@blamejs/blamejs-shop 0.5.4 → 0.5.6

package/lib/vendor/blamejs/lib/guard-html.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardHtml

package/lib/vendor/blamejs/lib/guard-idempotency-key.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardIdempotencyKey

package/lib/vendor/blamejs/lib/guard-image.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardImage

package/lib/vendor/blamejs/lib/guard-imap-command.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardImapCommand

package/lib/vendor/blamejs/lib/guard-jmap.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardJmap

package/lib/vendor/blamejs/lib/guard-json.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardJson

package/lib/vendor/blamejs/lib/guard-jsonpath.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardJsonpath

package/lib/vendor/blamejs/lib/guard-jwt.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardJwt

package/lib/vendor/blamejs/lib/guard-list-id.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardListId

package/lib/vendor/blamejs/lib/guard-list-unsubscribe.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardListUnsubscribe

package/lib/vendor/blamejs/lib/guard-mail-compose.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardMailCompose

package/lib/vendor/blamejs/lib/guard-mail-move.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardMailMove

package/lib/vendor/blamejs/lib/guard-mail-query.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardMailQuery

package/lib/vendor/blamejs/lib/guard-mail-reply.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardMailReply

package/lib/vendor/blamejs/lib/guard-mail-sieve.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardMailSieve

package/lib/vendor/blamejs/lib/guard-managesieve-command.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardManageSieveCommand

package/lib/vendor/blamejs/lib/guard-markdown.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardMarkdown

package/lib/vendor/blamejs/lib/guard-message-id.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardMessageId

package/lib/vendor/blamejs/lib/guard-mime.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardMime

package/lib/vendor/blamejs/lib/guard-oauth.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardOauth
@@ -296,7 +298,18 @@ function _detectIssues(flow, opts) {
                    "(RFC 6749 §10.5)",
         });
       }
-    } catch (_e) { /* drop-silent — operator-supplied store */ }
+    } catch (_e) {
+      // A replay-store error means we cannot prove the authorization code is
+      // unused — that is a denial, not "the code is fresh". codeReusePolicy is
+      // "reject" at every profile, so the replay check is unconditional: fail
+      // CLOSED with a high-severity refusal rather than silently skipping it.
+      issues.push({
+        kind: "code-reuse-unverifiable", severity: "high",
+        ruleId: "oauth.code-reuse-unverifiable",
+        snippet: "replay store (seenCodeStore.hasSeen) errored — cannot prove " +
+                 "the authorization code is unused; refusing (fail-closed, RFC 6749 §10.5)",
+      });
+    }
   }
 
   return issues;

package/lib/vendor/blamejs/lib/guard-pdf.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardPdf

package/lib/vendor/blamejs/lib/guard-pop3-command.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardPop3Command

package/lib/vendor/blamejs/lib/guard-posture-chain.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardPostureChain

package/lib/vendor/blamejs/lib/guard-regex.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardRegex
@@ -512,6 +514,61 @@ function gate(opts) {
 // ---- adaptive integration-test fixtures (consumed by layer-5 host harness) ----
 var INTEGRATION_FIXTURES = gateContract.identifierFixtures("^[a-z]+$", "(a+)+b");
 
