@blamejs/blamejs-shop 0.5.4 → 0.5.6

package/lib/vendor/blamejs/lib/auth/oid4vci.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.auth.oid4vci
@@ -665,7 +667,21 @@ function create(opts) {
           "exchangePreAuthorizedCode: tx_code does not match");
       }
     }
-    await codeStore.del(eopts.preAuthCode);
+    // Single-use enforcement under concurrency: claim the code by deleting it
+    // and gate issuance on having WON that delete. codeStore.del returns true
+    // only for the caller that removed the entry (a single DELETE ... WHERE /
+    // redis DEL is atomic — exactly one of two racing redemptions gets a true
+    // return, the other false). Without gating on the return, two concurrent
+    // /token requests with the same pre-authorized_code (and matching tx_code)
+    // both read the entry, both delete, and both mint an access token — issuing
+    // two credentials from a code RFC OID4VCI §3.5 mandates be single-use. The
+    // tx_code check above runs first and throws without consuming, so a wrong
+    // tx_code does not burn the code (a retrying wallet is unaffected).
+    var claimed = await codeStore.del(eopts.preAuthCode);
+    if (!claimed) {
+      throw new AuthError("auth-oid4vci/invalid-pre-auth-code",
+        "exchangePreAuthorizedCode: pre-authorized_code already redeemed");
+    }
     var accessToken = generateToken(32);                                                         // 256-bit access token
     var cNonce = generateToken(16);                                                              // 128-bit c_nonce
     var record = {
@@ -760,30 +776,55 @@ function create(opts) {
       throw new AuthError("auth-oid4vci/no-claims",
         "issueCredential: claims required (operator looks up the subject's data and supplies them)");
     }
-    var sdJwtToken = await opts.sdJwtIssuer.issue({
-      vct:                  spec.vct,
-      subject:              record.subject,
-      claims:               iopts.claims,
-      selectivelyDisclosed: iopts.selectivelyDisclosed || Object.keys(iopts.claims),
-      holderKey:            verified.jwk,
-      ttlMs:                iopts.ttlMs,
-    });
+    // Single-use access token: CLAIM it (atomic, gated delete) BEFORE minting,
+    // so two concurrent issueCredential calls bearing the same token can't both
+    // produce a credential. atStore.del returns true only for the caller that
+    // removed the entry; the loser is refused. The proof and claims checks above
+    // run first, so a bad proof does not burn the token (a wallet can retry).
+    // Done before the mint because deleting it only as post-mint cleanup let two
+    // racing requests both read the token and both mint (re-minting from a
+    // single-use token). c_nonce rotation alone does not stop this — both
+    // requests read the same un-rotated c_nonce.
+    if (accessTokenSingleUse) {
+      var atClaimed = await atStore.del(iopts.accessToken);
+      if (!atClaimed) {
+        throw new AuthError("auth-oid4vci/access-token-consumed",
+          "issueCredential: access token already used (single-use)");
+      }
+    }
+    var sdJwtToken;
+    try {
+      sdJwtToken = await opts.sdJwtIssuer.issue({
+        vct:                  spec.vct,
+        subject:              record.subject,
+        claims:               iopts.claims,
+        selectivelyDisclosed: iopts.selectivelyDisclosed || Object.keys(iopts.claims),
+        holderKey:            verified.jwk,
+        ttlMs:                iopts.ttlMs,
+      });
+    } catch (e) {
+      // Issuance failed AFTER the single-use access token was claimed (the
+      // operator's issuer threw — a transient signer/KMS outage or a validation
+      // error). Restore the token so the wallet can retry: the claim exists
+      // only to stop a concurrent double-mint, not to burn the token when no
+      // credential was returned. The next attempt re-claims atomically, so this
+      // opens no double-mint window.
+      if (accessTokenSingleUse) {
+        try { await atStore.set(iopts.accessToken, record); } catch (_e) { /* best-effort restore */ }
+      }
+      throw e;
+    }
 
     // Rotate c_nonce so a replayed proof-JWT for a follow-up
     // batch_credential request is rejected.
     var newCNonce = generateToken(16);                                                           // 128-bit c_nonce
     await cNonceStore.set(iopts.accessToken, newCNonce);
 
