@blamejs/blamejs-shop 0.5.19 → 0.5.20

package/lib/vendor/blamejs/lib/webhook-hmac.js

@@ -94,6 +94,7 @@ function _requireNonEmptyString(val, name) {
  *   sigField:     string,          // default: "v1"
  *   alg:          string,          // default: "hmac-sha256" (also "hmac-sha512")
  *   toleranceSec: number,          // default: 300 (5 minutes)
+ *   now:          number,          // epoch ms for the replay window; default: Date.now()
  *
  * @example
  *   var v = b.webhookHmac.verify({
@@ -107,7 +108,8 @@ function verify(opts) {
   opts = validateOpts.requireObject(opts, "webhookHmac.verify",
     WebhookHmacError, "webhook-hmac/bad-opts");
   validateOpts(opts,
-    ["header", "rawBody", "secret", "profile", "tsField", "sigField", "alg", "toleranceSec"],
+    ["header", "rawBody", "secret", "profile", "tsField", "sigField", "alg", "toleranceSec",
+      "now"],
     "webhookHmac.verify");
 
   // Resolve profile → field/alg defaults; explicit opts win.
@@ -141,6 +143,21 @@ function verify(opts) {
     WebhookHmacError, "webhook-hmac/bad-tolerance");
   var tolerance = typeof opts.toleranceSec === "number" ? opts.toleranceSec : DEFAULT_TOLERANCE_SEC;
 
+  // Replay window measured against an injectable clock (epoch milliseconds,
+  // the shape b.cwt.verify already takes), defaulting to wall time. A caller
+  // that owns its own time source -- a receiver built around an injected
+  // clock, a forensic replay of a captured delivery, a deterministic
+  // simulation -- otherwise has to abandon this primitive and rebuild the
+  // scheme by hand, since its window check and this one disagree the moment
+  // the injected clock is not now.
+  //
+  // An injected clock rather than a skip-the-check flag: the replay defense
+  // stays inside the primitive, and omitting the option falls back to wall
+  // time, so forgetting it fails closed instead of silently accepting an
+  // arbitrarily old delivery.
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.now, "now",
+    WebhookHmacError, "webhook-hmac/bad-now");
+
   // Parse "t=<ts>,v1=<sig>,v1=<rotated>" — comma-separated k=v. Collect the ts
   // and EVERY sigField value; ignore any other version keys.
   var tsRaw = null;
@@ -169,7 +186,7 @@ function verify(opts) {
     throw new WebhookHmacError("webhook-hmac/bad-timestamp",
       "verify: '" + tsField + "' is not a positive integer");
   }
-  var nowSec = Math.floor(Date.now() / 1000);
+  var nowSec = Math.floor((typeof opts.now === "number" ? opts.now : Date.now()) / 1000);
   var skew = Math.abs(nowSec - ts);
   if (skew > tolerance) {
     throw new WebhookHmacError("webhook-hmac/timestamp-skew",

package/lib/vendor/blamejs/lib/webhook.js

@@ -485,7 +485,7 @@ function signer(opts) {
       }, retryOpts);
       var statusCode = (res && (res.statusCode || res.status)) || 0;
       _emitEvent("webhook.send", 1, {
-        outcome: statusCode >= 200 && statusCode < 300 ? "success" : "failure",
+        outcome: C.HTTP.success(statusCode) ? "success" : "failure",
         status: statusCode,
         host: hostLabel,
       });

package/lib/vendor/blamejs/lib/ws-client.js

@@ -381,7 +381,23 @@ class WsClient extends EventEmitter {
                (parsed.protocol === "wss:" ? 443 : 80);                                  // TLS / HTTP default port
     var host = parsed.hostname;
 
-    function _onError(err) { self._handleSocketError(err); }
+    // Filled in on the wss:// path below with the options the dial actually
+    // used. dialTlsOpts is merged OVER the shared posture, so a caller that
+    // narrowed ecdhCurve or moved minVersion negotiated on something the
+    // shared object does not describe, and diagnosing against the shared one
+    // would answer for a connection that was never made.
+    var effectiveTls = null;
+
+    function _onError(err) {
+      // A wss:// handshake refused by the posture arrives as a bare OpenSSL
+      // alert; name the cause before it reaches the caller's handler.
+      networkTls().annotateOutboundFailure(err, {
+        host:    host,
+        port:    port,
+        tlsOpts: effectiveTls || {},
+      });
+      self._handleSocketError(err);
+    }
 
