@blamejs/blamejs-shop 0.4.56 → 0.4.57

package/lib/vendor/blamejs/lib/compliance-eaa.js

@@ -66,22 +66,12 @@ function create(opts) {
   var standards = opts.standards.slice();
   var contact = opts.contact || null;
   var supervisoryAuthority = opts.supervisoryAuthority || null;
-  var auditOn = opts.audit !== false;
   var now = typeof opts.now === "function" ? opts.now : function () { return Date.now(); };
 
   var criteria = new Map();
   var nonConformances = [];
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "compliance.eaa." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("compliance.eaa", opts.audit);
 
   function declareCriterion(id, decl) {
     if (typeof id !== "string" || id.length === 0) {

package/lib/vendor/blamejs/lib/compliance-sanctions-fetcher.js

@@ -65,20 +65,25 @@ function create(opts) {
     "fetchOnStart", "audit",
   ], "compliance.sanctions.fetcher.create");
 
-  if (!opts.screener || typeof opts.screener.reload !== "function") {
-    throw new SanctionsFetcherError("sanctions-fetcher/bad-screener",
-      "fetcher.create: screener must be a sanctions.create() instance");
-  }
-  if (typeof opts.fetch !== "function") {
-    throw new SanctionsFetcherError("sanctions-fetcher/bad-fetch",
-      "fetcher.create: fetch must be an async function returning entry[]");
-  }
-  validateOpts.optionalPositiveFinite(opts.intervalMs,
-    "fetcher.create: intervalMs", SanctionsFetcherError, "sanctions-fetcher/bad-opts");
-  validateOpts.optionalFunction(opts.onRefreshed,
-    "fetcher.create: onRefreshed", SanctionsFetcherError, "sanctions-fetcher/bad-opts");
-  validateOpts.optionalFunction(opts.onError,
-    "fetcher.create: onError", SanctionsFetcherError, "sanctions-fetcher/bad-opts");
+  validateOpts.shape(opts, {
+    screener: function (value) {
+      if (!value || typeof value.reload !== "function") {
+        throw new SanctionsFetcherError("sanctions-fetcher/bad-screener",
+          "fetcher.create: screener must be a sanctions.create() instance");
+      }
+    },
+    fetch: function (value) {
+      if (typeof value !== "function") {
+        throw new SanctionsFetcherError("sanctions-fetcher/bad-fetch",
+          "fetcher.create: fetch must be an async function returning entry[]");
+      }
+    },
+    intervalMs:   "optional-positive-finite",
+    onRefreshed:  "optional-function",
+    onError:      "optional-function",
+    fetchOnStart: "optional-boolean",
+    audit:        "optional-boolean",
+  }, "fetcher.create", SanctionsFetcherError, "sanctions-fetcher/bad-opts");
 
   var intervalMs   = opts.intervalMs   || C.TIME.hours(24);
   var fetchOnStart = opts.fetchOnStart !== false;
@@ -93,21 +98,9 @@ function create(opts) {
   var refreshCount = 0;
   var failureCount = 0;
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced(null, { audit: auditOn });
 
-  function _emitMetric(verb, n) {
-    try { observability().safeEvent("compliance.sanctions.fetcher." + verb, n || 1, {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitMetric = observability().namespaced("compliance.sanctions.fetcher");
 
   async function _tick() {
     if (stopping) return;

package/lib/vendor/blamejs/lib/compliance-sanctions.js

@@ -284,21 +284,9 @@ function create(opts) {
   // strings.
   var index = opts.entries.map(_normalizeEntry);
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit sink */ }
-  }
+  var _emitAudit = audit().namespaced(null, { audit: auditOn });
 
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("compliance.sanctions." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitMetric = observability().namespaced("compliance.sanctions");
 
   function _exactMatch(qNorm, candidate) {
     for (var i = 0; i < candidate._allNamesNormalized.length; i++) {

package/lib/vendor/blamejs/lib/compliance.js

@@ -47,6 +47,7 @@ var aiAct     = require("./compliance-ai-act");
 var { ComplianceError } = require("./framework-error");
 
 var audit         = lazyRequire(function () { return require("./audit"); });
+var auditEmit     = require("./audit-emit");
 var retentionMod  = lazyRequire(function () { return require("./retention"); });
 var db            = lazyRequire(function () { return require("./db"); });
 var cryptoField   = lazyRequire(function () { return require("./crypto-field"); });
@@ -316,15 +317,7 @@ var ARTIFACT_STANDARDS = Object.freeze([
 
 var STATE = { posture: null, setAt: null, fipsMode: false };
 
-function _emitAudit(action, metadata, outcome) {
-  try {
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome || "success",
-      metadata: metadata,
-    });
-  } catch (_e) { /* audit best-effort */ }
-}
+var _emitAudit = auditEmit.emit;
 
 /**
  * @primitive b.compliance.set

package/lib/vendor/blamejs/lib/config-drift.js

@@ -47,6 +47,7 @@ var { defineClass } = require("./framework-error");
 var atomicFile = require("./atomic-file");
 
 var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var ConfigDriftError = defineClass("ConfigDriftError", { alwaysPermanent: true });
 var _err = ConfigDriftError.factory;
@@ -159,18 +160,7 @@ function create(opts) {
   var sidecarPath = nodePath.join(dataDir,
     baselineName === "default" ? SIDECAR_NAME : ("config-baseline-" + baselineName + ".sig"));
 
-  function _emit(action, info, outcome) {
-    if (!auditOn) return;
-    var sink = auditInstance || audit();
-    try {
-      sink.safeEmit({
-        action:   action,
-        outcome:  outcome,
-        metadata: info || {},
-        reason:   info && info.reason ? info.reason : null,
-      });
-    } catch (_e) { /* audit best-effort */ }
-  }
+  var _emit = auditEmit.gatedReasonEmitter({ audit: auditOn, sink: auditInstance });
 
   function _readSidecar() {
     if (!nodeFs.existsSync(sidecarPath)) return null;

package/lib/vendor/blamejs/lib/content-digest.js

@@ -29,6 +29,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var structuredFields = require("./structured-fields");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -59,12 +60,12 @@ function _strictBase64(s, what) {
   return buf;
 }
 
-function _bodyBytes(body, what) {
-  if (Buffer.isBuffer(body)) return body;
-  if (body instanceof Uint8Array) return Buffer.from(body);
-  if (typeof body === "string") return Buffer.from(body, "utf8");
-  throw new ContentDigestError("content-digest/bad-body", "contentDigest: " + what + " must be a Buffer / Uint8Array / string");
-}
+var _bodyBytes = safeBuffer.makeByteCoercer({
+  errorClass:    ContentDigestError,
+  typeCode:      "content-digest/bad-body",
+  messagePrefix: "contentDigest: ",
+  messageSuffix: " must be a Buffer / Uint8Array / string",
+});
 
 /**
  * @primitive b.contentDigest.create
@@ -150,8 +151,9 @@ function verify(fieldValue, body, opts) {
     if (m === "") continue;
     var eq = m.indexOf("=");
     if (eq < 1) throw new ContentDigestError("content-digest/bad-field", "contentDigest.verify: malformed dictionary member");
-    var name = m.slice(0, eq).trim().toLowerCase();
-    var raw = m.slice(eq + 1).trim();
+    var kvp = structuredFields.parseKeyValuePiece(m);
+    var name = kvp.key;
+    var raw = kvp.value.trim();
     var nodeAlg = ACTIVE[name];
     if (!nodeAlg) continue;                                  // ignore legacy / unknown entries
     if (raw.length < 2 || raw.charAt(0) !== ":" || raw.charAt(raw.length - 1) !== ":") {

package/lib/vendor/blamejs/lib/cookies.js

@@ -48,6 +48,7 @@
  */
 
 var C = require("./constants");
+var structuredFields = require("./structured-fields");
 var validateOpts = require("./validate-opts");
 var { FrameworkError } = require("./framework-error");
 
@@ -143,9 +144,7 @@ function parse(cookieHeader) {
     if (!k) continue;
     var v = pair.slice(eq + 1).trim();
     // Strip surrounding double-quotes per RFC 6265 §5.2.
-    if (v.length >= 2 && v.charAt(0) === '"' && v.charAt(v.length - 1) === '"') {
-      v = v.slice(1, -1);
-    }
+    v = structuredFields.stripDoubleQuotes(v);
     try { v = decodeURIComponent(v); }
     catch (_e) { /* malformed encoding — keep raw */ }
     // Last write wins per RFC; matches every browser's behavior.
@@ -386,10 +385,8 @@ function create(opts) {
   }
 
   function _requireVault() {
-    if (!vault || typeof vault.seal !== "function" || typeof vault.unseal !== "function") {
-      throw new CookieError("cookies/no-vault",
-        "sealed cookies require opts.vault (a value with .seal/.unseal)");
-    }
+    validateOpts.requireMethods(vault, ["seal", "unseal"],
+      "sealed cookies: opts.vault", CookieError, "cookies/no-vault");
   }
 
   // Vault.seal returns "vault:<base64>". We strip the constant prefix
@@ -515,10 +512,7 @@ function parseSafe(cookieHeader, opts) {
       });
       continue;
     }
-    var v = pair.slice(eq + 1).trim();
-    if (v.length >= 2 && v.charAt(0) === '"' && v.charAt(v.length - 1) === '"') {
-      v = v.slice(1, -1);
-    }
+    var v = structuredFields.stripDoubleQuotes(pair.slice(eq + 1).trim());
     try { v = decodeURIComponent(v); }
     catch (_e) { /* malformed encoding — keep raw */ }
 

package/lib/vendor/blamejs/lib/cose.js

@@ -55,6 +55,7 @@
 var nodeCrypto = require("node:crypto");
 var cbor = require("./cbor");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -110,10 +111,11 @@ function _algParamsFor(algId) {
 }
 
 function _bstr(x) {
-  if (Buffer.isBuffer(x)) return x;
-  if (x instanceof Uint8Array) return Buffer.from(x);
-  if (typeof x === "string") return Buffer.from(x, "utf8");
-  throw new CoseError("cose/bad-bytes", "cose: expected bytes (Buffer / Uint8Array / string)");
+  return safeBuffer.toBuffer(x, {
+    errorFactory: function (code, msg) { return new CoseError(code, msg); },
+    typeCode:    "cose/bad-bytes",
+    typeMessage: "cose: expected bytes (Buffer / Uint8Array / string)",
+  });
 }
 
 // Sig_structure (RFC 9052 §4.4) for COSE_Sign1:
@@ -753,11 +755,14 @@ var COSE_KEY_LABEL_KTY = 1;
 var COSE_KEY_LABEL_KID = 2;
 var COSE_KEY_LABEL_ALG = 3;
 
-function _coseKeyBytes(v, what) {
-  if (Buffer.isBuffer(v)) return v;
-  if (v instanceof Uint8Array) return Buffer.from(v);
-  throw new CoseError("cose/bad-cose-key", "cose.importKey: COSE_Key " + what + " must be a byte string");
-}
+// COSE_Key components are byte strings, never text (allowString:false).
+var _coseKeyBytes = safeBuffer.makeByteCoercer({
+  errorClass:    CoseError,
+  typeCode:      "cose/bad-cose-key",
+  messagePrefix: "cose.importKey: COSE_Key ",
+  messageSuffix: " must be a byte string",
+  allowString:   false,
+});
 
 /**
  * @primitive b.cose.importKey
@@ -806,8 +811,11 @@ function importKey(coseKey) {
   } else {
     throw new CoseError("cose/unsupported-key", "cose.importKey: kty must be OKP (1) or EC2 (2), got " + kty);
   }
-  try { return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }
-  catch (e) { throw new CoseError("cose/bad-cose-key", "cose.importKey: could not import COSE_Key: " + ((e && e.message) || e)); }
+  return bCrypto.importPublicJwk(jwk, {
+    errorClass:    CoseError,
+    code:          "cose/bad-cose-key",
+    messagePrefix: "cose.importKey: could not import COSE_Key: ",
+  });
 }
 
 /**

package/lib/vendor/blamejs/lib/cra-report.js

@@ -70,7 +70,6 @@ function create(opts) {
   var enisaEndpoint = typeof opts.enisaEndpoint === "string" && opts.enisaEndpoint.length > 0
     ? opts.enisaEndpoint : null;
   var httpClient = opts.httpClient || null;
-  var auditOn = opts.audit !== false;
 
   // CRA Article 14 deadlines — operators don't override these without
   // documented regulatory justification (the deadlines are statutory,
@@ -89,16 +88,7 @@ function create(opts) {
     },
   });
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "cra.report." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("cra.report", opts.audit);
 
   async function _submitToEnisa(payload) {
     if (!enisaEndpoint || !httpClient) {

package/lib/vendor/blamejs/lib/crypto-field.js

@@ -56,6 +56,7 @@
  *   Per-column field-level encryption with AAD-bound envelopes.
  */
 var lazyRequire = require("./lazy-require");
+var boundedMap = require("./bounded-map");
 var vault = require("./vault");
 var vaultAad = require("./vault-aad");
 var validateOpts = require("./validate-opts");
@@ -568,14 +569,9 @@ function computeNamespacedHash(ns, value, opts) {
       "(default) or 'hmac-shake256', got " + JSON.stringify(mode));
   }
   var truncateBytes = opts.truncateBytes;
-  if (truncateBytes !== undefined) {
-    if (typeof truncateBytes !== "number" || !isFinite(truncateBytes) ||
-        truncateBytes <= 0 || Math.floor(truncateBytes) !== truncateBytes) {
-      throw new CryptoFieldError("crypto-field/bad-truncate-bytes",
-        "computeNamespacedHash: opts.truncateBytes must be a " +
-        "positive integer (bytes), got " + JSON.stringify(truncateBytes));
-    }
-  }
+  numericBounds.requirePositiveFiniteIntIfPresent(truncateBytes,
+    "computeNamespacedHash: opts.truncateBytes", CryptoFieldError,
+    "crypto-field/bad-truncate-bytes");
   var hex = _computeDerivedHash({ mode: mode }, mode, ns, String(value));
   if (truncateBytes !== undefined) {
     return hex.slice(0, truncateBytes * 2);
@@ -918,8 +914,7 @@ function _rateNoteFailure(actor, table, column) {
   if (!_rateCap) return false;
   var nowMs = _rateCap.now();
   var key = _rateKey(actor, table, column);
-  var arr = _rateFailWindows.get(key);
-  if (!arr) { arr = []; _rateFailWindows.set(key, arr); }
+  var arr = boundedMap.getOrInsert(_rateFailWindows, key, function () { return []; });
   // Prune entries older than the window (sliding-window via timestamp
   // array — same shape as b.mail.server.rateLimit._pruneWindow).
   var cutoff = nowMs - _rateCap.windowMs;

package/lib/vendor/blamejs/lib/crypto.js

@@ -49,6 +49,7 @@ var nodeFs = require("node:fs");
 var { pipeline } = require("node:stream/promises");
 var { xchacha20poly1305 } = require("./vendor/noble-ciphers.cjs");
 var C = require("./constants");
+var numericBounds = require("./numeric-bounds");
 // Circular: audit imports b.crypto for sha3Hash + envelope sign. Lazy-
 // load the audit module so the legacy-envelope decrypt path can emit
 // `system.crypto.decrypt.allow_legacy` events without an inline
@@ -337,8 +338,7 @@ function hashFilesParallel(filePaths, opts) {
   // override per-call.
   var maxBytesPerFile = opts.maxBytesPerFile !== undefined
     ? opts.maxBytesPerFile : C.BYTES.gib(1);
-  if (typeof maxBytesPerFile !== "number" || !isFinite(maxBytesPerFile) ||
-      maxBytesPerFile <= 0 || Math.floor(maxBytesPerFile) !== maxBytesPerFile) {
+  if (!numericBounds.isPositiveFiniteInt(maxBytesPerFile)) {
     return Promise.reject(new TypeError(
       "crypto.hashFilesParallel: opts.maxBytesPerFile must be a positive integer, got " + maxBytesPerFile
     ));
@@ -847,6 +847,74 @@ function fromBase64Url(s, opts) {
   return Buffer.from(s, "base64url");
 }
 
+/**
+ * @primitive b.crypto.makeBase64UrlDecoder
+ * @signature b.crypto.makeBase64UrlDecoder(opts)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.crypto.fromBase64Url, b.crypto.toBase64Url
+ *
+ * Bind the strict `fromBase64Url` decoder to one module's error contract,
+ * returning a `decode(s)` that translates the decoder's `TypeError` (bad
+ * type or non-canonical input) into the caller's typed error. Every
+ * base64url-carrying surface — JWT segments, DPoP / OAuth tokens, status
+ * lists, pagination cursors — wrapped `fromBase64Url` in the same
+ * `if (typeof s !== "string") throw new XError(...); try { return
+ * fromBase64Url(s); } catch { throw new XError(...); }` shape, differing
+ * only in error class, code, and the two messages; this owns that binding.
+ *
+ * `opts.badMessage` is thrown on any decode failure (non-canonical /
+ * malformed input — the strict decoder rejects the CWE-347 signature-
+ * canonicalization footgun). `opts.typeMessage` is optional: when set, a
+ * non-string input throws it directly (the common case names the field —
+ * "cursor must be a string"); when omitted, a non-string falls through to
+ * `badMessage` like any other decode failure.
+ *
+ * @opts
+ *   errorClass:  Function,  // required — (code, message) error constructor
+ *   code:        string,    // required — error code for both throws
+ *   badMessage:  string,    // required — message on a decode failure
+ *   typeMessage: string,    // optional — message on a non-string input
+ *
+ * @example
+ *   var b = require("blamejs");
+ *
+ *   function JwtError(code, message) { this.code = code; this.message = message; }
+ *   var decodeSeg = b.crypto.makeBase64UrlDecoder({
+ *     errorClass:  JwtError,
+ *     code:        "jwt/malformed",
+ *     typeMessage: "expected base64url string",
+ *     badMessage:  "JWT segment is not valid base64url",
+ *   });
+ *   decodeSeg("aGVsbG8");   // → <Buffer 68 65 6c 6c 6f>
+ *   // decodeSeg("!!!") throws JwtError("jwt/malformed", "JWT segment is not valid base64url")
+ */
+function makeBase64UrlDecoder(opts) {
+  if (!opts || typeof opts !== "object") {
+    throw new TypeError("crypto.makeBase64UrlDecoder: opts is required");
+  }
+  if (typeof opts.errorClass !== "function") {
+    throw new TypeError("crypto.makeBase64UrlDecoder: opts.errorClass must be a constructor");
+  }
+  if (typeof opts.badMessage !== "string") {
+    throw new TypeError("crypto.makeBase64UrlDecoder: opts.badMessage must be a string");
+  }
+  var ErrorClass = opts.errorClass;
+  var code = opts.code;
+  var typeMessage = opts.typeMessage;
+  var badMessage = opts.badMessage;
+  return function decode(s) {
+    if (typeMessage !== undefined && typeof s !== "string") {
+      throw new ErrorClass(code, typeMessage);
+    }
+    try {
+      return fromBase64Url(s);
+    } catch (_e) {
+      throw new ErrorClass(code, badMessage);
+    }
+  };
+}
+
 // ---- Subresource Integrity (W3C SRI 1.0) ----
 //
 // b.crypto.sri(content, { algorithm? }) — returns a `sha###-base64`
@@ -1024,6 +1092,53 @@ function verify(data, signature, publicKeyPem) {
   return nodeCrypto.verify(null, Buffer.from(data), publicKeyPem, signature);
 }
 
+/**
+ * @primitive b.crypto.importPublicJwk
+ * @signature b.crypto.importPublicJwk(jwk, opts?)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.crypto.verify
+ *
+ * Import a JWK as a public `KeyObject` via
+ * `crypto.createPublicKey({ key, format: "jwk" })`, translating the Node
+ * import failure into a caller-supplied typed error. Untrusted JWKs reach
+ * this from DID documents (`publicKeyJwk`), DNSKEY records, and COSE_Key
+ * structures — each module validates the `kty` / `crv` it accepts BEFORE
+ * calling, then hands the assembled JWK here for the final import + error
+ * translation that was otherwise hand-rolled identically in every one.
+ * Centralising it gives one place to harden untrusted-JWK import.
+ *
+ * On failure, when `opts.errorClass` is supplied the thrown error is
+ * `new opts.errorClass(opts.code, opts.messagePrefix + nodeFailureDetail)`
+ * so the operator sees the module's own code + a message naming the
+ * source; without it the original Node error propagates unchanged.
+ *
+ * @opts
+ *   errorClass:    Function,  // (code, message) error constructor
+ *   code:          string,    // error code passed to errorClass
+ *   messagePrefix: string,    // text before the Node failure detail. default: ""
+ *
+ * @example
+ *   var b = require("blamejs");
+ *
+ *   function KeyError(code, message) { this.code = code; this.message = message; }
+ *   var key = b.crypto.importPublicJwk(
+ *     { kty: "OKP", crv: "Ed25519", x: "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo" },
+ *     { errorClass: KeyError, code: "bad-key", messagePrefix: "bad key: " });
+ *   // → <KeyObject>  (or throws KeyError("bad-key", "bad key: <detail>"))
+ */
+function importPublicJwk(jwk, opts) {
+  opts = opts || {};
+  try {
+    return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" });
+  } catch (e) {
+    if (typeof opts.errorClass === "function") {
+      throw new opts.errorClass(opts.code, (opts.messagePrefix || "") + ((e && e.message) || e));
+    }
+    throw e;
+  }
+}
+
 // Track whether the hybrid-disabled audit has been emitted at least
 // once per process, so a high-volume KEM-only deployment doesn't peg
 // the audit bus with one event per encrypt() call. Operators who want
@@ -1768,7 +1883,7 @@ function _pemToDer(pemOrDer) {
   // for mTLS bootstrap / webhook verification / peer-cert pinning.
   // 64 KiB caps the largest plausible PEM (a P-384 cert + chain) at
   // ~3× margin while refusing pathological inputs outright.
-  if (pemOrDer.length > C.BYTES.kib(64)) {
+  if (safeBuffer.byteLengthOf(pemOrDer) > C.BYTES.kib(64)) {
     throw new TypeError(
       "crypto.hashCertFingerprint: PEM input exceeds 64 KiB (" +
       pemOrDer.length + " bytes); refuse oversized input to avoid " +
@@ -2022,6 +2137,8 @@ module.exports = {
   // Signatures
   sign:                        sign,
   verify:                      verify,
+  importPublicJwk:             importPublicJwk,
+  makeBase64UrlDecoder:        makeBase64UrlDecoder,
   // Envelope encrypt/decrypt
   encrypt:                     encrypt,
   decrypt:                     decrypt,