+/**
+ * @primitive  b.guardRegex.assertSafe
+ * @signature  b.guardRegex.assertSafe(input, label?, ErrorClass?, code?, opts?)
+ * @since      0.15.39
+ * @status     stable
+ * @related    b.guardRegex.sanitize, b.guardRegex.validate
+ *
+ * Screen an already-compiled <code>RegExp</code> (or a raw pattern string) for
+ * catastrophic-backtracking (ReDoS) shapes, throwing if the pattern is unsafe.
+ * This is the config-time guard for request-lifecycle code that matches an
+ * operator-supplied regex against attacker-controlled input (User-Agent,
+ * Origin, request path, form field, HELO) — an accidentally-catastrophic
+ * operator pattern would otherwise be a per-request DoS once a hostile input
+ * triggers the backtracking.
+ *
+ * Pass a <code>RegExp</code> instance (its <code>.source</code> is screened) or
+ * a pattern string. On a hostile shape it throws <code>ErrorClass(code, ...)</code>
+ * when an error class is supplied, otherwise the underlying
+ * <code>GuardRegexError</code>. Returns the input unchanged on success.
+ *
+ * By default it rejects the catastrophic-backtracking classes — nested,
+ * alternation-with, and lookaround quantifiers — but ALLOWS large/open bounded
+ * repeats (<code>{8,}</code>, <code>{n,m}</code>): a single counted repeat is
+ * linear, not exponential, and legitimate patterns (e.g. a hex hash of 8+
+ * digits) use them. Pass an explicit <code>opts</code> to override.
+ *
+ * @opts
+ *   profile:             string,   // guardRegex profile (default: "strict")
+ *   boundedRepeatPolicy: string,   // default: "allow" (large bounded repeats are linear)
+ *
+ * @example
+ *   b.guardRegex.assertSafe(/^[a-z]+$/);            // ok — returns the RegExp
+ *   b.guardRegex.assertSafe(/\.[a-f0-9]{8,}\./);    // ok — a single bounded repeat is linear
+ *   try { b.guardRegex.assertSafe(/((a)+)+$/); }    // throws — nested quantifier
+ *   catch (e) { e.code; }                           // → "regex/unsafe-pattern"
+ */
+function assertSafe(input, label, ErrorClass, code, opts) {
+  var source = (input instanceof RegExp) ? input.source : input;
+  try {
+    // Screen the catastrophic-backtracking classes (nested / alternation /
+    // lookaround quantifiers — held at every profile) but allow large bounded
+    // repeats: a counted repeat matches in linear time, and rejecting `{n,}`
+    // would refuse legitimate operator patterns (and the framework's own
+    // defaults, e.g. b.staticServe.DEFAULT_HASHED_PATTERN's `{8,}`).
+    _guard.sanitize(source, opts || { profile: "strict", boundedRepeatPolicy: "allow" });
+  } catch (e) {
+    if (ErrorClass) {
+      throw new ErrorClass(code || "regex/unsafe-pattern",
+        (label || "regex") + ": pattern rejected as unsafe (ReDoS shape) - " + (e && e.message));
+    }
+    throw e;
+  }
+  return input;
+}
+
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / INTEGRATION_FIXTURES), buildProfile /
 // compliancePosture / loadRulePack wiring, plus the per-guard inspection
@@ -530,3 +587,5 @@ var _guard = module.exports = gateContract.defineGuard({
   intOpts:           ["maxBytes", "maxPatternBytes", "maxBoundedRepeat", "maxConsecutiveStars"],
   gate:        gate,
 });
+
+_guard.assertSafe = assertSafe;

package/lib/vendor/blamejs/lib/guard-saga-config.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardSagaConfig

package/lib/vendor/blamejs/lib/guard-shell.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardShell

package/lib/vendor/blamejs/lib/guard-smtp-command.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardSmtpCommand

package/lib/vendor/blamejs/lib/guard-snapshot-envelope.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardSnapshotEnvelope

package/lib/vendor/blamejs/lib/guard-sql.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardSql

package/lib/vendor/blamejs/lib/guard-stream-args.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardStreamArgs

package/lib/vendor/blamejs/lib/guard-svg.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardSvg

package/lib/vendor/blamejs/lib/guard-template.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardTemplate

package/lib/vendor/blamejs/lib/guard-tenant-id.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardTenantId

package/lib/vendor/blamejs/lib/guard-text.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardText

package/lib/vendor/blamejs/lib/guard-time.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardTime

package/lib/vendor/blamejs/lib/guard-trace-context.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.guardTraceContext

package/lib/vendor/blamejs/lib/guard-uuid.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardUuid

package/lib/vendor/blamejs/lib/guard-xml.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardXml

package/lib/vendor/blamejs/lib/guard-yaml.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.guardYaml

package/lib/vendor/blamejs/lib/hal.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.hal

package/lib/vendor/blamejs/lib/handlers.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Async handler primitive — buffered emit + resilient drain.

package/lib/vendor/blamejs/lib/honeytoken.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.honeytoken

package/lib/vendor/blamejs/lib/html-balance.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.htmlBalance

package/lib/vendor/blamejs/lib/http-client-cache.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.httpClient.cache

package/lib/vendor/blamejs/lib/http-client-cookie-jar.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.httpClient.cookieJar — outbound HTTP cookie store.

package/lib/vendor/blamejs/lib/http-client.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.httpClient

package/lib/vendor/blamejs/lib/http-message-signature.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.crypto.httpSig — RFC 9421 HTTP Message Signatures.
@@ -55,8 +57,13 @@
  *   }, {
  *     keyResolver: function (keyid, alg) { return publicKeyPem; },
  *     toleranceMs: b.constants.TIME.minutes(5),
+ *     // requiredComponents (RFC 9421 §3.2): components the covered set MUST
+ *     // include, else verify refuses with reason "missing-required-component".
+ *     // Omitted → secure default: @method + @target-uri, plus content-digest
+ *     // when the request has a body. [] explicitly waives the coverage floor.
+ *     requiredComponents: ["@method", "@target-uri", "content-digest"],
  *   });
- *   // → { valid, label, keyid, alg, covered, reason? }
+ *   // → { valid, label, keyid, alg, covered, reason?, missing? }
  */
 
 var nodeCrypto       = require("node:crypto");
@@ -152,6 +159,54 @@ function _resolveDerivedComponent(name, msg) {
   }
 }
 
+// The WHATWG application/x-www-form-urlencoded percent-encode set leaves ONLY
+// these (all ASCII) bytes UNescaped: ALPHA / DIGIT / "*" / "-" / "." / "_".
+// Note "~" (0x7E) IS encoded here (unlike RFC 3986 unreserved) and "*" (0x2A)
+// is NOT — which is why encodeURIComponent (survivor set differs by ! ' ( ) *
+// ~) cannot be reused. Membership is a single-char lookup in this set string.
+var _QP_SURVIVORS =
+  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789*-._";
+
+// _canonQueryParamPart — RFC 9421 §2.2.8 canonicalization of a single
+// @query-param name or value. Two stages:
+//   (1) parse per WHATWG application/x-www-form-urlencoded PARSING (§5.1):
+//       "+" -> SP, "%XX" -> decoded byte. This collapses the "+"-for-space and
+//       "%20"-for-space wire forms to the same decoded byte, and normalizes
+//       hex case.
+//   (2) re-encode per byte over UTF-8 WITHOUT the form serializer's
+//       space-as-plus rule, so SP -> "%20" (NOT "+"). RFC 9421 §2.2.8's own
+//       worked example is the governing interop vector: a wire value
+//       "with+plus+whitespace" canonicalizes to "with%20plus%20whitespace".
+//       The form serializer (URLSearchParams.toString) emits "+" and is
+//       deliberately not used for output; encodeURIComponent has the wrong
+//       survivor set. Every non-survivor byte is percent-encoded UPPERCASE.
+// Malformed input degrades to the raw token rather than throwing mid-base
+// build (defensive request-shape reader — return default, don't throw).
+function _canonQueryParamPart(rawToken) {
+  var decoded;
+  try {
+    // Parse the token as a single form value. The form parser splits pairs on
+    // "&" only (the first "=" is consumed by the "k=" prefix), so a literal "&"
+    // in a caller-supplied decoded name (e.g. "a&b") must be escaped first or
+    // it would split the token and silently drop everything after it. A "%26"
+    // already present (an encoded "&") is left as-is and decodes normally.
+    decoded = new URLSearchParams("k=" + rawToken.replace(/&/g, "%26")).get("k");
+    if (decoded === null) decoded = "";
+  } catch (_e) {
+    return rawToken;
+  }
+  var bytes = Buffer.from(decoded, "utf8");
+  var out = "";
+  for (var i = 0; i < bytes.length; i++) {
+    var b = bytes[i];
+    var ch = String.fromCharCode(b);
+    out += _QP_SURVIVORS.indexOf(ch) !== -1
+      ? ch
+      : "%" + b.toString(16).toUpperCase().padStart(2, "0");
+  }
+  return out;
+}
+
 // _resolveQueryParam — RFC 9421 §2.2.8 — covered identifier of the
 // shape `"@query-param";name="k"` (the name parameter selects which
 // query-string parameter participates in the signature base).
@@ -162,21 +217,46 @@ function _resolveQueryParam(msg, paramName) {
       "httpSig: @query-param;name=" + JSON.stringify(paramName) + " but URL has no query");
   }
   var pairs = search.split("&");
-  // RFC 9421 §2.2.8 — names compare without percent-decoding (server
-  // and signer must agree on the literal bytes). The framework follows
-  // the spec strictly: literal compare on encoded names.
-  var encName = encodeURIComponent(paramName);
+  // RFC 9421 §2.2.8 — canonicalize BOTH the requested name and each wire name
+  // token (decode then re-encode) and compare canonical forms, so "+"/"%20"/
+  // hex-case/"*"-vs-"%2A" wire variations all match; return the canonicalized
+  // value (§2.2.8 step 2).
+  var wantName = _canonQueryParamPart(paramName);
   for (var i = 0; i < pairs.length; i++) {
     var eq = pairs[i].indexOf("=");
     var rawName = eq === -1 ? pairs[i] : pairs[i].slice(0, eq);
-    if (rawName === encName || rawName === paramName) {
-      return eq === -1 ? "" : pairs[i].slice(eq + 1);
+    if (_canonQueryParamPart(rawName) === wantName) {
+      return _canonQueryParamPart(eq === -1 ? "" : pairs[i].slice(eq + 1));
     }
   }
   throw _err("MISSING_QUERY_PARAM",
     "httpSig: @query-param;name=" + JSON.stringify(paramName) + " not present in URL");
 }
 