-    // When single-use is on (default), DELETE the access token
-    // after successful credential mint. A stolen access token paired
-    // with a fresh proof would otherwise re-mint credentials; the
-    // c_nonce rotation alone defends against proof replay but not
-    // against an attacker who exfiltrated the access token. The
-    // accompanying c_nonce entry expires with its TTL; deleting it
-    // explicitly tightens cleanup.
+    // The single-use access token was already claimed (atomically) before the
+    // mint above. Here we only clean up its now-orphaned c_nonce entry (it would
+    // otherwise expire with its TTL). Best-effort.
     if (accessTokenSingleUse) {
       try {
-        await atStore.del(iopts.accessToken);
         await cNonceStore.del(iopts.accessToken);
       } catch (_e) { /* drop-silent — cleanup is best-effort */ }
     }

package/lib/vendor/blamejs/lib/auth/oid4vp.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.auth.oid4vp

package/lib/vendor/blamejs/lib/auth/openid-federation.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.auth.openidFederation

package/lib/vendor/blamejs/lib/auth/passkey.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Passkey / WebAuthn (FIDO2) — registration + authentication primitives.

package/lib/vendor/blamejs/lib/auth/password.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Argon2id password hashing — public framework primitive.

package/lib/vendor/blamejs/lib/auth/saml.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.auth.saml
@@ -1050,7 +1052,7 @@ function create(opts) {
         "parseLogoutRequest: inflate failed: " + ((e && e.message) || String(e)));
     }
     // Verify the redirect-binding signature when an IdP key is supplied.
-    if (vopts.idpVerifyKey) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutRequest")) {
       if (typeof vopts.queryString !== "string") {
         throw new AuthError("auth-saml/no-query-string",
           "parseLogoutRequest: idpVerifyKey requires queryString (raw URL query)");
@@ -1238,7 +1240,7 @@ function create(opts) {
       throw new AuthError("auth-saml/bad-saml-response",
         "parseLogoutResponse: inflate failed: " + ((e && e.message) || String(e)));
     }
-    if (vopts.idpVerifyKey) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutResponse")) {
       if (typeof vopts.queryString !== "string") {
         throw new AuthError("auth-saml/no-query-string",
           "parseLogoutResponse: idpVerifyKey requires queryString");
@@ -1410,7 +1412,7 @@ function create(opts) {
         "parseLogoutRequestPost: samlRequestB64 must be a non-empty string");
     }
     var xml = Buffer.from(samlRequestB64, "base64").toString("utf8");
-    if (vopts.idpVerifyKey || vopts.idpVerifyAlg) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutRequestPost")) {
       _verifyEmbeddedXmlDsig(xml, vopts.idpVerifyKey, vopts.idpVerifyAlg, "LogoutRequest");
     }
     var c14n = xmlC14n();
@@ -1532,7 +1534,7 @@ function create(opts) {
         "parseLogoutResponseSoap: soap:Body is empty");
     }
     var innerXml = Buffer.from(c14n.canonicalize(inner)).toString("utf8");
-    if (vopts.idpVerifyKey || vopts.idpVerifyAlg) {
+    if (_verifyConfig(vopts.idpVerifyKey, vopts.idpVerifyAlg, "parseLogoutResponseSoap")) {
       _verifyEmbeddedXmlDsig(innerXml, vopts.idpVerifyKey, vopts.idpVerifyAlg, "LogoutResponse");
     }
     var innerLocal = inner.name.split(":").pop();
@@ -1864,8 +1866,31 @@ function _embedXmlDsig(bodyXml, refId, signingKey, signingAlg) {
   return bodyXml.substring(0, splitAt) + sigEl + bodyXml.substring(splitAt);
 }
 
