@blamejs/core 0.15.12 → 0.15.14

package/lib/codepoint-class.js

@@ -172,7 +172,7 @@ function detectMixedScripts(label, allowedScripts) {
 //
 //   issues.push.apply(issues,
 //     codepointClass.detectCharThreats(text, opts, "html"));
-function detectCharThreats(text, opts, codePrefix) {
+function detectCharThreats(text, opts, codePrefix, zeroWidthSeverity) {
   var issues = [];
   if (typeof text !== "string") return issues;
   if (opts && opts.bidiPolicy !== "allow") {
@@ -208,6 +208,28 @@ function detectCharThreats(text, opts, codePrefix) {
       });
     }
   }
+  // Zero-width / invisible-formatting chars — the fourth Trojan-source-class
+  // character threat, detected here alongside its siblings so no guard
+  // hand-rolls it. OPT-IN AND severity via zeroWidthSeverity: a caller that
+  // wants zero-width detection passes the context-appropriate severity
+  // ("high" where an invisible char spoofs an identifier / filename / line of
+  // text; "warn" where it is cosmetic), and omitting it skips the scan. Gated
+  // further on a defined non-`allow` zeroWidthPolicy — flagged under `strip`
+  // too (like bidi / null / control) so a zero-width-only input under `strip`
+  // reaches the sanitizer and is removed rather than served unchanged.
+  if (zeroWidthSeverity && opts && opts.zeroWidthPolicy &&
+      opts.zeroWidthPolicy !== "allow") {
+    var zwMatch = text.match(ZERO_WIDTH_RE);
+    if (zwMatch) {
+      issues.push({
+        kind: "zero-width", severity: zeroWidthSeverity,
+        ruleId: codePrefix + ".zero-width",
+        location: zwMatch.index,
+        snippet: "zero-width / invisible-formatting char U+" +
+                 zwMatch[0].charCodeAt(0).toString(HEX_RADIX) + " at byte " + zwMatch.index,
+      });
+    }
+  }
   return issues;
 }
 
@@ -292,7 +314,68 @@ function isUnreserved(cc) {
          cc === 0x7e;     // ~
 }
 
