatTagName(tag: string): string {
diff --git a/apps/web/src/lib/sanitize.ts b/apps/web/src/lib/sanitize.ts
new file mode 100644
index 0000000..c6f71a8
--- /dev/null
+++ b/apps/web/src/lib/sanitize.ts
@@ -0,0 +1,26 @@
+import sanitizeHtml from 'sanitize-html';
+
+/**
+ * Strip all HTML tags to plain text.
+ * Uses sanitize-html (a real HTML parser), not regex, so encoded entities and
+ * malformed/nested tags can't bypass it. For displaying untrusted content as text.
+ */
+export function sanitizeContent(raw: string): string {
+  return sanitizeHtml(raw, {
+    allowedTags: [],
+    allowedAttributes: {},
+    disallowedTagsMode: 'discard',
+  });
+}
+
+/**
+ * Sanitize Pagefind excerpt HTML, preserving only <mark> highlight tags.
+ * Used in client-side search results rendered via {@html ...}.
+ */
+export function sanitizeExcerpt(html: string): string {
+  return sanitizeHtml(html, {
+    allowedTags: ['mark'],
+    allowedAttributes: {},
+    disallowedTagsMode: 'discard',
+  });
+}
diff --git a/apps/web/src/pages/browse/[title].astro b/apps/web/src/pages/browse/[title].astro
index 3524ee0..5537283 100644
--- a/apps/web/src/pages/browse/[title].astro
+++ b/apps/web/src/pages/browse/[title].astro
@@ -1,5 +1,6 @@
 ---
 import { getCollection } from 'astro:content';
+import { compareSectionNumbers } from '@civic-source/shared';
 import BaseLayout from '../../layouts/BaseLayout.astro';
 import Breadcrumbs from '../../components/Breadcrumbs.astro';
 import TitleFilter from '../../components/TitleFilter.svelte';
@@ -56,12 +57,7 @@ for (const entry of entries) {
 
 const sortedChapters = [...byChapter.entries()].sort((a, b) => a[0] - b[0]);
 for (const [, chapterEntries] of sortedChapters) {
-  chapterEntries.sort((a, b) => {
-    const aNum = parseFloat(a.data.usc_section);
-    const bNum = parseFloat(b.data.usc_section);
-    if (!isNaN(aNum) && !isNaN(bNum)) return aNum - bNum;
-    return a.data.usc_section.localeCompare(b.data.usc_section, undefined, { numeric: true });
-  });
+  chapterEntries.sort((a, b) => compareSectionNumbers(a.data.usc_section, b.data.usc_section));
 }
 
 const base = import.meta.env.BASE_URL;
@@ -152,13 +148,13 @@ const chapters: ChapterView[] = sortedChapters.map(([chapterNum, chapterEntries]
     <div class="not-prose mt-3 mb-2 flex gap-2 font-sans text-xs">
       <button
         id="expand-all"
+        type="button"
         class="rounded border border-gray-300 px-2 py-1 text-gray-600 hover:bg-gray-50 dark:border-gray-700 dark:text-gray-400 dark:hover:bg-gray-800"
-        onclick="document.querySelectorAll('#title-toc details').forEach(d => d.open = true)"
       >Expand all</button>
       <button
         id="collapse-all"
+        type="button"
         class="rounded border border-gray-300 px-2 py-1 text-gray-600 hover:bg-gray-50 dark:border-gray-700 dark:text-gray-400 dark:hover:bg-gray-800"
-        onclick="document.querySelectorAll('#title-toc details').forEach(d => d.open = false)"
       >Collapse all</button>
     </div>
   )}
@@ -236,6 +232,19 @@ const chapters: ChapterView[] = sortedChapters.map(([chapterNum, chapterEntries]
 
