@blamejs/blamejs-shop 0.1.37 → 0.2.0

package/lib/vendor/blamejs/lib/mail-server-mx.js

@@ -25,7 +25,7 @@
  *
  *   ## Defenses baked in
  *
- *   - **SMTP smuggling** (CVE-2023-51764 / CVE-2024-32178) — every
+ *   - **SMTP smuggling** (CVE-2023-51764 Postfix / CVE-2023-51765 Sendmail / CVE-2023-51766 Exim) — every
  *     wire line passes through `b.guardSmtpCommand.validate` which
  *     refuses bare LF, bare CR, NUL, C0 controls, DEL, and oversize.
  *     The DATA body's `\r\n.\r\n` terminator is matched on canonical
@@ -67,9 +67,11 @@
  *
  *   - `mail.server.mx.connect`           — IP, TLS state, FCrDNS hostname
  *   - `mail.server.mx.helo`              — HELO greeting, helo-gate verdict
- *   - `mail.server.mx.mail_from`         — sender, SPF verdict, alignment verdict
- *   - `mail.server.mx.rcpt_to`           — recipient, RBL verdict, greylist verdict
- *   - `mail.server.mx.data_accepted`     — message size, DKIM verdict, DMARC verdict
+ *   - `mail.server.mx.helo_gate_refused` — HELO identity refused (gate action)
+ *   - `mail.server.mx.mail_from`         — sender address
+ *   - `mail.server.mx.rcpt_to`           — recipient, rblListed flag, greylist action
+ *   - `mail.server.mx.rbl_refused`       — connecting IP on a DNS blocklist (zones)
+ *   - `mail.server.mx.greylist_deferred` — (ip, from, rcpt) first-seen 450 deferral
  *   - `mail.server.mx.data_refused`      — refusal reason + SMTP code (5xx vs 4xx)
  *   - `mail.server.mx.delivered`         — agent.handoff ack
  *   - `mail.server.mx.tls_handshake_failed` — handshake error
@@ -100,19 +102,30 @@
  *
  *   Every gate is a primitive that already exists. The MX slice is a
  *   state-machine + wire-protocol coordinator — no new crypto, no
- *   new parsing, no new RFC-layer primitives. If a gate isn't ready
- *   (e.g. operator hasn't wired `b.mail.auth.dmarc`), the listener
- *   skips that phase with an audit note rather than synthesizing a
- *   verdict.
+ *   new parsing, no new RFC-layer primitives. When the operator
+ *   doesn't wire a gate (e.g. omits `opts.greylist`), the listener
+ *   skips that phase rather than synthesizing a verdict.
+ *
+ *   Connection-level gates are wired into the live state machine:
+ *   `opts.helo` (HELO identity) evaluates at HELO/EHLO; `opts.rbl`
+ *   (connecting-IP DNS blocklist, evaluated once per connection) and
+ *   `opts.greylist` ((ip, from, rcpt) first-seen deferral) evaluate at
+ *   RCPT TO and surface their verdicts on the `rcpt_to` event. The
+ *   message-authentication gates (`b.guardEnvelope` SPF/DKIM/DMARC
+ *   alignment) require the inbound SPF + DKIM verification results as
+ *   inputs; that inbound-auth pipeline composes `b.mail.spf` +
+ *   `b.mail.dmarc` + DKIM verification and lands as a follow-up, at
+ *   which point the DATA-phase envelope/DMARC gate wires in. Until
+ *   then operators run those checks on the delivered message via the
+ *   agent handoff.
  *
  * @card
  *   Inbound SMTP / MX listener. RFC 5321 state machine with SMTP-
  *   smuggling defense baked into the wire-protocol layer (RFC 5321
- *   §2.3.8 + CVE-2023-51764 / CVE-2024-32178), open-relay refusal by
+ *   §2.3.8 + CVE-2023-51764 / 51765 / 51766), open-relay refusal by
  *   default, STARTTLS-stripping defense (CVE-2021-38371), and the
- *   framework's mail-gate cascade (HELO / RBL / greylist /
- *   guardEnvelope / DMARC / safeMime / guardEmail) running at the
- *   appropriate phase.
+ *   connection-level gate cascade (HELO identity / RBL / greylist)
+ *   running at the appropriate phase.
  */
 
