@blamejs/blamejs-shop 0.4.124 → 0.4.125

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.125 (2026-06-27) — **Vendored framework refreshed to 0.15.34 — RSA OpenPGP signatures with a high zero byte now verify reliably.** Updates the vendored blamejs framework to 0.15.34. The upstream release fixes the framework's OpenPGP verification: an RSA signature whose value began with one or more zero bytes — about 1 in 256 of all signatures, for any key — was rejected as invalid even though it was correct, because the OpenPGP wire format strips those leading zero bytes and the verifier handed the shortened signature straight to RSA verification (which requires the signature to be exactly the key's modulus length). The signature is now left-padded back to the modulus width before verification, so every valid RSA signature verifies reliably, including signatures produced by other OpenPGP implementations. The release also carries internal test-suite tooling with no runtime effect. **Changed:** *Vendored framework refreshed to 0.15.34 (reliable RSA OpenPGP signature verification)* — Refreshes the vendored blamejs framework to 0.15.34. The upstream fix left-pads an RSA OpenPGP signature back to the key's modulus byte length before verifying it, so a valid signature whose value carried one or more leading zero bytes (~1 in 256, for any key) is no longer intermittently rejected — matching the padding the Ed25519 verification path already applied. Any code path that verifies OpenPGP RSA signatures through the framework now accepts every correct signature. The rest of the release is internal test-suite tooling with no runtime, public-API, or wire-format change.
+
 - v0.4.124 (2026-06-27) — **Adding the same item to a cart from two requests at once always sums the quantity, and the manager role can configure delivery cutoffs and postal zones.** Two correctness fixes. First, adding the same product to a cart from two requests at once — a double-click, or two open tabs — could drop one of the quantity increases: the cart line's quantity was read and then written back as an absolute value, so the second write overwrote the first instead of adding to it. Adding to the cart now sums the quantity in a single atomic database statement, so simultaneous adds of the same item always total correctly; the same atomic write covers applying a bundle's units onto an existing line and merging a guest cart into a signed-in cart at login. Second, an operator with the manager role was wrongly denied the delivery-estimate cutoff-time and postal-zone screens — those two actions were not mapped to the catalog-write permission and fell through to the owner-only fallback, so only the owner could reach them; managers can now manage them alongside the other delivery-estimate settings. **Fixed:** *Simultaneous add-to-cart requests for the same item sum the quantity instead of losing one* — Adding a line to a cart read the existing quantity and then wrote back the absolute sum, so two requests adding the same item to the same cart at the same time (a rapid double-click, or two tabs) could each read the same starting quantity and overwrite each other — one increase was lost. The add is now a single atomic upsert that increments the stored quantity in the database (`qty = qty + added`), so concurrent adds of the same item always total correctly and a concurrent first-add no longer fails on the cart's unique-line constraint. A plain re-add still keeps the line's existing price. The same atomic write applies to placing a bundle's units onto an existing line (the per-unit price re-blends to the combined value, rounded up so it never charges below it) and to merging a guest cart into a signed-in cart at login. · *The manager role can configure delivery cutoff times and postal zones* — The delivery-estimate cutoff-time and postal-zone actions were not mapped to the catalog-write permission, so they fell through to the owner-only fallback and an operator with the manager role was denied access to those two screens while being allowed the adjacent transit-time and holiday screens. Both actions now require catalog-write, matching the rest of the delivery-estimate settings, so managers can configure them.
 