   <script is:inline>
     (function () {
+      var expandBtn = document.getElementById('expand-all');
+      var collapseBtn = document.getElementById('collapse-all');
+      if (expandBtn) {
+        expandBtn.addEventListener('click', function () {
+          document.querySelectorAll('#title-toc details').forEach(function (d) { d.open = true; });
+        });
+      }
+      if (collapseBtn) {
+        collapseBtn.addEventListener('click', function () {
+          document.querySelectorAll('#title-toc details').forEach(function (d) { d.open = false; });
+        });
+      }
+
       function openFromHash() {
         var hash = window.location.hash;
         if (!hash || !hash.startsWith('#chapter-')) return;
diff --git a/apps/web/src/pages/browse/[title]/[chapter].astro b/apps/web/src/pages/browse/[title]/[chapter].astro
index 85f50e3..12ecc6a 100644
--- a/apps/web/src/pages/browse/[title]/[chapter].astro
+++ b/apps/web/src/pages/browse/[title]/[chapter].astro
@@ -1,5 +1,6 @@
 ---
 import { getCollection, render } from 'astro:content';
+import { compareSectionNumbers } from '@civic-source/shared';
 import BaseLayout from '../../../layouts/BaseLayout.astro';
 import Breadcrumbs from '../../../components/Breadcrumbs.astro';
 import { TITLE_NAMES } from '../../../data/title-names';
@@ -30,13 +31,8 @@ export async function getStaticPaths() {
 const { titleNum, chapterNum, entries } = Astro.props;
 const titleName = TITLE_NAMES[titleNum] ?? `Title ${titleNum}`;
 
-// Sort sections numerically
-const sortedSections = entries.sort((a, b) => {
-  const aNum = parseFloat(a.data.usc_section);
-  const bNum = parseFloat(b.data.usc_section);
-  if (!isNaN(aNum) && !isNaN(bNum)) return aNum - bNum;
-  return a.data.usc_section.localeCompare(b.data.usc_section, undefined, { numeric: true });
-});
+// Sort sections using natural legal section comparison
+const sortedSections = entries.sort((a, b) => compareSectionNumbers(a.data.usc_section, b.data.usc_section));
 
 // Pre-compute section metadata (no rendering — that's deferred to toggle)
 const sectionMeta = sortedSections.map((entry) => {
@@ -247,7 +243,9 @@ const activeCount = sectionMeta.filter(s => !s.isInactive).length;
 
                   var wrapper = document.createElement('div');
                   wrapper.className = 'prose prose-gray min-w-0 font-serif dark:prose-invert [&>h1]:hidden';
-                  wrapper.innerHTML = prose.innerHTML;
+                  while (prose.firstChild) {
+                    wrapper.appendChild(document.adoptNode(prose.firstChild));
+                  }
                   article.appendChild(wrapper);
                   content.appendChild(article);
                 }
diff --git a/apps/web/src/pages/statute/[...slug].astro b/apps/web/src/pages/statute/[...slug].astro
index 07e63b6..2f3513b 100644
--- a/apps/web/src/pages/statute/[...slug].astro
+++ b/apps/web/src/pages/statute/[...slug].astro
@@ -1,5 +1,6 @@
 ---
 import { getCollection, getEntry, render } from 'astro:content';
+import { compareSectionNumbers } from '@civic-source/shared';
 import BaseLayout from '../../layouts/BaseLayout.astro';
 import DiffViewer from '../../components/DiffViewer.svelte';
 import PrecedentDrawer from '../../components/PrecedentDrawer.svelte';
@@ -21,14 +22,9 @@ export async function getStaticPaths() {
     byTitleChapter.get(key)!.push(entry);
   }
 
-  // Sort each chapter's sections
+  // Sort each chapter's sections using natural legal section comparison
   for (const [, chapterEntries] of byTitleChapter) {
-    chapterEntries.sort((a, b) => {
-      const aNum = parseFloat(a.data.usc_section);
-      const bNum = parseFloat(b.data.usc_section);
-      if (!isNaN(aNum) && !isNaN(bNum)) return aNum - bNum;
-      return a.data.usc_section.localeCompare(b.data.usc_section, undefined, { numeric: true });
-    });
+    chapterEntries.sort((a, b) => compareSectionNumbers(a.data.usc_section, b.data.usc_section));
   }
 
