@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/safe-object.js

@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     b.safeObject
+ * @nav        Validation
+ * @title      Safe object access
+ * @order      100
+ *
+ * @intro
+ *   Prototype-pollution-safe own-property access. Interpolators, template
+ *   engines, and structured readers that look up a key by name on an
+ *   attacker-influenced object must treat an inherited / prototype-chain key
+ *   (`__proto__`, `constructor`, `toString`) as ABSENT — never read it into
+ *   rendered output. This composes that guard into one primitive so every
+ *   consumer routes through the same hardened read instead of hand-rolling
+ *   `Object.prototype.hasOwnProperty.call(o, k) ? o[k] : undefined` (which a
+ *   `__proto__` accessor property can still defeat).
+ *
+ * @card
+ *   Prototype-pollution-safe own-property get/set — the single guard every
+ *   interpolator composes.
+ */
+
+/**
+ * @primitive  b.safeObject.ownProp
+ * @signature  b.safeObject.ownProp(obj, key)
+ * @since      0.17.13
+ * @status     stable
+ * @related    b.safeObject.ownSet
+ *
+ * Returns the value of `obj`'s OWN property `key`, or `undefined` when `key`
+ * is not an own property (inherited / prototype-chain keys read as absent).
+ * Uses `Object.getOwnPropertyDescriptor` rather than `hasOwnProperty` + index
+ * read, so a `__proto__`-injected accessor property cannot run on read. A
+ * defined-but-`undefined` own value returns `undefined` (callers treat that as
+ * absent, matching the prior guarded reads).
+ *
+ * @example
+ *   b.safeObject.ownProp({ a: 1 }, "a");          // → 1
+ *   b.safeObject.ownProp({}, "toString");         // → undefined  (inherited)
+ *   b.safeObject.ownProp({}, "__proto__");        // → undefined
+ */
+function ownProp(obj, key) {
+  if (obj === null || obj === undefined) return undefined;
+  var d = Object.getOwnPropertyDescriptor(obj, key);
+  return d ? d.value : undefined;
+}
+
+/**
+ * @primitive  b.safeObject.ownSet
+ * @signature  b.safeObject.ownSet(obj, key, value)
+ * @since      0.17.13
+ * @status     stable
+ * @related    b.safeObject.ownProp
+ *
+ * Sets `obj[key] = value` as a plain own data property via
+ * `Object.defineProperty`, so a `__proto__` / `constructor` / accessor key on
+ * the prototype chain cannot intercept the write or pollute the prototype.
+ * Returns `obj`.
+ *
+ * @example
+ *   var o = {};
+ *   b.safeObject.ownSet(o, "__proto__", { polluted: 1 });
+ *   ({}).polluted;   // → undefined  (Object.prototype not touched)
+ */
+function ownSet(obj, key, value) {
+  Object.defineProperty(obj, key, {
+    value:        value,
+    writable:     true,
+    enumerable:   true,
+    configurable: true,
+  });
+  return obj;
+}
+
+module.exports = {
+  ownProp: ownProp,
+  ownSet:  ownSet,
+};

package/lib/vendor/blamejs/lib/safe-path.js

@@ -138,6 +138,53 @@ function validate(base, rel, opts) {
   catch (e) { return { ok: false, code: e.code || "safe-path/unknown", message: e.message }; }
 }
 
+/**
+ * @primitive b.safePath.confineToBase
+ * @signature b.safePath.confineToBase(base, rel, opts?)
+ * @since     0.17.16
+ * @status    stable
+ * @related   b.safePath.resolve, b.staticServe.create
+ *
+ * The lexical traversal-containment core, WITHOUT the user-input
+ * strictness of `resolve` (no reserved-name / ADS / bidi / control-char
+ * refusal). Resolve `rel` against `base` using the TARGET platform's path
+ * semantics and confirm the result stays strictly inside `base`; return
+ * the confined absolute path, or `null` if it escapes.
+ *
+ * This is the barrier `resolve` layers its user-input checks on top of,
+ * and the one a consumer composes when it wants ONLY traversal containment
+ * and runs its OWN, separately-calibrated filename validation — as
+ * b.staticServe does, keeping its per-file basename gate (b.guardFilename)
+ * a distinct step rather than fusing `resolve`'s all-segment user-input
+ * strictness into the containment barrier.
+ *
+ * @opts
+ *   platform: string,   // "windows" forces win32 path semantics regardless of host
+ *
+ * @example
+ *   var p = b.safePath.confineToBase("/srv/www", "docs/a.html");
+ *   // → "/srv/www/docs/a.html"  (null if rel escaped /srv/www)
+ */
+function confineToBase(base, rel, opts) {
+  opts = opts || {};
+  if (typeof base !== "string" || base.length === 0) return null;
+  if (typeof rel !== "string") return null;
+  var platform = opts.platform || process.platform;
+  var isWin = platform === "win32" || platform === "windows";
+  // Resolve + contain using the TARGET platform's path module, NOT the
+  // runtime's: the runtime path module would treat the OTHER platform's
+  // separator as an ordinary filename character and miss a backslash
+  // traversal on a POSIX host (and inversely false-refuse legitimate paths).
+  var pathMod = isWin ? nodePath.win32 : nodePath.posix;
+  var baseResolved = pathMod.resolve(base);
+  var joined = pathMod.resolve(baseResolved, rel);
+  var sepChar = pathMod.sep;
+  if (joined !== baseResolved && joined.slice(0, baseResolved.length + 1) !== baseResolved + sepChar) {
+    return null;
+  }
+  return joined;
+}
+
 function _resolveCore(base, rel, opts) {
   if (typeof base !== "string" || base.length === 0) {
     _refuse("safe-path/bad-input", "b.safePath.resolve: base must be a non-empty string");
@@ -219,11 +266,11 @@ function _resolveCore(base, rel, opts) {
   // that hole AND stops the inverse false-refusal of legitimate in-base paths.
   var pathMod = isWin ? nodePath.win32 : nodePath.posix;
   var baseResolved = pathMod.resolve(base);
-  var joined = pathMod.resolve(baseResolved, rel);
-  var sepChar = pathMod.sep;
-  if (joined !== baseResolved && joined.slice(0, baseResolved.length + 1) !== baseResolved + sepChar) {
+  var joined = confineToBase(base, rel, { platform: platform });
+  if (joined === null) {
     _refuse("safe-path/escapes-base",
-      "b.safePath.resolve: rel resolves outside base ('" + joined + "' not inside '" + baseResolved + "')");
+      "b.safePath.resolve: rel resolves outside base ('" +
+      pathMod.resolve(baseResolved, rel) + "' not inside '" + baseResolved + "')");
   }
   if (opts.realpath === true) {
     // realpath resolves symlinks on the RUNTIME filesystem, so it must use the
@@ -266,5 +313,6 @@ module.exports = {
   resolve:        resolve,
   resolveOrNull:  resolveOrNull,
   validate:       validate,
+  confineToBase:  confineToBase,
   SafePathError:  SafePathError,
 };

package/lib/vendor/blamejs/lib/safe-redirect.js

@@ -97,15 +97,23 @@ function resolve(rawTarget, opts) {
   try { parsed = safeUrl.parse(rawTarget, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS }); }
   catch (_e) { return fallback; }
 
+  // parsed.origin / host / hostname come lowercased from the WHATWG URL
+  // parser (scheme + host are case-insensitive per RFC 3986). Canonicalize
+  // each operator allowlist entry the same way before comparing, so a
+  // mixed-case operator entry ("HTTPS://Example.com" / "Example.COM") still
+  // matches instead of silently never matching and falling through to the
+  // fallback. The attacker-controlled rawTarget is already normalized, so
+  // this only makes the operator's intended allowlist work — never widens it.
   if (baseOrigin !== null && parsed.origin === baseOrigin) return rawTarget;
   if (allowedOrigins) {
     for (var i = 0; i < allowedOrigins.length; i += 1) {
-      if (parsed.origin === allowedOrigins[i]) return rawTarget;
+      if (parsed.origin === String(allowedOrigins[i]).toLowerCase()) return rawTarget;
     }
   }
   if (allowedHosts) {
     for (var j = 0; j < allowedHosts.length; j += 1) {
-      if (parsed.host === allowedHosts[j] || parsed.hostname === allowedHosts[j]) {
+      var allowedHost = String(allowedHosts[j]).toLowerCase();
+      if (parsed.host === allowedHost || parsed.hostname === allowedHost) {
         return rawTarget;
       }
     }

package/lib/vendor/blamejs/lib/safe-schema.js

@@ -996,8 +996,11 @@ function unknown() { return any(); }
  *   // → "object/unknown-key"
  *
  *   // Prototype-pollution attempt rejected even with passthrough.
+ *   // A hostile __proto__ only becomes an own key through JSON input;
+ *   // object-literal `__proto__:` sets the prototype instead.
  *   var loose = user.passthrough();
- *   var report = loose.safeParse({ email: "a@b.com", age: 30, __proto__: { admin: true } });
+ *   var hostile = JSON.parse('{ "email": "a@b.com", "age": 30, "__proto__": { "admin": true } }');
+ *   var report = loose.safeParse(hostile);
  *   report.ok;
  *   // → false
  *   report.errors[0].code;

package/lib/vendor/blamejs/lib/safe-sieve.js

@@ -429,7 +429,39 @@ function _parseScript(tokens, caps, requiredCaps) {
       }
       if (t.k === "tag") {
         consume("tag");
-        tags.push({ name: t.v });
+        // `:comparator <string>` binds the FOLLOWING string as its value
+        // (RFC 5228 section 2.7.3). It must be attached to the tag, NOT left in
+        // the positional stream -- otherwise the comparator name lands at
+        // positional[0] and shifts every real positional arg (the header/address
+        // name and the key list) by one, silently breaking the test so it never
+        // matches and the message falls through to implicit keep (a filter
+        // bypass). In the base grammar `:comparator` is the only value-taking tag.
+        if (t.v === "comparator") {
+          var cv = peek();
+          if (cv.k !== "str") {
+            throw new SafeSieveError("safe-sieve/parse-error",
+              "safeSieve.parse: :comparator must be followed by a comparator-name string");
+          }
+          consume("str");
+          // Validate the comparator name against the implemented set, exactly as
+          // `require ["comparator-<name>"]` does -- otherwise an unsupported
+          // comparator (e.g. i;unicode-casemap) would be accepted here and the
+          // interpreter would silently treat it as octet (exact) matching,
+          // bypassing the capability guard. Fail closed on anything not
+          // implemented.
+          var compCap = "comparator-" + cv.v;
+          if (!Object.prototype.hasOwnProperty.call(KNOWN_CAPABILITIES, compCap)) {
+            throw new SafeSieveError("safe-sieve/unknown-capability",
+              "safeSieve.parse: unknown comparator \"" + cv.v + "\"");
+          }
+          if (KNOWN_CAPABILITIES[compCap] === false) {
+            throw new SafeSieveError("safe-sieve/unimplemented-capability",
+              "safeSieve.parse: unimplemented comparator \"" + cv.v + "\"");
+          }
+          tags.push({ name: t.v, val: cv.v });
+        } else {
+          tags.push({ name: t.v });
+        }
         continue;
       }
       if (t.k === "num") {

package/lib/vendor/blamejs/lib/safe-sql.js

@@ -494,6 +494,93 @@ function toPositional(sql, dialect) {
   return out;
 }
 
+/**
+ * @primitive b.safeSql.normalizeForScan
+ * @signature b.safeSql.normalizeForScan(sql)
+ * @since     0.17.4
+ * @status    stable
+ * @related   b.safeSql.countPlaceholders, b.safeSql.toPositional, b.safeSql.assertSingleStatement
+ *
+ * Produce a parse-only copy of `sql` whose token boundaries are real
+ * whitespace, so a regex tokenizer that assumes whitespace-separated tokens
+ * cannot be evaded. SQL lets two tokens abut with NO whitespace whenever a
+ * comment OR a quoted-identifier boundary separates them (an `INSERT` whose
+ * quoted table name abuts `INTO`, or a slash-star comment wedged between a
+ * keyword and the table); a keyword/table detector hand-rolled with `\s+`
+ * boundaries silently misses those forms even though the engine executes them.
+ * This scan replaces every line (`--`) and slash-star block comment with a
+ * single space and inserts a separating space wherever a quoted string /
+ * identifier (`'...'` / `"..."` / a backtick-quoted name) abuts a word
+ * character on either side — a word char directly before the opening quote OR
+ * directly after the closing quote. The same quote- and comment-aware single
+ * pass as `countPlaceholders` / `toPositional` (doubled-quote escapes
+ * respected), so a comment marker inside a string literal is copied verbatim,
+ * never collapsed. The executed SQL is unchanged — this copy only feeds a
+ * scanner.
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   b.safeSql.normalizeForScan('INSERT INTO"t"(a) VALUES(?)');
+ *   // → 'INSERT INTO "t"(a) VALUES(?)'
+ *
+ *   b.safeSql.normalizeForScan('UPDATE"residents"SET x=1');
+ *   // → 'UPDATE "residents" SET x=1'
+ *
+ *   b.safeSql.normalizeForScan("SELECT 1-- note");
+ *   // → "SELECT 1 "
+ */
+function normalizeForScan(sql) {
+  var s = String(sql);
+  var out = "";
+  var i = 0;
+  var len = s.length;
+  while (i < len) {
+    var c = s.charAt(i);
+    var nx = i + 1 < len ? s.charAt(i + 1) : "";
+    if (c === "'" || c === '"' || c === "`") {
+      // A quoted token abutting a word character gets a separating space so the
+      // downstream whitespace-anchored tokenizer sees the boundary — on BOTH
+      // sides: before the opening quote when a word char precedes it
+      // (`INTO"t"`), and after the closing quote when a word char follows it
+      // (`"t"SET` / `UPDATE"residents"SET`). A quoted identifier separates
+      // tokens with no whitespace in either direction, so a one-sided boundary
+      // still lets a write hide from the scan. Between, copy the whole quoted
+      // run verbatim (doubled-quote escapes preserved) so a comment marker
+      // inside the literal is never collapsed.
+      if (out.length > 0 && /\w/.test(out.charAt(out.length - 1))) out += " ";
+      out += c;
+      i += 1;
+      while (i < len) {
+        var q = s.charAt(i);
+        out += q;
+        if (q === c) {
+          if (s.charAt(i + 1) === c) { out += c; i += 2; continue; }
+          i += 1; break;
+        }
+        i += 1;
+      }
+      if (i < len && /\w/.test(s.charAt(i))) out += " ";
+      continue;
+    }
+    if (c === "-" && nx === "-") {          // line comment → one space
+      i += 2;
+      while (i < len && s.charAt(i) !== "\n") i += 1;
+      out += " ";
+      continue;
+    }
+    if (c === "/" && nx === "*") {          // block comment → one space
+      i += 2;
+      while (i < len && !(s.charAt(i) === "*" && s.charAt(i + 1) === "/")) i += 1;
+      i += 2;
+      out += " ";
+      continue;
+    }
+    out += c;
+    i += 1;
+  }
+  return out;
+}
+
 /**
  * @primitive b.safeSql.DEFAULT_IDENTIFIER_RE
  * @signature b.safeSql.DEFAULT_IDENTIFIER_RE
@@ -693,6 +780,7 @@ module.exports = {
   assertOneOf:         assertOneOf,
   countPlaceholders:   countPlaceholders,
   toPositional:        toPositional,
+  normalizeForScan:    normalizeForScan,
   SafeSqlError:        SafeSqlError,
   // Exposed so consumers can compose their own validators
   DEFAULT_IDENTIFIER_RE: DEFAULT_IDENTIFIER_RE,

package/lib/vendor/blamejs/lib/safe-vcard.js

@@ -225,14 +225,18 @@ function _resolveCaps(opts) {
   if (typeof opts.profile === "string") {
     name = opts.profile;
   } else if (typeof opts.compliancePosture === "string") {
-    name = COMPLIANCE_POSTURES[opts.compliancePosture] || "strict";
+    name = Object.prototype.hasOwnProperty.call(COMPLIANCE_POSTURES, opts.compliancePosture)
+      ? COMPLIANCE_POSTURES[opts.compliancePosture] : "strict";
   }
-  var caps = PROFILES[name];
-  if (!caps) {
+  // Own-property lookup: `name` derives from attacker/operator opts.profile, so
+  // a bare `if (!PROFILES[name])` would let a prototype key ("constructor") pass
+  // as a known profile and run under an inherited member (fail-open).
+  if (!Object.prototype.hasOwnProperty.call(PROFILES, name)) {
     throw new SafeVcardError("safe-vcard/bad-opt",
       "safeVcard.parse: unknown profile '" + name +
       "' (expected strict|balanced|permissive)");
   }
+  var caps = PROFILES[name];
   return caps;
 }
 

package/lib/vendor/blamejs/lib/scheduler.js

@@ -135,7 +135,14 @@ function _parseCronField(text, range) {
       hi = parseInt(seg[1], 10);
     } else {
       lo = parseInt(part, 10);
-      hi = lo;
+      // A bare number followed by a step (`N/step`) is the Vixie-cron
+      // shorthand for `N-max/step` (e.g. `5/15` in minutes = 5,20,35,50,
+      // matching crontab.guru and `*/15` = 0,15,30,45). Without a step a
+      // bare number is the single value {N}. Anchoring `hi` at range.max
+      // when a step is present is what turns the step into a repeat; keeping
+      // hi = lo silently collapsed the schedule to a single fire — the same
+      // silent-under-firing class rejected for over-range steps above.
+      hi = (stepIdx !== -1) ? range.max : lo;
     }
     if (!Number.isFinite(lo) || !Number.isFinite(hi) || lo > hi ||
         lo < range.min || hi > range.max) {

package/lib/vendor/blamejs/lib/security-assert.js

@@ -340,14 +340,14 @@ async function assertProduction(opts) {
   if (opts.extra !== undefined) {
     if (!Array.isArray(opts.extra)) {
       throw new SecurityAssertError(
-        "security.assertProduction: opts.extra must be an array of functions, got " + typeof opts.extra,
-        "BAD_OPT", true);
+        "BAD_OPT",
+        "security.assertProduction: opts.extra must be an array of functions, got " + typeof opts.extra);
     }
     for (var ei = 0; ei < opts.extra.length; ei++) {
       if (typeof opts.extra[ei] !== "function") {
         throw new SecurityAssertError(
-          "security.assertProduction: opts.extra[" + ei + "] must be a function",
-          "BAD_OPT", true);
+          "BAD_OPT",
+          "security.assertProduction: opts.extra[" + ei + "] must be a function");
       }
       var verdict;
       try { verdict = await opts.extra[ei](); }
@@ -383,8 +383,8 @@ async function assertProduction(opts) {
   if (failures.length > 0) {
     var summary = failures.map(function (f) { return "  - " + f.code + ": " + f.message; }).join("\n");
     var err = new SecurityAssertError(
-      "production security policy failed (" + failures.length + " assertion(s)):\n" + summary,
-      "ASSERT_FAILED", true);
+      "ASSERT_FAILED",
+      "production security policy failed (" + failures.length + " assertion(s)):\n" + summary);
     err.failures = failures;
     throw err;
   }

package/lib/vendor/blamejs/lib/self-update-standalone-verifier.js

@@ -88,6 +88,17 @@
 var nodeCrypto = require("node:crypto");
 var nodeFs     = require("node:fs");
 
+// _svErr — throw shape for this module. A plain Error (zero-dep — no framework
+// error class) carrying a machine-readable `.kind` so a framework caller
+// (b.selfUpdate.verify) can map the failure to its own typed error class
+// without parsing English message text. Operators consuming the module
+// standalone still get the human-readable `.message` unchanged.
+function _svErr(kind, message) {
+  var e = new Error(message);
+  e.kind = kind;
+  return e;
+}
+
 // _streamHashAndVerify — read the asset in 64 KiB chunks, feed each
 // chunk into sha256, sha3-512, AND the signature verifier in parallel.
 // Single pass over the file; no in-memory copy. node:crypto's
@@ -103,18 +114,18 @@ function _detectAlg(pubkeyPem) {
   try {
     key = nodeCrypto.createPublicKey(pubkeyPem);
   } catch (e) {
-    throw new Error("standalone-verifier: pubkey PEM did not parse: " +
+    throw _svErr("bad-pubkey", "standalone-verifier: pubkey PEM did not parse: " +
                     (e && e.message ? e.message : String(e)));
   }
   var t = key.asymmetricKeyType;
   if (t === "ec") {
     var curve = key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve;
     if (curve === "P-384" || curve === "secp384r1") return { alg: "ecdsa-p384", key: key };
-    throw new Error("standalone-verifier: unsupported EC curve '" + curve + "' (need P-384)");
+    throw _svErr("unsupported-key", "standalone-verifier: unsupported EC curve '" + curve + "' (need P-384)");
   }
   if (t === "ed25519") return { alg: "ed25519", key: key };
   if (t === "ml-dsa-87" || t === "ml-dsa") return { alg: "ml-dsa-87", key: key };
-  throw new Error("standalone-verifier: unrecognized pubkey type '" + t + "' " +
+  throw _svErr("unsupported-key", "standalone-verifier: unrecognized pubkey type '" + t + "' " +
                   "(need ecdsa-p384, ed25519, or ml-dsa-87)");
 }
 
@@ -163,7 +174,7 @@ function _looksLikeDerEcdsa(sig) {
 
 /**
  * @primitive b.selfUpdate.standaloneVerifier.verify
- * @signature b.selfUpdate.standaloneVerifier.verify(assetPath, signaturePath, pubkeyPem)
+ * @signature b.selfUpdate.standaloneVerifier.verify(assetPath, signaturePath, pubkeyPem, opts?)
  * @since     0.9.13
  * @status    stable
  * @related   b.selfUpdate.verify
@@ -175,12 +186,21 @@ function _looksLikeDerEcdsa(sig) {
  * Streams the asset in 64 KiB chunks through SHA-256 + SHA-3-512 + the
  * signature verifier in parallel — single allocation peak (one buffer
  * sized to fstat(asset).size for Ed25519 / ML-DSA-87, ECDSA P-384 needs
- * no buffer because createVerify is incremental).
+ * no buffer because createVerify is incremental). The signature commits
+ * to a SHA3-512 digest and the ECDSA encoding is dispatched by structure
+ * (DER SEQUENCE vs raw IEEE-P1363), so both encodings of a SHA3-512-signed
+ * P-384 sidecar verify.
  *
- * Returns `{ ok, sha3_512, sha256, alg }` on success; throws on
- * unrecognized pubkey shape, missing files, or signature mismatch.
- * `alg` is one of `"ecdsa-p384"`, `"ed25519"`, `"ml-dsa-87"` (auto-
- * detected from the pubkey PEM).
+ * Returns `{ ok, sha3_512, sha256, alg, bytes, digests }` on success;
+ * throws on unrecognized pubkey shape, missing files, or signature
+ * mismatch. `alg` is one of `"ecdsa-p384"`, `"ed25519"`, `"ml-dsa-87"`
+ * (auto-detected from the pubkey PEM). `bytes` is the verified asset byte
+ * count; `digests` maps each requested `opts.extraDigests` name to its
+ * hex digest (computed in the same single pass).
+ *
+ * @opts
+ *   maxAssetBytes: number,   // asset-size ceiling (default 2 GiB); refuse a larger asset before hashing
+ *   extraDigests:  array,    // additional node:crypto digest names to compute in the same stream
  *
  * @example
  *   var verifier = require("./standalone-verifier");
@@ -193,15 +213,26 @@ function _looksLikeDerEcdsa(sig) {
  *   if (!result.ok) process.exit(1);
  *   process.stdout.write("verified " + result.alg + " sha3-512=" + result.sha3_512 + "\n");
  */
-function verify(assetPath, signaturePath, pubkeyPem) {
+function verify(assetPath, signaturePath, pubkeyPem, opts) {
+  opts = opts || {};
+  // Asset-size ceiling — override the default via opts.maxAssetBytes (the
+  // framework caller passes its own maxBytes). A self-update bundle (SEA) is
+  // intentionally large, so the default ceiling is generous (2 GiB), but it
+  // stops a signaturePath/assetPath pointed at an unbounded file from OOM-ing.
+  var maxAssetBytes = (typeof opts.maxAssetBytes === "number" && isFinite(opts.maxAssetBytes) &&
+                       opts.maxAssetBytes > 0)
+    ? opts.maxAssetBytes
+    : (2 * 1024 * 1024 * 1024);   // allow:raw-byte-literal — zero-dep module, 2 GiB asset ceiling
+  var extraDigests = Array.isArray(opts.extraDigests) ? opts.extraDigests : [];
+
   if (typeof assetPath !== "string" || assetPath.length === 0) {
-    throw new Error("standalone-verifier.verify: assetPath must be a non-empty string");
+    throw _svErr("bad-input", "standalone-verifier.verify: assetPath must be a non-empty string");
   }
   if (typeof signaturePath !== "string" || signaturePath.length === 0) {
-    throw new Error("standalone-verifier.verify: signaturePath must be a non-empty string");
+    throw _svErr("bad-input", "standalone-verifier.verify: signaturePath must be a non-empty string");
   }
   if (typeof pubkeyPem !== "string" || pubkeyPem.indexOf("-----BEGIN ") !== 0) {
-    throw new Error("standalone-verifier.verify: pubkeyPem must be a PEM-encoded public key string");
+    throw _svErr("bad-input", "standalone-verifier.verify: pubkeyPem must be a PEM-encoded public key string");
   }
 
   // Open both files BEFORE parsing the pubkey so we own stable fds
@@ -212,7 +243,7 @@ function verify(assetPath, signaturePath, pubkeyPem) {
   try {
     assetFd = nodeFs.openSync(assetPath, "r");
   } catch (e) {
-    throw new Error("standalone-verifier.verify: asset not found at " + assetPath +
+    throw _svErr("asset-not-found", "standalone-verifier.verify: asset not found at " + assetPath +
                     " — " + (e && e.message ? e.message : String(e)));
   }
   var sigFd;
@@ -220,7 +251,7 @@ function verify(assetPath, signaturePath, pubkeyPem) {
     sigFd = nodeFs.openSync(signaturePath, "r");
   } catch (e) {
     nodeFs.closeSync(assetFd);
-    throw new Error("standalone-verifier.verify: signature not found at " + signaturePath +
+    throw _svErr("sig-not-found", "standalone-verifier.verify: signature not found at " + signaturePath +
                     " — " + (e && e.message ? e.message : String(e)));
   }
   var signature;
@@ -231,7 +262,7 @@ function verify(assetPath, signaturePath, pubkeyPem) {
     // from OOM-ing if signaturePath is pointed at a giant file. Zero-dep by
     // contract — inline literal, cannot import C.BYTES.
     if (sigStat.size > 64 * 1024) {   // allow:raw-byte-literal — zero-dep module
-      throw new Error("standalone-verifier.verify: signature file implausibly large (" +
+      throw _svErr("sig-too-large", "standalone-verifier.verify: signature file implausibly large (" +
                       sigStat.size + " bytes)");
     }
     signature = Buffer.allocUnsafe(sigStat.size);
@@ -241,7 +272,7 @@ function verify(assetPath, signaturePath, pubkeyPem) {
   }
   if (signature.length === 0) {
     nodeFs.closeSync(assetFd);
-    throw new Error("standalone-verifier.verify: signature file is empty");
+    throw _svErr("sig-empty", "standalone-verifier.verify: signature file is empty");
   }
 
   var detected;
@@ -249,7 +280,7 @@ function verify(assetPath, signaturePath, pubkeyPem) {
     detected = _detectAlg(pubkeyPem);
   } catch (e) {
     nodeFs.closeSync(assetFd);
-    throw e;
+    throw e;   // carries _detectAlg's .kind (bad-pubkey / unsupported-key)
   }
   var alg = detected.alg;
   var key = detected.key;
@@ -273,15 +304,24 @@ function verify(assetPath, signaturePath, pubkeyPem) {
   // time.
   var assetStat = nodeFs.fstatSync(assetFd);
   // Bound the asset alloc before Buffer.allocUnsafe(assetStat.size): a self-update
-  // bundle (SEA) is intentionally large, so the ceiling is generous (2 GiB), but
-  // it stops a signaturePath/assetPath pointed at an unbounded file from OOM-ing
-  // the verifier before any byte is hashed. Zero-dep by contract — inline literal.
-  if (assetStat.size > 2 * 1024 * 1024 * 1024) {   // allow:raw-byte-literal — zero-dep module, 2 GiB asset ceiling
-    throw new Error("standalone-verifier.verify: asset implausibly large (" +
-                    assetStat.size + " bytes) — exceeds the 2 GiB self-update ceiling");
+  // bundle (SEA) is intentionally large, so the ceiling is generous (2 GiB by
+  // default, or opts.maxAssetBytes), but it stops a signaturePath/assetPath
+  // pointed at an unbounded file from OOM-ing the verifier before any byte is
+  // hashed.
+  if (assetStat.size > maxAssetBytes) {
+    nodeFs.closeSync(assetFd);
+    throw _svErr("asset-too-large", "standalone-verifier.verify: asset implausibly large (" +
+                    assetStat.size + " bytes) — exceeds the " + maxAssetBytes + "-byte asset ceiling");
   }
   var sha256 = nodeCrypto.createHash("sha256");
   var sha3   = nodeCrypto.createHash("sha3-512");
+  // Additional operator-requested digests, computed in the same single pass so
+  // a framework caller can report an audit digest (sha-512 / shake256 / …)
+  // without a second read of the asset.
+  var extraHashers = [];
+  for (var xd = 0; xd < extraDigests.length; xd += 1) {
+    extraHashers.push({ name: extraDigests[xd], hash: nodeCrypto.createHash(extraDigests[xd]) });
+  }
   var verifier = (alg === "ecdsa-p384") ? nodeCrypto.createVerify("sha3-512") : null;
   var fullBuf  = null;
   var fullOff  = 0;
@@ -305,6 +345,7 @@ function verify(assetPath, signaturePath, pubkeyPem) {
       var slice = chunk.subarray(0, n);
       sha256.update(slice);
       sha3.update(slice);
+      for (var xh = 0; xh < extraHashers.length; xh += 1) extraHashers[xh].hash.update(slice);
       if (verifier) verifier.update(slice);
       if (fullBuf) {
         slice.copy(fullBuf, fullOff);
@@ -319,7 +360,7 @@ function verify(assetPath, signaturePath, pubkeyPem) {
   // beyond what the clamp let through. Both cases mean the hashers
   // and verifier saw a different byte set than the on-disk file.
   if (fullOff !== assetStat.size) {
-    throw new Error("standalone-verifier.verify: asset '" + assetPath +
+    throw _svErr("size-race", "standalone-verifier.verify: asset '" + assetPath +
                     "' changed size during read (expected " + assetStat.size +
                     " bytes per fstat, read " + fullOff +
                     " bytes) — refusing to return a hash that may not match the on-disk file");
@@ -327,6 +368,10 @@ function verify(assetPath, signaturePath, pubkeyPem) {
 
   var sha256Hex = sha256.digest("hex");
   var sha3Hex   = sha3.digest("hex");
+  var digests   = {};
+  for (var dh = 0; dh < extraHashers.length; dh += 1) {
+    digests[extraHashers[dh].name] = extraHashers[dh].hash.digest("hex");
+  }
 
   var ok = false;
   if (alg === "ecdsa-p384") {
@@ -351,7 +396,7 @@ function verify(assetPath, signaturePath, pubkeyPem) {
     } else {
       // assetFd was already closed by the read loop's `finally`; this is a
       // pure fail-closed refusal, same as the `if (!ok)` path below.
-      throw new Error("standalone-verifier.verify: ecdsa-p384 signature is neither a " +
+      throw _svErr("bad-sig-encoding", "standalone-verifier.verify: ecdsa-p384 signature is neither a " +
                       "well-formed DER SEQUENCE nor a raw " + (coordLen * 2) +
                       "-byte IEEE-P1363 pair (length " + signature.length +
                       ") — refusing to guess the encoding");
@@ -366,7 +411,7 @@ function verify(assetPath, signaturePath, pubkeyPem) {
   }
 
   if (!ok) {
-    throw new Error("standalone-verifier.verify: " + alg + " signature INVALID for " +
+    throw _svErr("verify-failed", "standalone-verifier.verify: " + alg + " signature INVALID for " +
                     assetPath + " (sha3-512=" + sha3Hex.slice(0, 16) + "...). " +   // 16-char hex prefix for forensic display, not bytes
                     "Either the asset was tampered with after signing, the signature " +
                     "doesn't match this asset, or the pubkey doesn't match the signing key.");
@@ -377,6 +422,8 @@ function verify(assetPath, signaturePath, pubkeyPem) {
     sha3_512: sha3Hex,
     sha256:   sha256Hex,
     alg:      alg,
+    bytes:    fullOff,
+    digests:  digests,
   };
 }