+// isForbiddenControlChar — the header-injection / RFC 5322 control-byte
+// predicate every "refuse control bytes in a header / line / value" loop
+// shares across the mail guards (dsn / imap / list-id / list-unsubscribe /
+// mail-compose / mail-sieve / managesieve) and the safe-* text parsers
+// (ical / mime / vcard / toml). TRUE for DEL (0x7f) and any C0 control
+// (< 0x20) other than TAB (0x09); LF (0x0a) and CR (0x0d) are refused by
+// default but can be permitted per call (a line reader that has already
+// split on CRLF, or a grammar that allows folding). Distinct from the
+// C0_CTRL_RANGES regex above, which is the stripping/scanning table that
+// always exempts LF/CR and never matches DEL.
+//
+// opts.forbidTab — TAB (0x09) is normally permitted (it is folding
+// whitespace in RFC 5322 header values). The stricter identifier / key /
+// name / single-line-value contexts (idempotency keys, step-up challenge
+// values, mailbox / folder / message-id names, assembly ids, DNSBL-free
+// single-line values) forbid EVERY C0 control plus DEL — there is no
+// folding to honour — so they pass `{ forbidTab: true }`, making the
+// predicate exactly `code < 0x20 || code === 0x7f`.
+function isForbiddenControlChar(code, opts) {
+  if (code === 0x7f) return true;          // DEL
+  if (code >= 0x20) return false;
+  if (code === 0x09 && (!opts || !opts.forbidTab)) return false;  // TAB — permitted unless forbidTab
+  if (opts) {
+    if (opts.allowLf && code === 0x0a) return false;
+    if (opts.allowCr && code === 0x0d) return false;
+  }
+  return true;
+}
+
+// firstControlCharOffset — index of the first isForbiddenControlChar in `s`
+// (under the same opts), or -1 when none. Callers wrap it as a boolean
+// (`offset !== -1`), throw with the offending code (`s.charCodeAt(offset)`),
+// or derive a byte offset from the index — replacing the open-coded
+// `for (i) { c = charCodeAt(i); if (c === 0 || c === 0x7f || (c < 0x20 &&
+// c !== 0x09)) … }` scan each parser previously rolled by hand.
+function firstControlCharOffset(s, opts) {
+  for (var i = 0; i < s.length; i += 1) {
+    if (isForbiddenControlChar(s.charCodeAt(i), opts)) return i;
+  }
+  return -1;
+}
+
+// Decode HTML numeric character references (hex &#x..; and decimal &#..;) just
+// enough to expose a scheme hidden behind entity-encoding. The trailing
+// semicolon is OPTIONAL — a browser decodes `&#106avascript:` (no semicolon)
+// the same as `&#106;avascript:`, so a semicolon-required decoder lets the
+// no-semicolon form bypass a scheme allowlist. Shared so guard-html / guard-svg
+// / guard-markdown cannot drift on this (the bug class that shipped one buggy
+// + one correct copy).
+var NUMERIC_ENTITY_RE_G = /&#(?:x([0-9a-f]+)|(\d+));?/gi;
+function decodeNumericEntities(s) {
+  return String(s == null ? "" : s).replace(NUMERIC_ENTITY_RE_G, function (m, hex, dec) {
+    var cp = hex !== undefined ? parseInt(hex, 16) : parseInt(dec, 10);
+    if (!isFinite(cp) || cp < 0 || cp > 0x10FFFF) return m;
+    try { return String.fromCodePoint(cp); } catch (_e) { return m; }
+  });
+}
+
 module.exports = {
+  isForbiddenControlChar:  isForbiddenControlChar,
+  firstControlCharOffset:  firstControlCharOffset,
+  decodeNumericEntities:   decodeNumericEntities,
   isAsciiAlnum:      isAsciiAlnum,
   isUnreserved:      isUnreserved,
   hex4:              hex4,

package/lib/compliance-ai-act-logging.js

@@ -131,12 +131,7 @@ function emit(event) {
   // namespace uses underscores, so the kind is rewritten before emit.
   try {
     var kindCanonical = String(event.kind || "log").replace(/-/g, "_");
-    audit().safeEmit({
-      action:   "compliance.aiact." + kindCanonical,
-      outcome:  event.outcome || "success",
-      actor:    event.actor || null,
-      metadata: event,
-    });
+    audit().namespaced("compliance.aiact")(kindCanonical, event.outcome || "success", event, { actor: event.actor || null });
   } catch (_e) { /* drop-silent */ }
   return event;
 }

package/lib/compliance-ai-act-transparency.js

@@ -39,6 +39,7 @@
  */
 
 var validateOpts  = require("./validate-opts");
+var markupEscape  = require("./markup-escape").markupEscape;
 var { ComplianceError } = require("./framework-error");
 
 var BANNER_KINDS = Object.freeze([
@@ -118,10 +119,7 @@ function htmlBanner(opts) {
 
 function _escapeHtml(s) {
   if (typeof s !== "string") return "";
-  return s.replace(/&/g, "&")
-          .replace(/</g, "&lt;")
-          .replace(/>/g, "&gt;")
-          .replace(/"/g, "&quot;");
+  return markupEscape(s);
 }
 
 // Watermark builder for Art. 50(2). Operators integrate with C2PA /

package/lib/compliance-eaa.js

@@ -66,22 +66,12 @@ function create(opts) {
   var standards = opts.standards.slice();
   var contact = opts.contact || null;
   var supervisoryAuthority = opts.supervisoryAuthority || null;
-  var auditOn = opts.audit !== false;
   var now = typeof opts.now === "function" ? opts.now : function () { return Date.now(); };
 
   var criteria = new Map();
   var nonConformances = [];
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "compliance.eaa." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("compliance.eaa", opts.audit);
 
   function declareCriterion(id, decl) {
     if (typeof id !== "string" || id.length === 0) {
@@ -92,7 +82,7 @@ function create(opts) {
       throw new ComplianceEaaError("compliance-eaa/bad-decl",
         "compliance.eaa.declareCriterion: decl must be an object with { conformance, note? }");
     }
-    if (!VALID_CONFORMANCE[decl.conformance]) {
+    if (!Object.prototype.hasOwnProperty.call(VALID_CONFORMANCE, decl.conformance)) {
       throw new ComplianceEaaError("compliance-eaa/bad-conformance",
         "compliance.eaa.declareCriterion: conformance must be one of " + Object.keys(VALID_CONFORMANCE).join(", "));
     }

package/lib/compliance-sanctions-fetcher.js

@@ -65,20 +65,25 @@ function create(opts) {
     "fetchOnStart", "audit",
   ], "compliance.sanctions.fetcher.create");
 
-  if (!opts.screener || typeof opts.screener.reload !== "function") {
-    throw new SanctionsFetcherError("sanctions-fetcher/bad-screener",
-      "fetcher.create: screener must be a sanctions.create() instance");
-  }
-  if (typeof opts.fetch !== "function") {
-    throw new SanctionsFetcherError("sanctions-fetcher/bad-fetch",
-      "fetcher.create: fetch must be an async function returning entry[]");
-  }
-  validateOpts.optionalPositiveFinite(opts.intervalMs,
-    "fetcher.create: intervalMs", SanctionsFetcherError, "sanctions-fetcher/bad-opts");
-  validateOpts.optionalFunction(opts.onRefreshed,
-    "fetcher.create: onRefreshed", SanctionsFetcherError, "sanctions-fetcher/bad-opts");
-  validateOpts.optionalFunction(opts.onError,
-    "fetcher.create: onError", SanctionsFetcherError, "sanctions-fetcher/bad-opts");
+  validateOpts.shape(opts, {
+    screener: function (value) {
+      if (!value || typeof value.reload !== "function") {
+        throw new SanctionsFetcherError("sanctions-fetcher/bad-screener",
+          "fetcher.create: screener must be a sanctions.create() instance");
+      }
+    },
+    fetch: function (value) {
+      if (typeof value !== "function") {
+        throw new SanctionsFetcherError("sanctions-fetcher/bad-fetch",
+          "fetcher.create: fetch must be an async function returning entry[]");
+      }
+    },
+    intervalMs:   "optional-positive-finite",
+    onRefreshed:  "optional-function",
+    onError:      "optional-function",
+    fetchOnStart: "optional-boolean",
+    audit:        "optional-boolean",
+  }, "fetcher.create", SanctionsFetcherError, "sanctions-fetcher/bad-opts");
 
   var intervalMs   = opts.intervalMs   || C.TIME.hours(24);
   var fetchOnStart = opts.fetchOnStart !== false;
@@ -93,21 +98,9 @@ function create(opts) {
   var refreshCount = 0;
   var failureCount = 0;
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced(null, { audit: auditOn });
 
-  function _emitMetric(verb, n) {
-    try { observability().safeEvent("compliance.sanctions.fetcher." + verb, n || 1, {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitMetric = observability().namespaced("compliance.sanctions.fetcher");
 
   async function _tick() {
     if (stopping) return;

package/lib/compliance-sanctions.js

@@ -284,21 +284,9 @@ function create(opts) {
   // strings.
   var index = opts.entries.map(_normalizeEntry);
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit sink */ }
-  }
+  var _emitAudit = audit().namespaced(null, { audit: auditOn });
 
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("compliance.sanctions." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitMetric = observability().namespaced("compliance.sanctions");
 
   function _exactMatch(qNorm, candidate) {
     for (var i = 0; i < candidate._allNamesNormalized.length; i++) {
@@ -380,13 +368,14 @@ function create(opts) {
 
     for (var c = 0; c < index.length; c++) {
       var candidate = index[c];
-      // Type filter: when input.type is set, skip candidates of
-      // the wrong type unless candidate is an entity (entities can
-      // be matched regardless to catch operator-side type errors).
-      if (input.type && candidate.type !== input.type &&
-          candidate.type !== "entity") {
-        continue;
-      }
+      // A sanctions screen MUST over-match on the legally-operative NAME. The
+      // operator-asserted input.type is an unverified counterparty
+      // self-classification, NOT data-driven non-match confidence — using it to
+      // EXCLUDE a name hit inverts the screen to under-match (a false negative
+      // that processes a payment which should have been blocked). So never skip
+      // a candidate on type; the name match runs against every record and the
+      // type mismatch is surfaced as a non-dispositive `typeMatch` signal on
+      // each hit for operator triage.
 
       var bestForCandidate = { score: 0, name: "" };
       for (var qi = 0; qi < queryNames.length; qi++) {
@@ -416,6 +405,7 @@ function create(opts) {
           listed:    candidate.listedAt,
           programs:  candidate.programs,
           type:      candidate.type,
+          typeMatch: input.type ? candidate.type === input.type : null,
           country:   candidate.country,
         });
       }

package/lib/compliance.js

@@ -47,6 +47,7 @@ var aiAct     = require("./compliance-ai-act");
 var { ComplianceError } = require("./framework-error");
 
 var audit         = lazyRequire(function () { return require("./audit"); });
+var auditEmit     = require("./audit-emit");
 var retentionMod  = lazyRequire(function () { return require("./retention"); });
 var db            = lazyRequire(function () { return require("./db"); });
 var cryptoField   = lazyRequire(function () { return require("./crypto-field"); });
@@ -316,15 +317,7 @@ var ARTIFACT_STANDARDS = Object.freeze([
 
 var STATE = { posture: null, setAt: null, fipsMode: false };
 
-function _emitAudit(action, metadata, outcome) {
-  try {
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome || "success",
-      metadata: metadata,
-    });
-  } catch (_e) { /* audit best-effort */ }
-}
+var _emitAudit = auditEmit.emit;
 
 /**
  * @primitive b.compliance.set
@@ -960,7 +953,7 @@ var REGIME_MAP = Object.freeze({
  *   b.compliance.describe("not-a-real-posture");   // → null
  */
 function describe(posture) {
-  return REGIME_MAP[posture] || null;
+  return Object.prototype.hasOwnProperty.call(REGIME_MAP, posture) ? REGIME_MAP[posture] : null;
 }
 
 // POSTURE_DEFAULTS — per-posture configuration knobs that primitives

package/lib/config-drift.js

@@ -35,7 +35,6 @@
  * @card
  *   Monitor + alert when runtime config diverges from a declared baseline.
  */
-var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var auditSign = require("./audit-sign");
 var canonicalJson = require("./canonical-json");
@@ -45,8 +44,10 @@ var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 var atomicFile = require("./atomic-file");
+var C = require("./constants");
 
 var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var ConfigDriftError = defineClass("ConfigDriftError", { alwaysPermanent: true });
 var _err = ConfigDriftError.factory;
@@ -159,23 +160,16 @@ function create(opts) {
   var sidecarPath = nodePath.join(dataDir,
     baselineName === "default" ? SIDECAR_NAME : ("config-baseline-" + baselineName + ".sig"));
 
-  function _emit(action, info, outcome) {
-    if (!auditOn) return;
-    var sink = auditInstance || audit();
-    try {
-      sink.safeEmit({
-        action:   action,
-        outcome:  outcome,
-        metadata: info || {},
-        reason:   info && info.reason ? info.reason : null,
-      });
-    } catch (_e) { /* audit best-effort */ }
-  }
+  var _emit = auditEmit.gatedReasonEmitter({ audit: auditOn, sink: auditInstance });
 
