@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/crypto.js

@@ -68,6 +68,10 @@ var safeBuffer  = lazyRequire(function () { return require("./safe-buffer"); });
 // pqc-software requires this module (b.crypto) — lazy-load to break the
 // cycle. Only the power-on self-test needs it here.
 var pqcSoftware = lazyRequire(function () { return require("./pqc-software"); });
+// network-tls requires this module (b.crypto) at top-of-file — lazy-load
+// to break the cycle. Only spkiPinVerifier composes its RFC 9525 strict
+// hostname/SAN matcher.
+var networkTls  = lazyRequire(function () { return require("./network-tls"); });
 
 // Streaming-hash algorithm allowlist. Mirrors the framework's PQC-
 // first crypto policy: SHA3 / SHAKE family is the default surface;
@@ -121,13 +125,20 @@ function hmac(key, data, algorithm) {
  */
 function hashStream(readable, algorithm) {
   var alg = (algorithm || STREAM_HASH_DEFAULT).toLowerCase();
-  var entry = STREAM_HASH_ALGORITHMS[alg];
-  if (!entry) {
+  // Own-property guard, not a truthiness check: STREAM_HASH_ALGORITHMS is a
+  // plain object, so a name colliding with an Object.prototype member
+  // ("constructor" → the Object constructor, "__proto__" → Object.prototype)
+  // would read back a truthy inherited value, slip past `if (!entry)`, and then
+  // throw ERR_INVALID_ARG_TYPE synchronously at createHash(entry.algorithm ===
+  // undefined) — a sync throw from a Promise-returning function. Refuse it here
+  // as the documented Promise.reject, matching b.crypto.sri's algorithm guard.
+  if (!Object.prototype.hasOwnProperty.call(STREAM_HASH_ALGORITHMS, alg)) {
     return Promise.reject(new TypeError(
       "crypto.hashStream: unsupported algorithm '" + algorithm +
       "' (allowed: " + Object.keys(STREAM_HASH_ALGORITHMS).join(", ") + ")"
     ));
   }
+  var entry = STREAM_HASH_ALGORITHMS[alg];
   if (!readable || typeof readable.pipe !== "function") {
     return Promise.reject(new TypeError(
       "crypto.hashStream: readable must be a Readable stream"
@@ -191,19 +202,38 @@ function _hashFileMulti(filePath, algorithms, opts) {
     var st;
     try { st = nodeFs.lstatSync(filePath); }
     catch (statErr) {
-      reject(new Error("crypto.hashFilesParallel: stat failed for '" +
-        filePath + "': " + (statErr && statErr.message ? statErr.message : String(statErr))));
+      // Preserve the underlying fs error metadata (.code / .errno /
+      // .syscall / .path) so callers branch on ENOENT vs EACCES vs
+      // ELOOP rather than string-matching the wrapped message. The
+      // mid-read `stream.on("error", reject)` path below rejects the
+      // raw fs error and already carries .code; wrapping the pre-open
+      // stat error WITHOUT copying it forward made the observable
+      // failure shape nondeterministic by timing. Match atomic-file's
+      // posture of surfacing the raw fs code on the ENOENT-class path.
+      var statWrapped = new Error("crypto.hashFilesParallel: stat failed for '" +
+        filePath + "': " + (statErr && statErr.message ? statErr.message : String(statErr)));
+      if (statErr) {
+        statWrapped.code    = statErr.code;
+        statWrapped.errno   = statErr.errno;
+        statWrapped.syscall = statErr.syscall;
+        statWrapped.cause   = statErr;
+      }
+      statWrapped.path = filePath;
+      reject(statWrapped);
       return;
     }
     if (st.isSymbolicLink() && !followSymlink) {
-      reject(new Error("crypto.hashFilesParallel: refusing symlink '" +
+      var symErr = new Error("crypto.hashFilesParallel: refusing symlink '" +
         filePath + "' — pass {followSymlinks: true} to opt in (an attacker " +
         "with write access to the input list can otherwise direct the hasher " +
-        "to files the caller cannot read directly)"));
+        "to files the caller cannot read directly)");
+      symErr.code = "crypto/hash-refused-symlink";
+      symErr.path = filePath;
+      reject(symErr);
       return;
     }
     if (!st.isFile() && !st.isSymbolicLink()) {
-      reject(new Error("crypto.hashFilesParallel: refusing non-regular file '" +
+      var nonRegularErr = new Error("crypto.hashFilesParallel: refusing non-regular file '" +
         filePath + "' (FIFOs / sockets / character / block devices read indefinitely " +
         "or return platform-undefined bytes; hashing them is meaningless and " +
         "DoS-prone). Type: " +
@@ -211,7 +241,10 @@ function _hashFileMulti(filePath, algorithms, opts) {
          st.isSocket() ? "socket" :
          st.isBlockDevice() ? "block-device" :
          st.isCharacterDevice() ? "char-device" :
-         st.isDirectory() ? "directory" : "unknown")));
+         st.isDirectory() ? "directory" : "unknown"));
+      nonRegularErr.code = "crypto/hash-refused-non-regular-file";
+      nonRegularErr.path = filePath;
+      reject(nonRegularErr);
       return;
     }
     var hashers = new Array(algorithms.length);
@@ -233,9 +266,12 @@ function _hashFileMulti(filePath, algorithms, opts) {
       if (maxBytes && byteLength > maxBytes) {
         aborted = true;
         try { stream.destroy(); } catch (_e) { /* best-effort */ }
-        reject(new Error("crypto.hashFilesParallel: file '" + filePath +
+        var maxBytesErr = new Error("crypto.hashFilesParallel: file '" + filePath +
           "' exceeded opts.maxBytesPerFile (" + maxBytes +
-          " bytes); refusing to continue hashing"));
+          " bytes); refusing to continue hashing");
+        maxBytesErr.code = "crypto/hash-max-bytes-exceeded";
+        maxBytesErr.path = filePath;
+        reject(maxBytesErr);
         return;
       }
       for (var j = 0; j < hashers.length; j += 1) hashers[j].update(chunk);
@@ -957,7 +993,7 @@ var SRI_ALGORITHMS = { "sha256": "sha256", "sha384": "sha384", "sha512": "sha512
  *
  * @example
  *   var attr = b.crypto.sri(Buffer.from("alert(1);", "utf8"), { algorithm: "sha384" });
- *   // → "sha384-pNdyOuHIPKgRPnYJTBxEEEZcJj1qHxJzNheCuHGRy3Cm0UpVbcnruIvMRIs5VcDb"
+ *   // → "sha384-dnux3uAPxaf+IhCrFG1D/XVNzP1XLDNcn3Pe3jyxouEAoot5kfwC5u8rMwNhE5oi"
  *
  *   var multi = b.crypto.sri(["payload-a", "payload-b"], { algorithm: "sha512" });
  *   // → "sha512-... sha512-..." (two tokens, space-separated)
@@ -1369,6 +1405,24 @@ function _envU16(buf, at) {
   return buf.readUInt16BE(at);
 }
 
+// Read a 2-byte-length-prefixed component and bounds-check that the declared
+// body actually fits in the envelope BEFORE slicing it. Without this a
+// truncated envelope hands an under-length component (a short KEM ciphertext /
+// ephemeral public key) to Node crypto, which throws a raw
+// "Failed to perform decapsulation" / key-parse error that escapes the
+// documented "Invalid envelope: ..." contract. Returns { bytes, pos } where
+// pos is the offset past the component. A well-formed envelope always carries
+// each declared component in full, so this never rejects a valid input.