+// SLO verification-config gate. Presence of EITHER idpVerifyKey or
+// idpVerifyAlg signals the operator intends to verify the inbound
+// message; a half-supplied pair is a configuration error, never a
+// license to skip the signature check. Returns true when both are
+// present (verify), false when neither is (verification not requested),
+// and throws — fail closed — when exactly one is present, so a
+// fat-fingered verifier can never silently accept a forged, unsigned
+// LogoutRequest / LogoutResponse. Every SLO parse path (HTTP-Redirect,
+// HTTP-POST, SOAP) routes its verify decision through this one gate so
+// the redirect and back-channel bindings agree on fail-closed behavior.
+function _verifyConfig(idpVerifyKey, idpVerifyAlg, ctx) {
+  if (!idpVerifyKey && !idpVerifyAlg) return false;
+  if (!idpVerifyKey) {
+    throw new AuthError("auth-saml/no-verify-key",
+      ctx + ": idpVerifyAlg supplied without idpVerifyKey — verification cannot proceed");
+  }
+  if (!idpVerifyAlg) {
+    throw new AuthError("auth-saml/no-verify-alg",
+      ctx + ": idpVerifyKey supplied without idpVerifyAlg (alg is required when key is supplied)");
+  }
+  return true;
+}
+
 function _verifyEmbeddedXmlDsig(xml, idpVerifyKey, idpVerifyAlg, expectedRootLocal) {
-  if (!idpVerifyKey || !idpVerifyAlg) return;
+  if (!_verifyConfig(idpVerifyKey, idpVerifyAlg, "_verifyEmbeddedXmlDsig")) return;
   var sigAlgUrn = _sigAlgUrn(idpVerifyAlg);
   if (!sigAlgUrn) {
     throw new AuthError("auth-saml/bad-verify-alg",
@@ -2128,12 +2153,48 @@ async function fetchMdq(opts) {
   if (opts.trustCertPem) {
     var c14n = xmlC14n();
     var root = c14n.parse(xml);
-    var sig = _findChild(root, "Signature");
+    // The element the operator consumes is the document-root EntityDescriptor
+    // (fetchMdq queries a single entityID; an EntitiesDescriptor aggregate is
+    // not what a per-entity MDQ lookup returns). Refusing the wrapper closes the
+    // XML-signature-wrapping vector where a genuine federation signature over a
+    // buried entity is paired with a forged sibling/outer entity carrying the
+    // attacker's signing cert (CVE-2024-45409 class).
+    var rootColon = root.name.indexOf(":");
+    var rootLocal = rootColon !== -1 ? root.name.substring(rootColon + 1) : root.name;
+    if (rootLocal !== "EntityDescriptor") {
+      throw new AuthError("auth-saml/mdq-not-entity-descriptor",
+        "fetchMdq: metadata root must be a single EntityDescriptor, got " + rootLocal +
+        " (signature-wrapping defense)");
+    }
+    // Refuse a duplicate top-level Signature (XSW multi-signature shape), the
+    // way verifyResponse refuses duplicate security-critical children.
+    var sigChildren = _findAllChildren(root, "Signature", null);
+    if (sigChildren.length > 1) {
+      throw new AuthError("auth-saml/mdq-duplicate-signature",
+        "fetchMdq: EntityDescriptor has multiple Signature children (XSW shape refused)");
+    }
+    var sig = sigChildren[0] || null;
     if (!sig) {
       throw new AuthError("auth-saml/mdq-unsigned",
         "fetchMdq: metadata is unsigned but trustCertPem was supplied");
     }
-    _verifyXmldsig(xml, sig, opts.trustCertPem);
+    var signed = _verifyXmldsig(xml, sig, opts.trustCertPem);
+    // Bind the verified bytes to the consumed element: the federation signature
+    // MUST cover the document-root EntityDescriptor, not some inner element a
+    // wrapper buried beside a forged one. Mirrors verifyResponse's
+    // signed.refId === _attr(root/assertion, "ID") guard.
+    if (signed.refId !== _attr(root, "ID")) {
+      throw new AuthError("auth-saml/signed-different-element",
+        "fetchMdq: metadata signature references a different element than the " +
+        "EntityDescriptor root (signature-wrapping defense)");
+    }
+    // And the signed root must be the entity that was requested, so a signed
+    // descriptor for one entity cannot be served for another.
+    if (_attr(root, "entityID") !== opts.entityId) {
+      throw new AuthError("auth-saml/mdq-entity-mismatch",
+        "fetchMdq: signed EntityDescriptor entityID '" + _attr(root, "entityID") +
+        "' does not match requested '" + opts.entityId + "'");
+    }
   }
   _emitAudit("mdq_fetched", "success", { entityId: opts.entityId });
   _emitMetric("mdq-fetched");

package/lib/vendor/blamejs/lib/auth/sd-jwt-vc-disclosure.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * SD-JWT VC disclosure encoding/decoding helper.

package/lib/vendor/blamejs/lib/auth/sd-jwt-vc-holder.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.auth.sdJwtVc.holder — operator-side holder/wallet helper.

package/lib/vendor/blamejs/lib/auth/sd-jwt-vc-issuer.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.auth.sdJwtVc.issuer — operator-side SD-JWT VC issuer factory.