 var net   = require("node:net");
@@ -149,6 +162,7 @@ var REPLY_221_BYE                = "221";
 var REPLY_250_OK                 = "250";
 var REPLY_354_START_INPUT        = "354";
 var REPLY_421_SERVICE_NOT_AVAIL  = "421";                                                             // allow:raw-byte-literal — SMTP transient code
+var REPLY_450_MAILBOX_BUSY       = "450";                                                             // allow:raw-byte-literal — SMTP transient code (greylist tempfail)
 var REPLY_451_LOCAL_ERROR        = "451";                                                             // allow:raw-byte-literal — SMTP transient code
 var REPLY_452_INSUFFICIENT_STG   = "452";                                                             // allow:raw-byte-literal — SMTP transient code
 var REPLY_500_SYNTAX             = "500";                                                             // allow:raw-byte-literal — SMTP permanent code
@@ -177,11 +191,9 @@ var RE_SIZE      = /SIZE=(\d+)/i;
  * @opts
  *   tlsContext:        TlsContext,      // required — b.network.tls.context() output (no implicit plaintext)
  *   greeting:          string,          // default "blamejs ESMTP" — HELO/EHLO 220-line banner
- *   helo:              b.mail.helo,     // optional gate
- *   rbl:               b.mail.rbl,      // optional gate
- *   greylist:          b.mail.greylist, // optional gate
- *   envelope:          b.guardEnvelope, // optional gate (SPF/DKIM alignment)
- *   dmarc:             b.mail.auth.dmarc,  // optional gate
+ *   helo:              b.mail.helo,            // optional gate — HELO identity (FCrDNS / shape / self-name)
+ *   rbl:               b.mail.rbl.create(…),   // optional gate — DNS blocklist on the connecting IP
+ *   greylist:          b.mail.greylist.create(…), // optional gate — defer first-seen (ip, from, rcpt)
  *   agent:             b.mail.agent,    // optional delivery handoff
  *   relayAllowedFor:   [{ cidr, scope }],  // operator-explicit relay allowlist; default [] = MX-only
  *   localDomains:      [string],        // RCPT TO local-domain allowlist (refuse non-local with 550 5.7.1)
@@ -199,7 +211,6 @@ var RE_SIZE      = /SIZE=(\d+)/i;
  *     helo:         b.mail.helo,
  *     rbl:          b.mail.rbl.create({ providers: ["zen.spamhaus.org"] }),
  *     greylist:     b.mail.greylist.create({ store: greylistStore }),
- *     envelope:     b.guardEnvelope,
  *     agent:        b.mail.agent.create({ store: mailStore }),
  *     localDomains: ["example.com"],
  *   });
@@ -260,8 +271,8 @@ function create(opts) {
 
   // Default-on operator-supplied-domain hardening. opts.localDomains
   // and the HELO / MAIL FROM / RCPT TO domain validations all route
-  // through `b.guardDomain` for IDN homograph defense (CVE-2017-5469
-  // class), special-use-domain refusal (RFC 6761), label-length cap
+  // through `b.guardDomain` for IDN homograph / Punycode-spoof defense
+  // (mixed-script confusable class), special-use-domain refusal (RFC 6761), label-length cap
   // (RFC 1035 §2.3.4), and bare-IP-as-domain refusal (CVE-2021-22931
   // class). Operators with a closed-network deployment can pass
   // `guardDomain: false` to skip; the default keeps the protection on.
@@ -367,6 +378,15 @@ function create(opts) {
     var lineBuffer = Buffer.alloc(0);
     var bodyCollector = null;
     var inDataBody = false;
+    // Async command pump: gates (HELO / RBL / greylist / envelope /
+    // DMARC) may await DNS or a store, so command handling is async.
+    // `pumpChain` FIFO-serializes per-chunk processing so a gate
+    // resolving cannot let a later pipelined command (RFC 2920) jump
+    // ahead of an earlier one — reply ordering + the per-command
+    // smuggling defenses stay intact. `connClosed` short-circuits any
+    // chunk queued before a teardown.
+    var pumpChain = Promise.resolve();
+    var connClosed = false;
 
     socket.setTimeout(idleTimeoutMs);
     socket.on("timeout", function () {
@@ -382,6 +402,7 @@ function create(opts) {
     });
 
     socket.on("close", function () {
+      connClosed = true;
       connections.delete(socket);
     });
 
@@ -395,20 +416,35 @@ function create(opts) {
     // 220 banner — RFC 5321 §3.1.
     _writeReply(socket, REPLY_220_READY, greeting + " ready");
 
-    socket.on("data", function (chunk) {
-      try { _ingestBytes(state, socket, chunk); }
-      catch (err) {
+    // Feed a chunk into the per-connection command pump. Chains each
+    // chunk behind the previous one's full (async) processing so command
+    // handlers + their gates run strictly in arrival order. Used by BOTH
+    // the plaintext `socket.on("data")` path AND the post-STARTTLS
+    // TLSSocket onData path — otherwise gate awaits on the upgraded
+    // socket would overlap later TLS chunks (the default strict/balanced
+    // profiles require STARTTLS before MAIL, so the gates run there) and
+    // async gate rejections would go unhandled instead of producing the
+    // 421 path. `activeSock` is whichever socket is current (plaintext or
+    // TLS) so the 421/close lands on the right transport.
+    function _feedChunk(activeSock, chunk) {
+      pumpChain = pumpChain.then(function () {
+        if (connClosed) return undefined;
+        return _ingestBytes(state, activeSock, chunk);
+      }).catch(function (err) {
+        if (connClosed) return;
         _emit("mail.server.mx.handler_threw",
           { connectionId: state.id, error: (err && err.message) || String(err) },
           "failure");
-        try { _writeReply(socket, REPLY_421_SERVICE_NOT_AVAIL, "4.3.0 Server error"); }
+        try { _writeReply(activeSock, REPLY_421_SERVICE_NOT_AVAIL, "4.3.0 Server error"); }
         catch (_e) { /* socket already gone */ }
-        _closeConnection(socket);
-      }
-    });
+        _closeConnection(activeSock);
+      });
+    }
+
+    socket.on("data", function (chunk) { _feedChunk(socket, chunk); });
 
     // ---- Byte-level ingestion --------------------------------------------
-    function _ingestBytes(state, socket, chunk) {
+    async function _ingestBytes(state, socket, chunk) {
       if (inDataBody) {
         // DATA body — accumulate via boundedChunkCollector, watch for
         // canonical "\r\n.\r\n" terminator only. Bare-LF dot terminator
@@ -444,9 +480,9 @@ function create(opts) {
         var endIdx = safeSmtp.findDotTerminator(collected);
         if (endIdx !== -1) {
           var body = collected.subarray(0, endIdx);
-          _finalizeDataBody(state, socket, body);
           inDataBody = false;
           bodyCollector = null;
+          await _finalizeDataBody(state, socket, body);
         }
         return;
       }
@@ -464,12 +500,13 @@ function create(opts) {
       while ((crlf = lineBuffer.indexOf(crlfNeedle)) !== -1) {
         var line = lineBuffer.subarray(0, crlf).toString("utf8");
         lineBuffer = lineBuffer.subarray(crlf + 2);
-        _handleCommand(state, socket, line);
+        await _handleCommand(state, socket, line);
         if (inDataBody) return;
+        if (connClosed) return;
       }
     }
 
-    function _handleCommand(state, socket, line) {
+    async function _handleCommand(state, socket, line) {
       // Per-line guard — refuse bare LF / NUL / C0 / DEL / oversize
       // BEFORE state-machine dispatch.
       try {
@@ -494,16 +531,16 @@ function create(opts) {
       switch (verb) {
         case "EHLO":
         case "HELO":
-          _handleEhlo(state, socket, line, verb);
+          await _handleEhlo(state, socket, line, verb);
           return;
         case "STARTTLS":
           _handleStartTls(state, socket);
           return;
         case "MAIL":
-          _handleMailFrom(state, socket, line);
+          await _handleMailFrom(state, socket, line);
           return;
         case "RCPT":
-          _handleRcptTo(state, socket, line);
+          await _handleRcptTo(state, socket, line);
           return;
         case "DATA":
           _handleData(state, socket);
@@ -531,7 +568,7 @@ function create(opts) {
     }
 
