@blamejs/blamejs-shop 0.4.56 → 0.4.57

package/lib/vendor/blamejs/lib/chain-writer.js

@@ -45,12 +45,14 @@ var safeAsync = require("./safe-async");
 var safeSql = require("./safe-sql");
 var sql = require("./sql");
 var C = require("./constants");
+var boundedMap = require("./bounded-map");
 var { FrameworkError } = require("./framework-error");
 
-// Allowlist of chain table names. Adding a new chain-backed table
-// (e.g. some future _blamejs_security_log) requires registering it here
-// so an operator can't accidentally point a chain-writer at a non-chain
-// table and corrupt the chain semantics.
+// Allowlist of chain table names. The two framework chains ship registered; a
+// consumer's own append-only hash-chained table is added at config time via
+// registerTable() BEFORE create() accepts it. The allowlist is never bypassed
+// — an unregistered table throws at create(), so a misconfig can't point a
+// chain-writer at a non-chain table and corrupt the chain semantics.
 var ALLOWED_CHAIN_TABLES = new Set(["audit_log", "consent_log"]);
 
 var FRAMEWORK_SQL_TIMEOUT_MS = C.TIME.seconds(30);
@@ -74,24 +76,83 @@ class ChainWriterError extends FrameworkError {
   }
 }
 
+/**
+ * @primitive b.chainWriter.registerTable
+ * @signature b.chainWriter.registerTable(table)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.chainWriter.create, b.safeSql.validateIdentifier
+ *
+ * Register a consumer-owned append-only table as chain-writable so
+ * `b.chainWriter.create({ table })` accepts it. Call once at boot (config
+ * time) for each app table carrying the chain columns (`monotonicCounter`,
+ * `recordedAt`, `nonce`, `prevHash`, `rowHash` — plus `fencingToken` in
+ * cluster mode). The framework chains (`audit_log`, `consent_log`) are
+ * pre-registered. Throws `ChainWriterError` (`chain-writer/invalid-config`) on
+ * a non-identifier name; the name is validated against the SQL identifier
+ * rules because it is interpolated into the chain SQL. Idempotent. Returns the
+ * registered name.
+ *
+ * Operator footgun to avoid on a MULTI-chain table (one configured with a
+ * `chainKey`): the per-key writer restarts `monotonicCounter` at 1 for each
+ * key, so a UNIQUE index on `monotonicCounter` ALONE (the shape the framework
+ * `audit_log` uses for its single chain) will reject the second key's first
+ * row. A keyed chain's uniqueness must be the composite
+ * `(chainKey, monotonicCounter)`, never `monotonicCounter` by itself.
+ *
+ * @example
+ *   b.chainWriter.registerTable("device_event_log");
+ *   var writer = b.chainWriter.create({
+ *     table:            "device_event_log",
+ *     chainKey:         "deviceId",
+ *     columnsForInsert: ["_id", "deviceId", "monotonicCounter", "recordedAt",
+ *                        "kind", "payload",
+ *                        "prevHash", "rowHash", "nonce", "fencingToken"],
+ *     hashableColumns:  ["_id", "deviceId", "monotonicCounter", "recordedAt",
+ *                        "kind", "payload"],
+ *   });
+ */
+function registerTable(table) {
+  if (typeof table !== "string" || table.length === 0) {
+    throw new ChainWriterError(
+      "registerTable requires a non-empty table name",
+      "chain-writer/invalid-config"
+    );
+  }
+  // Identifier-validate before admitting to the allowlist — the name is
+  // interpolated into the chain SQL, so the same shape rules create() relies
+  // on must hold here, at the config-time entry point.
+  safeSql.validateIdentifier(table);
+  ALLOWED_CHAIN_TABLES.add(table);
+  return table;
+}
+
 /**
  * @primitive b.chainWriter.create
  * @signature b.chainWriter.create(opts)
  * @since     0.8.48
  * @status    stable
- * @related   b.audit, b.consent, b.auditChain
+ * @related   b.audit, b.consent, b.auditChain, b.chainWriter.registerTable
  *
  * Build a chain-writer bound to a single hash-chained table. Returns
- * `{ table, append, _resetForTest, _getMutexForTest }`. `append(logical)`
- * is the public surface — async, leader-gated, mutex-serialized; on
- * success it returns the logical row decorated with the computed
- * `rowHash` and `prevHash`.
+ * `{ table, chainKey, append, _resetForTest, _getMutexForTest }`.
+ * `append(logical)` is the public surface — async, leader-gated,
+ * mutex-serialized; on success it returns the logical row decorated with the
+ * computed `rowHash` and `prevHash`.
+ *
+ * A `chainKey` makes one table hold many independent chains (one per account /
+ * device / tenant): tip-read, counter monotonicity, and the append Mutex all
+ * scope per key, so concurrent appends to DIFFERENT keys run in parallel while
+ * same-key appends serialize. Bind `chainKey` into `hashableColumns` so the
+ * partition is tamper-evident in the row hash, and key the table's uniqueness
+ * constraint on `(chainKey, monotonicCounter)`, never `monotonicCounter` alone.
  *
  * @opts
- *   table:            string,    // one of ALLOWED_CHAIN_TABLES (audit_log | consent_log)
+ *   table:            string,    // a registered chain table (audit_log | consent_log | registerTable name)
+ *   chainKey:         string,    // optional partition column — one independent chain per key value
  *   columnsForInsert: string[],  // INSERT column order (every name is identifier-validated)
  *   hashableColumns:  string[],  // columns that participate in the rowHash canonicalization
- *   validateInput:    Function,  // optional; (logical) → throws on invalid shape
+ *   validateInput:    Function,  // optional; (logical) -> throws on invalid shape
  *
  * @example
  *   var writer = b.chainWriter.create({
@@ -136,27 +197,57 @@ function create(opts) {
   var hashableColumns   = opts.hashableColumns.slice();
   var validateInput     = opts.validateInput || null;
 