     // Pin the connect to the SSRF-validated IPs returned by
     // ssrfGuard.checkUrl — closes the DNS-rebinding TOCTOU window where
@@ -413,6 +429,12 @@ class WsClient extends EventEmitter {
         port:         port,
         rejectUnauthorized: true,
       }, networkTls().outboundPosture(), dialTlsOpts || {});
+      // The posture advertises RFC 8879 certificate compression, which is a
+      // TLS 1.3 extension. A caller who capped this dial lower asked for none
+      // of it, and Node refuses the whole options object rather than ignoring
+      // an extension it cannot use.
+      networkTls()._stripUnreachableCertCompression(tlsOpts, dialTlsOpts);
+      effectiveTls = tlsOpts;
       // RFC 6066 §3: the TLS SNI ServerName MUST be a hostname, never an IP
       // literal — Node throws ERR_INVALID_ARG_VALUE when servername is an IP,
       // which made wss:// to any IP-literal target unusable. Send SNI only for
@@ -541,7 +563,7 @@ class WsClient extends EventEmitter {
       return;
     }
     var status = parseInt(match[1], 10);
-    if (status !== 101) {                                                                 // HTTP 101
+    if (status !== C.HTTP.STATUS.SWITCHING_PROTOCOLS) {                                                                 // HTTP 101
       // Body bytes after the header section are the server's
       // explanation. Surface them on the error so callers can branch
       // on the status code and inspect the body without re-parsing

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.17",
+  "version": "0.18.21",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:64b32cc6-e5c4-4968-a1b3-33ca68975bed",
+  "serialNumber": "urn:uuid:885de67e-71f9-4512-83e7-3538ecfd9d88",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-08T17:14:55.062Z",
+    "timestamp": "2026-08-10T21:28:58.997Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.17",
+      "bom-ref": "@blamejs/core@0.18.21",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.17",
+      "version": "0.18.21",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.17",
+      "purl": "pkg:npm/%40blamejs/core@0.18.21",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.17",
+      "ref": "@blamejs/core@0.18.21",
       "dependsOn": []
     }
   ]

package/lib/webhook-receiver.js

@@ -44,12 +44,14 @@
  *     - `b.crypto.namespaceHash`   — secret-at-rest fingerprint.
  *     - `b.crypto.sha3Hash`        — body fingerprint for audit.
  *     - `b.crypto.generateBytes`   — secret plaintext draw.
- *     - `b.crypto.timingSafeEqual` — constant-time hex compare on
- *                                    secret-hash + signature match.
- *     - `b.webhook.sign`           — HMAC-SHA-256 computation under
- *                                    the Stripe-shape algorithm
- *                                    (`t=<ts>,v1=<hex>`); we extract
- *                                    the hex portion.
+ *     - `b.crypto.timingSafeEqual` — constant-time hex compare on the
+ *                                    secret-hash match.
+ *     - `b.webhookHmac.verify`     — the whole `t=<ts>,v1=<hex>` scheme:
+ *                                    HMAC-SHA-256 over `<timestamp>.<raw-body>`,
+ *                                    the replay window (on this receiver's
+ *                                    injected clock and the source row's
+ *                                    tolerance), and a constant-time compare
+ *                                    across every signature the header carries.
  *     - `b.uuid.v7`                — row ids.
  *
  *   Surface:
@@ -305,34 +307,6 @@ function _hashSecret(canonical) {
   return b.crypto.namespaceHash(SECRET_NAMESPACE, canonical);
 }
 
-// Extract the v1 hex tag from a `t=<ts>,v1=<hex>` Stripe-shape header
-// produced by b.webhook.sign. We pin to this composition rather than
-// reach for node:crypto so the receiver inherits whatever HMAC-SHA-256
-// hardening lives in the vendored blamejs surface.
-function _hmacSha256Hex(secretPlaintext, timestampSeconds, bodyString) {
-  var header = b.webhook.sign({
-    alg:       "hmac-sha256-stripe",
-    secret:    secretPlaintext,
-    body:      bodyString,
-    timestamp: timestampSeconds,
-  });
-  // Header shape is `t=<ts>,v1=<hex>` — the marker is the only place
-  // ",v1=" appears so a literal indexOf is the canonical parse.
-  var marker = ",v1=";
-  var i = header.indexOf(marker);
-  if (i < 0) {
-    // Defensive: a future blamejs version that changes the shape
-    // would slip past silently if we returned an empty string. Throw
-    // loudly so the operator notices at deploy time, not at the
-    // first inbound webhook.
-    throw new Error(
-      "webhookReceiver: b.webhook.sign returned an unexpected header shape " +
-      "(no ',v1=' marker) — vendored blamejs may need a refresh"
-    );
-  }
-  return header.slice(i + marker.length);
-}
-
 // ---- factory ------------------------------------------------------------
 