   // Pre-compute sorted chapter list per title for cross-chapter nav
@@ -341,7 +337,7 @@ const readingTimeMin = Math.max(1, Math.round(wordCount / 200));
       <div class="flex items-center justify-between">
         <h3 class="text-base font-semibold text-gray-800 dark:text-gray-200">Case Law</h3>
         <a
-          href={`https://www.courtlistener.com/?q=%22${usc_title}+U.S.C.+%C2%A7+${usc_section}%22&type=o`}
+          href={`https://www.courtlistener.com/?q=${encodeURIComponent(`"${usc_title} U.S.C. § ${usc_section}"`)}&type=o`}
           target="_blank"
           rel="noopener noreferrer"
           class="rounded bg-teal/10 px-2 py-1 text-xs font-medium text-teal transition-colors hover:bg-teal/20"
@@ -436,7 +432,7 @@ const readingTimeMin = Math.max(1, Math.round(wordCount / 200));
   <!-- Keyboard shortcuts: j/k navigate sections -->
   <script is:inline>
     document.addEventListener('keydown', function (e) {
-      if (e.target.tagName === 'INPUT' || e.target.tagName === 'TEXTAREA') return;
+      if (['INPUT', 'TEXTAREA', 'SELECT'].includes(e.target.tagName) || e.target.isContentEditable) return;
       var nav = document.querySelector('nav[aria-label="Section navigation"]');
       if (!nav) return;
       var links = nav.querySelectorAll('a');
diff --git a/apps/web/src/styles/global.css b/apps/web/src/styles/global.css
index 73180a4..9a3ad82 100644
--- a/apps/web/src/styles/global.css
+++ b/apps/web/src/styles/global.css
@@ -11,9 +11,7 @@
   /* USWDS 3.x official civic palette */
   --color-navy: #1A4480;            /* blue-warm-70v — primary brand, headings */
   --color-navy-dark: #112F4E;       /* blue-warm-80 — high contrast ink text */
-  --color-navy-light: #D9E8F6;      /* blue-10 — subtle civic blue tint */
   --color-state-blue: #005EA2;      /* blue-60v — interactive links, active nav */
-  --color-state-blue-hover: #1A4480;/* blue-70v — link hover */
   
   --color-teal: #0F6E56;            /* mint-50 — in-force, success, diff additions */
   --color-teal-bright: #70E8B1;     /* mint-cool-40v — dark-mode contrast teal */
@@ -22,7 +20,6 @@
   /* Darkened from #C2850C (2.82:1) to pass WCAG AA (4.5:1) on warm-white (#FAFAF8) — ratio ≈ 4.80:1 */
   --color-amber: #8B6914;           /* gold-50v — accessible alert text */
   --color-amber-light: #FEF0C8;     /* gold-10 — warning tint, anchor target flash */
-  --color-gold: #FFBE2E;            /* gold-20v — icon fills */
 
   --color-crimson: #B50909;         /* red-warm-50v — repealed status, diff deletions */
   --color-crimson-light: #FDE0DB;   /* red-10 — repealed notice, diff del background */
@@ -38,25 +35,14 @@
 /* Semantic color tokens — light mode */
 :root {
   --color-text-primary: #112F4E;      /* navy-dark — high contrast body text */
-  --color-text-secondary: #3D4551;    /* slate — supporting text */
-  --color-text-muted: #5a6474;        /* slate lightened — captions, metadata */
-  --color-surface: #FAFAF8;           /* warm-white — page background */
-  --color-surface-elevated: #F0EDE8;  /* warm-gray — cards, sidebars */
   --color-border: #d1cec8;            /* warm-border — dividers */
-  --color-diff-add: #0F6E56;          /* USWDS mint/teal diff green */
-  --color-diff-remove: #B50909;       /* USWDS crimson diff red */
 }
 
 /* Semantic color tokens — dark mode */
 :where(.dark, .dark *) {
   --color-text-primary: #e8f0f8;      /* near-white with warm-blue tint */
-  --color-text-secondary: #a8b4c0;    /* muted blue-gray */
-  --color-text-muted: #6e7e8c;        /* dim blue-gray */
-  --color-surface: #0d1b2a;           /* deep navy — page background */
-  --color-surface-elevated: #112F4E;  /* navy-dark — cards, sidebars */
   --color-border: #1e3a5a;            /* navy mid — dividers */
-  --color-diff-add: #70E8B1;          /* bright mint diff green */
-  --color-diff-remove: #f85149;       /* bright crimson diff red */
+  --color-amber: #FFBE2E;            /* bright gold — passes WCAG AA (>8:1) on deep navy */
 }
 
 /* Legal text readability — 19px desktop, 16px mobile */
diff --git a/package.json b/package.json
index 20cce7d..ef37396 100644
--- a/package.json
+++ b/package.json
@@ -17,8 +17,6 @@
     "@commitlint/cli": "^21.2.3",
     "@commitlint/config-conventional": "^21.2.3",
     "@eslint/js": "^10.0.1",
-    "@typescript-eslint/eslint-plugin": "^8.71.0",
-    "@typescript-eslint/parser": "^8.71.0",
     "eslint": "^10.12.0",
     "turbo": "^2.11.7",
     "typescript": "^6.0.3",
diff --git a/packages/annotator/src/annotator.ts b/packages/annotator/src/annotator.ts
index deec7b2..b213020 100644
--- a/packages/annotator/src/annotator.ts
+++ b/packages/annotator/src/annotator.ts
@@ -94,7 +94,7 @@ export function courtListenerSourceUrl(absoluteUrl: string): string {
  * Falls back to a sanitized slug when the citation doesn't match the expected pattern.
  */
 export function buildAnnotationPath(section: string): string {
-  const match = /^(\d+[a-zA-Z]?)\s+U\.S\.C\.\s+(\d+[a-zA-Z-]*)$/.exec(section);
+  const match = /^(\d+[a-zA-Z]?)\s+U\.?S\.?C\.?\s*(?:§|&sect;)?\s*([a-zA-Z0-9-]+)$/i.exec(section.trim());
   if (!match) {
     // Fallback: sanitize the section string into a safe filename
     const slug = section.replace(/[^a-zA-Z0-9-]/g, '_').toLowerCase();
@@ -113,7 +113,8 @@ export function buildAnnotationPath(section: string): string {
  * terminate or inject into the scalar — a `"` or newline in any field must not
  * be able to forge or corrupt sidecar keys.
  */
-function yamlEscape(s: string): string {
+function yamlEscape(s: string | undefined | null): string {
+  if (s == null) return '';
   return s
     .replace(/\\/g, '\\\\')
     .replace(/"/g, '\\"')
@@ -140,6 +141,12 @@ export function annotationToYaml(annotation: PrecedentAnnotation): string {
     lines.push(`    holdingSummary: "${yamlEscape(c.holdingSummary)}"`);
     lines.push(`    sourceUrl: "${yamlEscape(c.sourceUrl)}"`);
     lines.push(`    impact: "${yamlEscape(c.impact)}"`);
+    if (c.statuteVersionRef) {
+      lines.push(`    statuteVersionRef: "${yamlEscape(c.statuteVersionRef)}"`);
+    }
+    if (c.statuteVersionNote) {
+      lines.push(`    statuteVersionNote: "${yamlEscape(c.statuteVersionNote)}"`);
+    }
   }
   return lines.join('\n') + '\n';
 }
diff --git a/packages/annotator/src/client.ts b/packages/annotator/src/client.ts
index 4669147..238bae4 100644
--- a/packages/annotator/src/client.ts
+++ b/packages/annotator/src/client.ts
@@ -166,7 +166,8 @@ export class CourtListenerClient {
     }
 
     const url = new URL(SEARCH_ENDPOINT, COURTLISTENER_BASE_URL);
-    url.searchParams.set('q', `"${section}"`);
+    const sanitizedQuery = section.replace(/["\\]/g, '').trim();
+    url.searchParams.set('q', `"${sanitizedQuery}"`);
     url.searchParams.set('type', 'o'); // opinions
     url.searchParams.set('order_by', 'dateFiled desc');
     url.searchParams.set('page_size', String(this.pageSize));
diff --git a/packages/annotator/tsconfig.build.json b/packages/annotator/tsconfig.build.json
index 9fb6f30..60ed234 100644
--- a/packages/annotator/tsconfig.build.json
+++ b/packages/annotator/tsconfig.build.json
@@ -8,5 +8,6 @@
     "rootDir": "src",
     "outDir": "dist"
   },
-  "include": ["src"]
+  "include": ["src"],
+  "exclude": ["src/__tests__"]
 }
diff --git a/packages/fetcher/src/constants.ts b/packages/fetcher/src/constants.ts
index 5d15228..14a5760 100644
--- a/packages/fetcher/src/constants.ts
+++ b/packages/fetcher/src/constants.ts
@@ -36,11 +36,11 @@ export const MAX_DOWNLOAD_BYTES = 314572800; // 300 MiB
  * because XML inflates roughly 10-20x: a title whose compressed entry sits well
  * under the download cap can still inflate past 300 MiB, and reusing the
  * compressed cap as the inflate cap would false-drop it (#226). The largest
- * single USC title decompresses to well under 1 GiB, so this leaves ample
- * headroom for real data while still aborting a decompression bomb (the inflate
- * exceeds `maxOutputLength` and throws).
+ * single USC title decompresses to well under 500 MiB, so this leaves ample
+ * headroom for real data while strictly staying within V8 MAX_STRING_LENGTH (~512 MB)
+ * to avoid RangeError during buffer-to-string decoding (#226).
  */
-export const MAX_DECOMPRESSED_BYTES = 1073741824; // 1 GiB
+export const MAX_DECOMPRESSED_BYTES = 524288000; // 500 MiB
 
 /** Path for hash storage relative to working directory */
 export const HASH_STORE_DIR = '.openlaw-git';
diff --git a/packages/fetcher/tsconfig.build.json b/packages/fetcher/tsconfig.build.json
index 9fb6f30..60ed234 100644
--- a/packages/fetcher/tsconfig.build.json
+++ b/packages/fetcher/tsconfig.build.json
@@ -8,5 +8,6 @@
     "rootDir": "src",
     "outDir": "dist"
   },
-  "include": ["src"]
+  "include": ["src"],
+  "exclude": ["src/__tests__"]
 }
diff --git a/packages/shared/src/__tests__/sort.test.ts b/packages/shared/src/__tests__/sort.test.ts
new file mode 100644
index 0000000..00f6b8b
--- /dev/null
+++ b/packages/shared/src/__tests__/sort.test.ts
@@ -0,0 +1,39 @@
+import { describe, it, expect } from 'vitest';
+import { compareSectionNumbers } from '../sort.js';
+
+describe('compareSectionNumbers', () => {
+  it('handles identical section numbers', () => {
+    expect(compareSectionNumbers('101', '101')).toBe(0);
+    expect(compareSectionNumbers('2000e-1', '2000e-1')).toBe(0);
+  });
+
+  it('orders basic numeric sections correctly', () => {
+    const sections = ['10', '2', '1', '20', '3'];
+    expect([...sections].sort(compareSectionNumbers)).toEqual(['1', '2', '3', '10', '20']);
+  });
+
+  it('correctly orders Title 42 Section 2000e series without scientific notation corruption', () => {
+    // Under parseFloat('2000e-1'), JavaScript evaluates this as 2000 * 10^-1 = 200,
+    // which incorrectly placed 2000e-1 before section 1000!
+    const sections = ['200', '2000a', '2000e', '2000e-1', '2000e-2', '2000f', '2001'];
+    expect([...sections].sort(compareSectionNumbers)).toEqual([
+      '200',
+      '2000a',
+      '2000e',
+      '2000e-1',
+      '2000e-2',
+      '2000f',
+      '2001',
+    ]);
+  });
+
+  it('correctly handles letter suffixes', () => {
+    const sections = ['102', '101b', '101', '101a'];
+    expect([...sections].sort(compareSectionNumbers)).toEqual(['101', '101a', '101b', '102']);
+  });
+
+  it('correctly handles hyphenated section numbers', () => {
+    const sections = ['2', '1-2', '1', '1-1'];
+    expect([...sections].sort(compareSectionNumbers)).toEqual(['1', '1-1', '1-2', '2']);
+  });
+});
diff --git a/packages/shared/src/index.ts b/packages/shared/src/index.ts
index 947cf16..a17cc3e 100644
--- a/packages/shared/src/index.ts
+++ b/packages/shared/src/index.ts
@@ -2,3 +2,4 @@ export { TIMEZONE, MAX_RETRIES, BASE_BACKOFF_MS, MAX_BACKOFF_MS } from './consta
 export { createLogger, type Logger, type LogLevel } from './logger.js';
 export { fetchWithRetry, type FetchWithRetryOptions } from './retry.js';
 export { TokenBucket, type TokenBucketConfig } from './rate-limiter.js';
+export { compareSectionNumbers } from './sort.js';
diff --git a/packages/shared/src/retry.ts b/packages/shared/src/retry.ts
index 71e9d52..4cbd8c8 100644
--- a/packages/shared/src/retry.ts
+++ b/packages/shared/src/retry.ts
@@ -23,9 +23,11 @@ function isRetryableStatus(status: number): boolean {
   return status === 429 || status >= 500;
 }
 
-/** Exponential backoff for a 1-based attempt, capped at MAX_BACKOFF_MS. */
+/** Exponential backoff with randomized full jitter, capped at MAX_BACKOFF_MS. */
 function backoffDelayMs(baseDelayMs: number, attempt: number): number {
-  return Math.min(baseDelayMs * Math.pow(2, attempt - 1), MAX_BACKOFF_MS);
+  const maxDelay = Math.min(baseDelayMs * Math.pow(2, attempt - 1), MAX_BACKOFF_MS);
+  // Full jitter: uniformly random between 0 and maxDelay to prevent thundering herds
+  return Math.floor(Math.random() * (maxDelay + 1));
 }
 
 /**
diff --git a/packages/shared/src/sort.ts b/packages/shared/src/sort.ts
new file mode 100644
index 0000000..4349ea1
--- /dev/null
+++ b/packages/shared/src/sort.ts
@@ -0,0 +1,15 @@
+/**
+ * Compares two US Code section strings in natural legal order.
+ * Uses Unicode Collation with numeric sorting, avoiding JavaScript's
+ * parseFloat() scientific notation pitfalls (e.g. Title 42 Section 2000e-1
+ * being mistakenly evaluated as 2000 * 10^-1 = 200).
+ *
+ * Examples:
+ * - '101' < '101a' < '102'
+ * - '2000a' < '2000e' < '2000e-1' < '2000e-2' < '2000f' < '2001'
+ * - '1-1' < '1-2' < '2'
+ */
+export function compareSectionNumbers(a: string, b: string): number {
+  if (a === b) return 0;
+  return a.localeCompare(b, undefined, { numeric: true, sensitivity: 'base' });
+}
diff --git a/packages/types/src/__tests__/schemas.test.ts b/packages/types/src/__tests__/schemas.test.ts
index fd00412..c6988c7 100644
--- a/packages/types/src/__tests__/schemas.test.ts
+++ b/packages/types/src/__tests__/schemas.test.ts
@@ -101,6 +101,11 @@ describe('CaseAnnotationSchema', () => {
     expect(() => CaseAnnotationSchema.parse({ ...valid, sourceUrl: 'javascript:alert(document.cookie)' })).toThrow();
   });
 
+  it('accepts an empty string sourceUrl (fallback for unpinned or missing source URLs)', () => {
+    const withEmpty = { ...valid, sourceUrl: '' };
+    expect(CaseAnnotationSchema.parse(withEmpty).sourceUrl).toBe('');
+  });
+
   it('rejects holdingSummary over 500 chars', () => {
     expect(() => CaseAnnotationSchema.parse({ ...valid, holdingSummary: 'x'.repeat(501) })).toThrow();
   });
diff --git a/packages/types/src/index.ts b/packages/types/src/index.ts
index abbe19d..b18b2cf 100644
--- a/packages/types/src/index.ts
+++ b/packages/types/src/index.ts
@@ -26,6 +26,15 @@ export const HttpUrlSchema = z
   .url()
   .refine((u) => /^https?:\/\//i.test(u), { message: 'URL must use the http(s) scheme' });
 
+/**
+ * A URL constrained to the http(s) scheme or an empty string. Used for external
+ * source URLs that collapse to empty string when failing origin validation without
+ * rejecting the entire annotation record (#248).
+ */
+export const OptionalHttpUrlSchema = z
+  .string()
+  .refine((u) => u === '' || /^https?:\/\//i.test(u), { message: 'URL must use the http(s) scheme or be empty' });
+
 // --- Release Point schema ---
 
 export const ReleasePointSchema = z.object({
@@ -64,7 +73,7 @@ export const CaseAnnotationSchema = z.object({
   court: z.enum(["SCOTUS", "Appellate", "District"]),
   date: z.string(),
   holdingSummary: z.string().max(500),
-  sourceUrl: HttpUrlSchema,
+  sourceUrl: OptionalHttpUrlSchema,
   impact: PrecedentImpactSchema,
   /** Public Law the statute was current through when this case was decided */
   statuteVersionRef: z.string().max(100).optional(),
diff --git a/packages/types/tsconfig.build.json b/packages/types/tsconfig.build.json
index fc6b691..ab94db7 100644
--- a/packages/types/tsconfig.build.json
+++ b/packages/types/tsconfig.build.json
@@ -9,5 +9,6 @@
     "outDir": "dist",
     "types": []
   },
-  "include": ["src"]
+  "include": ["src"],
+  "exclude": ["src/__tests__"]
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index dc8f898..05ef246 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -34,12 +34,6 @@ importers:
       '@eslint/js':
         specifier: ^10.0.1
         version: 10.0.1(eslint@10.12.0(jiti@2.7.0))
-      '@typescript-eslint/eslint-plugin':
-        specifier: ^8.71.0
-        version: 8.71.0(@typescript-eslint/parser@8.71.0(eslint@10.12.0(jiti@2.7.0))(typescript@6.0.3))(eslint@10.12.0(jiti@2.7.0))(typescript@6.0.3)
-      '@typescript-eslint/parser':
-        specifier: ^8.71.0
-        version: 8.71.0(eslint@10.12.0(jiti@2.7.0))(typescript@6.0.3)
       eslint:
         specifier: ^10.12.0
         version: 10.12.0(jiti@2.7.0)
@@ -67,6 +61,9 @@ importers:
       '@astrojs/svelte':
         specifier: ^9.0.1
         version: 9.0.1(@types/node@25.5.0)(astro@7.3.5(@astrojs/markdown-remark@7.3.1)(@types/node@25.5.0)(jiti@2.7.0)(yaml@2.9.1))(esbuild@0.28.2)(jiti@2.7.0)(svelte@5.57.1(@typescript-eslint/types@8.71.0))(typescript@6.0.3)(yaml@2.9.1)
+      '@civic-source/shared':
+        specifier: workspace:*
+        version: link:../../packages/shared
       '@civic-source/types':
         specifier: workspace:*
         version: link:../../packages/types

From d7dde2d3963e2f8af163c6f261db6a2f36f905d6 Mon Sep 17 00:00:00 2001
From: William Zujkowski <williamzujkowski@gmail.com>
Date: Tue, 6 Oct 2026 09:37:58 -0400
Subject: [PATCH 2/2] fix(annotator): eliminate polynomial backtracking in
 buildAnnotationPath citation regex

---
 .../annotator/src/__tests__/annotator.test.ts     | 15 +++++++++++++++
 packages/annotator/src/annotator.ts               |  5 ++++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/packages/annotator/src/__tests__/annotator.test.ts b/packages/annotator/src/__tests__/annotator.test.ts
index 47cd1e9..ccd5b3b 100644
--- a/packages/annotator/src/__tests__/annotator.test.ts
+++ b/packages/annotator/src/__tests__/annotator.test.ts
@@ -346,6 +346,21 @@ describe('buildAnnotationPath', () => {
     expect(buildAnnotationPath('42 U.S.C. 1983a')).toBe('annotations/title-42/section-1983a.yaml');
   });
 
+  it('handles section symbol (§ and &sect;) and hyphens', () => {
+    expect(buildAnnotationPath('18 U.S.C. § 111')).toBe('annotations/title-18/section-111.yaml');
+    expect(buildAnnotationPath('42 U.S.C. § 2000e-1')).toBe('annotations/title-42/section-2000e-1.yaml');
+    expect(buildAnnotationPath('5 U.S.C. &sect; 552')).toBe('annotations/title-5/section-552.yaml');
+  });
+
+  it('resists polynomial backtracking (ReDoS) on pathological spaces', () => {
+    const malicious = '9 usc ' + ' '.repeat(5000);
+    const start = performance.now();
+    const path = buildAnnotationPath(malicious);
+    const elapsed = performance.now() - start;
+    expect(elapsed).toBeLessThan(100);
+    expect(path).toMatch(/^annotations\/.*\.yaml$/);
+  });
+
   it('falls back to sanitized slug for non-standard citations', () => {
     const path = buildAnnotationPath('Some weird input!');
     expect(path).toMatch(/^annotations\/.*\.yaml$/);
diff --git a/packages/annotator/src/annotator.ts b/packages/annotator/src/annotator.ts
index b213020..25f1679 100644
--- a/packages/annotator/src/annotator.ts
+++ b/packages/annotator/src/annotator.ts
@@ -94,7 +94,10 @@ export function courtListenerSourceUrl(absoluteUrl: string): string {
  * Falls back to a sanitized slug when the citation doesn't match the expected pattern.
  */
 export function buildAnnotationPath(section: string): string {
-  const match = /^(\d+[a-zA-Z]?)\s+U\.?S\.?C\.?\s*(?:§|&sect;)?\s*([a-zA-Z0-9-]+)$/i.exec(section.trim());
+  // Pre-normalize section symbols and collapse multiple whitespace runs
+  // to avoid polynomial catastrophic backtracking (ReDoS) on untrusted input
+  const normalized = section.replace(/[§\u00A7]|&sect;/g, ' ').trim().replace(/\s+/g, ' ');
+  const match = /^(\d+[a-zA-Z]?)\s+U\.?S\.?C\.?\s+([a-zA-Z0-9-]+)$/i.exec(normalized);
   if (!match) {
     // Fallback: sanitize the section string into a safe filename
     const slug = section.replace(/[^a-zA-Z0-9-]/g, '_').toLowerCase();