+function _envSlice(buf, at, label) {
+  var len = _envU16(buf, at);
+  at += 2;
+  if (at + len > buf.length) {
+    throw new Error("Invalid envelope: truncated (declared " + len + "-byte " +
+      label + " at offset " + at + " exceeds the " + buf.length + "-byte envelope)");
+  }
+  return { bytes: buf.subarray(at, at + len), pos: at + len };
+}
+
 function decryptEnvelope(packed, privateKeys, internalOpts) {
   if (!Buffer.isBuffer(packed) || packed.length < 4) {
     throw new Error("Invalid envelope: too short (need at least the 4-byte suite header)");
@@ -1388,8 +1442,8 @@ function decryptEnvelope(packed, privateKeys, internalOpts) {
     throw new Error("Invalid envelope: unsupported KDF (only SHAKE256 supported)");
   }
 
-  var kemCtLen = _envU16(packed, pos); pos += 2;
-  var kemCt = packed.subarray(pos, pos + kemCtLen); pos += kemCtLen;
+  var kemSlice = _envSlice(packed, pos, "KEM ciphertext");
+  var kemCt = kemSlice.bytes; pos = kemSlice.pos;
 
   var mlkemPriv = nodeCrypto.createPrivateKey(
     typeof privateKeys === "string" ? privateKeys : privateKeys.privateKey
@@ -1399,8 +1453,8 @@ function decryptEnvelope(packed, privateKeys, internalOpts) {
   var fixedInfo = omitFixedInfo ? Buffer.alloc(0) : _suiteFixedInfo(kemId, cipherId, kdfId);
 
   if (kemId === C.KEM_IDS.ML_KEM_1024_P384) {
-    var ecEphLen = _envU16(packed, pos); pos += 2;
-    var ecEphDer = packed.subarray(pos, pos + ecEphLen); pos += ecEphLen;
+    var ecEphSlice = _envSlice(packed, pos, "EC ephemeral public key");
+    var ecEphDer = ecEphSlice.bytes; pos = ecEphSlice.pos;
     var ecPrivPem = typeof privateKeys === "string" ? null : privateKeys.ecPrivateKey;
     if (!ecPrivPem) throw new Error("Hybrid KEM requires EC private key");
     var ecSs = nodeCrypto.diffieHellman({
@@ -1416,8 +1470,8 @@ function decryptEnvelope(packed, privateKeys, internalOpts) {
     // the correct keypair via privateKeys when the envelope was sealed
     // with this algorithm. Same length-prefixed shape as the P-384
     // hybrid: 2-byte ec-eph-len + DER X25519 pubkey + nonce + ct.
-    var x25519EphLen = _envU16(packed, pos); pos += 2;
-    var x25519EphDer = packed.subarray(pos, pos + x25519EphLen); pos += x25519EphLen;
+    var x25519EphSlice = _envSlice(packed, pos, "X25519 ephemeral public key");
+    var x25519EphDer = x25519EphSlice.bytes; pos = x25519EphSlice.pos;
     var x25519PrivPem = typeof privateKeys === "string" ? null : privateKeys.x25519PrivateKey;
     if (!x25519PrivPem) throw new Error("ML-KEM-768 + X25519 hybrid envelope requires x25519PrivateKey");
     var x25519Ss = nodeCrypto.diffieHellman({
@@ -1429,7 +1483,22 @@ function decryptEnvelope(packed, privateKeys, internalOpts) {
     throw new Error("Invalid envelope: unsupported KEM ID " + kemId);
   }
 
-  var nonce = packed.subarray(pos, pos + C.BYTES.bytes(24)); pos += C.BYTES.bytes(24);
+  // Bounds-check the trailing nonce + AEAD tag before slicing them out. A
+  // truncated envelope (untrusted ciphertext) that ends inside the 24-byte
+  // nonce or before the 16-byte Poly1305 tag otherwise reaches the cipher as
+  // an under-length nonce / ciphertext and surfaces as a raw noble
+  // RangeError ("nonce"/"ciphertext" length) — escaping the documented
+  // "Invalid envelope: ..." error contract exactly the way an unchecked
+  // _envU16 read would (see _envU16 above). Fail with the typed envelope
+  // error instead. A valid envelope always carries a full nonce and at
+  // least the tag, so this never rejects a well-formed input.
+  var nonceLen = C.BYTES.bytes(24);
+  var tagLen = C.BYTES.bytes(16);
+  if (pos + nonceLen + tagLen > packed.length) {
+    throw new Error("Invalid envelope: truncated (expected a " + nonceLen +
+      "-byte nonce and a " + tagLen + "-byte authentication tag at offset " + pos + ")");
+  }
+  var nonce = packed.subarray(pos, pos + nonceLen); pos += nonceLen;
   // Re-derive the 4-byte envelope-header AAD from the bytes we just
   // dispatched on. A tampered header (algorithm-substitution attack)
   // surfaces here as a Poly1305 tag verification failure.
@@ -1509,6 +1578,17 @@ function decryptPacked(packed, key, aad) {
   if (packed[0] !== C.FORMAT.XCHACHA20_POLY1305) {
     throw new Error("Invalid packed format: unsupported version");
   }
+  // A packed blob shorter than the 1-byte format id + 24-byte nonce +
+  // 16-byte Poly1305 tag is truncated / corrupt (untrusted or damaged
+  // storage cell); slicing the nonce / ciphertext out of it otherwise
+  // reaches the cipher as an under-length nonce and throws a raw noble
+  // RangeError that escapes this function's typed error contract (mirrors
+  // the envelope decrypt bounds check). A valid packet is always at least
+  // this long, so this never rejects a well-formed input.
+  if (packed.length < 1 + C.BYTES.bytes(24) + C.BYTES.bytes(16)) {
+    throw new Error("Invalid packed format: truncated (need at least a 1-byte " +
+      "version, a 24-byte nonce, and a 16-byte authentication tag)");
+  }
   return Buffer.from(
     xchacha20poly1305(key, packed.subarray(1, 25), aad ? Buffer.from(aad) : undefined)
       .decrypt(packed.subarray(25))
@@ -1899,7 +1979,7 @@ function _pemToDer(pemOrDer) {
   // for mTLS bootstrap / webhook verification / peer-cert pinning.
   // 64 KiB caps the largest plausible PEM (a P-384 cert + chain) at
   // ~3× margin while refusing pathological inputs outright.
-  if (safeBuffer.byteLengthOf(pemOrDer) > C.BYTES.kib(64)) {
+  if (safeBuffer().byteLengthOf(pemOrDer) > C.BYTES.kib(64)) {
     throw new TypeError(
       "crypto.hashCertFingerprint: PEM input exceeds 64 KiB (" +
       pemOrDer.length + " bytes); refuse oversized input to avoid " +
@@ -1991,6 +2071,219 @@ function isCertRevoked(pemOrDer, denyList) {
   return false;
 }
 
+// ---- RFC 7469 SubjectPublicKeyInfo pinning ----
+//
+// The pin is base64(SHA-256(SPKI DER)) — RFC 7469 §2.4 / HPKP. This
+// deliberately uses SHA-256, which is otherwise absent from the b.crypto
+// surface (see the @module intro): it is an interop WIRE CONSTANT, not a
+// framework hashing choice. Browsers, curl `--pinnedpubkey sha256//...`,
+// OpenSSL, and every HPKP-style pin store speak SHA-256(SPKI); a SHA3-512
+// pin would not interoperate with any of them. `hashCertFingerprint`
+// documents the same "framework-canonical hash vs interop rendering"
+// split. The pin binds the certificate's LONG-TERM SubjectPublicKeyInfo
+// (which survives certificate reissue on the same key) — it says nothing
+// about the ephemeral PQC TLS key-exchange group negotiated per
+// handshake; those are orthogonal (identity of the peer key vs secrecy
+// of the session).
+var SPKI_PIN_PREFIX = "sha256/";
+
+// Decode a `sha256/<base64>` pin string into its raw 32-byte digest
+// Buffer, throwing a TypeError on any malformed entry (config-time /
+// entry-point tier — the operator catches the typo at construction).
+function _decodeSpkiPin(pinStr, ctx) {
+  if (typeof pinStr !== "string" || pinStr.length === 0) {
+    throw new TypeError(ctx + ": each pin must be a non-empty 'sha256/<base64>' string");
+  }
+  if (pinStr.indexOf(SPKI_PIN_PREFIX) !== 0) {
+    throw new TypeError(ctx + ": pin '" + pinStr +
+      "' must carry the RFC 7469 'sha256/' prefix");
+  }
+  var body = pinStr.slice(SPKI_PIN_PREFIX.length);
+  var buf = Buffer.from(body, "base64");
+  // SHA-256 digest = 32 bytes; require a canonical base64 round-trip so a
+  // silently-truncated / non-canonical body is refused rather than
+  // matching a shorter buffer.
+  if (buf.length !== 32 || buf.toString("base64") !== body) {
+    throw new TypeError(ctx + ": pin '" + pinStr +
+      "' must be base64 of a 32-byte SHA-256 SPKI digest");
+  }
+  return buf;
+}
+
+/**
+ * @primitive b.crypto.spkiPin
+ * @signature b.crypto.spkiPin(pemOrDer)
+ * @since     0.17.13
+ * @status    stable
+ * @related   b.crypto.spkiPinVerifier, b.crypto.hashCertFingerprint
+ *
+ * Computes the RFC 7469 (HPKP §2.4) public-key pin of an X.509
+ * certificate: `base64(SHA-256(SubjectPublicKeyInfo DER))`. Accepts DER
+ * bytes (Buffer) or a PEM string (BEGIN/END envelope stripped, base64
+ * body decoded — same 64 KiB ReDoS cap as `hashCertFingerprint`).
+ * Returns `{ sha256, b64, hex }`: `sha256` is the `sha256/<base64>` wire
+ * form browsers and `curl --pinnedpubkey` render, `b64` the bare base64
+ * body, `hex` the lowercase-hex digest.
+ *
+ * Unlike `hashCertFingerprint` (SHA3-512 over the WHOLE certificate), an
+ * SPKI pin binds only the public key, so it survives certificate reissue
+ * on the same key pair — the property RFC 7469 pinning relies on.
+ *
+ * This is the one place SHA-256 appears on the b.crypto surface: it is an
+ * RFC 7469 interop wire constant (browsers / curl / OpenSSL pin stores),
+ * not a framework hashing default. The pin binds the peer's long-term
+ * SPKI, not the ephemeral PQC key-exchange group negotiated per TLS
+ * handshake.
+ *
+ * @example
+ *   var fs  = require("fs");
+ *   var pem = fs.readFileSync("/etc/ssl/peer.cert.pem", "utf8");
+ *   var pin = b.crypto.spkiPin(pem);
+ *   pin.sha256;
+ *   // → "sha256/YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg="
+ */
+function spkiPin(pemOrDer) {
+  var der = _pemToDer(pemOrDer);
+  // SubjectPublicKeyInfo DER — the exact bytes RFC 7469 §2.4 hashes.
+  var spkiDer = new nodeCrypto.X509Certificate(der)
+    .publicKey.export({ type: "spki", format: "der" });
+  var digest = nodeCrypto.createHash("sha256").update(spkiDer).digest();
+  var b64 = digest.toString("base64");
+  return { sha256: SPKI_PIN_PREFIX + b64, b64: b64, hex: digest.toString("hex") };
+}
+
+/**
+ * @primitive b.crypto.spkiPinVerifier
+ * @signature b.crypto.spkiPinVerifier(opts)
+ * @since     0.17.13
+ * @status    stable
+ * @related   b.crypto.spkiPin, b.network.tls.checkServerIdentity9525
+ *
+ * Builds a `tls.checkServerIdentity`-compatible `(host, cert) =>
+ * Error | undefined` that enforces RFC 7469 public-key pinning on top of
+ * RFC 9525 strict hostname verification. Pass the returned function as
+ * `tls.connect({ checkServerIdentity })`.
+ *
+ * The verifier runs hostname/SAN identity FIRST (via
+ * `b.network.tls.checkServerIdentity9525` — SAN-required, no Common Name
+ * fallback), so a pin match on a certificate issued for the wrong name is
+ * still refused. Only when identity passes does it derive the peer's SPKI
+ * pin from the presented DER and constant-time-compare
+ * (`crypto.timingSafeEqual`) it against every configured pin. Returns the
+ * identity `Error` on a hostname/SAN failure, an `Error` with code
+ * `crypto/spki-pin-mismatch` when no pin matches, or `undefined` when
+ * both identity and pin check out.
+ *
+ * `opts.pins` MUST be an array of at least two `sha256/<base64>` pins:
+ * RFC 7469 §4.3 requires a backup pin corresponding to a key not in the
+ * current chain so key rotation does not brick the pinned endpoint. When
+ * `opts.hostname` is set, the certificate identity is checked against it
+ * instead of the host argument Node supplies — pin the expected name
+ * explicitly. Produce pin strings with `b.crypto.spkiPin(...).sha256`.
+ *
+ * @opts
+ *   pins:      string[],  // required — >= 2 'sha256/<base64>' pins (RFC 7469 backup-pin rule)
+ *   hostname:  string,    // optional — verify cert identity against this name instead of the host arg
+ *
+ * @example
+ *   var tls    = require("node:tls");
+ *   var verify = b.crypto.spkiPinVerifier({
+ *     pins: [
+ *       "sha256/YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=",
+ *       "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",   // backup key
+ *     ],
+ *   });
+ *   var sock = tls.connect({
+ *     host: "api.example.com",
+ *     port: 443,
+ *     checkServerIdentity: verify,
+ *   });
+ */
+function spkiPinVerifier(opts) {
+  if (!opts || typeof opts !== "object") {
+    throw new TypeError("crypto.spkiPinVerifier: opts is required");
+  }
+  if (!Array.isArray(opts.pins)) {
+    throw new TypeError(
+      "crypto.spkiPinVerifier: opts.pins must be an array of 'sha256/<base64>' pins"
+    );
+  }
+  // RFC 7469 §4.3 requires a backup pin corresponding to a key NOT in the
+  // current chain. Two IDENTICAL pins are not a backup (the same key repeated),
+  // so require at least two DISTINCT pins — a length-only check would accept a
+  // duplicate and silently leave the endpoint with no rotation key.
+  var distinctPins = [];
+  for (var dpi = 0; dpi < opts.pins.length; dpi += 1) {
+    if (distinctPins.indexOf(opts.pins[dpi]) === -1) distinctPins.push(opts.pins[dpi]);
+  }
+  if (distinctPins.length < 2) {
+    throw new TypeError(
+      "crypto.spkiPinVerifier: opts.pins must contain at least two DISTINCT " +
+      "'sha256/<base64>' pins — RFC 7469 §4.3 requires a backup pin " +
+      "corresponding to a key not in the current chain so key rotation " +
+      "does not brick the pinned endpoint"
+    );
+  }
+  var pinBufs = new Array(distinctPins.length);
+  for (var pi = 0; pi < distinctPins.length; pi += 1) {
+    pinBufs[pi] = _decodeSpkiPin(distinctPins[pi], "crypto.spkiPinVerifier");
+  }
+  var expectedHost = opts.hostname;
+  if (expectedHost !== undefined &&
+      (typeof expectedHost !== "string" || expectedHost.length === 0)) {
+    throw new TypeError(
+      "crypto.spkiPinVerifier: opts.hostname must be a non-empty string when supplied"
+    );
+  }
+  return function verifySpkiPin(host, cert) {
+    // Identity (hostname / SAN) FIRST — a pin match on a cert issued for
+    // the wrong name is still impersonation. checkServerIdentity9525 is
+    // RFC 9525 strict (SAN-required, no CN fallback) and returns
+    // Error | undefined.
+    var effectiveHost = expectedHost !== undefined ? expectedHost : host;
+    var identityError = networkTls().checkServerIdentity9525(effectiveHost, cert);
+    if (identityError) return identityError;
+    // Peer SPKI pin — hash the DER the peer actually presented. Node's
+    // detailed cert object exposes the raw DER as cert.raw.
+    if (!cert || !Buffer.isBuffer(cert.raw)) {
+      var noDerErr = new Error(
+        "crypto.spkiPinVerifier: peer cert object carries no DER `raw` bytes to pin"
+      );
+      noDerErr.code = "crypto/spki-pin-no-peer-der";
+      return noDerErr;
+    }
+    var peerBuf;
+    try {
+      peerBuf = Buffer.from(spkiPin(cert.raw).b64, "base64");
+    } catch (parseErr) {
+      var peerErr = new Error(
+        "crypto.spkiPinVerifier: failed to derive peer SPKI pin (" +
+        (parseErr && parseErr.message ? parseErr.message : String(parseErr)) + ")"
+      );
+      peerErr.code = "crypto/spki-pin-peer-parse-failed";
+      return peerErr;
+    }
+    var matched = false;
+    for (var mi = 0; mi < pinBufs.length; mi += 1) {
+      // No early exit — comparing against every pin keeps the match
+      // timing from leaking which configured pin matched.
+      if (peerBuf.length === pinBufs[mi].length &&
+          nodeCrypto.timingSafeEqual(peerBuf, pinBufs[mi])) {
+        matched = true;
+      }
+    }
+    if (!matched) {
+      var mismatchErr = new Error(
+        "crypto.spkiPinVerifier: peer SPKI pin (" + SPKI_PIN_PREFIX +
+        peerBuf.toString("base64") + ") does not match any configured pin"
+      );
+      mismatchErr.code = "crypto/spki-pin-mismatch";
+      return mismatchErr;
+    }
+    return undefined;
+  };
+}
+
 var SUPPORTED_KEM_ALGORITHMS = Object.freeze([
   { id: "ml-kem-1024",          envelopeId: C.KEM_IDS.ML_KEM_1024,        description: "ML-KEM-1024 KEM-only (legacy single-component)" },
   { id: "ml-kem-1024-p384",     envelopeId: C.KEM_IDS.ML_KEM_1024_P384,   description: "ML-KEM-1024 + ECDH P-384 hybrid (framework default)" },
@@ -2140,6 +2433,8 @@ module.exports = {
   // Cert fingerprint helpers
   hashCertFingerprint:         hashCertFingerprint,
   isCertRevoked:               isCertRevoked,
+  spkiPin:                     spkiPin,
+  spkiPinVerifier:             spkiPinVerifier,
   // Random
   generateBytes:               generateBytes,
   generateToken:               generateToken,

package/lib/vendor/blamejs/lib/csp.js

@@ -221,20 +221,28 @@ function build(directives, opts) {
           "csp.build: source '" + src + "' contains whitespace or ';' — a CSP source " +
           "must be a single token (directive-injection defense)");
       }
+      // A UA matches CSP source keywords ('unsafe-inline' ...) and scheme
+      // sources (https: / data:) ASCII case-INSENSITIVELY (CSP3 §2.3 /
+      // §6.7.2). Compare a lowercased copy against the (lowercase) guard sets
+      // so a case-variant token ("'Unsafe-Inline'" / "HTTPS:" / "DATA:") can't
+      // slip past and be emitted verbatim into a header the browser still
+      // honors. The ORIGINAL src is what gets emitted (hosts/paths stay
+      // case-preserved); only the guard comparison is normalized.
+      var srcLower = src.toLowerCase();
       if (!acknowledgeUnsafe && SCRIPT_DIRECTIVES.indexOf(name) !== -1 &&
-          UNSAFE_KEYWORDS.indexOf(src) !== -1) {
+          UNSAFE_KEYWORDS.indexOf(srcLower) !== -1) {
         throw new CspError("csp/unsafe-keyword",
           "csp.build: " + name + " contains " + src + "; pass acknowledgeUnsafe:true with a " +
           "documented justification to allow it (CSP3 §6.2.5.x — unsafe keywords are a " +
           "common XSS bypass surface)");
       }
-      if (CATCH_ALL_SOURCES.indexOf(src) !== -1) {
+      if (CATCH_ALL_SOURCES.indexOf(srcLower) !== -1) {
         throw new CspError("csp/catch-all-source",
           "csp.build: " + name + " contains catch-all source '" + src + "'; CSP3 best " +
           "practice refuses these (use an explicit allowlist instead)");
       }
       if (!allowDataImages && (name === "img-src" || name === "media-src" || name === "font-src") &&
-          src === "data:") {
+          srcLower === "data:") {
         throw new CspError("csp/data-source",
           "csp.build: " + name + " contains 'data:'; pass allowDataImages:true with a " +
           "documented reason (data: URLs sidestep most CSP defenses)");