@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/lib/cloud-events.js

@@ -110,7 +110,7 @@ function _genId() {
  *   }
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   var ce = b.cloudEvents.wrap({
  *     source:  "/services/orders",
  *     type:    "com.example.order.created",
@@ -214,7 +214,7 @@ function wrap(opts) {
  * envelope.
  *
  * @example
- *   var b = require("blamejs").create();
+ *   var b = require("blamejs");
  *   var record = b.cloudEvents.parse({
  *     specversion: "1.0",
  *     id:          "evt-1",

package/lib/vendor/blamejs/lib/cluster-provider-db.js

@@ -244,7 +244,17 @@ function create(config) {
   async function renewLease(lease, opts) {
     if (!lease || !lease.leaseId) throw _err("INVALID_LEASE", "lease required", true);
     var nowMs = Date.now();
-    var newExpiresAt = nowMs + (lease.expiresAt - lease.acquiredAt);
+    // A lease is a sliding window: the span (expiresAt - acquiredAt) equals
+    // the configured TTL at acquire time, and every renewal must slide BOTH
+    // ends forward so the span stays that TTL. Advancing only expiresAt
+    // (leaving acquiredAt frozen at the original acquisition) re-derives an
+    // ever-growing TTL on the next renewal, so the expiry drifts unboundedly
+    // into the future: a dead leader's row then never lapses within leaseTtl
+    // and no follower can steal it, breaking bounded takeover. Refresh
+    // acquiredAt alongside expiresAt to keep the span invariant.
+    var ttlMs = lease.expiresAt - lease.acquiredAt;
+    var newAcquiredAt = nowMs;
+    var newExpiresAt = nowMs + ttlMs;
     // opts.endpoint, when provided, refreshes the stored endpoint so
     // operators who hot-update their config see the discovery row catch
     // up. Default = preserve whatever was stored at acquire time.
@@ -261,7 +271,7 @@ function create(config) {
       // MySQL has no RETURNING — UPDATE then read back, with a takeover
       // detected when the read-back row no longer carries our leaseId.
       var rvBuilt = sql().update(LEADER_TABLE, { dialect: dialect })
-        .set({ expiresAt: newExpiresAt, endpoint: endpoint })
+        .set({ acquiredAt: newAcquiredAt, expiresAt: newExpiresAt, endpoint: endpoint })
         .where("scope", "leader").where("nodeId", lease.nodeId).where("leaseId", lease.leaseId)
         .toSql();
       var rv = await _q(clusterStorage().placeholderize(rvBuilt.sql, dialect), rvBuilt.params);
@@ -283,7 +293,7 @@ function create(config) {
       row = sel.rows[0];
     } else {
       var result = await _run(sql().update(LEADER_TABLE, { dialect: dialect })
-        .set({ expiresAt: newExpiresAt, endpoint: endpoint })
+        .set({ acquiredAt: newAcquiredAt, expiresAt: newExpiresAt, endpoint: endpoint })
         .where("scope", "leader").where("nodeId", lease.nodeId).where("leaseId", lease.leaseId)
         .returning(renewCols));
       if (!result.rows || result.rows.length === 0) {

package/lib/vendor/blamejs/lib/codepoint-class.js

@@ -581,10 +581,95 @@ function decodeNumericEntities(s) {
   });
 }
 
+// The HTML5 named-entity ASCII subset a browser resolves inside URL and CSS
+// attribute contexts — the scheme/whitespace-significant characters an attacker
+// hides a payload behind (`java	script:` / `behavior:`). One table so
+// guard-html / guard-svg / guard-markdown decode the SAME set and cannot drift
+// (guard-markdown shipped without named-entity decoding at all, so `	` /
+// `
` slipped past its scheme denylist).
+var NAMED_ENTITY_ASCII = {
+  // Whitespace + control chars browsers strip inside URL schemes
+  Tab: "\t", NewLine: "\n",
+  // Scheme-significant punctuation
+  colon: ":", semi: ";", period: ".", sol: "/", bsol: "\\",
+  num: "#", excl: "!", quest: "?", lpar: "(", rpar: ")",
+  lsqb: "[", rsqb: "]", lcub: "{", rcub: "}",
+  // Quotes / brackets
+  quot: "\"", apos: "'", lt: "<", gt: ">",
+  // Misc ASCII
+  amp: "&", commat: "@", dollar: "$", percnt: "%",
+  ast: "*", plus: "+", lowbar: "_", hyphen: "-",
+  // Latin-1 space browsers treat as URL-strippable
+  nbsp: " ",
+};
+var NAMED_ENTITY_RE_G = /&([A-Za-z][A-Za-z0-9]+);/g;
+
+/**
+ * @primitive b.codepointClass.decodeMarkupEntities
+ * @signature b.codepointClass.decodeMarkupEntities(value)
+ * @since     0.16.19
+ * @status    stable
+ * @related   b.codepointClass.decodeNumericEntities, b.codepointClass.stripUrlSchemeWhitespace
+ *
+ * Decode the character references a browser resolves inside an attribute value
+ * -- numeric (hex/decimal, semicolon OPTIONAL) then the named-entity ASCII
+ * subset browsers honor in URL/CSS contexts -- and drop the C0 controls and
+ * zero-widths a payload hides behind. The single decoder every content guard
+ * routes a scheme / CSS-token danger check through, so a threat cannot slip
+ * past the guard that forgot to decode an encoding a sibling strips. Pair with
+ * `stripUrlSchemeWhitespace` for a URL-scheme check.
+ *
+ * @example
+ *   b.codepointClass.decodeMarkupEntities("ex&#x70;ression(");   // "expression("
+ *   b.codepointClass.decodeMarkupEntities("behavior&colon;");    // "behavior:"
+ */
+function decodeMarkupEntities(value) {
+  var s = decodeNumericEntities(String(value == null ? "" : value));
+  s = s.replace(NAMED_ENTITY_RE_G, function (m, name) {
+    if (Object.prototype.hasOwnProperty.call(NAMED_ENTITY_ASCII, name)) {
+      return NAMED_ENTITY_ASCII[name];
+    }
+    return m;
+  });
+  return s.replace(C0_CTRL_RE_G, "").replace(ZW_RE_G, "");
+}
+
+var URL_TAB_NEWLINE_RE_G = /[\t\n\r]/g;                              // URL tab/newline strip, not byte size
+// allow:dynamic-regex -- codepoints from a literal [0x00, 0x20] range (C0 controls + space)
+var URL_C0_SPACE_CC = charClass([[0x0000, 0x0020]]);
+var URL_C0_SPACE_TRIM_RE = new RegExp("^(?:[" + URL_C0_SPACE_CC + "])+|(?:[" + URL_C0_SPACE_CC + "])+$", "g");
+/**
+ * @primitive b.codepointClass.stripUrlSchemeWhitespace
+ * @signature b.codepointClass.stripUrlSchemeWhitespace(s)
+ * @since     0.16.19
+ * @status    stable
+ * @related   b.codepointClass.decodeMarkupEntities, b.codepointClass.decodeNumericEntities
+ *
+ * Fold away exactly the whitespace the WHATWG URL parser removes before it
+ * resolves a scheme: ASCII tab / LF / CR from ANYWHERE, plus a leading/trailing
+ * C0-control-or-space run. tab/lf/cr are excluded from the C0-control catalog
+ * and space is not a control, so a danger check that strips only C0/zero-width
+ * still lets `java<TAB>script:` or an entity-encoded leading space
+ * (`&#32;javascript:`) read as scheme-less. Run AFTER entity decoding; every
+ * guard that extracts a URL scheme for a denylist routes the decoded value
+ * through this.
+ *
+ * @example
+ *   b.codepointClass.stripUrlSchemeWhitespace("  javascript:x");   // "javascript:x"
+ */
+function stripUrlSchemeWhitespace(s) {
+  return String(s == null ? "" : s)
+    .replace(URL_TAB_NEWLINE_RE_G, "")
+    .replace(URL_C0_SPACE_TRIM_RE, "");
+}
+
 module.exports = {
   isForbiddenControlChar:  isForbiddenControlChar,
   firstControlCharOffset:  firstControlCharOffset,
   decodeNumericEntities:   decodeNumericEntities,
+  decodeMarkupEntities:    decodeMarkupEntities,
+  NAMED_ENTITY_ASCII:      NAMED_ENTITY_ASCII,
+  stripUrlSchemeWhitespace: stripUrlSchemeWhitespace,
   isAsciiAlnum:      isAsciiAlnum,
   isUnreserved:      isUnreserved,
   hex4:              hex4,

package/lib/vendor/blamejs/lib/compliance-ai-act-prohibited.js

@@ -51,7 +51,7 @@ var PROHIBITED_PRACTICES = Object.freeze([
   Object.freeze({
     id:          "social-scoring",
     article:     "Art. 5(1)(c)",
-    title:       "Social scoring by public authorities",
+    title:       "Social scoring of natural persons",
     description: "AI systems for the evaluation or classification of natural persons over a certain period of time based on their social behaviour or known, inferred or predicted personal or personality characteristics, leading to detrimental or unfavourable treatment that is unjustified or disproportionate.",
     examples:    Object.freeze([
       "General-purpose social-credit ranking by a state agency",
@@ -151,9 +151,13 @@ function classify(systemDescription) {
   if (systemDescription.targetsVulnerableGroup === true) {
     hits.push("exploit-vulnerabilities");
   }
-  // (c) social scoring
-  if (systemDescription.purpose === "social-scoring" &&
-      systemDescription.deployerType === "public-authority") {
+  // (c) social scoring — Art. 5(1)(c) of the adopted Regulation (EU)
+  // 2024/1689 prohibits social scoring by ANY actor. The "by public
+  // authorities or on their behalf" limitation from the 2021 Commission
+  // proposal was dropped in the final text, so the practice is flagged on the
+  // purpose alone, not gated on deployerType (which would under-classify a
+  // private-actor social-scoring system as minimal-risk).
+  if (systemDescription.purpose === "social-scoring") {
     hits.push("social-scoring");
   }
   // (d) predictive policing on profiling alone

package/lib/vendor/blamejs/lib/compliance-ai-act-transparency.js

@@ -42,6 +42,7 @@
 
 var validateOpts  = require("./validate-opts");
 var markupEscape  = require("./markup-escape").markupEscape;
+var safeJson      = require("./safe-json");
 var { ComplianceError } = require("./framework-error");
 
 var BANNER_KINDS = Object.freeze([
@@ -112,10 +113,17 @@ function _articleFor(kind) {
 
 function htmlBanner(opts) {
   var b = banner(opts);
+  // Every interpolated value is entity-escaped for the double-quoted attribute
+  // context. `lang` is free-form (a request locale / Accept-Language / query
+  // param when the banner is server-rendered), so an unescaped double quote
+  // would break out of the attribute and inject active content (reflected
+  // XSS). `article` / `kind` are constrained today, but escape-at-the-sink is
+  // the invariant — a raw concat is the defect regardless of the current
+  // value domain.
   var attrs =
-    'role="status" data-blamejs-aiAct="' + b.article +
-    '" data-blamejs-kind="' + b.kind +
-    '" lang="' + b.lang + '"';
+    'role="status" data-blamejs-aiAct="' + _escapeHtml(b.article) +
+    '" data-blamejs-kind="' + _escapeHtml(b.kind) +
+    '" lang="' + _escapeHtml(b.lang) + '"';
   return '<div ' + attrs + '>' + _escapeHtml(b.text) + '</div>';
 }
 
@@ -159,9 +167,16 @@ function watermark(opts) {
 
 function jsonLdDisclosure(opts) {
   var w = watermark(opts);
+  // The manifest carries operator-supplied strings (modelId, deployerName,
+  // promptHash, ...). Embedding raw JSON.stringify inside a <script> element
+  // lets a value containing "</script>" (or "<!--") terminate the block and
+  // inject markup — the HTML parser ends the element at the first "</script>"
+  // regardless of the ld+json type. b.safeJson.stringifyForScript escapes
+  // < > & (and U+2028/U+2029) to \uXXXX so the parsed JSON is unchanged but no
+  // substring can break out of the script context.
   var script = '<script type="application/ld+json" ' +
                'data-blamejs-aiAct="Art. 50(2)">' +
-               JSON.stringify(w) + '</script>';
+               safeJson.stringifyForScript(w) + '</script>';
   return script;
 }
 

package/lib/vendor/blamejs/lib/compliance-ai-act.js

@@ -591,11 +591,10 @@ function deployerChecklist(assessment) {
  *   });
  */
 function fundamentalRightsImpactAssessment(opts) {
-  if (!opts || typeof opts !== "object") {
-    throw new Error("fundamentalRightsImpactAssessment: opts required");
-  }
+  validateOpts.requireObject(opts, "fundamentalRightsImpactAssessment",
+    ComplianceError, "compliance-ai-act/bad-input");
   validateOpts.requireNonEmptyString(opts.systemId, "systemId",
-    Error, "compliance-ai-act/no-system-id");
+    ComplianceError, "compliance-ai-act/no-system-id");
   return {
     "$schema":            "https://blamejs.com/schema/ai-act-fria-v1.json",
     regulation:           "EU Regulation 2024/1689 — AI Act",
@@ -657,11 +656,10 @@ function fundamentalRightsImpactAssessment(opts) {
  *   });
  */
 function trainingDataSummary(opts) {
-  if (!opts || typeof opts !== "object") {
-    throw new Error("trainingDataSummary: opts required");
-  }
+  validateOpts.requireObject(opts, "trainingDataSummary",
+    ComplianceError, "compliance-ai-act/bad-input");
   validateOpts.requireNonEmptyString(opts.modelId, "modelId",
-    Error, "compliance-ai-act/no-model-id");
+    ComplianceError, "compliance-ai-act/no-model-id");
   return {
     "$schema":           "https://blamejs.com/schema/ai-act-gpai-training-summary-v1.json",
     regulation:          "EU Regulation 2024/1689 — AI Act",

package/lib/vendor/blamejs/lib/content-credentials.js

@@ -595,7 +595,7 @@ function signCose(manifest, opts) {
   validateOpts.requireNonEmptyString(opts.privateKeyPem,
     "contentCredentials.signCose: privateKeyPem", ContentCredentialsError, "BAD_KEY");
   var algName = (opts.alg || "ml-dsa-87").toLowerCase();
-  if (!(algName in COSE_ALGS)) {
+  if (!Object.prototype.hasOwnProperty.call(COSE_ALGS, algName)) {
     throw ContentCredentialsError.factory("content-credentials/bad-alg",
       "contentCredentials.signCose: alg '" + algName +
       "' not in COSE alg registry. Known: " + Object.keys(COSE_ALGS).join(", "));

package/lib/vendor/blamejs/lib/content-digest.js

@@ -32,6 +32,7 @@
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("./crypto");
 var safeBuffer = require("./safe-buffer");
+var safeObject = require("./safe-object");
 var structuredFields = require("./structured-fields");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -104,7 +105,7 @@ function create(body, opts) {
     // hasOwnProperty: the algorithm name is operator/caller input; a bracket
     // lookup lets "constructor"/"toString" inherit a truthy value off the
     // prototype and pass the support check (proto shadowing).
-    var nodeAlg = Object.prototype.hasOwnProperty.call(ACTIVE, name) ? ACTIVE[name] : undefined;
+    var nodeAlg = safeObject.ownProp(ACTIVE, name);
     if (!nodeAlg) {
       if (Object.prototype.hasOwnProperty.call(DEPRECATED, name)) throw new ContentDigestError("content-digest/insecure-algorithm", "contentDigest.create: '" + name + "' is a deprecated/insecure digest algorithm (RFC 9530 §6); use sha-256 or sha-512");
       throw new ContentDigestError("content-digest/unsupported-algorithm", "contentDigest.create: unsupported digest algorithm '" + name + "'");

package/lib/vendor/blamejs/lib/cookies.js

@@ -214,15 +214,25 @@ function serialize(name, value, attrs) {
   //   __Host-*   — MUST be Secure, Path=/, NO Domain
   //
   // Caught at the source so every caller (csrf-protect / session /
-  // operator) gets the same enforcement.
-  if (name.indexOf("__Secure-") === 0) {
+  // operator) gets the same enforcement. RFC 6265bis §5.4 requires user
+  // agents to match these prefixes case-INSENSITIVELY (the server-side
+  // description in §4.1.3 reads "case-sensitive", but the UA is what
+  // actually enforces the cookie-drop): Chromium and Firefox both
+  // lowercase the name before the prefix test, so `__host-` / `__SECURE-`
+  // get the same browser enforcement -- Secure, Path=/, no Domain -- as
+  // `__Host-` / `__Secure-`. Case-sensitive matching was itself the
+  // vulnerability CVE-2024-5699 (httpwg/http-extensions#2231). Compare a
+  // lowercased copy so a case-variant name can't dodge the invariant here
+  // and then be silently dropped by the browser.
+  var lowerName = name.toLowerCase();
+  if (lowerName.indexOf("__secure-") === 0) {
     if (attrs.secure !== true) {
       throw new CookieError("cookies/prefix-secure-required",
         "__Secure-* cookies MUST set Secure (RFC 6265bis §4.1.3.1) — got '" +
         name + "' without secure: true");
     }
   }
-  if (name.indexOf("__Host-") === 0) {
+  if (lowerName.indexOf("__host-") === 0) {
     if (attrs.secure !== true) {
       throw new CookieError("cookies/prefix-host-secure-required",
         "__Host-* cookies MUST set Secure (RFC 6265bis §4.1.3.2) — got '" +

package/lib/vendor/blamejs/lib/cose.js

@@ -112,21 +112,36 @@ function _algParamsFor(algId) {
   }
 }
 
-// RFC 9053 §2 binds each ECDSA alg to ONE curve. node:crypto will happily
-// verify a sha512 (ES512-shape) signature against a P-256 key as
-// self-consistent, so without this check a COSE_Sign1 declaring ES512 but
-// carrying a P-256 key passes when ES512 is allowlisted — an alg/curve
-// confusion (the COSE sibling of jwt-external._assertAlgKtyMatch). EdDSA /
-// ML-DSA carry their parameters in the KeyObject and need no binding.
+// RFC 9053 §2 binds each COSE signature alg to ONE key shape. node:crypto
+// dispatches sign()/verify() on the KEY, never on the declared COSE alg —
+// for ECDSA it will happily verify a sha512 (ES512-shape) signature against
+// a P-256 key as self-consistent, and for the null-digest algorithms
+// (EdDSA, ML-DSA-87) it selects the primitive purely from the key type.
+// Without an alg→key binding a COSE_Sign1 declaring one algorithm but
+// carrying/using another key type verifies — an alg/key confusion (the COSE
+// sibling of jwt-external._assertAlgKtyMatch). Two live seams: a COSE_Sign1
+// declaring ES512 but carrying a P-256 key passes when ES512 is allowlisted;
+// and — because EdDSA/ML-DSA-87 both sign with a null digest — an EdDSA
+// signature passes a PQC-only ("ML-DSA-87") allowlist against an Ed25519 key
+// (and the reverse). EdDSA / ML-DSA carry no curve, so they are bound by
+// key TYPE, not curve. Every SIGNABLE alg is bound here.
 var _ES_ALG_CURVE = { ES256: "prime256v1", ES384: "secp384r1", ES512: "secp521r1" };
-function _assertEcAlgCurve(algName, key) {
-  var want = _ES_ALG_CURVE[algName];
-  if (want === undefined) return;                                                       // not an ECDSA alg — nothing to bind
-  var got = (key && key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve) || null;
-  if (key.asymmetricKeyType !== "ec" || got !== want) {
-    throw new CoseError("cose/alg-curve-mismatch",
-      "cose: alg '" + algName + "' requires an EC key on " + want +
-      ", got " + (key.asymmetricKeyType === "ec" ? got : key.asymmetricKeyType));
+var _ALG_KEY_TYPE = { EdDSA: "ed25519", "ML-DSA-87": "ml-dsa-87" };                    // null-digest algs → required key type
+function _assertAlgKeyMatch(algName, key) {
+  var wantCurve = _ES_ALG_CURVE[algName];
+  if (wantCurve !== undefined) {
+    var got = (key && key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve) || null;
+    if (!key || key.asymmetricKeyType !== "ec" || got !== wantCurve) {
+      throw new CoseError("cose/alg-curve-mismatch",
+        "cose: alg '" + algName + "' requires an EC key on " + wantCurve +
+        ", got " + (key && key.asymmetricKeyType === "ec" ? got : (key && key.asymmetricKeyType)));
+    }
+    return;
+  }
+  var wantType = _ALG_KEY_TYPE[algName];
+  if (wantType !== undefined && (!key || key.asymmetricKeyType !== wantType)) {
+    throw new CoseError("cose/alg-key-mismatch",
+      "cose: alg '" + algName + "' requires a " + wantType + " key, got " + (key && key.asymmetricKeyType));
   }
 }
 
@@ -189,7 +204,7 @@ async function sign(payload, opts) {
   var algId = ALG_NAME_TO_ID[opts.alg];
   var params = _algParamsFor(algId);
   var key = _toKeyObject(opts.privateKey, "private");
-  _assertEcAlgCurve(opts.alg, key);                                                      // RFC 9053 alg↔curve binding — refuse e.g. ES512 over a P-256 key
+  _assertAlgKeyMatch(opts.alg, key);                                                     // RFC 9053 alg↔key binding — refuse e.g. ES512 over a P-256 key, or EdDSA over an ML-DSA key
 
   var protMap = new Map();
   protMap.set(HDR_ALG, algId);
@@ -373,7 +388,7 @@ async function verify(coseSign1, opts) {
   var key = opts.publicKey
     ? _toKeyObject(opts.publicKey, "public")
     : _toKeyObject(opts.keyResolver(protMap, unprotected), "public");
-  _assertEcAlgCurve(algName, key);                                                      // RFC 9053 alg↔curve binding
+  _assertAlgKeyMatch(algName, key);                                                     // RFC 9053 alg↔key binding — refuse alg/key-type confusion (EdDSA vs ML-DSA-87, ES* vs wrong curve)
 
   var externalAad = opts.externalAad == null ? Buffer.alloc(0) : _bstr(opts.externalAad);
   var toBeSigned = _toBeSigned(protectedBstr, externalAad, payload);

package/lib/vendor/blamejs/lib/crypto-field.js

@@ -89,6 +89,11 @@ var TYPED_SENTINEL = String.fromCharCode(0) + "bjsv1:";
 
 function _encodeTyped(value) {
   if (typeof value === "string") {
+    // "" encodes to a NON-empty typed marker so a sealed empty string is a real
+    // authenticated envelope, never a bare plaintext "": vault.aad.seal refuses
+    // empty plaintext, and a bare "" in a sealed cell is indistinguishable from a
+    // ciphertext a DB-write attacker downgraded to "".
+    if (value === "") return TYPED_SENTINEL + "E:";
     return value.indexOf(TYPED_SENTINEL) === 0 ? TYPED_SENTINEL + "S:" + value : value;
   }
   if (Buffer.isBuffer(value)) return TYPED_SENTINEL + "B:" + value.toString("base64");
@@ -102,6 +107,7 @@ function _decodeTyped(str) {
   var body = str.slice(TYPED_SENTINEL.length);
   var tag = body.slice(0, 2);
   var payload = body.slice(2);
+  if (tag === "E:") return "";
   if (tag === "B:") return Buffer.from(payload, "base64");
   if (tag === "J:") return safeJson.parse(payload);   // plaintext is AEAD-verified; safeJson blocks proto-pollution defensively
   if (tag === "S:") return payload;
@@ -1071,6 +1077,11 @@ function sealRow(table, row, opts) {
   //   - plain mode: vault.seal (idempotent — already-sealed pass through).
   for (var i = 0; i < s.sealedFields.length; i++) {
     var field = s.sealedFields[i];
+    // Skip only null / undefined (nothing to seal). An empty string IS sealed:
+    // _encodeTyped("") yields a non-empty typed marker (E:), so every branch
+    // produces a real authenticated envelope -- never a bare plaintext "" that a
+    // DB-write attacker could forge, or that a ciphertext could be silently
+    // downgraded to (unsealRow fails closed on a bare "" in an AAD/keyed cell).
     if (out[field] === undefined || out[field] === null) continue;
     if (kRow && field === residencyCol) continue;   // residency tag stays plaintext
     if (kRow) {
@@ -1216,6 +1227,27 @@ function unsealRow(table, row, actor, dbHandle) {
 
   for (var i = 0; i < s.sealedFields.length; i++) {
     var field = s.sealedFields[i];
+    // Post-seal, a legitimately-empty sealed value is a NON-empty authenticated
+    // envelope (see _encodeTyped "" -> E:), so a bare "" present in an AAD-bound
+    // or per-row-key sealed column is an envelope-downgrade tamper -- a DB-write
+    // attacker replacing a ciphertext with "". Fail closed (null the cell + audit),
+    // mirroring the plain-vault aad-downgrade refusal below; never surface it as a
+    // valid empty value. Plain-mode tables keep the lenient pass-through.
+    if (out[field] === "" && (s.aad || keyedTable)) {
+      out[field] = null;
+      try {
+        audit().safeEmit({
+          action:  "system.crypto.unseal_failed",
+          outcome: "failure",
+          metadata: {
+            table: table, field: field, rowId: out[s.rowIdField] || out._id || null,
+            shape: (s.aad ? "aad" : "row"),
+            reason: "empty-string cell in a sealed AAD/keyed column (envelope downgrade)",
+          },
+        });
+      } catch (_e) { /* drop-silent */ }
+      continue;
+    }
     if (out[field]) {
       // Per-cell envelope shape for audit metadata (operators write alert
       // rules off it): "row" = K_row cell, "aad" = vault.aad: cell on an

package/lib/vendor/blamejs/lib/crypto-oprf.js

@@ -98,8 +98,17 @@ var SUITES = Object.keys(SUITE_IMPL);
  *   // out === s.oprf.evaluate(kp.secretKey, Buffer.from("user@example.com"))
  */
 function suite(name) {
-  var impl = SUITE_IMPL[String(name).toLowerCase()];
-  if (!impl) throw new OprfError("oprf/bad-suite", "crypto.oprf.suite: unknown suite '" + name + "'; expected one of " + SUITES.join(", "));
+  // Own-property guard, not a truthiness check: SUITE_IMPL is a plain object,
+  // so a bracket read with a prototype-chain name ("__proto__" → Object.prototype,
+  // "constructor" → the Object constructor) returns a truthy inherited value that
+  // an `if (!impl)` guard would accept as a "suite". Match the hasOwnProperty
+  // shape b.crypto.sri uses for its algorithm table so an unknown name — however
+  // it collides with Object.prototype — refuses cleanly with OprfError.
+  var key = String(name).toLowerCase();
+  if (!Object.prototype.hasOwnProperty.call(SUITE_IMPL, key)) {
+    throw new OprfError("oprf/bad-suite", "crypto.oprf.suite: unknown suite '" + name + "'; expected one of " + SUITES.join(", "));
+  }
+  var impl = SUITE_IMPL[key];
   // Expose only the modes the vendored @noble/curves implements (base +
   // verifiable). poprf is omitted rather than surfaced as an empty stub.
   return { name: impl.name, oprf: impl.oprf, voprf: impl.voprf };

package/lib/vendor/blamejs/lib/crypto-xwing.js

@@ -69,11 +69,29 @@ function _x25519Public(sk) {
   var spki = nodeCrypto.createPublicKey(key).export({ format: "der", type: "spki" });
   return spki.subarray(spki.length - X25519_LEN);
 }
+// draft-connolly-cfrg-xwing-kem uses X25519 exactly as RFC 7748 specifies it,
+// WITHOUT the optional RFC 7748 section 6.1 abort on an all-zero shared secret.
+// Decapsulation must be uniform implicit-rejection: a hostile low-order X25519
+// ephemeral in the ciphertext must NOT be able to signal validity by making
+// decapsulate throw (the documented "yields a different secret rather than an
+// error" contract, and a defense against a decapsulation oracle / crash-on-
+// crafted-input DoS). OpenSSL (the X25519 backing this seam) DOES abort that
+// derivation, so translate its error back into the all-zero shared secret RFC
+// 7748 X25519 yields for a low-order input point. The combiner still binds ctX
+// and pkX and the ML-KEM-768 leg still protects the result, so collapsing the
+// classical leg costs only the classical half of the "secure if either holds"
+// guarantee. A short/malformed key fails earlier at createPublicKey with a
+// different code and still propagates.
 function _x25519Shared(sk, pk) {
-  return nodeCrypto.diffieHellman({
-    privateKey: nodeCrypto.createPrivateKey({ key: Buffer.concat([X25519_PKCS8_PREFIX, sk]), format: "der", type: "pkcs8" }),
-    publicKey:  nodeCrypto.createPublicKey({ key: Buffer.concat([X25519_SPKI_PREFIX, pk]), format: "der", type: "spki" }),
-  });
+  try {
+    return nodeCrypto.diffieHellman({
+      privateKey: nodeCrypto.createPrivateKey({ key: Buffer.concat([X25519_PKCS8_PREFIX, sk]), format: "der", type: "pkcs8" }),
+      publicKey:  nodeCrypto.createPublicKey({ key: Buffer.concat([X25519_SPKI_PREFIX, pk]), format: "der", type: "spki" }),
+    });
+  } catch (e) {
+    if (e && e.code === "ERR_OSSL_FAILED_DURING_DERIVATION") return Buffer.alloc(X25519_LEN);
+    throw e;
+  }
 }
 
 function _shake256(buf, outLen) { return nodeCrypto.createHash("shake256", { outputLength: outLen }).update(buf).digest(); }