-  // Per-chain Mutex serializes the read-prev-tip + compute-hash + insert
+  // chainKey: the partition column for many independent chains in one table
+  // (one chain per account / device / tenant). When set, the tip read,
+  // counter priming, and the append Mutex all scope to a single key value, so
+  // appends to DIFFERENT keys run in parallel while same-key appends
+  // serialize. Identifier-validated at config time (THROW tier) because it is
+  // interpolated as a column name; it must also appear in columnsForInsert so
+  // every row carries its partition key.
+  var chainKey = opts.chainKey || null;
+  if (chainKey !== null) {
+    safeSql.validateIdentifier(chainKey);
+    if (columnsForInsert.indexOf(chainKey) === -1) {
+      throw new ChainWriterError(
+        "chainKey '" + chainKey + "' must be listed in columnsForInsert so " +
+        "every appended row carries its partition key",
+        "chain-writer/invalid-config"
+      );
+    }
+  }
+
+  // Per-CHAIN-KEY Mutex serializes the read-prev-tip + compute-hash + insert
   // sequence. Without serialization, two concurrent awaiting append() calls
-  // would hash against the same prev-tip and produce sibling rows with the
-  // same prevHash — forking the chain.
-  var _chainMutex = new safeAsync.Mutex();
+  // would hash against the same prev-tip and fork the chain. A single-chain
+  // writer (no chainKey) uses one shared lock under the sentinel key; a
+  // multi-chain writer keys the lock by the partition value so appends to
+  // DIFFERENT keys run concurrently while same-key appends serialize.
+  var _SINGLE_CHAIN_KEY = "__single_chain__";   // sentinel; not a valid driver value
+  var _mutexByKey = new Map();
+  function _mutexFor(keyValue) {
+    var k = chainKey !== null ? String(keyValue) : _SINGLE_CHAIN_KEY;
+    return boundedMap.getOrInsert(_mutexByKey, k, function () { return new safeAsync.Mutex(); });
+  }
 
-  // Lazy counter primer — first append reads MAX(monotonicCounter) and
-  // increments from there. Once ensures concurrent first-callers share
-  // one in-flight init Promise.
-  var _nextCounter = 1;
-  var _counterInit = null;
+  // Lazy counter primer — first append for a given key reads
+  // MAX(monotonicCounter) [WHERE chainKey = ?] and increments from there.
+  // Per-key so each chain's counter is independent; a per-key Once shares one
+  // in-flight init across concurrent first-callers for the same key.
+  var _nextCounterByKey = new Map();
+  var _counterInitByKey = new Map();
 
-  function _ensureCounterInit() {
-    if (!_counterInit) {
-      _counterInit = new safeAsync.Once(async function () {
+  function _ensureCounterInit(keyValue) {
+    var k = chainKey !== null ? String(keyValue) : _SINGLE_CHAIN_KEY;
+    var once = boundedMap.getOrInsert(_counterInitByKey, k, function () {
+      return new safeAsync.Once(async function () {
         // BARE logical table name — clusterStorage rewrites the framework
-        // name to the configured-prefix form and placeholderizes; b.sql
-        // quotes the camelCase column + emits the MAX aggregate.
-        var maxBuilt = sql.select(table, _sqlOpts())
-          .max("monotonicCounter", "m")
-          .toSql();
+        // name to the configured-prefix form (consumer tables pass through
+        // unchanged) and placeholderizes; b.sql quotes the camelCase column +
+        // emits the MAX aggregate. A keyed writer scopes the MAX to the
+        // partition via a bound WHERE.
+        var maxQ = sql.select(table, _sqlOpts()).max("monotonicCounter", "m");
+        if (chainKey !== null) maxQ = maxQ.where(chainKey, keyValue);
+        var maxBuilt = maxQ.toSql();
         var row = await safeAsync.withTimeout(
           safeAsync.asyncRetry(function () {
             return clusterStorage.executeOne(maxBuilt.sql, maxBuilt.params);
@@ -164,18 +255,21 @@ function create(opts) {
           FRAMEWORK_SQL_TIMEOUT_MS,
           { name: table + ".readMaxCounter" }
         );
-        _nextCounter = (row && row.m ? Number(row.m) : 0) + 1;
+        _nextCounterByKey.set(k, (row && row.m ? Number(row.m) : 0) + 1);
       });
-    }
-    return _counterInit.invoke();
+    });
+    return once.invoke();
   }
 
-  async function _readChainTipRow() {
-    var tipBuilt = sql.select(table, _sqlOpts())
+  async function _readChainTipRow(keyValue) {
+    var tipQ = sql.select(table, _sqlOpts())
       .columns(["rowHash"])
       .orderBy("monotonicCounter", "desc")
-      .limit(1)
-      .toSql();
+      .limit(1);
+    // Scope the tip to the partition so per-key chains link correctly —
+    // bound value, never interpolated.
+    if (chainKey !== null) tipQ = tipQ.where(chainKey, keyValue);
+    var tipBuilt = tipQ.toSql();
     return await safeAsync.withTimeout(
       safeAsync.asyncRetry(function () {
         return clusterStorage.executeOne(tipBuilt.sql, tipBuilt.params);
@@ -209,15 +303,33 @@ function create(opts) {
   async function append(logical) {
     if (validateInput) validateInput(logical);
     cluster.requireLeader();
-    await _ensureCounterInit();
 
-    return await _chainMutex.runExclusive(async function () {
-      return await _appendInsideMutex(logical);
+    // Resolve the partition key from the logical row for a multi-chain writer.
+    // Fail closed: a keyed writer with a missing / empty key can't pick a
+    // chain to append to, so refuse rather than silently fold the row into the
+    // wrong chain.
+    var keyValue = _SINGLE_CHAIN_KEY;
+    if (chainKey !== null) {
+      keyValue = logical ? logical[chainKey] : undefined;
+      if (keyValue === undefined || keyValue === null || String(keyValue).length === 0) {
+        throw new ChainWriterError(
+          "append: a chainKey writer requires logical['" + chainKey + "'] to be a " +
+          "non-empty partition value",
+          "chain-writer/invalid-input"
+        );
+      }
+    }
+    await _ensureCounterInit(keyValue);
+
+    return await _mutexFor(keyValue).runExclusive(async function () {
+      return await _appendInsideMutex(logical, keyValue);
     });
   }
 