 - v0.4.123 (2026-06-26) — **Vendored framework refreshed to 0.15.33.** Updates the vendored blamejs framework to 0.15.33. The upstream release is internal test-suite tooling only: it re-verifies three more of the framework's guard-suite suppression classes from scratch and renames their markers to descriptive tokens, recording the old names as retired so a re-verified class cannot inherit a stale approval. No runtime code, public API, or wire format changed upstream, so there is no runtime or behavior change for this storefront and no operator action is required. **Changed:** *Vendored framework refreshed to 0.15.33* — Refreshes the vendored blamejs framework to 0.15.33, an upstream release scoped to test-suite tooling — three more guard-suite suppression classes re-verified and their markers renamed to descriptive tokens, with the old names retired. The shipped framework runtime, public API, and wire format are unchanged, so no operator action is required.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.124",
+  "version": "0.4.125",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.15.33",
-      "tag": "v0.15.33",
+      "version": "0.15.34",
+      "tag": "v0.15.34",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -856,6 +856,7 @@
         "release-notes/v0.15.31.json": "lib/vendor/blamejs/release-notes/v0.15.31.json",
         "release-notes/v0.15.32.json": "lib/vendor/blamejs/release-notes/v0.15.32.json",
         "release-notes/v0.15.33.json": "lib/vendor/blamejs/release-notes/v0.15.33.json",
+        "release-notes/v0.15.34.json": "lib/vendor/blamejs/release-notes/v0.15.34.json",
         "release-notes/v0.15.4.json": "lib/vendor/blamejs/release-notes/v0.15.4.json",
         "release-notes/v0.15.5.json": "lib/vendor/blamejs/release-notes/v0.15.5.json",
         "release-notes/v0.15.6.json": "lib/vendor/blamejs/release-notes/v0.15.6.json",
@@ -1564,7 +1565,7 @@
         ".npmrc": "sha256:66f104e7d07c496d2d0409988225e8c0e4ceb8d247dbcac3be75b2128d20ce66",
         ".pinact.yaml": "sha256:0213ffda55961dc49b64c0a5dfa3c0567419633b1499d57eaf7c8d842d7da6c7",
         "ARCHITECTURE.md": "sha256:9b1c8d2b1b7a41838eb348b0a008e4b4369718fd72bfe2974b37155f7536d35b",
-        "CHANGELOG.md": "sha256:a72d9034e3821cdcb1694eb030baccc80cffd00140c7c4ab13af2aea868db641",
+        "CHANGELOG.md": "sha256:98f034fdf893233e36e89e1f8eaa1548f1de448d67f5afef4e07b401bccb4aa2",
         "CODE_OF_CONDUCT.md": "sha256:148a281960fff7c2fe6554dab66da572c72245ddeb00b0d14811558397bff386",
         "CONTRIBUTING.md": "sha256:bb4dbdbc8598da31dbce653a8ed322e08ff46560173f2eb67a4d684653948332",
         "GOVERNANCE.md": "sha256:906df6afb1f552b27b9acb50f7f96c47b917a2f1021cd4e987dbf4ee0e0a821b",
@@ -1574,7 +1575,7 @@
         "NOTICE": "sha256:f487fa47a11aca0f89e2615cdd3c713e9842abf7a30d8d328eeeae1c864aa774",
         "README.md": "sha256:3ddcc197b003da0b02db8bdd1aef1e943c94f7eab613c633d6a45bb11d0a80e9",
         "SECURITY.md": "sha256:77d8c2bcc04b425a08ef30e51204cebddbd48954b028a259c7a8412dbfeab40a",
-        "api-snapshot.json": "sha256:1458bc7368fc7d15cdd62fe3740e383939c54230b9107ed46b790a2fd266c797",
+        "api-snapshot.json": "sha256:610a4caba49d95d48cd4a129b4071e1756903eaea0de8eb904e6d76e1a887501",
         "assets/BlameJS_Logo.png": "sha256:3c65699753c771b48ef9ac7f45bb40815ec19a23afcdd0cd30ef4601bbbe293e",
         "assets/BlameJS_Logo.svg": "sha256:dda44f3fb1343d5de9db6b1fcdb75fc649c57e7a99a8e8239fcf852e3841e1a8",
         "bench/README.md": "sha256:74202f2507fd840bfc1ac6c681975d9273cf36cca6e0f72655f138337304033c",
@@ -1909,7 +1910,7 @@
         "lib/cra-report.js": "sha256:77e6c28bcb00273d652bd9578ca45fccb56d83ef47a18d4cac80929e17d59dff",
         "lib/crdt.js": "sha256:be5f4675e072eda28e9bbccf49213ad4350b5f53ae78b1ec28cc1d36bf1ea129",
         "lib/credential-hash.js": "sha256:9f4bf10f3ee86f03fba90e32778d99e0f9eb5966b826cbd1dc83e6c55000400e",
-        "lib/crypto-field.js": "sha256:c7b92fbe17d11539c0ef7ad5b7df086c95c4840a7d595acb1122fa59776ea363",
+        "lib/crypto-field.js": "sha256:30312fdf8e4245cae93d8b1914d84dded46480372953c0b4785ee6e14ea48077",
         "lib/crypto-hpke-pq.js": "sha256:f086e23f4f80de9d0713826890bf8bafc0a8ddfa53fe7e87f5a0fed8ffa35caf",
         "lib/crypto-hpke.js": "sha256:e9fb595fc16206237edeb738bfe4b037eeee91de9558e09ffe41e0f1e37558a7",
         "lib/crypto-oprf.js": "sha256:5c98b56ba2322d3c3f40ac5c849370d927b76a535f19f76448469f349ac2b408",
@@ -1944,7 +1945,7 @@
         "lib/error-page.js": "sha256:4ed2e8a118b35d3dc76a072b233713ae1fdaedb54334df68ad081e19f765cb88",
         "lib/events.js": "sha256:b5f0034fda33285f571b9b247db50bff08f632762d9bf69b83784b435eeea75c",
         "lib/external-db-migrate.js": "sha256:990014016e71a818672b3f2c32eaa2ff6815553feb52efafb88ec765df9a570a",
