@blamejs/core 0.18.53 → 0.18.54

package/lib/guard-filename.js

@@ -253,15 +253,13 @@ function _foldSuperscriptDigits(s) {
 // A `..` segment: the whole name, or bounded by path separators on both sides.
 // Bounded, not merely present — `..foo` and `a..b` are ordinary names.
 function _hasTraversalSegment(name) {
-  for (var i = 0; i + 1 < name.length; i += 1) {
-    if (name.charAt(i) !== "." || name.charAt(i + 1) !== ".") continue;
+  return codepointClass.hasPairWhere(name, ".", ".", function (i) {
     var beforeOk = i === 0 ||
       PATH_SEPARATORS.indexOf(name.charAt(i - 1)) !== -1;
     var afterOk = i + 2 === name.length ||
       PATH_SEPARATORS.indexOf(name.charAt(i + 2)) !== -1;
-    if (beforeOk && afterOk) return true;
-  }
-  return false;
+    return beforeOk && afterOk;
+  });
 }
 
 function _hasAnyFolded(name, needles) {
@@ -280,17 +278,13 @@ function _hasUncPrefix(name) {
 
 // An NTFS alternate-data-stream suffix: a colon followed by a run with no
 // further colon and no separator in it, at the very end of the name.
-// One wording for every path that refuses a stream-suffixed name. A caller who
-// set `adsPolicy: "allow"` can arrive at any of them — sanitize in either mode,
-// validate, or gate — and each has to answer the same question, or the option
-// reads as broken from whichever door they happened to use. Saying it in one
-// place and only one is how three of the four ended up silent the first time.
-//
-// `verifyExtractionPath` is deliberately absent: it is the one entry point that
-// HONOURS the option, so it never reaches this text.
-var ADS_SCOPE_NOTE = "always refused here; adsPolicy \"allow\" applies only " +
-  "to verifyExtractionPath";
-var ADS_SNIPPET = "NTFS alternate data stream syntax (name:stream) — " + ADS_SCOPE_NOTE;
+// One wording for every path that refuses a stream-suffixed name — sanitize in
+// either mode, validate, gate, verifyExtractionPath — so a caller meets the same
+// answer whichever door they arrive at, and the way out is named where they are
+// standing rather than somewhere else in the documentation.
+var ADS_SNIPPET = "NTFS alternate data stream syntax (name:stream); set " +
+  "adsPolicy \"allow\" when the target filesystem is not NTFS and a colon is " +
+  "an ordinary filename character there";
 var ADS_MESSAGE = "filename contains " + ADS_SNIPPET;
 
 function _hasAdsSuffix(name) {
@@ -474,9 +468,11 @@ function _detectIssues(input, opts) {
 
   // 6. NTFS alternate data streams — `name:stream`. Unconditional: a write to
   // `name:stream` lands on a hidden stream of the base file rather than the
-  // file the caller named, which no policy value makes safe.
+  // file the caller named — on Windows. On the Linux targets `adsPolicy`
+  // exists for, a colon is an ordinary filename character, so the operator
+  // holds the switch and the finding is suppressed when they set it.
   {
-    if (_hasAdsSuffix(name) && name.charAt(0) !== "/") {
+    if (opts.adsPolicy !== "allow" && _hasAdsSuffix(name) && name.charAt(0) !== "/") {
       // Only flag when there's a `:` followed by stream-name characters
       // and we're NOT at the start (relative path indicator).
       issues.push({
@@ -673,17 +669,21 @@ function _sanitize(input, opts) {
     name = "_" + name;
   }
 
-  // ADS detection. Not gated on `adsPolicy`, and the message says so: a
-  // stream-suffixed name is one of the shapes a filename guard always refuses,
-  // because on Windows the write lands on a hidden stream of the base file
-  // rather than on a file anyone can see. `adsPolicy` still takes "allow", for
-  // `verifyExtractionPath` alone, where an operator may be deliberately
-  // extracting stream-suffixed entries to a root they chose.
+  // ADS detection. On Windows a `name:stream` write lands on a hidden stream of
+  // the base file rather than on a file anyone can see, so this is refused by
+  // default in every profile.
+  //
+  // It is an opt-out rather than an absolute, because the check is lexical and
+  // a colon is an ordinary filename character on the Linux targets these
+  // policies exist for: `12:30 notes.txt` has the same shape as an attack and
+  // is a timestamped note (#623). Only the operator knows which filesystem the
+  // name will be written to, which is why they get the switch.
   //
-  // The scope is in the message because it is invisible from the call site: a
-  // caller who sets "allow" here gets a refusal that, without it, never
-  // mentions the setting they changed and so reads as the option being broken.
-  if (_hasAdsSuffix(name)) {
+  // An earlier attempt refused regardless and put the scope in the message,
+  // which reads as a considered boundary right up until a caller has set every
+  // documented opt-out and still cannot store the file. An option that is
+  // accepted and documented as opting out must opt out.
+  if (opts.adsPolicy !== "allow" && _hasAdsSuffix(name)) {
     throw _err("filename.ntfs-ads", ADS_MESSAGE);
   }
 
