@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/lib/vc.js

@@ -151,11 +151,41 @@ function _validateVcdm(cred, opts) {
   }
 }
 
+// XSD dateTime (VCDM 2.0 section 4.9): [-]CCYY-MM-DDThh:mm:ss with an optional
+// fractional second and an optional timezone (Z or +/-hh:mm). Date.parse alone
+// is far too lenient in TWO ways: it accepts non-XSD shapes (a bare year, a
+// slash date, a date with no time, locale forms), AND for an in-shape but
+// IMPOSSIBLE calendar date it NORMALIZES rather than rejects (2024-02-31 ->
+// 2024-03-02, a non-leap 2023-02-29 -> 2023-03-01, 2024-04-31 -> 2024-05-01),
+// silently shifting the validity window. So the shape is asserted with a
+// capturing regex AND the calendar fields are range-checked (month 1..12, day
+// within the real length of that month, leap years honoured) BEFORE Date.parse.
+var _XSD_DATETIME = /^(-?\d{4,})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})?$/;
+
+function _daysInMonth(year, month) {
+  if (month === 2) {
+    var leap = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+    return leap ? 29 : 28;
+  }
+  return (month === 4 || month === 6 || month === 9 || month === 11) ? 30 : 31;
+}
+
 function _parseValidityField(cred, name) {
   if (cred[name] === undefined) return null;
-  if (typeof cred[name] !== "string") {
+  var m = typeof cred[name] === "string" ? _XSD_DATETIME.exec(cred[name]) : null;
+  if (!m) {
     throw new VcError("vc/bad-validity", "vc: " + name + " must be an XSD dateTime string");
   }
+  var year = Number(m[1]), month = Number(m[2]), day = Number(m[3]);
+  // Reject an in-shape but impossible calendar DATE before Date.parse can
+  // normalize a day overflow into a different valid instant (2024-02-31 ->
+  // 2024-03-02, a non-leap 2023-02-29 -> 2023-03-01). Time-field overflow
+  // (hour/minute/second) is already rejected by Date.parse below (NaN), and
+  // 24:00:00 is the valid XSD end-of-day, so only the day-of-month needs a guard.
+  if (month < 1 || month > 12 || day < 1 || day > _daysInMonth(year, month)) {
+    throw new VcError("vc/bad-validity",
+      "vc: " + name + " is not a real calendar date: " + cred[name]);
+  }
   var ms = Date.parse(cred[name]);
   if (!isFinite(ms)) {
     throw new VcError("vc/bad-validity", "vc: " + name + " is not a valid dateTime: " + cred[name]);
@@ -217,10 +247,10 @@ function _sign(doc, opts, joseTyp, coseTyp, coseContentType, fnName) {
     });
   }
   if (opts.securing === "jose") {
-    var params = JOSE_ALGS[opts.alg];
-    if (!params) {
+    if (!Object.prototype.hasOwnProperty.call(JOSE_ALGS, opts.alg)) {
       throw new VcError("vc/bad-alg", fnName + ": JOSE securing requires alg ES256/384/512 or EdDSA (got " + opts.alg + ")");
     }
+    var params = JOSE_ALGS[opts.alg];
     var key = _toKey(opts.privateKey, "private");
     var header = { alg: opts.alg, typ: joseTyp };
     if (typeof opts.kid === "string") header.kid = opts.kid;
@@ -287,9 +317,18 @@ async function _verifyCose(bytes, opts, expectedTyp) {
     publicKey:   opts.publicKey,
     keyResolver: opts.keyResolver,
   });
+  // The typ header (RFC 9596 label 16) binds the COSE_Sign1 to the
+  // vc+cose / vp+cose media type. The JOSE path MANDATES its typ; the COSE
+  // path must too — an absent typ is not "unspecified, therefore ok" but an
+  // unbound statement that could be a signature made for another purpose
+  // (or the sibling securing form). Require it, symmetric with _verifyJose,
+  // rather than only checking it when present (which let an issuer-signed
+  // but typ-less COSE_Sign1 be accepted under a weaker contract).
   var typ = out.protectedHeaders.get(HDR_COSE_TYP);
-  if (typ !== undefined && typ !== expectedTyp) {
-    throw new VcError("vc/bad-typ", "vc.verify: COSE typ header is '" + typ + "', expected '" + expectedTyp + "'");
+  if (typ !== expectedTyp) {
+    throw new VcError("vc/bad-typ",
+      "vc.verify: COSE typ header is " + (typ === undefined ? "absent" : "'" + typ + "'") +
+      ", expected '" + expectedTyp + "'");
   }
   var payload;
   try { payload = safeJson.parse(out.payload.toString("utf8")); }

package/lib/vendor/blamejs/lib/vendor/MANIFEST.json

@@ -12,13 +12,13 @@
       "files": {
         "server": "lib/vendor/noble-ciphers.cjs"
       },
-      "bundler": "esbuild --format=cjs --minify --platform=node",
-      "bundledAt": "2026-04-25T00:00:00Z",
+      "bundler": "esbuild --format=cjs --platform=node",
+      "bundledAt": "2026-07-13T00:00:00Z",
       "cpe": "cpe:2.3:a:paulmillr:noble-ciphers:2.2.0:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:5d539dfc9ef47121d4c09bd7256d76448a1f5ac47ee09ac44c78ff6a062af9ab"
+        "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
       },
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -34,13 +34,13 @@
       "files": {
         "server": "lib/vendor/noble-curves.cjs"
       },
-      "bundler": "esbuild --format=cjs --minify --platform=node",
-      "bundledAt": "2026-05-26T00:00:00Z",
+      "bundler": "esbuild --format=cjs --platform=node",
+      "bundledAt": "2026-07-13T00:00:00Z",
       "cpe": "cpe:2.3:a:paulmillr:noble-curves:2.2.0:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:ebf254d5eb56aef8705a1c4af9603f47987b4870a9bb5e657e06907b701e2731"
+        "server": "sha256:2880c288b1285ef51d356d057bee6f0c8a00de36638cf47b47617e8c1faf10d5"
       },
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -65,13 +65,13 @@
       "files": {
         "server": "lib/vendor/noble-post-quantum.cjs"
       },
-      "bundler": "esbuild --format=cjs --minify --platform=node",
-      "bundledAt": "2026-05-06T00:00:00Z",
+      "bundler": "esbuild --format=cjs --platform=node",
+      "bundledAt": "2026-07-13T00:00:00Z",
       "cpe": "cpe:2.3:a:paulmillr:noble-post-quantum:0.6.1:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:f9190309daadca4c2e2cc2b76beaa6b96e463429cc3c390bd9f0ceaf7b588c68"
+        "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
       },
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -88,13 +88,13 @@
       "files": {
         "server": "lib/vendor/simplewebauthn-server.cjs"
       },
-      "bundler": "esbuild --format=cjs --minify --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-06-24T00:00:00Z",
+      "bundler": "esbuild --format=cjs --platform=node --alias:reflect-metadata=reflect-metadata/lite --external:crypto --external:node:crypto",
+      "bundledAt": "2026-07-13T00:00:00Z",
       "cpe": "cpe:2.3:a:simplewebauthn:server:13.3.2:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:49411d893f5e9b0e2fcaa564b4ec7921f73a9a06229b5e53d49c1453ea1a365c"
+        "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -152,14 +152,14 @@
         "data_js": "lib/vendor/public-suffix-list.data.js"
       },
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
-      "bundledAt": "2026-06-24T00:00:00Z",
+      "bundledAt": "2026-07-24T00:00:00Z",
       "hashes": {
-        "server": "sha256:5afbeea28737514a69a0bdca7cd3818979e67c443444de4d19f2f8713cf5372e",
-        "data_js": "sha256:6ed61937db12f148494db7c336498740bf4458cd9f49ec73d887eda83529f207"
+        "server": "sha256:1fc04fd8ebd4b77c78c38c76d832673c27b56ca154fda6339be61f38b9918701",
+        "data_js": "sha256:1d17ee3059030d1de7208d699ffdd1595c97cd3009d1f41bbfde2ba1a3315372"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -185,12 +185,12 @@
       "files": {
         "server": "lib/vendor/pki.cjs"
       },
-      "bundler": "esbuild --format=cjs --minify --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-04-29T00:00:00Z",
+      "bundler": "esbuild --format=cjs --platform=node --alias:reflect-metadata=reflect-metadata/lite --external:node:crypto --external:crypto",
+      "bundledAt": "2026-07-13T00:00:00Z",
       "hashes": {
-        "server": "sha256:9bbc191afaaa2b1e5757f00480457c08134cdc2c55d541df18d9155bba9cbf77"
+        "server": "sha256:2307ef65e070757ffb13442b377e45efb9fa1a10432d9b39618387720ab990ed"
       },
-      "refreshedAt": "2026-07-02T23:54:12.403Z"
+      "refreshedAt": "2026-07-25T04:14:23.876Z"
     }
   }
 }