-  async function _appendInsideMutex(logical) {
-    var counter = _nextCounter++;
+  async function _appendInsideMutex(logical, keyValue) {
+    var _ck = chainKey !== null ? String(keyValue) : _SINGLE_CHAIN_KEY;
+    var counter = _nextCounterByKey.get(_ck);
+    _nextCounterByKey.set(_ck, counter + 1);
     var nowMs   = Date.now();
     var nonce   = generateBytes(C.BYTES.bytes(16));
 
@@ -239,8 +351,8 @@ function create(opts) {
       if (!(hashableColumns[hci] in sealed)) sealed[hashableColumns[hci]] = null;
     }
 
-    // Compute rowHash over the sealed content fields
-    var tipRow = await _readChainTipRow();
+    // Compute rowHash over the sealed content fields, linking to THIS key's tip.
+    var tipRow = await _readChainTipRow(keyValue);
     var prevHash = tipRow ? tipRow.rowHash : auditChain.ZERO_HASH;
     var rowHash = auditChain.computeRowHash(prevHash, sealed, nonce);
 
@@ -259,22 +371,25 @@ function create(opts) {
   }
 
   function _resetForTest() {
-    _chainMutex = new safeAsync.Mutex();
-    _counterInit = null;
-    _nextCounter = 1;
+    _mutexByKey = new Map();
+    _counterInitByKey = new Map();
+    _nextCounterByKey = new Map();
   }
 
   return {
     table:          table,
+    chainKey:       chainKey,
     append:         append,
     _resetForTest:  _resetForTest,
-    // Expose for diagnostic introspection
-    _getMutexForTest: function () { return _chainMutex; },
+    // Expose for diagnostic introspection — the lock for a given key (or the
+    // single-chain lock when no chainKey is configured).
+    _getMutexForTest: function (keyValue) { return _mutexFor(keyValue); },
   };
 }
 
 module.exports = {
   create:               create,
+  registerTable:        registerTable,
   ChainWriterError:     ChainWriterError,
   ALLOWED_CHAIN_TABLES: ALLOWED_CHAIN_TABLES,
   FRAMEWORK_SQL_TIMEOUT_MS: FRAMEWORK_SQL_TIMEOUT_MS,

package/lib/vendor/blamejs/lib/cli.js

@@ -1110,12 +1110,16 @@ async function _runApiKey(args, ctx) {
         return report.error("--scopes must contain at least one non-empty scope", 2);
       }
       var label = typeof args.flags.label === "string" ? args.flags.label : null;
+      // --expires-ms is the absolute expiry as a unix-ms timestamp; the
+      // registry's validated opt is `expiresAt` (apiKey.issue rejects any other
+      // key). Passing `expiresMs` silently did nothing before — the lib only
+      // ever read `expiresAt` — so the flag was a no-op; map it correctly.
       var expiresMs = args.flags["expires-ms"];
       var issued = await registry.issue({
         ownerId:   String(ownerId),
         scopes:    scopeList,
         metadata:  label ? { label: label } : null,
-        expiresMs: expiresMs && expiresMs !== true ? Number(expiresMs) : undefined,
+        expiresAt: expiresMs && expiresMs !== true ? Number(expiresMs) : undefined,
       });
       report.write("id:     " + issued.id);
       report.write("key:    " + issued.key);