-        "lib/external-db.js": "sha256:92b0e0df9da2ad17c5a6b29a1cacbc15412b11003773e6c662fe92737b4d7cb9",
+        "lib/external-db.js": "sha256:d39513c1ef842397374218d8416c62ff0ec36e73ab0e9c507298dcfb9d0bda63",
         "lib/fapi2.js": "sha256:6ae4679931675a629fa3f9e9efba71172fe69251dec2dd5d8c995cfb9dcad8f7",
         "lib/fda-21cfr11.js": "sha256:9256bcea7d526a7280d5d3b1beed5be1daf2402ded2d5a18d602466d01a7884c",
         "lib/fdx.js": "sha256:67a29b140b6d07a767da31d6b55d1db0c2219cdaa780531fdec0fec63a5c551c",
@@ -2070,7 +2071,7 @@
         "lib/mail-auth.js": "sha256:da409e8f2b3bae1308f1d008b6df27f468075a83ceaeae8ee7cda0ab9c4a1027",
         "lib/mail-bimi.js": "sha256:b22afc5e8ad04503fee7e41f3b34c05c9f0759579436bfbe5f7706180c466155",
         "lib/mail-bounce.js": "sha256:461e885dd2ea0664e9a4af39ae5c36f3a5d9c7dc914dad4c40641b705952fd04",
-        "lib/mail-crypto-pgp.js": "sha256:5339f6e0b03d76add7cba04c0435c8281fbea5ce2dcba23d585f4fdfd86e73b1",
+        "lib/mail-crypto-pgp.js": "sha256:2e94f51d2cb13b92c612e84f73cf96e83eb17843d57b9dc9aef688ce55a1f9b4",
         "lib/mail-crypto-smime.js": "sha256:066d0456f385c470000dd05dcf978592c369298675dd8a25263592c8f15c7934",
         "lib/mail-crypto.js": "sha256:19d5f2a9fe6376d2ed6b0153a944dd1d05d8b893172bad173e2df9733c0dafd3",
         "lib/mail-dav.js": "sha256:3bfe6d8c0fa1c0a5d56d78a07778de932828eeebd6e091d2f988ebeaabcf451a",
@@ -2136,7 +2137,7 @@
         "lib/middleware/headers.js": "sha256:d53abbe53b1981df5b934aad06dc4588729ce2024f014d2b4b0aa5ff0701cebd",
         "lib/middleware/health.js": "sha256:d9e95a38cd18a1236b4787901f6145b258e9a63d98f98eb34e6200489673a4e3",
         "lib/middleware/host-allowlist.js": "sha256:c5572e12b460c69dcc98664eb95a4c810f08c95e66ee8f24f860e08f70b8e3fa",
-        "lib/middleware/idempotency-key.js": "sha256:58d8381cf13b0b6a0fb54aea7b917556f591f7ef22ade89f76759aaec2eb33f5",
+        "lib/middleware/idempotency-key.js": "sha256:3310288d1d42e30b950cfef829daab48600dd8c4a796fe7adbd05d52aeb7bf2b",
         "lib/middleware/index.js": "sha256:01643697e716ab912fab7f214d5d51eb1d70ca4363ad67fba5b912be2ccc0c16",
         "lib/middleware/nel.js": "sha256:712165cd41a504493f797903b2cc0a1f360f7e2f03695163bd3d93219079f8e8",
         "lib/middleware/network-allowlist.js": "sha256:61055651e394d7cadb9750c77d78b8b07e194059399f77c87dc6149c17020464",
@@ -2345,7 +2346,7 @@
         "oss-fuzz/projects/blamejs/README.md": "sha256:ae13b7bb79ed8d69b1b3276e5562807a0349fb6e6b7d11cf1f683aad1eafdb4b",
         "oss-fuzz/projects/blamejs/build.sh": "sha256:0ced1cf21782c97be7f8d74faf5e27a308b60b2f858836fb5ca3b8c4e939a8f7",
         "oss-fuzz/projects/blamejs/project.yaml": "sha256:59f2cb83aa622325a175b77416fe155be15b70a9c798bd1a78bba05763b1b03d",
-        "package.json": "sha256:69f5a0b0cfc8dc14380bd8ccec1c5517680ae98de4bb3fe8de04ad2eb8637d64",
+        "package.json": "sha256:ca031cc44ce6ade614e436bd1f29d01cd2d495ad41c55a819c02c85a5f3a2f96",
         "release-notes/v0.0.x.json": "sha256:7a49819f30068ee119000cad7010194882bb8bfaa12acbdab4dfc066efb7982f",
         "release-notes/v0.1.x.json": "sha256:6742a8c17f947c5cb76f69dead7eea86b942d80621d914b774ba5488e09937e5",
         "release-notes/v0.10.x.json": "sha256:fe498045daf88337bd3d987e5964aa42c99a50e1685b6f09e51f698b8687726f",
@@ -2381,6 +2382,7 @@
         "release-notes/v0.15.31.json": "sha256:f1d259dcee41503588b9c54060e56e436eb5fa7db502872a895c84ebb96627a9",
         "release-notes/v0.15.32.json": "sha256:af99a8a782dcc30aff3a135c27179b064d63181fc4c302c31da632c1615b68ce",
         "release-notes/v0.15.33.json": "sha256:295ea9939b74498c7f0be6afdc8bc511f97cb2383a436c3040c58b0600598b19",
+        "release-notes/v0.15.34.json": "sha256:2a1b36d897d8e9f2cece051c098030f08d9c6ee6bef136800bd19453ad65f188",
         "release-notes/v0.15.4.json": "sha256:6ac7fa0ef1728c27e71b2050d1b07a810f9b4b1440ccddbf28ad56e2f54d8585",
         "release-notes/v0.15.5.json": "sha256:cca1d0edd5d6fc41b512d19d98be224b990dcab41478622c11962f0fcb1bb09a",
         "release-notes/v0.15.6.json": "sha256:0e3b9e5e43b70b61dd258c3003d1b8729cd3c26c62a34dedcca81bbec5d31077",
@@ -2627,7 +2629,7 @@
         "test/layer-0-primitives/cluster-storage.test.js": "sha256:238b3b3db0eba3e6312a863710533178f566347b90e161e564481aa826707647",
         "test/layer-0-primitives/cluster-vault-rotation.test.js": "sha256:3514e9e71d6c39e805248f58ad2f41528d091e196c0f3766a032675677161b2d",
         "test/layer-0-primitives/cms-codec.test.js": "sha256:7e46078ed82be5b69d22c48f22dba37ea5015371c2a8cf5f94fb1a792fb7bb78",
-        "test/layer-0-primitives/codebase-patterns.test.js": "sha256:323ee48a6e6c4cce47f48155cb059e4bc6115af7a01283b30d89592367bb6198",
+        "test/layer-0-primitives/codebase-patterns.test.js": "sha256:69d9da97b002a40c9edb39a6848d7369c2b43e2e09b935bdf9e9e8228765f40a",