   function _readSidecar() {
-    if (!nodeFs.existsSync(sidecarPath)) return null;
+    // Capped fd-bound read (no existsSync check-then-read window): the signed
+    // config-baseline sidecar is parsed + verified, so a tampered multi-GB file
+    // would OOM the reader before signature verify. refuseSymlink stays OFF: the
+    // data dir may be a symlink-mounted volume (k8s PVC). Any read failure
+    // (missing / too-large) → null, the existing "no baseline yet" behavior.
     var raw;
-    try { raw = nodeFs.readFileSync(sidecarPath, "utf8"); }
+    try { raw = atomicFile.fdSafeReadSync(sidecarPath, { maxBytes: C.BYTES.mib(1), encoding: "utf8" }); }
     catch (_e) { return null; }
     var parsed;
     try { parsed = safeJson.parse(raw); }
@@ -200,9 +194,12 @@ function create(opts) {
       publicKeyPem:     auditSign.getPublicKey(),
       snapshot:         snapshot,
     };
-    var tmp = sidecarPath + ".tmp";
-    nodeFs.writeFileSync(tmp, JSON.stringify(payload, null, 2));
-    atomicFile.renameWithRetry(tmp, sidecarPath);
+    // Atomic, symlink-refusing write. The previous hand-rolled form staged
+    // into a PREDICTABLE temp name (`sidecarPath + ".tmp"`) via a plain
+    // writeFileSync, so an attacker could pre-plant a symlink at that exact
+    // path and have the signed sidecar written through it (CWE-59 / CWE-377).
+    // writeSync uses a CSPRNG temp name opened O_EXCL | O_NOFOLLOW.
+    atomicFile.writeSync(sidecarPath, JSON.stringify(payload, null, 2), { fileMode: 0o600 });
   }
 
   function _verifySidecar(parsed) {
@@ -377,7 +374,10 @@ function verifyVendorIntegrity(opts) {
   var libVendorDir  = opts.libVendorDir  || nodePath.join(__dirname, "vendor");
   var manifestPath  = opts.manifestPath  || nodePath.join(libVendorDir, "MANIFEST.json");
   var raw;
-  try { raw = nodeFs.readFileSync(manifestPath, "utf8"); }
+  // Capped fd-bound read of the vendor MANIFEST.json (operator-bundled, install-
+  // time). refuseSymlink OFF — the vendored tree ships read-only and an install
+  // may symlink lib/. The cap precedes the alloc.
+  try { raw = atomicFile.fdSafeReadSync(manifestPath, { maxBytes: C.BYTES.mib(4), encoding: "utf8" }); }
   catch (_e) {
     throw _err("VENDOR_MANIFEST_MISSING",
       "vendor MANIFEST.json missing at " + manifestPath, true);
@@ -407,7 +407,11 @@ function verifyVendorIntegrity(opts) {
       var abs = nodePath.isAbsolute(rel) ? rel : nodePath.join(libVendorDir, relInVendor);
       var actual;
       try {
-        var bytes = nodeFs.readFileSync(abs);
+        // Capped fd-bound read (raw bytes — hashing, no encoding). Sanity ceiling
+        // so a corrupted/huge vendored file is a read-failed mismatch (caught
+        // below) rather than an OOM in the boot integrity loop. NO refuseSymlink
+        // (vendored tree ships read-only; installs may symlink lib/).
+        var bytes = atomicFile.fdSafeReadSync(abs, { maxBytes: C.BYTES.mib(64) });
         actual = "sha256:" + require("node:crypto")
           .createHash("sha256").update(bytes).digest("hex");
       } catch (_e) {

package/lib/content-credentials.js

@@ -31,6 +31,7 @@
 var nodeCrypto = require("node:crypto");
 var C = require("./constants");
 var bCrypto = require("./crypto");
+var x509Chain = require("./x509-chain");
 var canonicalJson = require("./canonical-json");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
@@ -1103,7 +1104,7 @@ function attachIdentityAssertion(opts) {
   validateOpts.requireObject(opts, "contentCredentials.attachIdentityAssertion", ContentCredentialsError);
   validateOpts(opts, ["binding", "subject", "referencedAssertions", "privateKeyPem", "audit"],
     "contentCredentials.attachIdentityAssertion");
-  if (typeof opts.binding !== "string" || !IDENTITY_BINDINGS[opts.binding]) {
+  if (typeof opts.binding !== "string" || !Object.prototype.hasOwnProperty.call(IDENTITY_BINDINGS, opts.binding)) {
     throw ContentCredentialsError.factory("content-credentials/bad-identity-binding",
       "attachIdentityAssertion: binding must be one of " + Object.keys(IDENTITY_BINDINGS).join(" / "));
   }
@@ -1217,7 +1218,7 @@ function verifyIdentityAssertion(assertion, publicKeyPem, opts) {
     return _fail("public-key-required");
   }
   var sp = assertion.signer_payload;
-  if (!sp || typeof sp !== "object" || typeof sp.binding !== "string" || !IDENTITY_BINDINGS[sp.binding] ||
+  if (!sp || typeof sp !== "object" || typeof sp.binding !== "string" || !Object.prototype.hasOwnProperty.call(IDENTITY_BINDINGS, sp.binding) ||
       !Array.isArray(sp.referenced_assertions)) {
     return _fail("signer-payload-shape");
   }
@@ -1334,9 +1335,10 @@ function _verifyIdentityX509Chain(certChainPem, trustAnchorsPem) {
   // only direct-root / self-signed leaves.
   for (var li = 0; li < certs.length - 1; li += 1) {
     var child = certs[li], parent = certs[li + 1];
-    var linked = false;
-    try { linked = child.checkIssued(parent) && child.verify(parent.publicKey); }
-    catch (_eLink) { linked = false; }
+    // issuerValidlyIssued enforces basicConstraints cA:TRUE on the parent in
+    // addition to the issuance + signature linkage — a non-CA cert cannot be
+    // an intermediate issuer (basicConstraints bypass, CVE-2002-0862 class).
+    var linked = x509Chain.issuerValidlyIssued(parent, child);
     if (!linked) { return { ok: false, reason: "broken-chain" }; }
   }
   // The top of the presented chain must chain to (or BE) a trust anchor.
@@ -1347,8 +1349,9 @@ function _verifyIdentityX509Chain(certChainPem, trustAnchorsPem) {
     if (top.fingerprint256 === anchor.fingerprint256) {
       chained = true;   // top of the chain IS the anchor (root-in-chain or self-signed leaf == anchor)
     } else {
-      try { chained = top.checkIssued(anchor) && top.verify(anchor.publicKey); }
-      catch (_eChk) { chained = false; }
+      // issuerValidlyIssued enforces basicConstraints cA:TRUE on the anchor
+      // in addition to issuance + signature (basicConstraints bypass class).
+      chained = x509Chain.issuerValidlyIssued(anchor, top);
     }
     if (chained) {
       if (now < anchor.validFromDate.getTime() || now > anchor.validToDate.getTime()) {
@@ -1427,7 +1430,7 @@ function cacImplicitLabel(opts) {
     throw new ContentCredentialsError("cac-implicit-label/bad-content-id",
       "cacImplicitLabel: contentId must match [A-Za-z0-9._:/-]");
   }
-  if (typeof opts.contentKind !== "string" || !CAC_KIND_ENUM[opts.contentKind]) {
+  if (typeof opts.contentKind !== "string" || !Object.prototype.hasOwnProperty.call(CAC_KIND_ENUM, opts.contentKind)) {
     throw new ContentCredentialsError("cac-implicit-label/bad-content-kind",
       "cacImplicitLabel: contentKind must be one of " +
       Object.keys(CAC_KIND_ENUM).join("/"));

package/lib/content-digest.js

@@ -29,6 +29,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var structuredFields = require("./structured-fields");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -59,12 +60,12 @@ function _strictBase64(s, what) {
   return buf;
 }
 
-function _bodyBytes(body, what) {
-  if (Buffer.isBuffer(body)) return body;
-  if (body instanceof Uint8Array) return Buffer.from(body);
-  if (typeof body === "string") return Buffer.from(body, "utf8");
-  throw new ContentDigestError("content-digest/bad-body", "contentDigest: " + what + " must be a Buffer / Uint8Array / string");
-}
+var _bodyBytes = safeBuffer.makeByteCoercer({
+  errorClass:    ContentDigestError,
+  typeCode:      "content-digest/bad-body",
+  messagePrefix: "contentDigest: ",
+  messageSuffix: " must be a Buffer / Uint8Array / string",
+});
 
 /**
  * @primitive b.contentDigest.create
@@ -98,9 +99,12 @@ function create(body, opts) {
   if (!Array.isArray(algos) || algos.length === 0) throw new ContentDigestError("content-digest/bad-arg", "contentDigest.create: opts.algorithms must be a non-empty array");
   var members = algos.map(function (a) {
     var name = String(a).toLowerCase();
-    var nodeAlg = ACTIVE[name];
+    // hasOwnProperty: the algorithm name is operator/caller input; a bracket
+    // lookup lets "constructor"/"toString" inherit a truthy value off the
+    // prototype and pass the support check (proto shadowing).
+    var nodeAlg = Object.prototype.hasOwnProperty.call(ACTIVE, name) ? ACTIVE[name] : undefined;
     if (!nodeAlg) {
-      if (DEPRECATED[name]) throw new ContentDigestError("content-digest/insecure-algorithm", "contentDigest.create: '" + name + "' is a deprecated/insecure digest algorithm (RFC 9530 §6); use sha-256 or sha-512");
+      if (Object.prototype.hasOwnProperty.call(DEPRECATED, name)) throw new ContentDigestError("content-digest/insecure-algorithm", "contentDigest.create: '" + name + "' is a deprecated/insecure digest algorithm (RFC 9530 §6); use sha-256 or sha-512");
       throw new ContentDigestError("content-digest/unsupported-algorithm", "contentDigest.create: unsupported digest algorithm '" + name + "'");
     }
     var digest = nodeCrypto.createHash(nodeAlg).update(bytes).digest("base64");
@@ -150,10 +154,15 @@ function verify(fieldValue, body, opts) {
     if (m === "") continue;
     var eq = m.indexOf("=");
     if (eq < 1) throw new ContentDigestError("content-digest/bad-field", "contentDigest.verify: malformed dictionary member");
-    var name = m.slice(0, eq).trim().toLowerCase();
-    var raw = m.slice(eq + 1).trim();
+    var kvp = structuredFields.parseKeyValuePiece(m);
+    var name = kvp.key;
+    var raw = kvp.value.trim();
+    // hasOwnProperty: `name` is the algorithm token from the untrusted inbound
+    // Content-Digest header; a bracket lookup lets "constructor"/"__proto__"
+    // inherit a truthy value off the prototype and reach createHash (proto
+    // shadowing).
+    if (!Object.prototype.hasOwnProperty.call(ACTIVE, name)) continue;  // ignore legacy / unknown entries
     var nodeAlg = ACTIVE[name];
-    if (!nodeAlg) continue;                                  // ignore legacy / unknown entries
     if (raw.length < 2 || raw.charAt(0) !== ":" || raw.charAt(raw.length - 1) !== ":") {
       throw new ContentDigestError("content-digest/bad-field", "contentDigest.verify: '" + name + "' value is not an RFC 8941 byte sequence (:base64:)");
     }
@@ -170,7 +179,7 @@ function verify(fieldValue, body, opts) {
     if (!Array.isArray(opts.required)) throw new ContentDigestError("content-digest/bad-arg", "contentDigest.verify: opts.required must be an array");
     for (var r = 0; r < opts.required.length; r++) {
       var req = String(opts.required[r]).toLowerCase();
-      if (!ACTIVE[req]) throw new ContentDigestError("content-digest/unsupported-algorithm", "contentDigest.verify: required algorithm '" + req + "' is not a modern digest");
+      if (!Object.prototype.hasOwnProperty.call(ACTIVE, req)) throw new ContentDigestError("content-digest/unsupported-algorithm", "contentDigest.verify: required algorithm '" + req + "' is not a modern digest");
       if (!seen[req]) throw new ContentDigestError("content-digest/missing-algorithm", "contentDigest.verify: required digest '" + req + "' is not present");
     }
   }

package/lib/cookies.js

@@ -48,6 +48,7 @@
  */
 
 var C = require("./constants");
+var structuredFields = require("./structured-fields");
 var validateOpts = require("./validate-opts");
 var { FrameworkError } = require("./framework-error");
 
@@ -95,7 +96,11 @@ function _validateValue(value) {
   // Length cap before the regex test (defense in depth — the regex
   // here is a simple character class, but the same discipline that
   // bounds longer regexes elsewhere applies).
-  if (value.length > MAX_VALUE_LENGTH || FORBIDDEN_VALUE_RE.test(value)) {
+  // Byte length, not value.length (UTF-16 code units): the cap bounds the
+  // on-the-wire Set-Cookie size, and a multibyte value is 2-4x larger in bytes
+  // than chars, so a char-count check under-enforces and a 4096-char value can
+  // emit a ~12 KiB+ header.
+  if (Buffer.byteLength(value, "utf8") > MAX_VALUE_LENGTH || FORBIDDEN_VALUE_RE.test(value)) {
     throw new CookieError("cookies/invalid-value",
       "cookie value is too long or contains forbidden control character (CRLF/NUL/;/,)");
   }
@@ -107,7 +112,11 @@ function _validateValue(value) {
 // header — never trust unscrubbed values reach the wire.
 function _scrubAttr(s) {
   if (typeof s !== "string") return s;
-  return s.replace(/[\r\n\0]/g, "");                                             // allow:duplicate-regex — CR/LF/NUL header-injection rejection appears in cookies / mail / security-headers; each is the boundary primitive for its domain
+  // `;` joins Set-Cookie attributes, so an unscrubbed `;` in Path/SameSite is
+  // attribute injection (e.g. Path=/x; HttpOnly). Domain is regex-validated
+  // upstream; Path/SameSite only flow through here, so strip `;` alongside the
+  // CR/LF/NUL header-injection set.
+  return s.replace(/[\r\n\0;]/g, "");                                            // allow:duplicate-regex — CR/LF/NUL(+;) header-injection rejection appears in cookies / mail / security-headers; each is the boundary primitive for its domain
 
 }
 
@@ -143,9 +152,7 @@ function parse(cookieHeader) {
     if (!k) continue;
     var v = pair.slice(eq + 1).trim();
     // Strip surrounding double-quotes per RFC 6265 §5.2.
-    if (v.length >= 2 && v.charAt(0) === '"' && v.charAt(v.length - 1) === '"') {
-      v = v.slice(1, -1);
-    }
+    v = structuredFields.stripDoubleQuotes(v);
     try { v = decodeURIComponent(v); }
     catch (_e) { /* malformed encoding — keep raw */ }
     // Last write wins per RFC; matches every browser's behavior.
@@ -386,10 +393,8 @@ function create(opts) {
   }
 
   function _requireVault() {
-    if (!vault || typeof vault.seal !== "function" || typeof vault.unseal !== "function") {
-      throw new CookieError("cookies/no-vault",
-        "sealed cookies require opts.vault (a value with .seal/.unseal)");
-    }
+    validateOpts.requireMethods(vault, ["seal", "unseal"],
+      "sealed cookies: opts.vault", CookieError, "cookies/no-vault");
   }
 
   // Vault.seal returns "vault:<base64>". We strip the constant prefix
@@ -515,10 +520,7 @@ function parseSafe(cookieHeader, opts) {
       });
       continue;
     }
-    var v = pair.slice(eq + 1).trim();
-    if (v.length >= 2 && v.charAt(0) === '"' && v.charAt(v.length - 1) === '"') {
-      v = v.slice(1, -1);
-    }
+    var v = structuredFields.stripDoubleQuotes(pair.slice(eq + 1).trim());
     try { v = decodeURIComponent(v); }
     catch (_e) { /* malformed encoding — keep raw */ }