package/lib/vendor/blamejs/lib/client-hints.js

@@ -158,15 +158,13 @@ function _parseBrandMember(piece) {
   var brand = _parseSfString(params[0].trim());
   if (brand === null) return null;
   var member = { brand: brand, version: null, params: {} };
-  for (var i = 1; i < params.length; i += 1) {
-    var kv = params[i].trim();
-    if (kv.length === 0) continue;
-    var eq = kv.indexOf("=");
-    if (eq === -1) { member.params[kv.toLowerCase()] = true; continue; }
-    var k = kv.slice(0, eq).trim().toLowerCase();
-    var v = _parseSfString(kv.slice(eq + 1));
-    member.params[k] = v;
-    if (k === "v" && v !== null) member.version = v;
+  var kvps = structuredFields.parseKeyValuePieces(params, 1);
+  for (var i = 0; i < kvps.length; i += 1) {
+    var kv = kvps[i];
+    if (kv.value === null) { member.params[kv.key] = true; continue; }
+    var v = _parseSfString(kv.value);
+    member.params[kv.key] = v;
+    if (kv.key === "v" && v !== null) member.version = v;
   }
   return member;
 }

package/lib/vendor/blamejs/lib/cloud-events.js

@@ -118,21 +118,41 @@ function _genId() {
  *   // → "1.0"
  */
 function wrap(opts) {
-  validateOpts.requireObject(opts, "cloudEvents.wrap", CloudEventsError);
-  validateOpts.requireNonEmptyString(opts.source,
-    "cloudEvents.wrap: source", CloudEventsError, "cloud-events/bad-source");
-  validateOpts.requireNonEmptyString(opts.type,
-    "cloudEvents.wrap: type", CloudEventsError, "cloud-events/bad-type");
-  validateOpts.optionalNonEmptyString(opts.id,
-    "cloudEvents.wrap: id", CloudEventsError, "cloud-events/bad-id");
-  validateOpts.optionalNonEmptyString(opts.subject,
-    "cloudEvents.wrap: subject", CloudEventsError, "cloud-events/bad-subject");
-  validateOpts.optionalNonEmptyString(opts.time,
-    "cloudEvents.wrap: time", CloudEventsError, "cloud-events/bad-time");
-  validateOpts.optionalNonEmptyString(opts.datacontenttype,
-    "cloudEvents.wrap: datacontenttype", CloudEventsError, "cloud-events/bad-datacontenttype");
-  validateOpts.optionalNonEmptyString(opts.dataschema,
-    "cloudEvents.wrap: dataschema", CloudEventsError, "cloud-events/bad-dataschema");
+  validateOpts.shape(opts, {
+    source:          { rule: "required-string", code: "cloud-events/bad-source" },
+    type:            { rule: "required-string", code: "cloud-events/bad-type" },
+    id:              { rule: "optional-string", code: "cloud-events/bad-id" },
+    subject:         { rule: "optional-string", code: "cloud-events/bad-subject" },
+    time:            { rule: "optional-string", code: "cloud-events/bad-time" },
+    datacontenttype: { rule: "optional-string", code: "cloud-events/bad-datacontenttype" },
+    dataschema:      { rule: "optional-string", code: "cloud-events/bad-dataschema" },
+    // data is any JSON value or a Buffer — wrap routes Buffers to
+    // data_base64 and everything else to the data attribute, imposing no
+    // type constraint of its own, so accept any value here.
+    data:            function () {},
+    // extensions — plain object whose keys conform to the §3.1 naming
+    // rules (lowercase ASCII alnum, 1-20 chars) and collide with no spec
+    // attribute. Validation lives IN the shape; the body only copies the
+    // validated keys onto the envelope.
+    extensions:      function (v) {
+      validateOpts.optionalPlainObject(v,
+        "cloudEvents.wrap: extensions", CloudEventsError, "cloud-events/bad-extensions");
+      if (v === undefined || v === null) return;
+      var extKeys = Object.keys(v);
+      for (var i = 0; i < extKeys.length; i += 1) {
+        var k = extKeys[i];
+        // bound BEFORE regex test — k.length > 0 && k.length <= 20
+        if (typeof k !== "string" || k.length === 0 || k.length > 20 || !EXT_ATTR_NAME_RE.test(k)) {
+          throw new CloudEventsError("cloud-events/bad-extension-name",
+            "cloudEvents.wrap: extension '" + k + "' must match [a-z0-9]{1,20}");
+        }
+        if (REQUIRED_ATTRS.indexOf(k) !== -1 || KNOWN_OPTIONAL_ATTRS[k]) {
+          throw new CloudEventsError("cloud-events/extension-conflicts-with-spec",
+            "cloudEvents.wrap: extension '" + k + "' conflicts with a spec attribute");
+        }
+      }
+    },
+  }, "cloudEvents.wrap", CloudEventsError);
 
   var out = {
     specversion: SPECVERSION,
@@ -158,24 +178,13 @@ function wrap(opts) {
     out.datacontenttype = opts.datacontenttype;
   }
 