         "test/layer-0-primitives/codepoint-class.test.js": "sha256:19d1b69efa7e0e9f7ef2392ca264167767a5ec5890ee339b2cfd8a7818035d27",
         "test/layer-0-primitives/compliance-ai-act.test.js": "sha256:5ee4ad05d12233cb3c5457ef10a727833710bbc1ce1318838f9f9ef5d2cb8d4b",
         "test/layer-0-primitives/compliance-cascade.test.js": "sha256:ee02cf14541a837a9d7977c6ea6bf7f9210bed293925d93c976e31f270aebec4",
@@ -2822,7 +2824,7 @@
         "test/layer-0-primitives/mail-bounce.test.js": "sha256:d4ef09adc71e1c9e336a9fc5b059e6b264d9abcd0c032023bfa7b15a9173a4b7",
         "test/layer-0-primitives/mail-canspam.test.js": "sha256:c21dec043c9984d191af0b1f3425e85953b559ec6dfdf281a5f746f7121eb281",
         "test/layer-0-primitives/mail-crypto-pgp-experimental.test.js": "sha256:5b00a55d58cc48eb2864c6f7c6386ce44423e478b1033e5b11bb5130b4bb60c5",
-        "test/layer-0-primitives/mail-crypto-pgp.test.js": "sha256:e7b399a99e2ea3d443a409a2a7ddba9d0871c8383a821414a1b1b1122757e3cb",
+        "test/layer-0-primitives/mail-crypto-pgp.test.js": "sha256:a5340ca432e631104496e6aa9ebe4a99a1c26d9de6819a1f6df9534821b8ed43",
         "test/layer-0-primitives/mail-crypto-smime-bad-validity.test.js": "sha256:e7bdef1d3d3aafacfd328a7fb7e0dacb45bf66103e18ad19d97d6e308e4aee31",
         "test/layer-0-primitives/mail-crypto-smime.test.js": "sha256:2b840ad3706840a8d206c9fa09337e0c13ecb83a7ea4d97fceb49d4fb4454dfa",
         "test/layer-0-primitives/mail-dav.test.js": "sha256:5b4dcb1b9d8942f0cc2235a99487b076cf4f984933c609d737bb40471ae7333c",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.34 (2026-06-26) — **`b.mail.crypto.pgp.verify` now accepts every valid RSA OpenPGP signature — one whose value happened to have a high zero byte (about 1 in 256) was being rejected.** An OpenPGP RSA signature is an integer modulo the key's modulus, and ~1 in 256 signatures have a value that begins with a zero byte. The MPI encoding strips those leading zero bytes (RFC 9580 §3.2), but b.mail.crypto.pgp.verify passed the stripped value straight to the RSA verification, which requires a signature exactly the modulus byte length — so a perfectly valid signature was intermittently reported invalid. The signature is now left-padded back to the modulus width before verification, exactly as the Ed25519 path already pads its components. Verification of every valid RSA signature is now reliable, including signatures produced by other OpenPGP implementations. Also includes internal test-tooling: two more guard-suite suppression classes were re-verified and their tokens retired. **Fixed:** *RSA OpenPGP signatures with a high zero byte now verify reliably* — b.mail.crypto.pgp.verify read the RSA signature MPI (whose leading zero bytes the OpenPGP wire format strips) and handed it to the RSA verification without restoring the stripped bytes. Node's RSA verify requires the signature to be exactly the modulus byte length, so a signature whose value had one or more high zero bytes — about 1 in 256 of all signatures, for any key — was rejected as invalid even though it was correct. The signature is now left-padded to the modulus width before verification (the same correction the Ed25519 verification path already applied to its R/S components). This affects signatures the framework produces and signatures from other OpenPGP implementations alike. A deterministic regression test searches for a short-MPI signature and asserts it verifies. **Detectors:** *Two more suppression-marker classes re-verified and their tokens retired* — The raw-hash-compare and seal-without-aad guard classes were re-read and confirmed (a data-residency region tag compared with === — not a secret; and two intentional non-AEAD-bound seals — a non-regulated plain-mode column whose AAD is enforced by the posture seal-envelope floor where it matters, and a throwaway vault-readiness probe), then renamed to descriptive tokens with their old names added to the retired-token set. Test-suite tooling only.
+
 - v0.15.33 (2026-06-26) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** Three more suppression classes in the codebase-patterns guard suite were re-verified from scratch and renamed to descriptive tokens, with their old names recorded as retired and their in-source marker comments updated to match. No runtime code, public API, or wire format changed. **Detectors:** *Three more suppression-marker classes re-verified and their tokens retired* — Continuing the re-verification pass: each marked site for the math-random-noncrypto, raw-new-url, and dynamic-require guard classes was re-read and confirmed (non-security jitter/sampling; URL parsing for shape/origin inspection or behind the safe wrapper; operator-supplied module loads), then the class was renamed to a descriptive token and its old name added to the retired-token set. This is test-suite tooling; no shipped framework behavior changed.
 
 - v0.15.32 (2026-06-26) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** Three more suppression classes in the codebase-patterns guard suite were re-verified from scratch and renamed to descriptive tokens, with their old names recorded as retired so the prior approval cannot be silently resurrected and their in-source marker comments updated to match. No runtime code, public API, or wire format changed. **Detectors:** *Three more suppression-marker classes re-verified and their tokens retired* — Continuing the re-verification pass: each marked site for the process-exit, hand-rolled buffer-collect, and raw-outbound-http guard classes was re-read and confirmed (operator-opt-in exits; bounded protocol-framing / TLV assembly; framework-routed outbound calls), then the class was renamed to a descriptive token and its old name added to the retired-token set. This is test-suite tooling; no shipped framework behavior changed.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.15.33",
-  "createdAt": "2026-06-26T20:59:47.809Z",
+  "frameworkVersion": "0.15.34",
+  "createdAt": "2026-06-26T23:09:44.793Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/crypto-field.js

@@ -1090,7 +1090,7 @@ function sealRow(table, row, opts) {
       out[field] = vaultAad.seal(_encodeTyped(out[field]),
         _aadParts(s, table, field, out));
     } else {
-      // allow:seal-without-aad — plain-mode legacy table; operator
+      // allow:seal-without-aad-by-design — plain-mode legacy table; operator
       // opts into AAD via registerTable({aad:true})
       out[field] = vault.seal(_encodeTyped(out[field]));
     }