package/lib/vendor/blamejs/lib/auth/sd-jwt-vc.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.auth.sdJwtVc — Selective Disclosure JWT for Verifiable Credentials
@@ -62,6 +64,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("../crypto");
+var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
@@ -523,6 +526,12 @@ async function verify(presentation, opts) {
   // 2. Validate iss / iat / exp / vct
   var nowSec = (typeof opts.now === "number" && isFinite(opts.now))
     ? Math.floor(opts.now / 1000) : Math.floor(Date.now() / 1000);                  // ms→s conversion factor
+  // A present maxClockSkewSec must be a non-negative finite integer; a bare
+  // typeof check lets Infinity/NaN through, and `exp < nowSec - Infinity` (or
+  // NaN) is always false — silently accepting an expired credential. Reject a
+  // malformed skew (operator config).
+  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.maxClockSkewSec,
+    "verify: opts.maxClockSkewSec", AuthError, "auth-sd-jwt-vc/bad-clock-skew");
   var skew = (typeof opts.maxClockSkewSec === "number") ? opts.maxClockSkewSec : 60; // allow:raw-time-literal — default 60s clock-skew tolerance
   if (typeof jwtParsed.payload.iat === "number" && jwtParsed.payload.iat > nowSec + skew) {
     throw new AuthError("auth-sd-jwt-vc/iat-future",

package/lib/vendor/blamejs/lib/auth/status-list.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * OAuth Token Status List (draft-ietf-oauth-status-list-20).
@@ -219,6 +221,11 @@ async function fromJwt(token, opts) {
     audience:     opts.expectedAudience,
     clockToleranceSec: opts.clockToleranceSec,
     now:          opts.now,
+    // RFC 8725 §3.11 — bind the header typ to the one toJwt() stamps
+    // ("statuslist+jwt"), so a token minted for another purpose can't be
+    // replayed here as a status list even before the status_list.lst claim
+    // check. Every sibling verifier enforces its typ; this closes the gap.
+    expectedTyp:  "statuslist+jwt",
   });
   var sl = claims.status_list;
   if (!sl || typeof sl !== "object" || typeof sl.lst !== "string") {

package/lib/vendor/blamejs/lib/auth/step-up-policy.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Step-up policy DSL — compose RFC 9470 step-up requirements as a

package/lib/vendor/blamejs/lib/auth/step-up.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * RFC 9470 — OAuth 2.0 Step-Up Authentication Challenge.

package/lib/vendor/blamejs/lib/auth-bot-challenge.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.authBotChallenge
@@ -41,6 +43,7 @@ var lazyRequire = require("./lazy-require");
 var requestHelpers = require("./request-helpers");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
+var safeAsync = require("./safe-async");
 var { AuthBotChallengeError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -280,15 +283,9 @@ function create(opts) {
   // per-key promise chain applies advances for a key sequentially. (Cross-node
   // atomicity additionally needs an atomic store; this fixes the in-process
   // race the gate actually depends on.)
-  var _advanceChains = new Map();
+  var _advanceSerializer = safeAsync.keyedSerializer();
   function _advanceFailure(key, req) {
-    var prev = _advanceChains.get(key) || Promise.resolve();
-    var run = prev.then(function () { return _doAdvanceFailure(key, req); },
-                        function () { return _doAdvanceFailure(key, req); });
-    var tail = run.then(function () {}, function () {});
-    _advanceChains.set(key, tail);
-    tail.then(function () { if (_advanceChains.get(key) === tail) _advanceChains.delete(key); });
-    return run;
+    return _advanceSerializer.run(key, function () { return _doAdvanceFailure(key, req); });
   }
 
   async function _doAdvanceFailure(key, req) {

package/lib/vendor/blamejs/lib/auth-header.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.authHeader

package/lib/vendor/blamejs/lib/backup/bundle.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * backup-bundle — produce an encrypted backup bundle on disk.

package/lib/vendor/blamejs/lib/backup/crypto.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * backup-crypto — passphrase-based symmetric crypto for backup files.

package/lib/vendor/blamejs/lib/backup/index.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.backup
@@ -1176,7 +1178,19 @@ function bundleAdapterStorage(opts) {
       "the adapter — the wrap layer composes only with tar / tar.gz bundles. Per-file " +
       "encryption for directory format is a future patch alongside the _crypto-base.js refactor.");
   }
+  // Mirror create()'s ambient-posture read (see the create() encryption
+  // gate above): an explicit opts.posture wins, but when it is unset the
+  // globally-pinned compliance posture (b.compliance.set(...)) still drives
+  // the encryption-required gate. Without this fallback a deployment that
+  // pins HIPAA / PCI-DSS once and constructs the store with the documented
+  // default ({ adapter }, cryptoStrategy defaulting to "none") slips a
+  // plaintext bundle store past a gate create() enforces on encrypt:false —
+  // an asymmetric fail-open under the same regulated posture.
   var posture = opts.posture;
+  if (posture === undefined || posture === null) {
+    try { posture = compliance().current(); }
+    catch (_e) { posture = null; }                                                  // compliance optional at construction time
+  }
   if (posture && BACKUP_ENCRYPTION_REQUIRED_POSTURES.indexOf(posture) !== -1) {
     if (cryptoStrategy === "none") {
       throw new BackupError("backup/posture-requires-encryption",

package/lib/vendor/blamejs/lib/backup/manifest.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * backup-manifest — schema + validation for backup bundle manifests.