-  // Extension attributes — operator-defined, must conform to the
-  // §3.1 naming rules (lowercase ASCII alnum, 1-20 chars).
+  // Extension attributes — validated in the shape above (plain object,
+  // §3.1 key naming, no spec collisions); copy the validated keys onto
+  // the envelope.
   if (opts.extensions !== undefined && opts.extensions !== null) {
-    validateOpts.optionalPlainObject(opts.extensions,
-      "cloudEvents.wrap: extensions", CloudEventsError, "cloud-events/bad-extensions");
     var extKeys = Object.keys(opts.extensions);
     for (var i = 0; i < extKeys.length; i += 1) {
-      var k = extKeys[i];
-      // bound BEFORE regex test — k.length > 0 && k.length <= 20
-      if (typeof k !== "string" || k.length === 0 || k.length > 20 || !EXT_ATTR_NAME_RE.test(k)) {
-        throw new CloudEventsError("cloud-events/bad-extension-name",
-          "cloudEvents.wrap: extension '" + k + "' must match [a-z0-9]{1,20}");
-      }
-      if (REQUIRED_ATTRS.indexOf(k) !== -1 || KNOWN_OPTIONAL_ATTRS[k]) {
-        throw new CloudEventsError("cloud-events/extension-conflicts-with-spec",
-          "cloudEvents.wrap: extension '" + k + "' conflicts with a spec attribute");
-      }
-      out[k] = opts.extensions[k];
+      out[extKeys[i]] = opts.extensions[extKeys[i]];
     }
   }
   return out;
@@ -668,7 +677,7 @@ function decodeBinary(headers, body, opts) {
   else if (Buffer.isBuffer(body)) raw = body;
   else if (typeof body === "string") raw = Buffer.from(body, "utf8");
   else throw new CloudEventsError("cloud-events/bad-input", "cloudEvents.http.decodeBinary: body must be a string or Buffer");
-  if (raw.length > maxBytes) throw new CloudEventsError("cloud-events/too-large", "cloudEvents.http.decodeBinary: body exceeds maxBytes (" + maxBytes + ")");
+  if (safeBuffer.byteLengthOf(raw) > maxBytes) throw new CloudEventsError("cloud-events/too-large", "cloudEvents.http.decodeBinary: body exceeds maxBytes (" + maxBytes + ")");
   if (raw.length > 0) {
     if (_isJsonMedia(ct)) {
       try { event.data = safeJson.parse(raw, { maxBytes: maxBytes }); }

package/lib/vendor/blamejs/lib/cluster-storage.js

@@ -30,6 +30,7 @@
 var cluster = require("./cluster");
 var frameworkSchema = require("./framework-schema");
 var externalDb = require("./external-db");
+var safeSql = require("./safe-sql");
 var lazyRequire = require("./lazy-require");
 var { FrameworkError } = require("./framework-error");
 
@@ -277,44 +278,7 @@ function resolveTables(sql) {
  *   // → "SELECT id FROM audit_log WHERE counter > $1 AND actor = $2"
  */
 function placeholderize(sql, dialect) {
-  if (dialect !== "postgres") return sql;
-  var out = "";
-  var n = 0;
-  var i = 0;
-  var len = sql.length;
-  while (i < len) {
-    var c = sql.charAt(i);
-    var nx = i + 1 < len ? sql.charAt(i + 1) : "";
-    // Quote contexts: ' string literal, " identifier, ` mysql identifier.
-    // A doubled quote escapes itself within the span.
-    if (c === "'" || c === '"' || c === "`") {
-      out += c;
-      i += 1;
-      while (i < len) {
-        var q = sql.charAt(i);
-        if (q === c) {
-          if (sql.charAt(i + 1) === c) { out += c + c; i += 2; continue; }
-          out += c; i += 1; break;
-        }
-        out += q; i += 1;
-      }
-      continue;
-    }
-    if (c === "-" && nx === "-") {                              // line comment
-      while (i < len && sql.charAt(i) !== "\n") { out += sql.charAt(i); i += 1; }
-      continue;
-    }
-    if (c === "/" && nx === "*") {                              // block comment
-      out += "/*"; i += 2;
-      while (i < len && !(sql.charAt(i) === "*" && sql.charAt(i + 1) === "/")) { out += sql.charAt(i); i += 1; }
-      if (i < len) { out += "*/"; i += 2; }
-      continue;
-    }
-    if (c === "?") { n += 1; out += "$" + n; i += 1; continue; }
-    out += c;
-    i += 1;
-  }
-  return out;
+  return safeSql.toPositional(sql, dialect);
 }
 
 // ---- execute() ----

package/lib/vendor/blamejs/lib/cms-codec.js

@@ -68,6 +68,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var safeBuffer = require("./safe-buffer");
 var asn1 = require("./asn1-der");
 var bCrypto = require("./crypto");
 var pqcSoftware = require("./pqc-software");
@@ -322,7 +323,7 @@ function decode(buf, opts) {
     throw new CmsCodecError("cms/bad-input", "decode: buf must be a Buffer");
   }
   var maxBytes = opts.maxBytes || DEFAULT_MAX_LEN;
-  if (buf.length > maxBytes) {
+  if (safeBuffer.byteLengthOf(buf) > maxBytes) {
     throw new CmsCodecError("cms/oversize",
       "decode: input " + buf.length + " bytes exceeds maxBytes=" + maxBytes);
   }

package/lib/vendor/blamejs/lib/codepoint-class.js

@@ -172,7 +172,7 @@ function detectMixedScripts(label, allowedScripts) {
 //
 //   issues.push.apply(issues,
 //     codepointClass.detectCharThreats(text, opts, "html"));
-function detectCharThreats(text, opts, codePrefix) {
+function detectCharThreats(text, opts, codePrefix, zeroWidthSeverity) {
   var issues = [];
   if (typeof text !== "string") return issues;
   if (opts && opts.bidiPolicy !== "allow") {
@@ -208,6 +208,28 @@ function detectCharThreats(text, opts, codePrefix) {
       });
     }
   }
+  // Zero-width / invisible-formatting chars — the fourth Trojan-source-class
+  // character threat, detected here alongside its siblings so no guard
+  // hand-rolls it. OPT-IN AND severity via zeroWidthSeverity: a caller that
+  // wants zero-width detection passes the context-appropriate severity
+  // ("high" where an invisible char spoofs an identifier / filename / line of
+  // text; "warn" where it is cosmetic), and omitting it skips the scan. Gated
+  // further on a defined non-`allow` zeroWidthPolicy — flagged under `strip`
+  // too (like bidi / null / control) so a zero-width-only input under `strip`
+  // reaches the sanitizer and is removed rather than served unchanged.
+  if (zeroWidthSeverity && opts && opts.zeroWidthPolicy &&
+      opts.zeroWidthPolicy !== "allow") {
+    var zwMatch = text.match(ZERO_WIDTH_RE);
+    if (zwMatch) {
+      issues.push({
+        kind: "zero-width", severity: zeroWidthSeverity,
+        ruleId: codePrefix + ".zero-width",
+        location: zwMatch.index,
+        snippet: "zero-width / invisible-formatting char U+" +
+                 zwMatch[0].charCodeAt(0).toString(HEX_RADIX) + " at byte " + zwMatch.index,
+      });
+    }
+  }
   return issues;
 }
 
@@ -292,7 +314,51 @@ function isUnreserved(cc) {
          cc === 0x7e;     // ~
 }
 
+// isForbiddenControlChar — the header-injection / RFC 5322 control-byte
+// predicate every "refuse control bytes in a header / line / value" loop
+// shares across the mail guards (dsn / imap / list-id / list-unsubscribe /
+// mail-compose / mail-sieve / managesieve) and the safe-* text parsers
+// (ical / mime / vcard / toml). TRUE for DEL (0x7f) and any C0 control
+// (< 0x20) other than TAB (0x09); LF (0x0a) and CR (0x0d) are refused by
+// default but can be permitted per call (a line reader that has already
+// split on CRLF, or a grammar that allows folding). Distinct from the
+// C0_CTRL_RANGES regex above, which is the stripping/scanning table that
+// always exempts LF/CR and never matches DEL.
+//
+// opts.forbidTab — TAB (0x09) is normally permitted (it is folding
+// whitespace in RFC 5322 header values). The stricter identifier / key /
+// name / single-line-value contexts (idempotency keys, step-up challenge
+// values, mailbox / folder / message-id names, assembly ids, DNSBL-free
+// single-line values) forbid EVERY C0 control plus DEL — there is no
+// folding to honour — so they pass `{ forbidTab: true }`, making the
+// predicate exactly `code < 0x20 || code === 0x7f`.
+function isForbiddenControlChar(code, opts) {
+  if (code === 0x7f) return true;          // DEL
+  if (code >= 0x20) return false;
+  if (code === 0x09 && (!opts || !opts.forbidTab)) return false;  // TAB — permitted unless forbidTab
+  if (opts) {
+    if (opts.allowLf && code === 0x0a) return false;
+    if (opts.allowCr && code === 0x0d) return false;
+  }
+  return true;
+}
+
+// firstControlCharOffset — index of the first isForbiddenControlChar in `s`
+// (under the same opts), or -1 when none. Callers wrap it as a boolean
+// (`offset !== -1`), throw with the offending code (`s.charCodeAt(offset)`),
+// or derive a byte offset from the index — replacing the open-coded
+// `for (i) { c = charCodeAt(i); if (c === 0 || c === 0x7f || (c < 0x20 &&
+// c !== 0x09)) … }` scan each parser previously rolled by hand.
+function firstControlCharOffset(s, opts) {
+  for (var i = 0; i < s.length; i += 1) {
+    if (isForbiddenControlChar(s.charCodeAt(i), opts)) return i;
+  }
+  return -1;
+}
+
 module.exports = {
+  isForbiddenControlChar:  isForbiddenControlChar,
+  firstControlCharOffset:  firstControlCharOffset,
   isAsciiAlnum:      isAsciiAlnum,
   isUnreserved:      isUnreserved,
   hex4:              hex4,

package/lib/vendor/blamejs/lib/compliance-ai-act-logging.js

@@ -131,12 +131,7 @@ function emit(event) {
   // namespace uses underscores, so the kind is rewritten before emit.
   try {
     var kindCanonical = String(event.kind || "log").replace(/-/g, "_");
-    audit().safeEmit({
-      action:   "compliance.aiact." + kindCanonical,
-      outcome:  event.outcome || "success",
-      actor:    event.actor || null,
-      metadata: event,
-    });
+    audit().namespaced("compliance.aiact")(kindCanonical, event.outcome || "success", event, { actor: event.actor || null });
   } catch (_e) { /* drop-silent */ }
   return event;
 }

package/lib/vendor/blamejs/lib/compliance-ai-act-transparency.js

@@ -39,6 +39,7 @@
  */
 
 var validateOpts  = require("./validate-opts");
+var markupEscape  = require("./markup-escape").markupEscape;
 var { ComplianceError } = require("./framework-error");
 
 var BANNER_KINDS = Object.freeze([
@@ -118,10 +119,7 @@ function htmlBanner(opts) {
 
 function _escapeHtml(s) {
   if (typeof s !== "string") return "";
-  return s.replace(/&/g, "&")
-          .replace(/</g, "&lt;")
-          .replace(/>/g, "&gt;")
-          .replace(/"/g, "&quot;");
+  return markupEscape(s);
 }
 
 // Watermark builder for Art. 50(2). Operators integrate with C2PA /