 function create(opts) {
@@ -610,40 +584,9 @@ function create(opts) {
           timestamp_out_of_window:  false,
         };
       }
-      var timestampSeconds = parseInt(tsStr, 10);
-      if (!Number.isFinite(timestampSeconds) || timestampSeconds < 0) {
-        return {
-          ok:                       false,
-          event_id:                 null,
-          replay:                   false,
-          signature_invalid:        true,
-          timestamp_out_of_window:  false,
-        };
-      }
-
-      // Replay-window check. The third-party's timestamp must land
-      // within ±replay_window_seconds of the receiver's current
-      // wall-clock. We accept future-skewed timestamps inside the
-      // window (a peer with a slightly fast clock shouldn't reject)
-      // but not arbitrarily-future timestamps that would let an
-      // attacker bypass replay protection by stamping a fresh ts.
-      var windowSec = Number(sourceRow.replay_window_seconds);
-      var nowSec    = Math.floor(nowMs / 1000);
-      var ageSec    = Math.abs(nowSec - timestampSeconds);
-      if (ageSec > windowSec) {
-        return {
-          ok:                       false,
-          event_id:                 null,
-          replay:                   false,
-          signature_invalid:        false,
-          timestamp_out_of_window:  true,
-        };
-      }
-
-      // Signature validation. The third-party signs the literal
-      // `<timestamp>.<body>` string with HMAC-SHA-256 under the
-      // secret. We recompute via b.webhook.sign and constant-time-
-      // compare the supplied hex against the expected hex.
+      // The signature must be exactly the hex digest before it is composed
+      // into the header below — a value carrying a comma or an `=` would
+      // otherwise add fields the parser reads as its own.
       var supplied = input.signature_header.trim().toLowerCase();
       if (!SIGNATURE_HEX_RE.test(supplied)) {
         return {
@@ -654,15 +597,42 @@ function create(opts) {
           timestamp_out_of_window:  false,
         };
       }
-      var expected = _hmacSha256Hex(matched.plaintext, timestampSeconds, bodyBytes.toString("utf8"));
-      var sigOk = b.crypto.timingSafeEqual(supplied, expected);
-      if (!sigOk) {
+
+      // Signature + replay window, both from b.webhookHmac. It owns this exact
+      // scheme — `t=<ts>,v1=<hex>` over `<timestamp>.<raw-body>` — including
+      // the strict-integer timestamp, the skew window, a constant-time compare
+      // and multi-signature support for a rotated secret. This receiver takes
+      // its clock from the operator (opts.now) and its window from the source
+      // row, so both are passed in; the primitive gained the clock argument in
+      // 0.18.18, which is what made composing it possible at all.
+      //
+      // The body goes in as BYTES. Signing a UTF-8 string rebuild of it
+      // replaces anything that is not valid UTF-8 with U+FFFD, taking the
+      // digest over different bytes than the sender signed and rejecting a
+      // correctly-signed delivery. The timestamp goes in as the raw header
+      // text rather than a reparsed integer for the same reason.
+      var windowSec = Number(sourceRow.replay_window_seconds);
+      try {
+        b.webhookHmac.verify({
+          header:       "t=" + tsStr + ",v1=" + supplied,
+          rawBody:      bodyBytes,
+          secret:       matched.plaintext,
+          profile:      "stripe",
+          toleranceSec: windowSec,
+          now:          nowMs,
+        });
+      } catch (e) {
+        // Out-of-window and bad-signature are distinct outcomes to an operator
+        // reading the delivery log: one is a clock or a replay, the other is a
+        // wrong secret. Every other refusal is a malformed header, which is
+        // not a signature the receiver can accept.
+        var skew = e && e.code === "webhook-hmac/timestamp-skew";
         return {
           ok:                       false,
           event_id:                 null,
           replay:                   false,
-          signature_invalid:        true,
-          timestamp_out_of_window:  false,
+          signature_invalid:        !skew,
+          timestamp_out_of_window:  skew,
         };
       }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.5.19",
+  "version": "0.5.20",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {