@blamejs/blamejs-shop 0.4.56 → 0.4.57

package/lib/vendor/blamejs/lib/guard-image.js

@@ -33,11 +33,15 @@
  *   (e.g. JPEG marker followed by an embedded ZIP central directory) —
  *   refused at every profile.
  *
- *   EXIF / XMP metadata strip: handled by the operator's decoder
- *   (sharp's `withMetadata: false`, libvips `metadata-strip`). The
- *   guard does not parse byte streams; it enforces the policy boundary
- *   and refuses the upload when the decoder's reported metadata
- *   violates a cap.
+ *   EXIF / XMP / IPTC metadata strip: `sanitize` removes the metadata
+ *   segments in-framework by walking the container framing (JPEG APPn/COM
+ *   markers, PNG ancillary text chunks, GIF comment/application extensions,
+ *   WebP EXIF/XMP RIFF chunks) — the privacy-leak and metadata-stego surface,
+ *   stripped without a vendored decoder. Pixel transcoding / dimension
+ *   downscale still belong to the operator's decoder (sharp's
+ *   `withMetadata: false`, libvips `metadata-strip`); formats whose metadata
+ *   lives in an offset-based structure (TIFF / HEIC / AVIF) are refused rather
+ *   than passed through.
  *
  *   SVG routing: bytes that match the SVG magic are refused under every
  *   profile — operators must route SVG explicitly to `b.guardSvg`
@@ -60,9 +64,9 @@
  */
 
 var lazyRequire = require("./lazy-require");
+var safeBuffer = require("./safe-buffer");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var { GuardImageError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -143,34 +147,9 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode: "enforce",
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa":   Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "gdpr":    Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "soc2":    Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
-});
+var DEFAULTS = gateContract.strictDefaults(PROFILES);
 
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardImageError,
-    errCodePrefix:      "image",
-  });
-}
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256 });
 
 function _bytesAt(buf, offset, sig) {
   if (buf.length < offset + sig.length) return false;
@@ -202,7 +181,7 @@ function _detectIssues(metadata, opts) {
   }
 
   var bytes = metadata.bytes;
-  if (bytes && typeof bytes.length === "number" && bytes.length > opts.maxBytes) {
+  if (bytes && typeof bytes.length === "number" && safeBuffer.byteLengthOf(bytes) > opts.maxBytes) {
     return [{ kind: "image-cap", severity: "high",
               ruleId: "image.image-cap",
               snippet: "image bytes exceed maxBytes " + opts.maxBytes }];
@@ -351,13 +330,11 @@ function _detectIssues(metadata, opts) {
  *   big.issues.some(function (i) { return i.kind === "width-cap"; });
  *   //                                                   → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes", "maxWidth", "maxHeight", "maxFrames"],
-    "guardImage.validate", GuardImageError, "image.bad-opt");
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with the maxBytes / maxWidth / maxHeight /
+// maxFrames caps declared via `intOpts`. The @primitive block above
+// documents the resulting public ABI.
 
 /**
  * @primitive b.guardImage.sanitize
@@ -366,19 +343,35 @@ function validate(input, opts) {
  * @status    stable
  * @related   b.guardImage.validate, b.guardImage.gate
  *
- * Best-effort metadata pass-through. Image-byte sanitization
- * (transcoding, EXIF strip, dimension downscale) is the operator
- * decoder's responsibility — the guard cannot rewrite raster bytes
- * without a vendored decoder. `sanitize` validates the metadata
- * against the active profile and re-throws `GuardImageError` when
- * any issue is `critical` or `high`. Returns the input unchanged
- * when every issue is `warn` or below.
+ * Strip the container's metadata segments from `input.bytes` — EXIF/GPS,
+ * XMP/IPTC, and comment payloads (the privacy-leak and metadata-stego
+ * surface) — and return the bag with the cleaned bytes. Stripping walks the
+ * linear container framing (JPEG APPn/COM markers, PNG ancillary text chunks,
+ * GIF comment/application extensions, WebP EXIF/XMP RIFF chunks); pixel
+ * transcoding and dimension downscale still need a vendored decoder and stay
+ * the operator's job.
+ *
+ * `sanitize` first runs the validate chain and re-throws `GuardImageError`
+ * when any issue is `critical` or `high` (a polyglot or MIME-mismatch is
+ * refused, never stripped). A format whose metadata lives in an offset-based
+ * structure that cannot be rewritten without a decoder (TIFF / HEIC / AVIF) is
+ * refused with `image.sanitize-unsupported-format`; a structurally malformed
+ * container is refused with `image.sanitize-malformed` rather than returned
+ * half-stripped. BMP / ICO carry no metadata container and pass through.
  *
  * @opts
  *   profile:           "strict"|"balanced"|"permissive",
  *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *
  * @example
+ *   // EXIF-laden JPEG → the APP1 (EXIF/XMP) segment is removed.
+ *   var clean = b.guardImage.sanitize({
+ *     bytes: jpegWithExif,
+ *     declaredMime: "image/jpeg",
+ *   }, { profile: "strict" });
+ *   clean.bytes.length < jpegWithExif.length;            // → true
+ *
+ *   // A MIME-mismatch is refused, not stripped.
  *   try {
  *     b.guardImage.sanitize({
  *       bytes: Buffer.from([0xFF, 0xD8, 0xFF]),
@@ -388,14 +381,221 @@ function validate(input, opts) {
  *     e.code;                                            // → "image.mime-mismatch"
  *   }
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  if (!input || typeof input !== "object") {
-    throw _err("image.bad-input", "sanitize requires metadata object");
+// ---- Container-framing metadata strip (sanitize) ----
+//
+// Linear TLV byte-surgery over the well-defined container framing — the same
+// signature-walk shape as inspectMagic, NOT a pixel decoder (Hard rule: no
+// vendored raster library). Removes the metadata segments that carry EXIF/GPS,
+// XMP/IPTC PII, and metadata-embedded stego/polyglot payloads operators need
+// stripped before serving an otherwise-clean image. Pixel transcoding and
+// dimension downscale still need a decoder and stay the operator's job.
+//
+// A structurally malformed container is REFUSED (throw), never returned
+// half-stripped — sanitize must not hand back bytes it could not fully clean.
+
+function _stripMalformed(detail) {
+  return _err("image.sanitize-malformed",
+    "cannot strip image metadata — malformed container framing: " + detail);
+}
+
+// JPEG: FFD8 SOI, then marker segments until SOS (FFDA) begins entropy data.
+// Drop EXIF/XMP (APP1=E1), IPTC/Photoshop (APP13=ED), comments (COM=FE), and
+// the vendor APPn range (E3..EC, EF). Keep JFIF (APP0=E0), ICC color
+// (APP2=E2), Adobe (APP14=EE), and every coding segment (SOFn/DHT/DQT/DRI/SOS).
+function _stripJpegMetadata(buf) {
+  if (buf.length < 2 || buf[0] !== 0xFF || buf[1] !== 0xD8) {
+    throw _stripMalformed("missing SOI");
   }
-  var issues = _detectIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues, { errorClass: GuardImageError, codePrefix: "image" });
-  return input;
+  var parts = [buf.slice(0, 2)];
+  var i = 2;
+  while (i < buf.length) {
+    if (buf[i] !== 0xFF) throw _stripMalformed("expected marker at " + i);
+    // Collapse any 0xFF fill bytes preceding the marker code.
+    var mi = i + 1;
+    while (mi < buf.length && buf[mi] === 0xFF) mi += 1;
+    if (mi >= buf.length) throw _stripMalformed("truncated marker");
+    var marker = buf[mi];
+    // Standalone markers (no length payload): TEM(01), RSTn(D0..D7).
+    if (marker === 0x01 || (marker >= 0xD0 && marker <= 0xD7)) {
+      parts.push(buf.slice(i, mi + 1)); i = mi + 1; continue;
+    }
+    if (marker === 0xD9) { parts.push(buf.slice(i, mi + 1)); i = mi + 1; break; }  // EOI
+    if (marker === 0xDA) { parts.push(buf.slice(i)); i = buf.length; break; }      // SOS + entropy → verbatim
+    if (mi + 3 > buf.length) throw _stripMalformed("truncated segment length");
+    var segLen = (buf[mi + 1] << 8) | buf[mi + 2];
+    if (segLen < 2) throw _stripMalformed("bad segment length");
+    var segEnd = mi + 1 + segLen;
+    if (segEnd > buf.length) throw _stripMalformed("segment overruns buffer");
+    var drop = marker === 0xE1 || marker === 0xED || marker === 0xFE ||
+               (marker >= 0xE3 && marker <= 0xEC) || marker === 0xEF;
+    if (!drop) parts.push(buf.slice(i, segEnd));
+    i = segEnd;
+  }
+  return Buffer.concat(parts);
+}
+
+// PNG: 8-byte signature, then length(4 BE)+type(4)+data+crc(4) chunks. Drop the
+// text/metadata/time ancillary chunks; keep critical chunks (IHDR/PLTE/IDAT/
+// IEND) and rendering ancillary (gAMA/cHRM/sRGB/iCCP/pHYs/tRNS/bKGD/sBIT/...).
+// Dropping a chunk never disturbs another's per-chunk CRC.
+var _PNG_DROP = Object.freeze({ tEXt: 1, zTXt: 1, iTXt: 1, eXIf: 1, tIME: 1, dSIG: 1 });
+function _stripPngMetadata(buf) {
+  if (buf.length < 8) throw _stripMalformed("truncated signature");
+  var parts = [buf.slice(0, 8)];
+  var i = 8;
+  while (i + 8 <= buf.length) {
+    var len = buf.readUInt32BE(i);
+    if (len > 0x7FFFFFFF) throw _stripMalformed("chunk length exceeds PNG max");
+    var type = buf.toString("latin1", i + 4, i + 8);
+    var end = i + 12 + len;                                                        // 4 len + 4 type + len + 4 crc
+    if (end > buf.length) throw _stripMalformed("chunk overruns buffer");
+    if (!_PNG_DROP[type]) parts.push(buf.slice(i, end));
+    i = end;
+    if (type === "IEND") break;
+  }
+  return Buffer.concat(parts);
+}
+
+// GIF: header(6)+logical-screen-descriptor(7)+optional global color table, then
+// blocks. Drop comment (0x21 0xFE) + plain-text (0x21 0x01) + non-loop
+// application (0x21 0xFF, e.g. XMP) extensions; keep graphic-control extensions
+// (0x21 0xF9), the NETSCAPE/ANIMEXTS loop extension (animation control), image
+// descriptors (0x2C), and the trailer (0x3B).
+function _gifSkipSubBlocks(buf, i) {
+  while (i < buf.length) {
+    var size = buf[i];
+    i += 1;
+    if (size === 0) return i;                                                      // block terminator
+    i += size;
+  }
+  throw _stripMalformed("unterminated sub-block stream");
+}
+function _stripGifMetadata(buf) {
+  if (buf.length < 13) throw _stripMalformed("truncated header");
+  var i = 13;
+  var packed = buf[10];
+  if (packed & 0x80) i += 3 * (1 << ((packed & 0x07) + 1));                        // global color table
+  if (i > buf.length) throw _stripMalformed("global color table overruns buffer");
+  var parts = [buf.slice(0, i)];
+  while (i < buf.length) {
+    var b = buf[i];
+    if (b === 0x3B) { parts.push(buf.slice(i, i + 1)); i += 1; break; }            // trailer
+    if (b === 0x2C) {                                                              // image descriptor
+      var start = i;
+      if (i + 10 > buf.length) throw _stripMalformed("truncated image descriptor");
+      var lc = buf[i + 9];
+      i += 10;
+      if (lc & 0x80) i += 3 * (1 << ((lc & 0x07) + 1));                            // local color table
+      if (i + 1 > buf.length) throw _stripMalformed("truncated LZW code size");
+      i += 1;                                                                      // LZW minimum code size
+      i = _gifSkipSubBlocks(buf, i);
+      parts.push(buf.slice(start, i));
+      continue;
+    }
+    if (b === 0x21) {                                                              // extension introducer
+      if (i + 2 > buf.length) throw _stripMalformed("truncated extension");
+      var label = buf[i + 1];
+      var start2 = i;
+      var j = i + 2;
+      if (label === 0xF9) {                                                        // graphic control — keep
+        var k = _gifSkipSubBlocks(buf, j);
+        parts.push(buf.slice(start2, k));
+        i = k;
+        continue;
+      }
+      if (label === 0xFF) {                                                        // application extension
+        if (j >= buf.length) throw _stripMalformed("truncated app extension");
+        var blockSize = buf[j];
+        var idEnd = j + 1 + blockSize;
+        if (idEnd > buf.length) throw _stripMalformed("app-id overruns buffer");
+        var appId = buf.toString("latin1", j + 1, idEnd);
+        var k2 = _gifSkipSubBlocks(buf, idEnd);
+        if (appId.indexOf("NETSCAPE2.0") === 0 || appId.indexOf("ANIMEXTS1.0") === 0) {
+          parts.push(buf.slice(start2, k2));                                       // keep loop control
+        }
+        i = k2;
+        continue;
+      }
+      // comment (0xFE) / plain-text (0x01) / other → drop.
+      var k3 = j;
+      if (label === 0x01) {                                                        // plain text has a 12-byte header block
+        if (k3 >= buf.length) throw _stripMalformed("truncated plain-text header");
+        k3 += 1 + buf[k3];
+        if (k3 > buf.length) throw _stripMalformed("plain-text header overruns buffer");
+      }
+      k3 = _gifSkipSubBlocks(buf, k3);
+      i = k3;
+      continue;
+    }
+    throw _stripMalformed("unknown block 0x" + b.toString(16) + " at " + i);
+  }
+  return Buffer.concat(parts);
+}
+
+// WebP: RIFF container — "RIFF"+size(4 LE)+"WEBP"+chunks (FourCC+size(4 LE)+
+// data, padded to even). Drop EXIF + XMP chunks, clear the VP8X EXIF/XMP flag
+// bits so a strict decoder does not expect the dropped chunks, and rewrite the
+// RIFF size. Keep VP8/VP8L/VP8X/ANIM/ANMF/ALPH/ICCP.
+function _stripWebpMetadata(buf) {
+  if (buf.length < 12 ||
+      buf.toString("latin1", 0, 4) !== "RIFF" ||
+      buf.toString("latin1", 8, 12) !== "WEBP") {
+    throw _stripMalformed("not a RIFF/WEBP container");
+  }
+  var body = [];
+  var i = 12;
+  while (i + 8 <= buf.length) {
+    var fourcc = buf.toString("latin1", i, i + 4);
+    var size = buf.readUInt32LE(i + 4);
+    var dataEnd = i + 8 + size;
+    if (dataEnd > buf.length) throw _stripMalformed("chunk overruns buffer");
+    var padded = dataEnd + (size & 1);                                             // even-pad
+    if (padded > buf.length) padded = buf.length;                                  // tolerate a missing final pad byte
+    if (fourcc === "EXIF" || fourcc === "XMP ") { i = padded; continue; }          // drop metadata chunk
+    var chunk = buf.slice(i, padded);
+    if (fourcc === "VP8X" && size >= 1) {
+      chunk = Buffer.from(chunk);                                                  // own copy before mutating flags
+      chunk[8] = chunk[8] & ~0x08 & ~0x04;                                         // clear EXIF + XMP presence bits
+    }
+    body.push(chunk);
+    i = padded;
+  }
+  var bodyBuf = Buffer.concat(body);
+  var out = Buffer.concat([buf.slice(0, 12), bodyBuf]);
+  out.writeUInt32LE(4 + bodyBuf.length, 4);                                        // RIFF size = "WEBP" + chunks
+  return out;
+}
+
+function _stripImageMetadata(bytes) {
+  var mimes = _detectMagicMimes(bytes);
+  if (mimes.indexOf("image/jpeg") !== -1) return _stripJpegMetadata(bytes);
+  if (mimes.indexOf("image/png")  !== -1) return _stripPngMetadata(bytes);
+  if (mimes.indexOf("image/gif")  !== -1) return _stripGifMetadata(bytes);
+  if (mimes.indexOf("image/webp") !== -1) return _stripWebpMetadata(bytes);
+  // BMP / ICO carry no text/EXIF metadata container — nothing to strip.
+  if (mimes.indexOf("image/bmp") !== -1 || mimes.indexOf("image/x-icon") !== -1) return bytes;
+  // TIFF / HEIC / AVIF keep metadata in IFD / ISO-BMFF box structures that need
+  // offset-aware rewriting (a format parser — forbidden). Refuse rather than
+  // hand back un-stripped bytes claiming they were sanitized.
+  throw _err("image.sanitize-unsupported-format",
+    "in-framework metadata strip covers jpeg/png/gif/webp (linear container " +
+    "framing); this format needs a vendored decoder — refuse and run an " +
+    "external sanitizer");
+}
+
+// _sanitizeTransform — defineGuard's generated sanitize runs resolve → detect →
+// throw-on-refusal first, so a polyglot / mime-mismatch (critical/high) is
+// refused before this point. For an otherwise-clean image the metadata bag's
+// bytes are stripped of their EXIF/XMP/IPTC/comment segments; pixel transcoding
+// still needs a decoder and stays the operator's job. Non-Buffer bytes pass
+// through (validate already refused bad input upstream).
+function _sanitizeTransform(metadata) {
+  if (!metadata || typeof metadata !== "object" || !Buffer.isBuffer(metadata.bytes)) {
+    return metadata;
+  }
+  var cleaned = _stripImageMetadata(metadata.bytes);
+  if (cleaned === metadata.bytes) return metadata;
+  return Object.assign({}, metadata, { bytes: cleaned });
 }
 
 /**
@@ -410,9 +610,10 @@ function sanitize(input, opts) {
  * { "image/png": gate, "image/jpeg": gate } })` or `b.staticServe`.
  * Operators pass `ctx.metadata` (the decoder's reported shape) plus
  * the original `bytes`. Action chain: `serve` (no issues) →
- * `audit-only` (warn-only) → `refuse` (any critical / high). No
- * `sanitize` action — image bytes can't be transcoded without a
- * vendored decoder.
+ * `audit-only` (warn-only) → `refuse` (any critical / high). The gate
+ * does not auto-strip; an operator who wants metadata removed before
+ * serving calls `b.guardImage.sanitize(bag)` explicitly (it walks the
+ * container framing — EXIF/XMP/IPTC out of JPEG/PNG/GIF/WebP).
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
@@ -434,25 +635,21 @@ function sanitize(input, opts) {
  *   verdict.issues[0].kind;                              // → "mime-mismatch"
  */
 function gate(opts) {
-  opts = _resolveOpts(opts);
+  opts = gateContract.resolveProfileAndPosture(opts, {
+    profiles:           PROFILES,
+    compliancePostures: COMPLIANCE_POSTURES,
+    defaults:           DEFAULTS,
+    errorClass:         GuardImageError,
+    errCodePrefix:      "image",
+  });
   return gateContract.buildGuardGate(
     opts.name || "guardImage:" + (opts.profile || "default"),
     opts,
     async function (ctx) {
       var meta = ctx && (ctx.metadata || ctx.imageMetadata);
       if (!meta) return { ok: true, action: "serve" };
-      var rv = validate(meta, opts);
-      if (rv.issues.length === 0) return { ok: true, action: "serve" };
-      var hasCritical = rv.issues.some(function (i) {
-        return i.severity === "critical";
-      });
-      var hasHigh = rv.issues.some(function (i) {
-        return i.severity === "high";
-      });
-      if (!hasCritical && !hasHigh) {
-        return { ok: true, action: "audit-only", issues: rv.issues };
-      }
-      return { ok: false, action: "refuse", issues: rv.issues };
+      var rv = module.exports.validate(meta, opts);
+      return gateContract.severityDisposition(rv.issues);
     });
 }
 
@@ -506,10 +703,12 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / INTEGRATION_FIXTURES), buildProfile /
 // compliancePosture / loadRulePack wiring, plus the per-guard inspection
-// surface (validate / sanitize / gate) and the image extra (inspectMagic)
-// passed through verbatim. KIND="metadata" is a custom kind, so the bespoke
-// `gate` (operator-feeds-metadata ctx.metadata reader) is REQUIRED and
-// carries the magic-byte / polyglot / dimension chain unchanged.
+// surface. validate + sanitize are generated from `detect` (_detectIssues)
+// and `sanitizeTransform` (_sanitizeTransform) with the positive-finite-int
+// caps declared via `intOpts`. The image extra (inspectMagic) passes through
+// verbatim. KIND="metadata" is a custom kind, so the bespoke `gate`
+// (operator-feeds-metadata ctx.metadata reader) is REQUIRED and carries the
+// magic-byte / polyglot / dimension chain unchanged.
 module.exports = gateContract.defineGuard({
   name:        "image",
   kind:        "metadata",
@@ -518,8 +717,12 @@ module.exports = gateContract.defineGuard({
   defaults:    DEFAULTS,
   postures:    COMPLIANCE_POSTURES,
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  // detect/sanitizeTransform read a structured `{ bytes, declaredMime, ... }`
+  // metadata report, not text. The generated validate's default "raw" input
+  // contract hands the bag straight to detect (which owns its own bad-input).
+  detect:            _detectIssues,
+  sanitizeTransform: _sanitizeTransform,
+  intOpts:           ["maxBytes", "maxWidth", "maxHeight", "maxFrames"],
   gate:        gate,
   extra: {
     inspectMagic: inspectMagic,

package/lib/vendor/blamejs/lib/guard-imap-command.js

@@ -83,6 +83,8 @@
 
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
+var codepointClass = require("./codepoint-class");
+var safeBuffer = require("./safe-buffer");
 
 var GuardImapCommandError = defineClass("GuardImapCommandError", { alwaysPermanent: true });
 
@@ -210,21 +212,18 @@ function validate(line, opts) {
     throw new GuardImapCommandError("guard-imap-command/empty-line",
       "guardImapCommand.validate: empty command line");
   }
-  if (line.length > caps.maxLineBytes) {
+  if (safeBuffer.byteLengthOf(line) > caps.maxLineBytes) {
     throw new GuardImapCommandError("guard-imap-command/line-too-long",
-      "guardImapCommand.validate: line " + line.length + " bytes exceeds cap " + caps.maxLineBytes);
+      "guardImapCommand.validate: line " + safeBuffer.byteLengthOf(line) + " bytes exceeds cap " + caps.maxLineBytes);
   }
   // Byte-safety: refuse bare CR / bare LF / NUL / C0 / DEL. The
   // wire-protocol reader has already stripped the terminating CRLF
   // before calling validate(); any remaining CR or LF is a smuggling
   // shape.
-  for (var i = 0; i < line.length; i += 1) {
-    var c = line.charCodeAt(i);
-    if (c === 0x00 || c === 0x7F || (c < 0x20 && c !== 0x09)) {                                       // control-byte refusal
-      if (c === 0x0A && caps.allowBareLf) continue;
-      throw new GuardImapCommandError("guard-imap-command/bad-byte",
-        "guardImapCommand.validate: control byte 0x" + c.toString(16) + " at offset " + i);          // hex format literal in error message
-    }
+  var ctrlAt = codepointClass.firstControlCharOffset(line, { allowLf: caps.allowBareLf });            // bare LF permitted only when caps allow
+  if (ctrlAt !== -1) {
+    throw new GuardImapCommandError("guard-imap-command/bad-byte",
+      "guardImapCommand.validate: control byte 0x" + line.charCodeAt(ctrlAt).toString(16) + " at offset " + ctrlAt);  // hex format literal in error message
   }
 
   // RFC 9051 §2.2.1 — `tag SP command [SP args] CRLF`