     // ---- EHLO / HELO ------------------------------------------------------
-    function _handleEhlo(state, socket, line, verb) {
+    async function _handleEhlo(state, socket, line, verb) {
       var helo = line.slice(verb.length).trim();
       if (!helo) {
         _writeReply(socket, REPLY_501_BAD_ARGS, "5.5.4 " + verb + " requires a domain argument");
@@ -552,6 +589,25 @@ function create(opts) {
           return;
         }
       }
+      // Operator HELO-identity gate (b.mail.helo) — FCrDNS / HELO-shape /
+      // self-name spoofing checks. Composed when the operator wires
+      // `opts.helo`; skipped silently otherwise (no synthesized verdict).
+      // Hard-reject actions (reject-shape / match-self-refused /
+      // literal-mismatch) refuse the connection; "accept" and the
+      // advisory "soft-*" actions pass (the soft verdict rides the event).
+      if (opts.helo && typeof opts.helo.evaluate === "function") {
+        var heloGate = await opts.helo.evaluate(
+          { claimedName: helo, ip: state.remoteAddress, tls: state.tls }, {});
+        state.heloVerdict = heloGate && heloGate.action;
+        if (heloGate && heloGate.action && heloGate.action !== "accept" &&
+            heloGate.action.indexOf("soft") !== 0) {
+          _emit("mail.server.mx.helo_gate_refused",
+            { connectionId: state.id, helo: helo, action: heloGate.action }, "denied");
+          _writeReply(socket, REPLY_550_MAILBOX_UNAVAIL,
+            "5.7.1 " + verb + " identity refused (" + heloGate.action + ")");
+          return;
+        }
+      }
       state.helo  = helo;
       state.stage = "ehlo";
       // Multi-line 250 capabilities advertisement per RFC 5321 §4.1.1.1.
@@ -572,7 +628,8 @@ function create(opts) {
         _writeReply(socket, REPLY_250_OK, greeting + " greets " + helo);
       }
       _emit("mail.server.mx.helo",
-        { connectionId: state.id, verb: verb, helo: helo, tls: state.tls });
+        { connectionId: state.id, verb: verb, helo: helo, tls: state.tls,
+          heloVerdict: state.heloVerdict || null });
     }
 
     // ---- STARTTLS ---------------------------------------------------------
@@ -604,13 +661,11 @@ function create(opts) {
           state.helo  = null;
         },
         onData: function (tlsSocket, chunk) {
-          try { _ingestBytes(state, tlsSocket, chunk); }
-          catch (err) {
-            _emit("mail.server.mx.handler_threw",
-              { connectionId: state.id, error: (err && err.message) || String(err) },
-              "failure");
-            _closeConnection(tlsSocket);
-          }
+          // Route the upgraded socket through the SAME serialized pump as
+          // the plaintext path — post-STARTTLS is where the gates run in
+          // the default strict/balanced profiles, so it MUST be serialized
+          // and its async rejections MUST hit the 421 path.
+          _feedChunk(tlsSocket, chunk);
         },
         onError: function (err) {
           _emit("mail.server.mx.tls_handshake_failed",
@@ -626,7 +681,7 @@ function create(opts) {
     }
 
     // ---- MAIL FROM --------------------------------------------------------
-    function _handleMailFrom(state, socket, line) {
+    async function _handleMailFrom(state, socket, line) {
       if (!state.tls && _requiresStartTls()) {
         _writeReply(socket, REPLY_530_AUTH_REQUIRED, "5.7.0 Must issue a STARTTLS command first");
         return;
@@ -677,7 +732,7 @@ function create(opts) {
     }
 
     // ---- RCPT TO ----------------------------------------------------------
-    function _handleRcptTo(state, socket, line) {
+    async function _handleRcptTo(state, socket, line) {
       if (state.stage !== "rcpt") {
         _writeReply(socket, REPLY_503_BAD_SEQUENCE, "5.5.1 MAIL FROM first");
         return;
@@ -740,9 +795,49 @@ function create(opts) {
           return;
         }
       }
+      // RBL gate (b.mail.rbl) — DNS blocklist check on the connecting
+      // IP. The verdict is per-connection, so it's evaluated once and
+      // cached on state; a listed IP refuses with 554. Skipped silently
+      // when opts.rbl isn't wired.
+      if (opts.rbl && typeof opts.rbl.query === "function") {
+        if (state.rblVerdict === undefined) {
+          state.rblVerdict = await opts.rbl.query(state.remoteAddress);
+        }
+        if (state.rblVerdict && Array.isArray(state.rblVerdict.listed) &&
+            state.rblVerdict.listed.length > 0) {
+          _trackRefusedRcpt(state, rcpt, "rbl-listed");
+          _emit("mail.server.mx.rbl_refused",
+            { connectionId: state.id, remoteAddress: state.remoteAddress,
+              zones: state.rblVerdict.listed.map(function (l) { return l.zone; }) }, "denied");
+          _writeReply(socket, REPLY_554_TRANSACTION_FAILED,
+            "5.7.1 Connecting IP is on a DNS blocklist");
+          return;
+        }
+      }
+      // Greylist gate (b.mail.greylist) — defer first sight of an
+      // (ip, mailFrom, rcpt) tuple with a 450 tempfail; legitimate
+      // senders retry and pass. "defer" → 450; "accept" → continue.
+      // Skipped silently when opts.greylist isn't wired.
+      var greyVerdict = null;
+      if (opts.greylist && typeof opts.greylist.check === "function") {
+        greyVerdict = await opts.greylist.check(
+          { ip: state.remoteAddress, mailFrom: state.mailFrom || "", rcptTo: rcpt });
+        if (greyVerdict && greyVerdict.action === "defer") {
+          _emit("mail.server.mx.greylist_deferred",
+            { connectionId: state.id, remoteAddress: state.remoteAddress,
+              mailFrom: state.mailFrom, rcptTo: rcpt,
+              reason: greyVerdict.reason }, "denied");
+          _writeReply(socket, REPLY_450_MAILBOX_BUSY,
+            "4.7.1 Greylisted — please retry shortly");
+          return;
+        }
+      }
       state.rcpts.push(rcpt);
       _emit("mail.server.mx.rcpt_to",
-        { connectionId: state.id, rcptTo: rcpt, rcptCount: state.rcpts.length });
+        { connectionId: state.id, rcptTo: rcpt, rcptCount: state.rcpts.length,
+          rblListed: !!(state.rblVerdict && Array.isArray(state.rblVerdict.listed) &&
+            state.rblVerdict.listed.length > 0),
+          greylist: greyVerdict ? greyVerdict.action : null });
       _writeReply(socket, REPLY_250_OK, "2.1.5 Recipient OK");
     }
 
@@ -764,7 +859,7 @@ function create(opts) {
       });
     }
 
-    function _finalizeDataBody(state, socket, body) {
+    async function _finalizeDataBody(state, socket, body) {
       // body is the raw bytes BEFORE dot-stuffing reversal. RFC 5321
       // §4.5.2 — a single leading "." is doubled on the wire; undo.
       var dedotted = safeSmtp.dotUnstuff(body);

package/lib/vendor/blamejs/lib/mail-server-submission.js

@@ -40,7 +40,7 @@
  *
  *   ## Wire-protocol defenses (inherited from MX listener pattern)
  *
- *   - SMTP smuggling (CVE-2023-51764 / -51765 / -51766 / 2024-32178 /
+ *   - SMTP smuggling (CVE-2023-51764 / -51765 / -51766 /
  *     RFC 5321 §2.3.8): every wire line through
  *     `b.guardSmtpCommand.validate`; DATA-body terminator scan
  *     through `b.safeSmtp.findDotTerminator` (strict-CRLF);
@@ -79,11 +79,12 @@
  *
  *   - **DKIM signing pre-relay** — operator wires `b.mail.dkim.sign`
  *     in their outbound agent.
- *   - **CHUNKING (BDAT) extension** — RFC 3030 BDAT not yet
- *     supported on submission; clients use DATA instead.
  *   - **Per-actor outbound quota** — operator implements via
  *     `b.dailyByteQuota` against the authenticated actor.
  *
+ *   (CHUNKING / BDAT, RFC 3030, IS supported — advertised in EHLO and
+ *   handled alongside DATA.)
+ *
  *   ## Composition contract
  *
  *   Every gate is a primitive that already exists. Submission listener
@@ -350,8 +351,8 @@ function create(opts) {
   }
 
   // Default-on guardDomain hardening for HELO / MAIL FROM / RCPT TO.
-  // Same posture as mail-server-mx — IDN homograph (CVE-2017-5469
-  // class), special-use-domain refusal (RFC 6761), label-length cap
+  // Same posture as mail-server-mx — IDN homograph / Punycode-spoof
+  // (mixed-script confusable class), special-use-domain refusal (RFC 6761), label-length cap
   // (RFC 1035 §2.3.4), bare-IP-as-domain refusal (CVE-2021-22931
   // class). Operators with a closed-network deployment pass
   // `guardDomain: false` to skip; the default keeps protection on.

package/lib/vendor/blamejs/lib/mail-store.js

@@ -50,7 +50,7 @@
  *   of caller; only `b.legalHold.release` can flip the flag.
  *
  *   Parses messages on append via `b.safeMime.parse` (bounded
- *   substrate, defends CVE-2024-39929 + CVE-2025-30258). Validates
+ *   substrate, defends CVE-2024-39929 + CVE-2026-26312). Validates
  *   `Message-Id` via `b.guardMessageId.validate`.
  *
  * @card
@@ -526,7 +526,7 @@ function _appendMessage(args) {
       "appendMessage: folder '" + args.folderName + "' not found");
   }
 
-  // Parse via safe-mime — bounded; defends CVE-2024-39929 + CVE-2025-30258.
+  // Parse via safe-mime — bounded; defends CVE-2024-39929 + CVE-2026-26312.
   var tree = safeMime.parse(buf, args.safeMimeOpts);
 
   // Extract canonical fields.

package/lib/vendor/blamejs/lib/mail.js

@@ -1594,10 +1594,10 @@ function create(opts) {
   var auditOn = opts.audit !== false;
 
   // Default-on guardDomain hardening for every outbound recipient + the
-  // sender address. Refuses CVE-2017-5469-class IDN homograph spoofs in
+  // sender address. Refuses IDN homograph / mixed-script-confusable spoofs in
   // recipient or from domains, RFC 6761 special-use domain names
   // (`.localhost`, `.test`, `.invalid`, `.example`) in production sends,
-  // RFC 1035 §2.3.4 label-length violations, and CVE-2021-22931-class
+  // RFC 1035 §2.3.4 label-length violations, and CVE-2021-22931 class
   // bare-IP-as-domain (DNS-rebinding allowlist-bypass class). Operators
   // sending to address literals (`<x@[1.2.3.4]>`) — rare; mostly mailing-
   // list internals — pass `guardDomain: false` to opt out, or pass

package/lib/vendor/blamejs/lib/mdoc.js

@@ -30,22 +30,22 @@
  *   <code>opts.trustAnchorsPem</code> additionally verifies the issuer
  *   certificate chain and its validity at the asserted time.
  *
- *   <strong>Scope.</strong> This is issuer-data authentication
- *   (ISO 18013-5 §9.1.2.4) — the data is genuine and issuer-signed. The
- *   mdoc <em>device authentication</em> half (DeviceSigned / the
- *   SessionTranscript-bound holder-binding proof, §9.1.3) is deferred:
- *   it needs the live session transcript a verifier negotiates, so it is
- *   a presentation-protocol concern rather than a credential check.
- *   Composes <code>b.cose</code> + <code>b.cbor</code>; no new runtime
- *   dependency. Distinct from W3C VCDM (<code>b.vc</code>) and IETF
- *   SD-JWT VC (<code>b.auth.sdJwtVc</code>) — the three credential
- *   ecosystems.
+ *   <strong>Scope.</strong> Two halves are verified: issuer-data
+ *   authentication (ISO 18013-5 §9.1.2.4 — the data is genuine and
+ *   issuer-signed, via <code>verifyIssuerSigned</code>) and mdoc device
+ *   authentication (§9.1.3 — holder binding over the verifier's
+ *   <code>SessionTranscript</code>, via <code>verifyDeviceAuth</code>).
+ *   Device auth covers the COSE_Sign1 signature variant; the COSE_Mac0
+ *   (deviceMac) variant is refused rather than mis-verified. Composes
+ *   <code>b.cose</code> + <code>b.cbor</code>; no new runtime dependency.
+ *   Distinct from W3C VCDM (<code>b.vc</code>) and IETF SD-JWT VC
+ *   (<code>b.auth.sdJwtVc</code>) — the three credential ecosystems.
  *
  * @card
- *   ISO 18013-5 mdoc / mDL issuer-data verification — checks the
- *   COSE_Sign1 IssuerAuth, the MSO validity window, and every disclosed
- *   element's digest against the Mobile Security Object. Composes
- *   b.cose + b.cbor; device-auth holder-binding deferred.
+ *   ISO 18013-5 mdoc / mDL verification — issuer-data (COSE_Sign1
+ *   IssuerAuth, MSO validity window, disclosed-element digests) plus
+ *   device-auth holder binding (§9.1.3 signature variant over the session
+ *   transcript). Composes b.cose + b.cbor.
  */
 
 var nodeCrypto = require("node:crypto");

package/lib/vendor/blamejs/lib/network-dnssec.js

@@ -30,16 +30,18 @@
  *   <code>dnssec/uncanonicalizable-type</code> rather than mis-validated
  *   — the security-critical DNSKEY / DS and the name-free address /
  *   text types (A, AAAA, TXT, …) are fully supported. The recursive
- *   chain-walk (root → TLD → zone), NSEC / NSEC3 denial-of-existence,
- *   and the IANA root trust-anchor bundle are deferred: these primitives
- *   are the per-RRset building blocks a chain-walker composes.
+ *   chain-walk (root → TLD → zone via <code>verifyChain</code> against the
+ *   bundled IANA root trust anchors) and NSEC / NSEC3 denial-of-existence
+ *   (<code>verifyDenial</code> / <code>nsec3Hash</code>) ship alongside the
+ *   per-RRset verification core.
  *
  * @card
- *   Local DNSSEC verification (RFC 4035) — verify an RRSIG over a
- *   canonicalised RRset against a DNSKEY (RSA / ECDSA P-256·P-384 /
- *   Ed25519), plus DS-digest + key-tag. Don't trust the upstream AD bit;
- *   verify the signature. Name-bearing RR types are refused, not
- *   mis-validated; chain-walk + NSEC3 deferred.
+ *   Local DNSSEC verification (RFC 4035 / 4034 / 5155) — verify an RRSIG
+ *   over a canonicalised RRset against a DNSKEY (RSA / ECDSA P-256·P-384 /
+ *   Ed25519) + DS-digest + key-tag, walk the root→zone chain to the IANA
+ *   trust anchors, and check NSEC / NSEC3 denial of existence. Don't trust
+ *   the upstream AD bit; verify the signature. Name-bearing RR types are
+ *   refused, not mis-validated.
  */
 
 var nodeCrypto = require("node:crypto");

package/lib/vendor/blamejs/lib/network-tls.js

@@ -462,12 +462,15 @@ function applyToContext(opts) {
 //   setKeyShares(["X25519MLKEM768", "X25519"])        → string[] (after)
 //   resetKeyShares()                                  → restores default
 
-// RFC 9794 (PQ TLS Hybrid Key Exchange) named-group ordering. The
-// preferred groups (the first the peer mutually supports wins) put the
-// IANA-registered hybrid named groups ahead of the classical fallback:
+// PQ/T-hybrid named-group ordering (RFC 9794 is the PQ/T-hybrid
+// *terminology*; the TLS codepoints come from the IANA TLS Supported
+// Groups registry + draft-kwiatkowski-tls-ecdhe-mlkem +
+// draft-ietf-tls-hybrid-design). The preferred groups (the first the peer
+// mutually supports wins) put the IANA-registered hybrid named groups
+// ahead of the classical fallback:
 //
-//   X25519MLKEM768       — codepoint 0x11EC, RFC 9794 default hybrid
-//   SecP256r1MLKEM768    — codepoint 0x11EB, RFC 9794 optional hybrid
+//   X25519MLKEM768       — codepoint 0x11EC (IANA; draft-kwiatkowski-tls-ecdhe-mlkem)
+//   SecP256r1MLKEM768    — codepoint 0x11EB (IANA; NIST-curve hybrid)
 //                            (NIST-curve fallback for FIPS-mandated peers
 //                            that refuse X25519)
 //   SecP384r1MLKEM1024   — draft-kwiatkowski-tls-ecdhe-mlkem-02 codepoint
@@ -520,7 +523,7 @@ function resetKeyShares() {
   return getKeyShares();
 }
 
-// preferredGroups — RFC 9794 alias surface for the named-group list.
+// preferredGroups — alias surface for the named-group list.
 // `set(list)` overrides the default ordering; `get()` reads the active
 // list; `reset()` restores the framework default. The setKeyShares /
 // getKeyShares / resetKeyShares names are kept as the lower-level
@@ -604,7 +607,7 @@ function buildOptions(opts) {
 
   // PQC group preference. Caller may narrow (drop a group) but not
   // widen — every requested group must appear in the framework
-  // preferred list. Both `groups` (RFC 9794 alias) and `ecdhCurve`
+  // preferred list. Both `groups` (alias) and `ecdhCurve`
   // (Node TLS option) are accepted; `groups` wins when both supplied.
   var requested = null;
   if (Array.isArray(opts.groups)) {

package/lib/vendor/blamejs/lib/safe-decompress.js

@@ -54,10 +54,12 @@
  *   bytes ever cross the audit boundary on the bomb-class path.
  *
  *   Threat model:
- *     - **CVE-2025-0725** (libcurl + zlib decompression amplification)
- *       — bounded output + ratio cap defeat the amplification.
- *     - **CVE-2024-zlib** class (decompression-bomb research, gzip /
- *       deflate / brotli variants) — bounded output prevents OOM.
+ *     - **Decompression bomb** (CWE-409 — improper handling of highly
+ *       compressed data; the classic 42.zip nested-bomb expands to
+ *       petabytes from kilobytes) across gzip / deflate / brotli —
+ *       the bounded-output cap + expansion-ratio cap refuse before the
+ *       allocation, so no decompressed bytes are ever materialized past
+ *       the cap.
  *     - **Efail-class** (CVE-2017-17688 / 17689) — operators decrypting
  *       MIME parts compose `b.safeDecompress` on the inner deflate
  *       streams; the bounded-output posture defeats the unbounded-
@@ -73,8 +75,8 @@
  *   - [RFC 1951](https://www.rfc-editor.org/rfc/rfc1951) deflate
  *   - [RFC 1952](https://www.rfc-editor.org/rfc/rfc1952) gzip
  *   - [RFC 7932](https://www.rfc-editor.org/rfc/rfc7932) brotli
- *   - [CVE-2025-0725](https://nvd.nist.gov/vuln/detail/CVE-2025-0725)
- *   - [CVE-2024-zlib](https://nvd.nist.gov/) decompression-bomb class
+ *   - [CWE-409](https://cwe.mitre.org/data/definitions/409.html) improper
+ *     handling of highly compressed data (decompression bomb)
  */
 
 var zlib = require("node:zlib");