@@ -735,9 +735,10 @@ function _sanitize(input, opts) {
  *                                                        //   than refusing is safe
  *   reservedCharPolicy:   "reject"|"strip"|"allow",
  *   reservedNamePolicy:   "reject"|"audit"|"allow",
- *   adsPolicy:            "reject"|"allow",               // reject here; "allow"
- *                                                         //   is honoured only
- *                                                         //   by verifyExtractionPath
+ *   adsPolicy:            "reject"|"allow",               // "allow" when the target
+ *                                                         //   filesystem is not NTFS
+ *                                                         //   and a colon is ordinary
+ *                                                         //   there (Linux, macOS)
  *   leadingTrailingPolicy: "reject"|"strip"|"allow",
  *   shellExecExtPolicy:   "reject"|"audit"|"allow",
  *   pathSeparatorsPolicy: "reject"|"audit"|"allow",
@@ -817,7 +818,7 @@ function _sanitizeStripMode(input, opts) {
   if (_hasUncPrefix(name)) {
     throw _err("filename.unc", "UNC path syntax");
   }
-  if (_hasAdsSuffix(name) && name.charAt(0) !== "/") {
+  if (opts.adsPolicy !== "allow" && _hasAdsSuffix(name) && name.charAt(0) !== "/") {
     throw _err("filename.ntfs-ads", ADS_MESSAGE);
   }
   if (Buffer.byteLength(name, "utf8") > opts.maxBytes) {

package/lib/guard-managesieve-command.js

@@ -102,6 +102,7 @@
  *   under strict (RFC 4954 §4 class), validates per-verb shape.
  */
 
+var C = require("./constants");
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
 var codepointClass = require("./codepoint-class");
@@ -112,6 +113,12 @@ var GuardManageSieveCommandError = defineClass("GuardManageSieveCommandError",
 
 var DEFAULT_PROFILE = "strict";
 
+// A SASL token — the AUTHENTICATE initial response and every later response in
+// a multi-step exchange. Bounded far below the script cap because it is a
+// base64 blob of credentials, not a script body, and because the client
+// declaring its size is by definition not yet authenticated.
+var MAX_SASL_TOKEN_BYTES = C.BYTES.kib(4);
+
 var PROFILES = Object.freeze({
   strict: {
     maxLineBytes:        8192,                                                                          // 8 KiB per-line cap (strict)
@@ -339,13 +346,15 @@ function _validateAuthenticate(rest, caps, profileName, opts) {
         throw new GuardManageSieveCommandError("guard-managesieve-command/literal-plus-refused",
           "guardManageSieveCommand.validate: LITERAL+ refused under profile '" + profileName + "'");
       }
-      // Base64-initial-response cap: bound by the script-name cap
-      // (initial-response is a SASL token, not a script body; 4 KiB
-      // is generous).
-      if (n > 4096) {                                                                                   // 4 KiB SASL initial-response cap
+      // A SASL token, not a script body, so it is bounded well below the
+      // script cap. The same number bounds the client's LATER responses in a
+      // multi-step exchange (b.mail.server.managesieve reads it from
+      // MAX_SASL_TOKEN_BYTES): one exchange, one bound, whichever round the
+      // token arrives on and whichever representation it uses.
+      if (n > MAX_SASL_TOKEN_BYTES) {
         throw new GuardManageSieveCommandError("guard-managesieve-command/literal-too-large",
           "guardManageSieveCommand.validate: AUTHENTICATE initial-response " +
-          n + " bytes exceeds 4096-byte cap");
+          n + " bytes exceeds " + MAX_SASL_TOKEN_BYTES + "-byte cap");
       }
       literalBytes = n;
       literalPlus  = isPlus;
@@ -478,10 +487,34 @@ function _validateRenamescript(rest, caps) {
   return { verb: "RENAMESCRIPT", args: [first.value, second.value] };
 }
 