package/lib/vendor/blamejs/lib/external-db.js

@@ -1709,7 +1709,7 @@ function _crossBorderRegulated(posture) {
 
 function _residencyCompatible(primaryTag, replicaTag) {
   if (!primaryTag || !replicaTag) return true;
-  if (primaryTag === replicaTag) return true; // allow:raw-hash-compare — residency tag string, not a secret hash
+  if (primaryTag === replicaTag) return true; // allow:raw-hash-compare-nonsecret-tag — residency tag string, not a secret hash
   if (primaryTag === "unrestricted" || replicaTag === "unrestricted") return true;
   return false;
 }

package/lib/vendor/blamejs/lib/mail-crypto-pgp.js

@@ -865,11 +865,22 @@ function verify(opts) {
   var ok;
   if (parsed.pubAlg === PUB_ALG_RSA) {
     var rsaMpi = _readMpi(parsed.sigMpisBytes, 0);
+    // The signature is an integer in [0, n); when its value has one or more
+    // high zero bytes (~1/256 of signatures) the OpenPGP MPI encoding strips
+    // them (RFC 9580 §3.2), but node's RSA verify requires a signature exactly
+    // the modulus byte length. Left-pad the stripped MPI back to the modulus
+    // width — the same correction the Ed25519 branch applies to its R/S
+    // components below — or a valid signature is rejected.
+    var rsaSigBytes = rsaMpi.value;
+    var modLen = rsaPub.n.length;
+    if (rsaSigBytes.length < modLen) {
+      rsaSigBytes = Buffer.concat([Buffer.alloc(modLen - rsaSigBytes.length), rsaSigBytes]);
+    }
     try {
       ok = nodeCrypto.verify(hashName, hashInput, {
         key: publicKey,
         padding: nodeCrypto.constants.RSA_PKCS1_PADDING,
-      }, rsaMpi.value);
+      }, rsaSigBytes);
     } catch (e) {
       return _fail("mail-crypto/pgp/verify-error",
         "RSA verify threw: " + ((e && e.message) || String(e)));

package/lib/vendor/blamejs/lib/middleware/idempotency-key.js

@@ -290,7 +290,7 @@ function dbStore(opts) {
   var sealEnabled = false;
   if (sealReq) {
     try {
-      // allow:seal-without-aad — vault-readiness probe; throwaway
+      // allow:seal-without-aad-by-design — vault-readiness probe; throwaway
       // sentinel value, not row-bound data
       vault.seal("__idempotency_seal_probe__");
       sealEnabled = true;

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.33",
+  "version": "0.15.34",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.34.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.34",
+  "date": "2026-06-26",
+  "headline": "`b.mail.crypto.pgp.verify` now accepts every valid RSA OpenPGP signature — one whose value happened to have a high zero byte (about 1 in 256) was being rejected",
+  "summary": "An OpenPGP RSA signature is an integer modulo the key's modulus, and ~1 in 256 signatures have a value that begins with a zero byte. The MPI encoding strips those leading zero bytes (RFC 9580 §3.2), but b.mail.crypto.pgp.verify passed the stripped value straight to the RSA verification, which requires a signature exactly the modulus byte length — so a perfectly valid signature was intermittently reported invalid. The signature is now left-padded back to the modulus width before verification, exactly as the Ed25519 path already pads its components. Verification of every valid RSA signature is now reliable, including signatures produced by other OpenPGP implementations. Also includes internal test-tooling: two more guard-suite suppression classes were re-verified and their tokens retired.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "RSA OpenPGP signatures with a high zero byte now verify reliably",
+          "body": "b.mail.crypto.pgp.verify read the RSA signature MPI (whose leading zero bytes the OpenPGP wire format strips) and handed it to the RSA verification without restoring the stripped bytes. Node's RSA verify requires the signature to be exactly the modulus byte length, so a signature whose value had one or more high zero bytes — about 1 in 256 of all signatures, for any key — was rejected as invalid even though it was correct. The signature is now left-padded to the modulus width before verification (the same correction the Ed25519 verification path already applied to its R/S components). This affects signatures the framework produces and signatures from other OpenPGP implementations alike. A deterministic regression test searches for a short-MPI signature and asserts it verifies."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Two more suppression-marker classes re-verified and their tokens retired",
+          "body": "The raw-hash-compare and seal-without-aad guard classes were re-read and confirmed (a data-residency region tag compared with === — not a secret; and two intentional non-AEAD-bound seals — a non-regulated plain-mode column whose AAD is enforced by the posture seal-envelope floor where it matters, and a throwaway vault-readiness probe), then renamed to descriptive tokens with their old names added to the retired-token set. Test-suite tooling only."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -344,7 +344,7 @@ var VALID_ALLOW_CLASSES = {
   "primitive-unreachable": 1,
   "process-exit-operator-optin": 1,
   "raw-byte-literal": 1,
-  "raw-hash-compare": 1,
+  "raw-hash-compare-nonsecret-tag": 1,
   "raw-new-url-parse-only": 1,
   "raw-outbound-http-framework-internal": 1,
   "raw-process-env-bootstrap": 1,
@@ -353,7 +353,7 @@ var VALID_ALLOW_CLASSES = {
   "raw-timing-safe-equal-boot-prechecked": 1,
   "raw-xfp-telemetry-only": 1,
   "regex-no-length-cap": 1,
-  "seal-without-aad": 1,
+  "seal-without-aad-by-design": 1,
   "silent-catch-stream-teardown": 1,
   "slsa-framework-action-not-sha-pinned": 1,
   "timer-no-unref-unrefed-below": 1,
@@ -387,6 +387,8 @@ var RETIRED_ALLOW_TOKENS = {
   "math-random-noncrypto": "renamed to 'math-random-noncrypto-jitter-sampling' (2026-06-26 re-verify pass) — every site is jitter / sampling / backoff where predictability is not a threat; re-verify before reusing",
   "raw-new-url": "renamed to 'raw-new-url-parse-only' (2026-06-26 re-verify pass) — every site parses for shape/origin inspection, is the safeUrl wrapper itself, or is re-validated downstream — none is an unguarded outbound-fetch target; re-verify before reusing",
   "dynamic-require": "renamed to 'dynamic-require-operator-module' (2026-06-26 re-verify pass) — every site loads an operator-supplied path (migration / seed / extensibility entry, centralized in module-loader.js) or is diagnostic message text; re-verify before reusing",
+  "raw-hash-compare": "renamed to 'raw-hash-compare-nonsecret-tag' (2026-06-26 re-verify pass) — the one site compares a data-residency region tag with ===, not a secret hash; re-verify before reusing",
+  "seal-without-aad": "renamed to 'seal-without-aad-by-design' (2026-06-26 re-verify pass) — both sites intentionally seal without AAD (a non-regulated plain-mode table whose AAD is enforced by the posture sealEnvelopeFloor where required, and a throwaway vault-readiness probe sentinel); re-verify before reusing",
 };
 
 function testNoRetiredAllowTokenReRegistered() {
@@ -1665,7 +1667,7 @@ function testNoRawHashCompare() {
   // with === are timing-attack-prone. Should use `crypto.timingSafeEqual`.
   var matches = _scan(
     /\b\w*(Hash|Token|Sig|Signature|Mac|Digest|Tag)\s*===\s*\w*(Hash|Token|Sig|Signature|Mac|Digest|Tag)/);
-  matches = _filterMarkers(matches, "raw-hash-compare");
+  matches = _filterMarkers(matches, "raw-hash-compare-nonsecret-tag");
   _report("hash/token/sig/mac/digest compared with timingSafeEqual " +
           "(or has allow marker for known-non-secret comparison)",
     matches);
@@ -11124,7 +11126,7 @@ function testSealWithoutAad() {
       }
     }
   }
-  bad = _filterMarkers(bad, "seal-without-aad");
+  bad = _filterMarkers(bad, "seal-without-aad-by-design");
   _report("dbStore-shaped sealed-row code routes through vault.aad.seal " +
           "(or has allow marker) — CRYPTO-1",
     bad);
@@ -11177,7 +11179,7 @@ function testNoHexShaCompareEquals() {
   matches = matches.concat(_scan(
     /\b\w+Hex\s*(===|!==)\s*(hmac\w*Hex|mac\w*Hex|signature\w*Hex|sigVerify\w*Hex)/i));
   matches = _filterMarkers(matches, "hex-sha-compare-equals");
-  matches = _filterMarkers(matches, "raw-hash-compare");
+  matches = _filterMarkers(matches, "raw-hash-compare-nonsecret-tag");
   _report("hex HMAC / MAC / signature compared with timingSafeEqual " +
           "(CVE-2026-21713 — memcmp leaks per-byte timing)",
     matches);

package/lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-pgp.test.js

@@ -159,6 +159,55 @@ function testPgpRsaRoundTrip() {
   check("rsa verify reports fingerprint",      verify.signerFingerprint === rv.fingerprint);
 }
 
+// Minimal parse of an ASCII-armored detached signature down to the RSA
+// signature MPI's value byte-length, so the test can DETERMINISTICALLY find a
+// signature whose high zero byte was stripped (rather than relying on a ~1/256
+// random round-trip to flake). New-format packet (RFC 9580 §4.2.1): tag byte +
+// length octet(s), then v4 sig body: ver/type/pubalg/hashalg(4) + hashedLen(2) +
+// hashed + unhashedLen(2) + unhashed + hashLeft16(2) + MPI(2-byte bits + value).
+function _rsaSigMpiByteLen(armored) {
+  var lines = armored.replace(/\r/g, "").split("\n");
+  var collecting = false, body = "";
+  for (var i = 0; i < lines.length; i++) {
+    var L = lines[i];
+    if (L.indexOf("-----BEGIN") === 0) { collecting = false; continue; }
+    if (L.indexOf("-----END") === 0) break;
+    if (L === "") { collecting = true; continue; }   // blank line precedes the body
+    if (collecting) { if (L.charAt(0) === "=") break; body += L; }   // '=' is the CRC line
+  }
+  var pkt = Buffer.from(body, "base64");
+  var p = 1;                                          // skip the new-format tag byte
+  var l0 = pkt[p];
+  if (l0 < 192) p += 1; else if (l0 < 224) p += 2; else if (l0 === 255) p += 5; else p += 1;
+  p += 4;                                             // ver, type, pubalg, hashalg
+  var hashedLen = pkt.readUInt16BE(p); p += 2 + hashedLen;
+  var unhashedLen = pkt.readUInt16BE(p); p += 2 + unhashedLen;
+  p += 2;                                             // hashLeft16
+  return Math.ceil(pkt.readUInt16BE(p) / 8);          // MPI bit-length → value byte-length
+}
+
+function testPgpRsaVerifyLeadingZeroSignature() {
+  // An RSA signature is an integer in [0, n); ~1/256 of (key, message) pairs
+  // produce a value with a high zero byte, which the OpenPGP MPI encoding
+  // strips (RFC 9580 §3.2). verify() must left-pad the stripped MPI back to the
+  // modulus byte length before the RSA op, or it rejects a VALID signature.
+  // That bug surfaced only as a ~0.4% flake in the random-key round-trip above;
+  // this finds the case deterministically and proves the signature still verifies.
+  var kp = _rsaKeypair(2048);
+  var MOD_BYTES = 256;                                // 2048-bit modulus
+  var tested = false;
+  for (var i = 0; i < 4000 && !tested; i++) {
+    var message = "rsa-leading-zero-probe-" + i;
+    var rv = pgp.sign({ message: message, privateKeyPem: kp.privateKey });
+    if (_rsaSigMpiByteLen(rv.armored) < MOD_BYTES) {
+      var verify = pgp.verify({ message: message, armored: rv.armored, publicKeyPem: kp.publicKey });
+      check("rsa verify accepts a high-zero-byte (short-MPI) signature", verify.ok === true);
+      tested = true;
+    }
+  }
+  check("found a short-MPI RSA signature to exercise (within 4000 messages)", tested);
+}
+
 // ---- Tamper detection ----
 
 function testPgpTamperDetection() {
@@ -308,6 +357,7 @@ function run() {
   testPgpSignInputValidation();
   testPgpEd25519RoundTrip();
   testPgpRsaRoundTrip();
+  testPgpRsaVerifyLeadingZeroSignature();
   testPgpTamperDetection();
   testPgpVerifyInputValidation();
   testPgpDocBlockNamesEfail();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.124",
+  "version": "0.4.125",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {