@blamejs/blamejs-shop 0.4.69 → 0.4.70

package/lib/vendor/blamejs/lib/agent-snapshot.js

@@ -58,6 +58,7 @@ var validateOpts          = require("./validate-opts");
 
 var audit                 = lazyRequire(function () { return require("./audit"); });
 var auditSign             = lazyRequire(function () { return require("./audit-sign"); });
+var compliance            = lazyRequire(function () { return require("./compliance"); });
 var vault                 = lazyRequire(function () { return require("./vault"); });
 
 var AgentSnapshotError = defineClass("AgentSnapshotError", { alwaysPermanent: true });
@@ -310,14 +311,40 @@ function _resolveSigner(ctx) {
     "OR pass opts.signer to b.agent.snapshot.create({ signer: { sign, verify } })");
 }
 
+// allowPlaintext is a dev / single-tenant escape hatch (no at-rest sealing,
+// and no signature required on load). It is REFUSED under a regulated
+// compliance posture so a regulated deployment cannot silently persist OR
+// restore unsealed, unsigned snapshot state. Posture is read from the
+// framework's globally-pinned source (compliance().current()) — the same
+// source the residency + cryptoField seal floors use.
+var REGULATED_NO_PLAINTEXT = ["hipaa", "pci-dss", "gdpr", "soc2"];
+function _activePosture() {
+  try { var c = compliance(); return (c && typeof c.current === "function") ? c.current() : null; }
+  catch (_e) { return null; }
+}
+function _refusePlaintextUnderPosture(action) {
+  var active = _activePosture();
+  if (active && REGULATED_NO_PLAINTEXT.indexOf(active) !== -1) {
+    throw new AgentSnapshotError("agent-snapshot/plaintext-refused-under-posture",
+      action + ": allowPlaintext is refused under the '" + active + "' compliance posture — " +
+      "wire a sealer (b.vault.init() at boot OR opts.sealer { seal, unseal }) so snapshot " +
+      "state is sealed + signature-verified at rest");
+  }
+}
+
 function _resolveSealer(ctx) {
   if (ctx.sealer) return ctx.sealer;
   var v;
   try { v = vault(); } catch (_e) { v = null; }
-  if (v && v.aad && typeof v.aad.seal === "function" && typeof v.aad.unseal === "function") {
+  // Only use the framework vault when it is actually INITIALIZED. A loaded-but-
+  // uninitialized vault still exposes aad.seal/unseal (they throw on call), which
+  // previously masked the allowPlaintext escape hatch and leaked a raw
+  // vault/not-initialized error instead of a clean sealer-not-wired refusal.
+  if (v && typeof v.isInitialized === "function" && v.isInitialized() &&
+      v.aad && typeof v.aad.seal === "function" && typeof v.aad.unseal === "function") {
     return v.aad;
   }
-  if (ctx.allowPlaintext) return null;
+  if (ctx.allowPlaintext) { _refusePlaintextUnderPosture("persist"); return null; }
   throw new AgentSnapshotError("agent-snapshot/sealer-not-wired",
     "persist: no sealer wired — operator must run b.vault.init() at boot " +
     "OR pass opts.sealer to b.agent.snapshot.create({ sealer: { seal, unseal } }) " +
@@ -526,6 +553,9 @@ async function _unwrapAndVerify(ctx, raw, expectedId) {
   // remains visible to compliance audit.
   if (typeof snap.sig !== "string" || snap.sig.length === 0) {
     if (ctx.allowPlaintext) {
+      // Even the dev escape hatch cannot waive signature verification under a
+      // regulated posture — refuse the unsigned restore rather than trust it.
+      _refusePlaintextUnderPosture("load");
       agentAudit.safeAudit(ctx.audit, "agent.snapshot.unsigned_load", null, {
         snapshotId: snap.snapshotId,
       });

package/lib/vendor/blamejs/lib/ai-aedt-bias-audit.js

@@ -36,6 +36,7 @@
  */
 
 var validateOpts = require("./validate-opts");
+var numericBounds = require("./numeric-bounds");
 var { defineClass } = require("./framework-error");
 
 var AedtBiasAuditError = defineClass("AedtBiasAuditError", { alwaysPermanent: true });
@@ -49,7 +50,7 @@ function _str(v, label) {
   return v;
 }
 function _count(v, label) {
-  if (typeof v !== "number" || !isFinite(v) || v < 0 || Math.floor(v) !== v) throw new AedtBiasAuditError("aedt/bad-count", "aedtBiasAudit: " + label + " must be a non-negative integer");
+  if (!numericBounds.isNonNegativeFiniteInt(v)) throw new AedtBiasAuditError("aedt/bad-count", "aedtBiasAudit: " + label + " must be a non-negative integer");
   return v;
 }
 

package/lib/vendor/blamejs/lib/ai-content-detect.js

@@ -255,9 +255,7 @@ function report(opts) {
  * @example
  *   b.ai.aiContentDetect.compliancePosture("ca-ab-853"); // → "strict"
  */
-function compliancePosture(posture) {
-  return COMPLIANCE_POSTURES[posture] || null;
-}
+var compliancePosture = gateContract.makePostureAccessor(COMPLIANCE_POSTURES);
 
 module.exports = {
   report:               report,

package/lib/vendor/blamejs/lib/ai-frontier-protocol.js

@@ -161,7 +161,7 @@ function frontierModelProtocol(opts) {
 function incidentReport(opts) {
   opts = opts || {};
   if (typeof opts !== "object") throw new FrontierProtocolError("frontier/bad-opts", "incidentReport: opts must be an object");
-  if (!CRITICAL_INCIDENT_TYPES[opts.type]) throw new FrontierProtocolError("frontier/bad-incident-type", "incidentReport: type must be one of " + Object.keys(CRITICAL_INCIDENT_TYPES).join(", "));
+  if (!Object.prototype.hasOwnProperty.call(CRITICAL_INCIDENT_TYPES, opts.type)) throw new FrontierProtocolError("frontier/bad-incident-type", "incidentReport: type must be one of " + Object.keys(CRITICAL_INCIDENT_TYPES).join(", "));
 
   var discoveredMs;
   if (opts.discoveredAt == null) discoveredMs = Date.now();

package/lib/vendor/blamejs/lib/ai-model-manifest.js

@@ -95,7 +95,7 @@ function _validateDataComponent(d, idx) {
       "build.datasets[" + idx + "]: must be an object");
   }
   _requireString(d, "name", "build.datasets[" + idx + "]");
-  if (d.type !== undefined && !VALID_DATA_TYPES[d.type]) {
+  if (d.type !== undefined && !Object.prototype.hasOwnProperty.call(VALID_DATA_TYPES, d.type)) {
     throw new AiModelManifestError("aibom/bad-dataset-type",
       "build.datasets[" + idx + "].type '" + d.type + "' not in CycloneDX 1.6 data-type vocabulary");
   }

package/lib/vendor/blamejs/lib/ai-output.js

@@ -59,14 +59,18 @@ var NEUTRALIZED_URL = "about:blank#blocked";
 // matched (we only need the URL to gate it). Reference-style definitions
 // ([id]: url) are caught by the third pattern so EchoLeak reference-link
 // payloads don't slip past.
-var MD_IMAGE_RE = /!\[[^\]]{0,2048}\]\(\s{0,256}([^)\s]+)/g;
-var MD_LINK_RE  = /(?<!!)\[[^\]]{0,2048}\]\(\s{0,256}([^)\s]+)/g;
-var MD_REF_RE   = /^[ \t]{0,3}\[[^\]]+\]:\s*(\S+)/gm;
+// The `d` (hasIndices) flag is required so _rewriteUrls can splice at the
+// captured URL's EXACT offset — when a markdown alt text equals its target URL
+// (`![u](u)`), locating the URL by m[0].indexOf would hit the alt-text copy and
+// leave the real exfiltration target intact (EchoLeak bypass).
+var MD_IMAGE_RE = /!\[[^\]]{0,2048}\]\(\s{0,256}([^)\s]+)/dg;
+var MD_LINK_RE  = /(?<!!)\[[^\]]{0,2048}\]\(\s{0,256}([^)\s]+)/dg;
+var MD_REF_RE   = /^[ \t]{0,3}\[[^\]]+\]:\s*(\S+)/dgm;
 // HTML src= / href= attribute URL extractor — the guardHtml pass already
 // strips dangerous markup, but a surviving same-origin-looking src that
 // points at an internal / metadata host must still be neutralized for
 // the auto-fetch exfiltration class.
-var HTML_URL_ATTR_RE = /\b(?:src|href)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^"'>\s]+))/gi;
+var HTML_URL_ATTR_RE = /\b(?:src|href)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^"'>\s]+))/dgi;
 
 // SQL-shaped fragment signal. Composes safe-sql's reserved-word stance:
 // a leading SQL keyword followed by a clause keyword is the executable
@@ -143,11 +147,16 @@ function _rewriteUrls(text, re, onUrl) {
   var last = 0;
   var m;
   while ((m = re.exec(text)) !== null) {
-    var url = m[1] || m[2] || m[3];
-    if (!url) continue;
+    var g = m[1] !== undefined ? 1 : (m[2] !== undefined ? 2 : (m[3] !== undefined ? 3 : 0));
+    var url = g ? m[g] : null;
+    if (!url) { if (re.lastIndex === m.index) re.lastIndex += 1; continue; }
     var replacement = onUrl(url);
     if (replacement !== null && replacement !== url) {
-      var idx = m.index + m[0].indexOf(url);
+      // Splice at the captured group's EXACT offset (hasIndices), never
+      // m[0].indexOf(url) — when a markdown alt text equals its target URL the
+      // indexOf would hit the alt copy and leave the real URL intact (EchoLeak).
+      var span = m.indices && m.indices[g];
+      var idx = span ? span[0] : (m.index + m[0].lastIndexOf(url));
       out += text.slice(last, idx) + replacement;
       last = idx + url.length;
     }

package/lib/vendor/blamejs/lib/api-snapshot.js

@@ -51,6 +51,7 @@
  */
 
 var nodeFs = require("node:fs");
+var atomicFile = require("./atomic-file");
 var numericBounds = require("./numeric-bounds");
 var safeJson = require("./safe-json");
 var { FrameworkError } = require("./framework-error");
@@ -199,7 +200,9 @@ function write(snapshot, filePath) {
     createdAt:        snapshot.createdAt,
     exports:          snapshot.exports,
   };
-  nodeFs.writeFileSync(filePath, JSON.stringify(canonical, null, 2) + "\n", { mode: 0o644 });
+  // Atomic, symlink-refusing write (0o644 — the snapshot is a public,
+  // committed artifact). writeSync stages into a no-follow exclusive temp.
+  atomicFile.writeSync(filePath, JSON.stringify(canonical, null, 2) + "\n", { fileMode: 0o644 });
   return filePath;
 }
 

package/lib/vendor/blamejs/lib/app-shutdown.js

@@ -511,6 +511,7 @@ function standardPhases(components) {
 // IS the lock.
 var nodeFs   = require("node:fs");
 var nodePath = require("node:path");
+var atomicFile = require("./atomic-file");
 
 /**
  * @primitive b.appShutdown.pidLock
@@ -552,7 +553,12 @@ function pidLock(lockPath) {
 
   function _readExisting() {
     try {
-      var raw = nodeFs.readFileSync(lockPath, "utf8");
+      // fd-safe + capped + symlink-refusing read: a PID lockfile is never a
+      // legitimate symlink (unlike a k8s/certbot secret mount), so refuseSymlink
+      // is safe here and stops a planted symlink/oversized file from redirecting
+      // or OOM-ing the read. Any throw (symlink/too-large/enoent) → null, the
+      // existing "no live lock" semantic.
+      var raw = atomicFile.fdSafeReadSync(lockPath, { maxBytes: C.BYTES.kib(1), refuseSymlink: true, encoding: "utf8" });
       var pid = parseInt(String(raw).trim(), 10);
       return isFinite(pid) && pid > 0 ? pid : null;
     } catch (_e) { return null; }

package/lib/vendor/blamejs/lib/archive-gz.js

@@ -149,6 +149,15 @@ function readGz(adapter, opts) {
         throw new ArchiveGzError("archive-gz/empty-input",
           "read.gz: adapter reports empty payload");
       }
+      // Cap the raw COMPRESSED read before allocating — `adapter.range(0, size)`
+      // does Buffer.allocUnsafe(size) of an fstat/HEAD-reported length, which a
+      // hostile .gz (or an objectStore/HTTP source advertising a huge size) can
+      // drive to OOM. maxOutputBytes bounds the DECOMPRESSED output only; this
+      // bounds the compressed read too, matching archive-tar-read's _collectAdapterBytes.
+      if (typeof maxOutputBytes === "number" && size > maxOutputBytes) {
+        throw new ArchiveGzError("archive-gz/source-too-large",
+          "read.gz: random-access source size=" + size + " exceeds the read cap " + maxOutputBytes);
+      }
       return adapter.range(0, size);
     }
     if (adapter.kind === "trusted-sequential") {

package/lib/vendor/blamejs/lib/archive-read.js

@@ -908,13 +908,15 @@ function zip(adapter, opts) {
             "cumulative uncompressed=" + totalDecompressed +
             " exceeds maxTotalDecompressedBytes during extract");
         }
-        // Write entry to disk. Atomic rename via a tmp file so a
-        // partial write during inflate doesn't leave a half-file at
-        // the canonical name. Pre-existence check above guarantees
-        // the rename targets a non-existent path.
-        var tmpPath = resolvedPath + ".__blamejs-archive-read-tmp__";
-        nodeFs.writeFileSync(tmpPath, body);
-        atomicFile.renameWithRetry(tmpPath, resolvedPath);
+        // Write entry to disk atomically. The previous hand-rolled form
+        // staged into a PREDICTABLE temp name (resolvedPath +
+        // ".__blamejs-archive-read-tmp__") via a plain writeFileSync, so a
+        // symlink pre-planted at that exact path would be followed (CWE-59
+        // arbitrary write outside the extract dir). writeSync stages into a
+        // CSPRNG temp opened O_EXCL | O_NOFOLLOW, then renames — a partial
+        // write during inflate also never leaves a half-file at the canonical
+        // name. The pre-existence check above keeps the rename non-clobbering.
+        atomicFile.writeSync(resolvedPath, body);
         written.push({ name: entry.name, bytesWritten: body.length, path: resolvedPath });
         bytesExtracted += body.length;
       }

package/lib/vendor/blamejs/lib/archive-tar-read.js

@@ -99,13 +99,43 @@ function _parsePaxRecords(buf) {
   return out;
 }
 
-async function _collectAdapterBytes(adapter) {
+// A PAX `size` attribute is an attacker-controlled ASCII string. `parseInt` of
+// a malformed value ("", "abc", "1e9") yields NaN, which then SILENTLY bypasses
+// the entry-size bomb check (`NaN > maxEntryDecompressedBytes` is false) AND
+// desyncs the block walker (`Math.ceil(NaN / BLOCK_SIZE)` is NaN, so `pos`
+// advances by NaN). Reject anything that is not a plain non-negative integer.
+function _paxSize(raw) {
+  var s = String(raw).trim();
+  var n = parseInt(s, 10);
+  // Round-trip: a clean non-negative integer survives parseInt → String
+  // unchanged. This rejects "", "abc" (NaN), "1e9", "100abc" (parseInt stops
+  // early), negatives, leading zeros, and astronomically long strings that
+  // overflow to Infinity (String(Infinity) !== s) — every shape that would
+  // otherwise yield NaN/garbage and bypass the bomb check + desync the walker.
+  if (!Number.isFinite(n) || n < 0 || String(n) !== s) {
+    throw new TarError("archive-tar/bad-pax-size",
+      "PAX size attribute " + JSON.stringify(raw) + " is not a non-negative integer");
+  }
+  return n;
+}
+
+async function _collectAdapterBytes(adapter, maxBytes) {
   if (adapter.kind === "random-access") {
     var size = adapter.size;
     if (size == null && typeof adapter.resolveSize === "function") {
       size = await adapter.resolveSize();
     }
-    if (typeof size !== "number" || size === 0) return Buffer.alloc(0);
+    if (typeof size !== "number" || !Number.isFinite(size) || size <= 0) return Buffer.alloc(0);
+    // Cap the random-access read the same way the trusted-sequential branch
+    // caps its collector — a multi-GiB adapter.range(0, size) is an OOM lever
+    // (the size comes from the adapter, e.g. an on-disk file's stat or an
+    // operator-supplied length). The default ceiling is the bomb policy's
+    // total-decompressed cap.
+    if (typeof maxBytes === "number" && size > maxBytes) {
+      throw new TarError("archive-tar/source-too-large",
+        "read.tar: random-access source size=" + size +
+        " exceeds the read cap " + maxBytes);
+    }
     return adapter.range(0, size);
   }
   if (adapter.kind === "trusted-sequential") {
@@ -172,7 +202,7 @@ function tar(adapter, opts) {
   var entryTypePolicy = _normalizeEntryTypePolicy(opts.entryTypePolicy);
 
   async function _walk() {
-    var bytes = await _collectAdapterBytes(adapter);
+    var bytes = await _collectAdapterBytes(adapter, bombPolicy.maxTotalDecompressedBytes);
     if (bytes.length === 0) return { entries: [], bytes: bytes };
     var pos = 0;
     var entries = [];
@@ -190,6 +220,16 @@ function tar(adapter, opts) {
       zeroBlockCount = 0;
       var hdr = _parseHeader(block);
       if (hdr.typeflag === TF_PAX_EXTENDED || hdr.typeflag === TF_PAX_GLOBAL) {
+        // The per-entry bomb cap below (line ~252) is AFTER the PAX `continue`,
+        // so a PAX header body (its size is the attacker-controlled ustar octal
+        // field, up to ~8 GiB) escaped it — a multi-hundred-MiB UTF-8 string +
+        // record Object materialization above the cap operators set. Legitimate
+        // PAX/global bodies are tiny, so bound them by the same per-entry cap.
+        if (hdr.size > bombPolicy.maxEntryDecompressedBytes) {
+          throw new TarError("archive-tar/entry-too-large",
+            "pax header body size=" + hdr.size + " exceeds maxEntryDecompressedBytes=" +
+            bombPolicy.maxEntryDecompressedBytes);
+        }
         var bodyEnd = pos + Math.ceil(hdr.size / BLOCK_SIZE) * BLOCK_SIZE;
         if (bodyEnd > bytes.length) {
           throw new TarError("archive-tar/truncated-entry",
@@ -206,12 +246,12 @@ function tar(adapter, opts) {
       }
       if (globalPax) {
         if (globalPax.path) hdr.name = globalPax.path;
-        if (globalPax.size) hdr.size = parseInt(globalPax.size, 10);
+        if (globalPax.size) hdr.size = _paxSize(globalPax.size);
         if (globalPax.linkpath) hdr.linkname = globalPax.linkpath;
       }
       if (pendingPax) {
         if (pendingPax.path) hdr.name = pendingPax.path;
-        if (pendingPax.size) hdr.size = parseInt(pendingPax.size, 10);
+        if (pendingPax.size) hdr.size = _paxSize(pendingPax.size);
         if (pendingPax.linkpath) hdr.linkname = pendingPax.linkpath;
         pendingPax = null;
       }
@@ -416,9 +456,12 @@ function tar(adapter, opts) {
             "cumulative uncompressed=" + totalDecompressed +
             " exceeds maxTotalDecompressedBytes during extract");
         }
-        var tmpPath = resolvedPath + ".__blamejs-archive-tar-tmp__";
-        nodeFs.writeFileSync(tmpPath, body);
-        atomicFile.renameWithRetry(tmpPath, resolvedPath);
+        // Atomic, symlink-refusing write. The previous hand-rolled form staged
+        // into a PREDICTABLE temp name (resolvedPath +
+        // ".__blamejs-archive-tar-tmp__") via a plain writeFileSync, so a
+        // symlink pre-planted at that exact path would be followed (CWE-59).
+        // writeSync uses a CSPRNG temp opened O_EXCL | O_NOFOLLOW + rename.
+        atomicFile.writeSync(resolvedPath, body);
         written.push({ name: entry.name, bytesWritten: body.length, path: resolvedPath });
         bytesExtracted += body.length;
       }

package/lib/vendor/blamejs/lib/archive.js

@@ -52,13 +52,13 @@
  *   ZIP archive creation primitive.
  */
 var zlib = require("node:zlib");
-var nodeFs   = require("node:fs");
 var nodeCrypto = require("node:crypto");
 var nodeStream = require("node:stream");
 var streamPromises = require("node:stream/promises");
 var C = require("./constants");
 var { defineClass } = require("./framework-error");
 var auditEmit = require("./audit-emit");
+var atomicFile = require("./atomic-file");
 
 var ArchiveError = defineClass("ArchiveError", { alwaysPermanent: true });
 
@@ -478,7 +478,9 @@ function zip() {
 
   function writeTo(filepath) {
     var buf = toBuffer();
-    nodeFs.writeFileSync(filepath, buf);
+    // Atomic, symlink-refusing write (a bare writeFileSync follows a symlink
+    // planted at filepath and can leave a torn archive on a crash).
+    atomicFile.writeSync(filepath, buf, { fileMode: 0o600 });
     return buf.length;
   }
 

package/lib/vendor/blamejs/lib/asn1-der.js

@@ -79,13 +79,25 @@ function readNode(buf, offset) {
     // High-tag-number form (multi-byte tag). Walk continuation octets
     // (each top bit set means another follows).
     tag = 0;
+    var tagOctets = 0;
     while (true) {
       if (offset + headerLen >= buf.length) {
         throw new Asn1Error("asn1/short", "tag continuation truncated");
       }
       var byte = buf[offset + headerLen];
+      if (tagOctets === 0 && byte === 0x80) {                                   // leading 0x80 = non-minimal
+        throw new Asn1Error("asn1/tag-non-minimal",
+          "high-tag-number form has a non-minimal leading 0x80 octet");
+      }
       headerLen += 1;
-      tag = (tag << 7) | (byte & 0x7f);                                         // base-128 tag bits
+      tagOctets += 1;
+      // Base-128 multiplication (NOT `tag << 7`, which coerces to 32-bit
+      // signed int and overflows to a negative/wrong tag past 2^28).
+      tag = (tag * 128) + (byte & 0x7f);
+      if (tag > Number.MAX_SAFE_INTEGER) {
+        throw new Asn1Error("asn1/tag-too-large",
+          "high-tag-number exceeds the safe-integer range");
+      }
       if ((byte & 0x80) === 0) break;                                           // continuation bit
     }
   }
@@ -161,29 +173,45 @@ function readOid(node) {
   if (bytes.length === 0) {
     throw new Asn1Error("asn1/oid-empty", "OID value is empty");
   }
-  // First two arcs are encoded as `40*X + Y`.
-  var first = Math.floor(bytes[0] / 40);                                        // OID encoding constant
-  var second = bytes[0] % 40;                                                   // OID encoding constant
-  // Per X.690, when first byte >= 80 the first arc is 2 and second is byte-80.
-  if (first > 2) { first = 2; second = bytes[0] - 80; }                         // OID encoding constant
-  var arcs = [String(first), String(second)];
-
-  var i = 1;
+  // Decode every subidentifier as a full base-128 quantity (X.690 §8.19),
+  // rejecting non-minimal leading-0x80 padding and unterminated/oversized
+  // arcs. The FIRST subidentifier may itself span continuation octets
+  // (§8.19.4); only after decoding it do we split into the first two arcs.
+  var subids = [];
+  var i = 0;
   while (i < bytes.length) {
     var arc = 0;
     var j = i;
+    var done = false;
     while (j < bytes.length) {
       var b = bytes[j];
+      if (j === i && b === 0x80) {                                              // leading 0x80 = non-minimal
+        throw new Asn1Error("asn1/oid-non-minimal",
+          "OID subidentifier has a non-minimal leading 0x80 octet");
+      }
       arc = (arc * 128) + (b & 0x7f);                                           // base-128 OID arc
+      if (arc > Number.MAX_SAFE_INTEGER) {
+        throw new Asn1Error("asn1/oid-overflow",
+          "OID subidentifier exceeds the safe-integer range");
+      }
       j += 1;
-      if ((b & 0x80) === 0) break;                                              // continuation bit
+      if ((b & 0x80) === 0) { done = true; break; }                            // continuation bit
     }
-    if (j === i) {
+    if (!done) {
       throw new Asn1Error("asn1/oid-malformed", "OID arc never terminated");
     }
-    arcs.push(String(arc));
+    subids.push(arc);
     i = j;
   }
+
+  // Split the first subidentifier into the first two arcs (40*X + Y).
+  var firstSubid = subids[0];
+  var first, second;
+  if (firstSubid < 40)      { first = 0; second = firstSubid; }
+  else if (firstSubid < 80) { first = 1; second = firstSubid - 40; }
+  else                      { first = 2; second = firstSubid - 80; }
+  var arcs = [String(first), String(second)];
+  for (var k = 1; k < subids.length; k += 1) arcs.push(String(subids[k]));
   return arcs.join(".");
 }
 
@@ -298,24 +326,44 @@ function writeInteger(buf) {
   return writeNode(TAG.INTEGER, buf);
 }
 
+// Append `arc` to `bytes` as a base-128 subidentifier (X.690 §8.19), most-
+// significant octet first, every octet but the last carrying the
+// continuation bit. Uses integer division (not 32-bit `>>> 7`) so arcs
+// beyond 2^31 encode correctly.
+function _writeBase128Subid(arc, bytes) {
+  if (arc === 0) { bytes.push(0); return; }
+  var stack = [];
+  while (arc > 0) {
+    stack.unshift(arc % 128);                                                    // base-128 digit
+    arc = Math.floor(arc / 128);
+  }
+  for (var j = 0; j < stack.length - 1; j += 1) stack[j] |= 0x80;                // continuation bit
+  for (var k = 0; k < stack.length; k += 1) bytes.push(stack[k]);
+}
+
 function writeOid(dotted) {
   // Encode dotted-decimal OID per X.690 §8.19.
   var parts = String(dotted).split(".").map(function (s) { return parseInt(s, 10); });
   if (parts.length < 2) {
     throw new Asn1Error("asn1/oid-too-short", "OID needs at least 2 arcs");
   }
-  var bytes = [parts[0] * 40 + parts[1]];                                        // OID first-arc encoding
-  for (var i = 2; i < parts.length; i += 1) {
-    var arc = parts[i];
-    if (arc === 0) { bytes.push(0); continue; }
-    var stack = [];
-    while (arc > 0) {
-      stack.unshift(arc & 0x7f);                                                 // base-128 mask
-      arc = arc >>> 7;                                                           // base-128 shift
+  for (var p = 0; p < parts.length; p += 1) {
+    if (!Number.isInteger(parts[p]) || parts[p] < 0 || parts[p] > Number.MAX_SAFE_INTEGER) {
+      throw new Asn1Error("asn1/oid-bad-arc", "OID arc " + p + " is not a non-negative integer");
     }
-    for (var j = 0; j < stack.length - 1; j += 1) stack[j] |= 0x80;              // continuation bit
-    for (var k = 0; k < stack.length; k += 1) bytes.push(stack[k]);
   }
+  if (parts[0] > 2) {
+    throw new Asn1Error("asn1/oid-bad-arc", "OID first arc must be 0, 1, or 2");
+  }
+  if (parts[0] < 2 && parts[1] >= 40) {
+    throw new Asn1Error("asn1/oid-bad-arc",
+      "OID second arc must be < 40 when the first arc is 0 or 1");
+  }
+  var bytes = [];
+  // The first two arcs share one subidentifier (40*X + Y), which may itself
+  // need multiple base-128 octets (e.g. 2.999 -> 1079).
+  _writeBase128Subid(parts[0] * 40 + parts[1], bytes);
+  for (var i = 2; i < parts.length; i += 1) _writeBase128Subid(parts[i], bytes);
   return writeNode(TAG.OID, Buffer.from(bytes));
 }