package/lib/vendor/blamejs/lib/base32.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.base32

package/lib/vendor/blamejs/lib/boot-gates.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.bootGates

package/lib/vendor/blamejs/lib/bounded-map.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * bounded-map — a Map facade that caps its entry count.
@@ -102,7 +104,7 @@ function boundedMap(opts) {
 
 // getOrInsert(map, key, factory, opts?) — Map.prototype.getOrInsertComputed(key,
 // factory) polyfill. The native method lands in Node 26 but the framework floor
-// is 24.16, so the framework's request-keyed Maps hand-roll `var v = m.get(k);
+// is 24.18, so the framework's request-keyed Maps hand-roll `var v = m.get(k);
 // if (!v) { v = ...; m.set(k, v); }` everywhere. This is the ONE place that
 // shape lives, so the floor-bump sweep swaps the body for the native method in
 // a single edit instead of N call sites. Returns the existing value; otherwise

package/lib/vendor/blamejs/lib/breach-deadline.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.breach.deadline + b.breach.report — US state breach-notification

package/lib/vendor/blamejs/lib/break-glass.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.breakGlass
@@ -58,6 +60,7 @@ var vault = lazyRequire(function () { return require("./vault"); });
 
 var lockout = lazyRequire(function () { return require("./auth/lockout"); });
 var passkey = lazyRequire(function () { return require("./auth/passkey"); });
+var permissions = lazyRequire(function () { return require("./permissions"); });
 
 // Errors — all 14 codes documented in the spec. `permanent: true`
 // means caller's input is bad (config-time / call-site reject);
@@ -1055,16 +1058,14 @@ async function grant(opts) {
         : []);
     var scopeOk = false;
     for (var sci = 0; sci < actorScopes.length; sci += 1) {
-      if (actorScopes[sci] === policy.requireScope) { scopeOk = true; break; }
-      // Wildcard support: "phi:*" matches "phi:admin" and "phi:read".
+      // Segment-aware scope match via the canonical b.permissions.match: an
+      // exact scope, or a wildcard whose "*" occupies a WHOLE colon segment
+      // ("phi:*" → "phi:admin"), satisfies the requirement. A raw string prefix
+      // ("phi:admin".indexOf("phi:a") === 0) wrongly let a partial-segment
+      // scope ("phi:a*") glass-unseal a different value.
       if (typeof actorScopes[sci] === "string" &&
-          actorScopes[sci].length > 0 &&
-          actorScopes[sci].charAt(actorScopes[sci].length - 1) === "*") {
-        var prefix = actorScopes[sci].slice(0, -1);
-        if (typeof policy.requireScope === "string" &&
-            policy.requireScope.indexOf(prefix) === 0) {
-          scopeOk = true; break;
-        }
+          permissions().match(actorScopes[sci], policy.requireScope)) {
+        scopeOk = true; break;
       }
     }
     if (!scopeOk) {

package/lib/vendor/blamejs/lib/budr.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.budr

package/lib/vendor/blamejs/lib/bundler.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.bundler

package/lib/vendor/blamejs/lib/cache-redis.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Redis-backed cache backend for b.cache.

package/lib/vendor/blamejs/lib/cache-status.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.cacheStatus

