chore(release): prepare 0.1.0-beta.4

AGENTS.md

@@ -4,7 +4,7 @@ This file is the durable engineering context for humans and coding agents workin
 
 ## Product intent
 
-Build a small, framework-agnostic, server-side TypeScript core for Apple Profile Service profile generation, optional signing, CMS response verification, and lossless response parsing. The current release target is `0.1.0-beta.3` under the npm scope `@udid-tools`.
+Build a small, framework-agnostic, server-side TypeScript core for Apple Profile Service profile generation, optional signing, CMS response verification, and lossless response parsing. The current release target is `0.1.0-beta.4` under the npm scope `@udid-tools`.
 
 MDM is a separate product boundary. Do not add MDM enrollment, APNs, check-in, commands, declarative management, SCEP orchestration, profile delivery state machines, HTTP servers, persistence, or UI code here. A future MDM package may reuse stable low-level primitives without changing this package’s Profile Service contract.
 

CHANGELOG.md

@@ -7,6 +7,19 @@ Versioning]. Prereleases use npm's `beta` distribution tag.
 
 ## [Unreleased]
 
+## [0.1.0-beta.4] - 2026-09-14
+
+### Changed
+
+- Refreshed the verified documentation toolchain with Astro 7.3.2,
+  `typedoc-plugin-frontmatter` 1.3.2, and `typescript-eslint` 8.70.0. The runtime API and runtime
+  dependencies are unchanged from `0.1.0-beta.3`.
+
+### Security
+
+- Updated the pinned CodeQL Action to 4.38.0 and its default CodeQL bundle to 2.27.0.
+- Adopted Astro 7.3.2's stricter escaping for dynamic MDX `<script>` and `<style>` content.
+
 ## [0.1.0-beta.3] - 2026-09-13
 
 ### Changed
@@ -46,7 +59,8 @@ Versioning]. Prereleases use npm's `beta` distribution tag.
 
 [keep a changelog]: https://keepachangelog.com/en/1.1.0/
 [semantic versioning]: https://semver.org/spec/v2.0.0.html
-[unreleased]: https://github.com/udid-tools/core/compare/v0.1.0-beta.3...HEAD
+[unreleased]: https://github.com/udid-tools/core/compare/v0.1.0-beta.4...HEAD
+[0.1.0-beta.4]: https://github.com/udid-tools/core/compare/v0.1.0-beta.3...v0.1.0-beta.4
 [0.1.0-beta.3]: https://github.com/udid-tools/core/compare/v0.1.0-beta.2...v0.1.0-beta.3
 [0.1.0-beta.2]: https://github.com/udid-tools/core/compare/v0.1.0-beta.1...v0.1.0-beta.2
 [0.1.0-beta.1]: https://github.com/udid-tools/core/releases/tag/v0.1.0-beta.1

README.md

@@ -11,7 +11,7 @@
 
 Security-first TypeScript primitives for Apple Profile Service profiles: generate XML, optionally produce attached CMS/PKCS#7 SignedData, verify device responses, and parse every returned plist field without losing unknown data.
 
-> **Beta:** `0.1.0-beta.3` is ready for evaluation. Its public API follows semantic versioning, but beta releases may still contain breaking changes. MDM is intentionally out of scope.
+> **Beta:** `0.1.0-beta.4` is ready for evaluation. Its public API follows semantic versioning, but beta releases may still contain breaking changes. MDM is intentionally out of scope.
 
 ## Install
 
@@ -101,7 +101,7 @@ The default verification mode checks RSA/SHA-1 and RSA/SHA-256 signature integri
 
 ## Capability matrix
 
-| Capability                                  | `0.1.0-beta.3`                                                                     |
+| Capability                                  | `0.1.0-beta.4`                                                                     |
 | ------------------------------------------- | ---------------------------------------------------------------------------------- |
 | Apple Profile Service payload               | Supported                                                                          |
 | Documented attributes                       | `UDID`, `VERSION`, `PRODUCT`, `SERIAL`, `MEID`, `IMEI`, `ICCID`, `MAC_ADDRESS_EN0` |

docs/src/content/docs/index.mdx

@@ -75,5 +75,5 @@ Signing is selected by providing a complete nested `signing` object. Parsing ver
 - Read the [security model](/core/concepts/security-model/) before exposing an endpoint to the internet.
 
 :::caution[Beta software]
-Version `0.1.0-beta.3` supports PKCS#12 RSA identities with SHA-256. Review the capability matrix before using the package in production.
+Version `0.1.0-beta.4` supports PKCS#12 RSA identities with SHA-256. Review the capability matrix before using the package in production.
 :::

docs/src/content/docs/project/release-integrity.md

@@ -17,42 +17,42 @@ Each GitHub Release contains:
 The workflow also records a GitHub artifact attestation for the tarball. npm Trusted Publishing
 adds registry provenance without a long-lived npm token.
 
-## Verify version 0.1.0-beta.3
+## Verify version 0.1.0-beta.4
 
 Download the immutable release assets:
 
 ```bash
-gh release download v0.1.0-beta.3 --repo udid-tools/core --dir core-release
+gh release download v0.1.0-beta.4 --repo udid-tools/core --dir core-release
 cd core-release
 ```
 
 Verify the tarball checksum on Linux:
 
 ```bash
-sha256sum --check udid-tools-core-0.1.0-beta.3.tgz.sha256
+sha256sum --check udid-tools-core-0.1.0-beta.4.tgz.sha256
 ```
 
 On macOS, use the compatible checksum command:
 
 ```bash
-shasum --algorithm 256 --check udid-tools-core-0.1.0-beta.3.tgz.sha256
+shasum --algorithm 256 --check udid-tools-core-0.1.0-beta.4.tgz.sha256
 ```
 
 Verify the tarball's keyless Sigstore signature, certificate identity, and transparency-log proof:
 
 ```bash
-cosign verify-blob udid-tools-core-0.1.0-beta.3.tgz \
-  --bundle udid-tools-core-0.1.0-beta.3.tgz.sigstore.json \
+cosign verify-blob udid-tools-core-0.1.0-beta.4.tgz \
+  --bundle udid-tools-core-0.1.0-beta.4.tgz.sigstore.json \
   --certificate-identity \
-  "https://github.com/udid-tools/core/.github/workflows/release.yml@refs/tags/v0.1.0-beta.3" \
+  "https://github.com/udid-tools/core/.github/workflows/release.yml@refs/tags/v0.1.0-beta.4" \
   --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
 ```
 
 Repeat `cosign verify-blob` with each SBOM or checksum file and its adjacent bundle when consuming
 those assets directly. Verify the GitHub artifact attestation independently:
 
 ```bash
-gh attestation verify udid-tools-core-0.1.0-beta.3.tgz \
+gh attestation verify udid-tools-core-0.1.0-beta.4.tgz \
   --repo udid-tools/core
 ```
 

docs/src/content/docs/reference/apple-compatibility.md

@@ -9,7 +9,7 @@ The special Profile Service protocol is primarily documented in Apple’s archiv
 2. **Observed:** verified on specified platform versions with reproducible fixtures.
 3. **Extension:** accepted losslessly but not yet normalized or claimed as Apple-defined.
 
-`0.1.0-beta.3` types the documented attribute names `UDID`, `VERSION`, `PRODUCT`, `SERIAL`, `MEID`, `IMEI`, `ICCID`, and `MAC_ADDRESS_EN0`. Availability depends on device hardware, OS, privacy behavior, and enrollment context. A requested value is not automatically guaranteed.
+`0.1.0-beta.4` types the documented attribute names `UDID`, `VERSION`, `PRODUCT`, `SERIAL`, `MEID`, `IMEI`, `ICCID`, and `MAC_ADDRESS_EN0`. Availability depends on device hardware, OS, privacy behavior, and enrollment context. A requested value is not automatically guaranteed.
 
 Apple Profile Service responses may use RSA/SHA-1. Apple's archived guide requires a signed CMS response but does not prescribe the digest algorithm. Response verification accepts both RSA/SHA-1 and RSA/SHA-256.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udid-tools/core",
-  "version": "0.1.0-beta.3",
+  "version": "0.1.0-beta.4",
   "description": "Framework-agnostic TypeScript SDK for Apple Profile Service profiles, CMS signing, verification, and device response parsing.",
   "keywords": [
     "apple",