+// _canonicalizeQueryParamIdentifiers — rewrite each covered identifier of the
+// shape `@query-param;name="X"` so the name is the canonical RFC 9421 §2.2.8
+// form. Applied once at sign() intake so the SAME canonical name appears in
+// both the signed base (component line + @signature-params terminator) and the
+// emitted Signature-Input header. Other components and other params (e.g. ;req)
+// pass through verbatim. The verifier does NOT re-canonicalize the identifier —
+// it reproduces Signature-Input byte-for-byte per §2.5 — but the shared
+// _resolveQueryParam canonicalizes the value on both sides.
+// Match the `;name="<sf-string body>"` parameter within a covered identifier.
+// The body is a tempered quoted-string run ([^"\\] | \\.) so an escaped quote
+// inside the name does not end it; linear, no backtracking. Only the name
+// parameter is rewritten — any other params (e.g. ;req) are left untouched.
+var _QP_NAME_PARAM_RE = /;name="((?:[^"\\]|\\.)*)"/;
+
+function _canonicalizeQueryParamIdentifiers(covered) {
+  return covered.map(function (raw) {
+    if (raw.indexOf("@query-param;") !== 0) return raw;
+    return raw.replace(_QP_NAME_PARAM_RE, function (_m, body) {
+      var nameVal = structuredFields.unescapeSfStringBody(body);
+      return ";name=" + _sfQuotedString(_canonQueryParamPart(nameVal));
+    });
+  });
+}
+
 // _resolveHeader — case-insensitive header lookup. RFC 9421 §2.1
 // requires obs-fold normalization (concat multi-values with ", ").
 function _resolveHeader(headers, name) {
@@ -331,7 +411,11 @@ function sign(msg, opts) {
     m.headers = Object.assign({}, m.headers, { "content-digest": digest });
   }
 
-  var base = _buildSignatureBase(opts.covered, params, m);
+  // Canonicalize @query-param identifier names (RFC 9421 §2.2.8) once, so the
+  // identical canonical name appears in BOTH the signed base and the emitted
+  // Signature-Input header below.
+  var covered = _canonicalizeQueryParamIdentifiers(opts.covered);
+  var base = _buildSignatureBase(covered, params, m);
   var sig;
   try {
     sig = nodeCrypto.sign(null, base, opts.privateKey);
@@ -340,7 +424,7 @@ function sign(msg, opts) {
   }
   var sigB64 = sig.toString("base64");
 
-  emittedHeaders["Signature-Input"] = label + "=" + _serializeCovered(opts.covered) +
+  emittedHeaders["Signature-Input"] = label + "=" + _serializeCovered(covered) +
                                       _serializeSigParams(params);
   emittedHeaders["Signature"] = label + "=:" + sigB64 + ":";
 
@@ -472,8 +556,23 @@ function verify(msg, opts) {
     throw _err("BAD_OPT",
       "httpSig.verify: keyResolver(keyid, alg) → publicKeyPem required");
   }
-  var toleranceMs = typeof opts.toleranceMs === "number" ? opts.toleranceMs : DEFAULT_TOLERANCE_MS;
-  var clockSkewMs = typeof opts.clockSkewMs === "number" ? opts.clockSkewMs : DEFAULT_CLOCK_SKEW_MS;
+  // requiredComponents (RFC 9421 §3.2): the verifier MUST refuse a signature
+  // that does not cover the components the application requires. undefined →
+  // the secure default (computed below, once the body is known); an explicit
+  // array overrides; an explicit [] waives the coverage floor (the signature
+  // itself still has to verify — only the floor is waived).
+  validateOpts.optionalNonEmptyStringArray(opts.requiredComponents,
+    "httpSig.verify: requiredComponents", HttpSigError, "BAD_OPT");
+  // A present toleranceMs / clockSkewMs must be a non-negative finite number;
+  // a bare typeof check lets Infinity/NaN through, and `ageMs > Infinity` (the
+  // expiry gate) or `-ageMs > Infinity` (the future-dating gate) is always
+  // false — silently accepting a stale (replayed) or future-dated signature.
+  // verify() returns verdicts rather than throwing, so a malformed value falls
+  // back to the safe default instead of disabling the window.
+  var toleranceMs = (typeof opts.toleranceMs === "number" && isFinite(opts.toleranceMs) && opts.toleranceMs >= 0)
+    ? opts.toleranceMs : DEFAULT_TOLERANCE_MS;
+  var clockSkewMs = (typeof opts.clockSkewMs === "number" && isFinite(opts.clockSkewMs) && opts.clockSkewMs >= 0)
+    ? opts.clockSkewMs : DEFAULT_CLOCK_SKEW_MS;
   var nowMs = opts.now ? opts.now() : Date.now();
 
   var sigInput = _resolveHeader(m.headers, "signature-input");
@@ -520,6 +619,40 @@ function verify(msg, opts) {
   // mandates that verifiers re-run the digest over the body — a stale
   // header from a proxy would otherwise verify trivially.
   var coveredLower = parsedInput.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header-token-grammar — same as sign() above: covered items are RFC 9421 §2.1 component-ids, token grammar
+
+  // RFC 9421 §3.2 — refuse a signature whose covered set omits a component the
+  // application requires, BEFORE and INDEPENDENT of the crypto check. Without
+  // this the verifier acts on a request whose method / target-uri / body were
+  // never signed: an attacker who under-covers (e.g. only @authority) can change
+  // them freely under an otherwise-valid signature. Default floor (security-on,
+  // not opt-in per the framework's defaults policy): @method + @target-uri
+  // always, plus content-digest when the message carries a body. An explicit
+  // requiredComponents overrides; an explicit [] waives the floor.
+  // The required-coverage comparison PRESERVES component parameters: a required
+  // `@query-param;name="tenant"` must not be satisfied by a covered
+  // `@query-param;name="other"`, so only the component NAME before ";" is
+  // case-folded and the parameter suffix is kept verbatim. (coveredLower above
+  // keeps the bare name for the param-free content-digest gate.)
+  function _componentKey(c) {
+    var semi = c.indexOf(";");
+    return semi === -1 ? c.toLowerCase() : c.slice(0, semi).toLowerCase() + c.slice(semi);
+  }
+  var requiredComponents;
+  if (opts.requiredComponents !== undefined && opts.requiredComponents !== null) {
+    requiredComponents = opts.requiredComponents.map(_componentKey);
+  } else {
+    requiredComponents = ["@method", "@target-uri"];
+    if (m.body != null) requiredComponents.push("content-digest");
+  }
+  var coveredKeys = parsedInput.covered.map(_componentKey);
+  var missingComponents = [];
+  for (var rci = 0; rci < requiredComponents.length; rci += 1) {
+    if (coveredKeys.indexOf(requiredComponents[rci]) === -1) missingComponents.push(requiredComponents[rci]);
+  }
+  if (missingComponents.length > 0) {
+    return { valid: false, reason: "missing-required-component", missing: missingComponents };
+  }
+
   if (coveredLower.indexOf("content-digest") !== -1) {
     if (m.body == null) {
       return { valid: false, reason: "content-digest-no-body" };

package/lib/vendor/blamejs/lib/http2-teardown.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * HTTP/2 session teardown — graceful close *then* force-destroy.