-// _parseQuotedString — extract a leading `"..."` quoted string from
-// `s` and return `{ value, rest }`, where `rest` is whitespace-trimmed.
-// Returns null if `s` does not begin with a DQUOTE. RFC 5804 §1.2
-// quoted strings allow UTF-8 content and `\"` / `\\` escape sequences.
+/**
+ * @primitive  b.guardManageSieveCommand.parseQuotedString
+ * @signature  b.guardManageSieveCommand.parseQuotedString(s)
+ * @since      0.18.54
+ * @status     stable
+ * @related    b.guardManageSieveCommand.validate, b.mail.server.managesieve.create
+ *
+ * Read a leading RFC 5804 §1.2 quoted string off `s` and return
+ * `{ value, rest }`, where `value` is the unescaped content and `rest` is
+ * what follows with leading whitespace removed. Returns `null` when `s` does
+ * not begin with a double quote.
+ *
+ * The production honours the `\"` and `\\` escapes, and refuses NUL, CR and
+ * LF inside the quotes: those end a line-oriented protocol record, so a
+ * string carrying one would split the command it appears in.
+ *
+ * Exposed because a `string` also arrives outside a command, as the client's
+ * reply to a SASL challenge. That line never reaches `validate`, and a second
+ * hand-rolled unquoting there would be free to lose the escape handling and
+ * the control-byte refusal this one has. `b.mail.server.managesieve` reads
+ * its SASL responses through this.
+ *
+ * @example
+ *   b.guardManageSieveCommand.parseQuotedString('"PLAIN" {12+}');
+ *   // → { value: "PLAIN", rest: "{12+}" }
+ *   b.guardManageSieveCommand.parseQuotedString("PLAIN");
+ *   // → null
+ */
 function _parseQuotedString(s) {
   if (s.length === 0 || s.charCodeAt(0) !== 0x22) return null;                                          // DQUOTE
   var out = "";
@@ -572,5 +605,12 @@ module.exports = gateContract.defineParser({
   extra: {
     KNOWN_VERBS:    KNOWN_VERBS,
     ZERO_ARG_VERBS: ZERO_ARG_VERBS,
+    MAX_SASL_TOKEN_BYTES: MAX_SASL_TOKEN_BYTES,
+    // The RFC 5804 §1.2 "string" production. The listener needs it for the
+    // client's reply to a SASL challenge, which arrives as a bare string on its
+    // own line rather than as a command argument — so it never reaches
+    // validate(), and hand-rolling a second dquote-strip there would drop this
+    // one's escape handling and its refusal of NUL / CR / LF inside the quotes.
+    parseQuotedString: _parseQuotedString,
   },
 });

package/lib/guard-regex.js

@@ -454,8 +454,7 @@ function _scanBraces(src, at) {
 // running the construct it screens over operator-supplied text, which is the
 // shape this module exists to keep away from.
 function _turnsFoldingOn(src) {
-  for (var i = 0; i + 2 < src.length; i += 1) {
-    if (src.charAt(i) !== "(" || src.charAt(i + 1) !== "?") continue;
+  return codepointClass.hasPairWhere(src, "(", "?", function (i) {
     var at = i + 2;
     var enablesFold = false;
     while (at < src.length && _isFlagLetter(src.charAt(at))) {
@@ -466,9 +465,8 @@ function _turnsFoldingOn(src) {
       at += 1;
       while (at < src.length && _isFlagLetter(src.charAt(at))) at += 1;
     }
-    if (enablesFold && src.charAt(at) === ":") return true;
-  }
-  return false;
+    return enablesFold && src.charAt(at) === ":";
+  });
 }
 
 function _parsePattern(src, flags, budget) {

package/lib/guard-yaml.js

@@ -179,17 +179,33 @@ function _hasLeadingZeroOctal(text) {
 
 // A merge key with an anchor reference — `<<` then optional whitespace, `:`,
 // optional whitespace, `*`.
-function _hasMergeKeyAlias(text) {
-  for (var i = 0; i + 1 < text.length; i += 1) {
-    if (text.charAt(i) !== "<" || text.charAt(i + 1) !== "<") continue;
+// A merge key is `<<: *anchor` — a mapping key, so a structural question, and
+// asked of the lexer rather than of the source.
+//
+// The test is whether a NODE can begin at the `<<`, not whether what follows is
+// well-formed: `<<:*d` with no space after the colon is not a mapping entry and
+// is reported anyway, because that is the shape being smuggled past a parser
+// variant that reads it as a merge. A node cannot begin inside a comment, a
+// quoted body, a block scalar's body, or a plain scalar's continuation line, so
+// one question covers all of them.
+//
+// Enumerating those regions instead was tried and is the wrong shape. Without
+// any of this, `<<: *base` written inside a block scalar — a line of someone's
+// shell script — was reported as a merge key; excluding block bodies and quoted
+// bodies then still reported one written in a comment, on a continuation line,
+// and after a document marker. Same root as the duplicate-key screen (#642): a
+// structural rule reading raw source, and a fix that lists regions is the same
+// mistake with a longer list.
+function _hasMergeKeyAlias(text, nodeStarts) {
+  return codepointClass.hasPairWhere(text, "<", "<", function (i) {
+    if (nodeStarts && !nodeStarts[i]) return false;
     var j = i + 2;
     while (j < text.length && _isSpace(text.charCodeAt(j))) j += 1;
-    if (text.charAt(j) !== ":") continue;
+    if (text.charAt(j) !== ":") return false;
     j += 1;
     while (j < text.length && _isSpace(text.charCodeAt(j))) j += 1;
-    if (text.charAt(j) === "*") return true;
-  }
-  return false;
+    return text.charAt(j) === "*";
+  });
 }
 
 // ---- Profile presets ----
@@ -368,11 +384,18 @@ function _detectIssues(input, opts) {
   // refused. The mask is index-aligned with the source and the same length, so
   // every location and line number reported below is still the source's.
   //
-  // Only the three sigil scans use it. The value-shaped detectors further down
-  // (the Norway problem, leading zeros, merge keys) are asking about scalar
-  // CONTENT, which is exactly what the mask removes, so they keep reading the
-  // source.
-  var masked = yamlLex.maskNonStructural(input);
+  // Every STRUCTURAL screen uses it: the three sigil scans, the duplicate-key
+  // scan, and the merge key. The value-shaped detectors (the Norway problem,
+  // leading zeros) are asking about scalar CONTENT, which is exactly what the
+  // mask removes, so those keep reading the source.
+  //
+  // Merge keys were on the wrong side of that line, listed with the
+  // value-shaped ones: `<<:` is a mapping key, and reading it from the source
+  // reported one written inside a block scalar. The test is not what the rule
+  // is looking for but what kind of question it asks — "is this a mapping
+  // entry?" is structure however scalar-shaped the token looks.
+  var lexed = yamlLex.lexLines(input);
+  var masked = lexed.masked;
 
   // 1. Tag-injection scan.
   var tagHits = _scanTags(masked);
@@ -488,7 +511,8 @@ function _detectIssues(input, opts) {
   }
 