package/lib/vendor/blamejs/lib/cache.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.cache
@@ -360,7 +362,8 @@ function _memoryBackend(cfg) {
       if (entry) { _untrack(key, entry); entries.delete(key); }
       return { updated: true, deleted: true };
     }
-    var effExpires = (decision.expiresAt !== undefined) ? decision.expiresAt : expiresAt;
+    var effExpires = (decision.ttlMs !== undefined) ? now + decision.ttlMs
+      : (decision.expiresAt !== undefined ? decision.expiresAt : expiresAt);
     await set(key, decision.value, effExpires, meta);
     return { updated: true, value: decision.value };
   }
@@ -640,7 +643,8 @@ function _clusterBackend(cfg) {
         // The mutator may pin the entry's expiry to the value's own
         // lifetime (e.g. a grant whose expiresAt the mutator just read);
         // otherwise the caller-resolved ttl applies.
-        var effExpires = (decision.expiresAt !== undefined) ? decision.expiresAt : expiresAt;
+        var effExpires = (decision.ttlMs !== undefined) ? now + decision.ttlMs
+          : (decision.expiresAt !== undefined ? decision.expiresAt : expiresAt);
         var storedExpires = (effExpires === Infinity) ? Number.MAX_SAFE_INTEGER : effExpires;
         if (oldRaw === null) {
           // Row was absent/expired — insert, but lose the race if another
@@ -1186,9 +1190,13 @@ function create(opts) {
    *
    * `mutatorFn` returns one of: `{ value }` to commit the new value,
    * `{ abort: data }` to leave the entry untouched and surface `data` to
-   * the caller, or `{ delete: true }` to remove the entry. The call
-   * resolves to `{ updated: true, value }`, `{ updated: true, deleted: true }`,
-   * or `{ aborted: data }`.
+   * the caller, or `{ delete: true }` to remove the entry. A committing
+   * decision may also set the written value's lifetime — `{ value, ttlMs }`
+   * (a duration the backend resolves against its own clock) or
+   * `{ value, expiresAt }` (an absolute time) — when the new value's own
+   * state decides how long it should live; otherwise the call `ttlMs`
+   * applies. The call resolves to `{ updated: true, value }`,
+   * `{ updated: true, deleted: true }`, or `{ aborted: data }`.
    *
    * @opts
    *   ttlMs:  number | Infinity,   // lifetime of the written value; default the instance ttlMs

package/lib/vendor/blamejs/lib/calendar.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module    b.calendar

package/lib/vendor/blamejs/lib/canonical-json.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.canonicalJson
@@ -42,7 +44,17 @@
 // RFC 8785 §3.2.3 sort. Primitives, strings, and numbers use
 // JSON.stringify, whose escaping (§3.2.2.2) and ECMAScript number format
 // (§3.2.2.3) are exactly what JCS references.
-function _emit(value, seen, bufferAs) {
+
+// Maximum nesting depth. The walk is recursive, so a deeply-nested input
+// (e.g. an attacker-supplied manifest handed to content-credentials.verify
+// BEFORE signature verification, or untrusted MCP tool-call args) would
+// otherwise overflow the V8 stack with an unhandled RangeError — a crash /
+// pre-auth DoS. Throw a typed framework error well before native overflow.
+// The cycle WeakSet below catches references that loop; this catches a tree
+// that is merely very deep. 512 is far beyond any legitimate signed document.
+var MAX_DEPTH = 512;
+
+function _emit(value, seen, bufferAs, depth) {
   if (value === null || typeof value === "undefined") return "null";
   var t = typeof value;
   if (t === "number" || t === "string" || t === "boolean") return JSON.stringify(value);
@@ -90,6 +102,10 @@ function _emit(value, seen, bufferAs) {
   if (seen.has(value)) {
     throw new Error("canonical-json: circular reference detected");
   }
+  depth = depth || 0;
+  if (depth > MAX_DEPTH) {
+    throw new Error("canonical-json: maximum nesting depth exceeded (" + MAX_DEPTH + ")");
+  }
   seen.add(value);
   if (Array.isArray(value)) {
     // Index loop, not .map(): map() skips holes in a sparse array,
@@ -97,7 +113,7 @@ function _emit(value, seen, bufferAs) {
     // reads as undefined → _emit returns "null" (matching JSON.stringify).
     var items = [];
     for (var ai = 0; ai < value.length; ai += 1) {
-      items.push(_emit(value[ai], seen, bufferAs));
+      items.push(_emit(value[ai], seen, bufferAs, depth + 1));
     }
     return "[" + items.join(",") + "]";
   }
@@ -107,7 +123,7 @@ function _emit(value, seen, bufferAs) {
   keys.sort();
   var parts = [];
   for (var i = 0; i < keys.length; i++) {
-    parts.push(JSON.stringify(keys[i]) + ":" + _emit(value[keys[i]], seen, bufferAs));
+    parts.push(JSON.stringify(keys[i]) + ":" + _emit(value[keys[i]], seen, bufferAs, depth + 1));
   }
   return "{" + parts.join(",") + "}";
 }

package/lib/vendor/blamejs/lib/cbor.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.cbor