   // 6. Merge-key chain depth.
-  if (opts.mergeKeyPolicy !== "allow" && _hasMergeKeyAlias(input)) {
+  if (opts.mergeKeyPolicy !== "allow" &&
+      _hasMergeKeyAlias(input, lexed.nodeStarts)) {
     issues.push({
       kind: "merge-key",
       severity: opts.mergeKeyPolicy === "reject" ? "high" : "warn",
@@ -537,12 +561,25 @@ function _detectIssues(input, opts) {
 // FIRST colon that is followed by whitespace or ends the line, which is where
 // a value begins — a colon inside the key (a timestamp, a URL) does not end
 // it unless whitespace follows.
-function _mappingEntryAt(line) {
+// `masked` is the same line with every non-structural region blanked by
+// yaml-lex. It decides WHICH colons are mapping separators; the raw line
+// supplies the key text, because the mask blanks that too.
+//
+// Without it, a colon inside a block scalar's body or a quoted value read as a
+// mapping entry, and two such lines inside one scalar were reported as a
+// duplicate key (#642). That is the same root as #631/#632 — a screen deciding
+// structure by reading the source — which survived here because only the sigil
+// scans were moved onto the mask.
+function _mappingEntryAt(line, masked) {
   var indent = 0;
   while (indent < line.length && _isSpace(line.charCodeAt(indent))) indent += 1;
   if (indent === line.length) return null;
   for (var i = indent; i < line.length; i += 1) {
     if (line.charAt(i) !== ":") continue;
+    // Structural only: the mask keeps a mapping separator and blanks a colon
+    // that is part of a scalar. Absent a mask, every colon counts, which is the
+    // pre-#642 behaviour and is what the non-masked callers still want.
+    if (masked !== undefined && masked.charAt(i) !== ":") continue;
     var after = line.charCodeAt(i + 1);
     if (i + 1 < line.length && !_isSpace(after)) continue;
     if (i === indent) return null;                                     // no key before the colon
@@ -581,6 +618,10 @@ var _splitLines = codepointClass.splitLines;
 function _detectDuplicateKeysYaml(text) {
   var dups = Object.create(null);
   var lines = _splitLines(text);
+  // Whether a line carries a mapping entry is a STRUCTURAL question, so it is
+  // asked of the lexer's mask rather than of the source. Split the same way, so
+  // line i of one is line i of the other.
+  var maskedLines = _splitLines(yamlLex.maskNonStructural(text));
   var indentScopes = Object.create(null);
   // The sequence items currently open, outermost first, each with the column
   // its first key sat in. Every key of an item at its top level is filed under
@@ -632,7 +673,11 @@ function _detectDuplicateKeysYaml(text) {
       // keyIndent is set by this item's first key, wherever it is written.
       itemStack.push({ dash: dashAt, keyIndent: -1 });
     }
-    var entry = _mappingEntryAt(line);
+    // Passed straight through, with no `|| ""` fallback: an empty mask line
+    // blanks every colon, so a missing one would exempt the line from the screen
+    // altogether. `undefined` means "no mask" instead, which counts every colon
+    // — over-reporting rather than under-reporting if the two ever desynchronise.
+    var entry = _mappingEntryAt(line, maskedLines[i]);
     if (!entry) continue;
     var indent = entry.indent;
     var key = entry.key.trim();

package/lib/mail-agent.js

@@ -539,19 +539,33 @@ async function _expunge(ctx, args) {
       "agent.expunge: { folder, objectIds, [candidateTtlMs] } required");
   }
 
-  // Look up the regulator-mandated retention floor for the operator's
-  // active posture. For expunge semantics, the floor IS the minimum
-  // TTL — messages younger than the floor MUST NOT be hard-deleted,
-  // even on operator request. Distinct from `b.retention.
-  // complianceFloor(posture, candidateTtl)` which composes the
-  // candidate TTL into a max — that primitive's "candidate must be
-  // positive" contract doesn't apply here because expunge means TTL=0.
-  // Read the floor table directly.
+  // Look up the regulator-mandated retention floor for the operator's active
+  // posture. For expunge semantics the floor IS the minimum TTL — messages
+  // younger than it MUST NOT be hard-deleted, even on operator request.
+  //
+  // Through b.retention.complianceFloor, not the floor table it wraps. The
+  // direct read fell back to zero for anything the table did not contain, so a
+  // misspelled posture, a capitalised one ("HIPAA"), or one the table simply
+  // does not carry all permitted an unbounded hard delete with no error — a
+  // typo refused where retention windows are computed and accepted at the one
+  // call that destroys mail permanently. It also read through the prototype:
+  // posture "constructor" returned a function, which is truthy, so the `|| 0`
+  // fallback kept it and every age comparison against it was nonsense.
+  //
+  // No posture at all is a legitimate configuration and keeps the zero floor.
+  // A posture that was supplied and is not understood now throws.
   var retentionModule = require("./retention");                                                    // allow:inline-require — lazy-load until first expunge call
   var posture = (ctx && ctx.posture) || (args && args.posture) || null;
   var floorMs = 0;
   if (typeof posture === "string" && posture.length > 0) {
-    floorMs = retentionModule.COMPLIANCE_RETENTION_FLOOR_MS[posture] || 0;
+    try {
+      floorMs = retentionModule.complianceFloor(posture);
+    } catch (e) {
+      throw new MailAgentError("mail-agent/unknown-posture",
+        "expunge: posture '" + posture + "' is not a posture the framework knows, " +
+        "so no retention floor can be established and the hard delete is refused " +
+        "rather than run unbounded: " + ((e && e.message) || String(e)));
+    }
   }
 
   // Read message metadata BEFORE invoking hardExpunge so the per-id

package/lib/mail-arc-sign.js

@@ -128,7 +128,12 @@ function _bodyHashB64(body, algorithm) {
   var canonical = _canonRelaxedBody(body);
   // RFC 6376 §3.4.4 — empty body canon is `\r\n` (one CRLF). Hash
   // includes that CRLF.
-  return nodeCrypto.createHash(hashAlgo).update(canonical).digest("base64");
+  //
+  // latin1, for the reason DKIM uses it: ARC seals a message the same way DKIM
+  // signs one, over the OCTETS on the wire. `update(string)` defaults to UTF-8,
+  // which re-encodes every high byte and seals a body that is not the one the
+  // message carries.
+  return nodeCrypto.createHash(hashAlgo).update(canonical, "latin1").digest("base64");
 }
 
 // RFC 8617 §5 — ARC chains MUST NOT exceed 50 hops. The verifier
@@ -182,8 +187,27 @@ function sign(opts) {
     "headersToSign", "timestamp", "audit", "excludeAarFromAms",
   ], "mail.arc.sign");
 
-  validateOpts.requireNonEmptyString(opts.rfc822, "sign: rfc822",
-    MailAuthError, "arc-sign/bad-input");
+  // A seal covers the OCTETS on the wire, so a caller holding them seals them
+  // rather than a UTF-8 decode of them. One code unit per octet from here down.
+  //
+  // Through `dkim._toWire`, which is the SAME function the DKIM signer uses.
+  // Converting the Buffer here by hand and leaving a string untouched was the
+  // first version, and it left every non-ASCII string message signed over the
+  // low byte of each code unit: the hashing and signing paths below read a
+  // string as latin1 octets, so a message that is not already ASCII has to be
+  // put into that form before it reaches them, not after. Two functions
+  // answering "which bytes is this message" is how they come to disagree.
+  var gaveBuffer = Buffer.isBuffer(opts.rfc822);
+  if (gaveBuffer) {
+    if (opts.rfc822.length === 0) {
+      throw new MailAuthError("arc-sign/bad-input",
+        "sign: rfc822 must be a non-empty Buffer or string");
+    }
+  } else {
+    validateOpts.requireNonEmptyString(opts.rfc822, "sign: rfc822",
+      MailAuthError, "arc-sign/bad-input");
+  }
+  opts = Object.assign({}, opts, { rfc822: dkim._toWire(opts.rfc822) });
   if (typeof opts.instance !== "number" || !isFinite(opts.instance) ||
       opts.instance < 1 || opts.instance > 50 ||                                        // RFC 8617 §5 chain bound
       Math.floor(opts.instance) !== opts.instance) {
@@ -387,7 +411,14 @@ function sign(opts) {
     "ARC-Seal: " + asValue + "\r\n" +
     "ARC-Message-Signature: " + amsValue + "\r\n" +
     "ARC-Authentication-Results: " + aarValue + "\r\n";
-  var sealedRfc822 = prependedHeaders + opts.rfc822;
+  // Returned in the shape it arrived in, so a caller relaying the sealed
+  // message relays the octets they handed over. See the same note in
+  // lib/mail-dkim.js sign(): a string caller gets their own string back, which
+  // is the UTF-8 decode of the wire form rather than the wire form itself.
+  var sealedWire = prependedHeaders + opts.rfc822;
+  var sealedRfc822 = gaveBuffer
+    ? Buffer.from(sealedWire, "latin1")
+    : Buffer.from(sealedWire, "latin1").toString("utf8");
 
   if (auditOn) {
     try {
@@ -418,15 +449,17 @@ function sign(opts) {
 }
 
 function _signOne(canonInput, keyObject, algorithm) {
+  // The canonicalized header octets, one code unit per octet — same boundary as
+  // the body hash above and as DKIM's.
+  var toSign = Buffer.from(canonInput, "latin1");
   if (algorithm === "ed25519-sha256") {
     // Ed25519 prehash variant — Node's `crypto.sign(null, msg, key)`
     // accepts the message directly.
-    return nodeCrypto.sign(null, Buffer.from(canonInput, "utf8"), keyObject)
-      .toString("base64");
+    return nodeCrypto.sign(null, toSign, keyObject).toString("base64");
   }
   // RSA-SHA256 / default — createSign + update + sign.
   var signer = nodeCrypto.createSign("RSA-SHA256");
-  signer.update(canonInput);
+  signer.update(toSign);
   return signer.sign(keyObject).toString("base64");
 }