@blamejs/blamejs-shop 0.5.4 → 0.5.6

package/lib/vendor/blamejs/fuzz/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "blamejs-fuzz",
+  "version": "0.0.0",
+  "private": true,
+  "description": "Coverage-guided fuzz harnesses (jazzer.js) for lib/ guards — dev-only, never published; not part of the framework tarball.",
+  "license": "Apache-2.0",
+  "dependencies": {
+    "@jazzer.js/core": "4.0.0"
+  }
+}

package/lib/vendor/blamejs/fuzz/parsers__safe-ini.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var b        = require("..");

package/lib/vendor/blamejs/fuzz/parsers__safe-toml.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var b        = require("..");

package/lib/vendor/blamejs/fuzz/parsers__safe-xml.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var b        = require("..");

package/lib/vendor/blamejs/fuzz/parsers__safe-yaml.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var b        = require("..");

package/lib/vendor/blamejs/fuzz/safe-archive.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Fuzz target: b.safeArchive

package/lib/vendor/blamejs/fuzz/safe-decompress.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Fuzz target: b.safeDecompress

package/lib/vendor/blamejs/fuzz/safe-dns.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Fuzz target: b.safeDns.parseResponse

package/lib/vendor/blamejs/fuzz/safe-ical.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var safeIcal = require("../lib/safe-ical");

package/lib/vendor/blamejs/fuzz/safe-icap.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Fuzz target: b.safeIcap.parse

package/lib/vendor/blamejs/fuzz/safe-json.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Fuzz target: b.safeJson.parse

package/lib/vendor/blamejs/fuzz/safe-jsonpath.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var b        = require("..");

package/lib/vendor/blamejs/fuzz/safe-mime.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Fuzz target: b.safeMime.parse

package/lib/vendor/blamejs/fuzz/safe-mount-info.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Fuzz target: b.safeMountInfo.parse

package/lib/vendor/blamejs/fuzz/safe-sieve.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 // jazzer.js fuzz harness for b.safeSieve.parse — bounded RFC 5228

package/lib/vendor/blamejs/fuzz/safe-smtp.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Fuzz target: b.mail.server.mx wire-protocol layer.

package/lib/vendor/blamejs/fuzz/safe-url.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var b        = require("..");

package/lib/vendor/blamejs/fuzz/safe-vcard.fuzz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var safeVcard = require("../lib/safe-vcard");

package/lib/vendor/blamejs/index.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 // TLS 1.3 minimum, framework-wide. Sets the default for every TLS

package/lib/vendor/blamejs/lib/_test/crypto-fixtures.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * lib/_test/crypto-fixtures.js — test-only fixtures for crypto round-

package/lib/vendor/blamejs/lib/a2a-tasks.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.a2a

package/lib/vendor/blamejs/lib/a2a.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.a2a

package/lib/vendor/blamejs/lib/acme.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.acme
@@ -1175,7 +1177,11 @@ function create(opts) {
       url: state.directory.keyChange,
     };
     var innerPayload = { account: state.accountUrl, oldKey: publicJwk };
-    var innerJws = _signJws(newPrivateKey, innerProtected, _stringify(innerPayload));
+    // _signJws base64url-encodes _stringify(payload) itself (like every
+    // other signer, e.g. _signedPost) — pass the raw object, never a
+    // pre-stringified string, or the inner JWS payload double-encodes to
+    // a JSON *string* and every RFC 8555 §7.3.5 server rejects it.
+    var innerJws = _signJws(newPrivateKey, innerProtected, innerPayload);
     var rsp = await _signedPost(state.directory.keyChange, innerJws);
     if (rsp.statusCode !== 200) {
       _emitAudit(audit, "acme.account.key_rotated", "failure",

package/lib/vendor/blamejs/lib/agent-audit.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.agent._audit — internal shared audit-emit helper for the agent

package/lib/vendor/blamejs/lib/agent-envelope-mac.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.agent._envelopeMac — internal shared keyed-MAC mechanism for

package/lib/vendor/blamejs/lib/agent-event-bus.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.agent.eventBus

package/lib/vendor/blamejs/lib/agent-idempotency.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.agent.idempotency

package/lib/vendor/blamejs/lib/agent-orchestrator.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.agent.orchestrator
@@ -60,6 +62,7 @@ var bCrypto           = require("./crypto");
 var agentAudit        = require("./agent-audit");
 var vaultAad          = require("./vault-aad");
 var validateOpts      = require("./validate-opts");
+var safeAsync         = require("./safe-async");
 
 var audit             = lazyRequire(function () { return require("./audit"); });
 var cluster           = lazyRequire(function () { return require("./cluster"); });
@@ -165,6 +168,11 @@ function create(opts) {
 
   var ctx = {
     backend:     backend,
+    // Serializes register/unregister per name so a concurrent pair for the same
+    // name can't interleave the check-then-create (await get -> throw-if-exists
+    // -> await set) and both write — a duplicate-create / lost-registration. In
+    // process only; a shared persistent backend also needs its own uniqueness.
+    registrySerializer: safeAsync.keyedSerializer(),
     cluster:     clusterImpl,
     audit:       auditImpl,
     permissions: permissions,
@@ -235,9 +243,9 @@ function create(opts) {
   }
 
   return {
-    register:        function (name, agent, regOpts)         { return _register(ctx, name, agent, regOpts || {}); },
+    register:        function (name, agent, regOpts)         { return ctx.registrySerializer.run(name, function () { return _register(ctx, name, agent, regOpts || {}); }); },
     hydrate:         function (name, agent)                  { return _hydrate(ctx, name, agent); },
-    unregister:      function (name, args)                   { return _unregister(ctx, name, args || {}); },
+    unregister:      function (name, args)                   { return ctx.registrySerializer.run(name, function () { return _unregister(ctx, name, args || {}); }); },
     lookup:          function (name, args)                   { return _lookup(ctx, name, args || {}); },
     list:            function (args)                         { return _list(ctx, args || {}); },
     spawnConsumers:  function (args)                         { return _spawnConsumers(ctx, args || {}); },

package/lib/vendor/blamejs/lib/agent-posture-chain.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.agent.postureChain

package/lib/vendor/blamejs/lib/agent-saga.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.agent.saga

package/lib/vendor/blamejs/lib/agent-snapshot.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.agent.snapshot

package/lib/vendor/blamejs/lib/agent-stream.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.agent.stream

package/lib/vendor/blamejs/lib/agent-tenant.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.agent.tenant
@@ -60,6 +62,7 @@ var agentAudit       = require("./agent-audit");
 var safeJson         = require("./safe-json");
 var vaultAad         = require("./vault-aad");
 var validateOpts     = require("./validate-opts");
+var safeAsync        = require("./safe-async");
 
 var audit            = lazyRequire(function () { return require("./audit"); });
 var cryptoField      = lazyRequire(function () { return require("./crypto-field"); });
@@ -159,13 +162,19 @@ function create(opts) {
   var permissions = opts.permissions || null;
   var ctx = {
     backend: backend, audit: auditImpl, permissions: permissions,
+    // Serializes register/unregister per tenantId so a concurrent pair for the
+    // same tenant can't interleave the check-then-create (await get ->
+    // throw-if-exists -> await set) and both write — a duplicate-create /
+    // lost-registration. In process only; a shared persistent backend also
+    // needs its own uniqueness constraint.
+    registrySerializer: safeAsync.keyedSerializer(),
     // Archived tenants — keys retained but no live config; restore
     // requires explicit operator opt-in.
     archive: new Map(),
   };
   return {
-    register:    function (tenantId, regOpts)      { return _register(ctx, tenantId, regOpts || {}); },
-    unregister:  function (tenantId, args)         { return _unregister(ctx, tenantId, args || {}); },
+    register:    function (tenantId, regOpts)      { return ctx.registrySerializer.run(tenantId, function () { return _register(ctx, tenantId, regOpts || {}); }); },
+    unregister:  function (tenantId, args)         { return ctx.registrySerializer.run(tenantId, function () { return _unregister(ctx, tenantId, args || {}); }); },
     lookup:      function (tenantId, args)         { return _lookup(ctx, tenantId, args || {}); },
     list:        function (args)                   { return _list(ctx, args || {}); },
     check:       function (actor, agentTenantId)   { return _check(ctx, actor, agentTenantId); },

package/lib/vendor/blamejs/lib/agent-trace.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.agent.trace

package/lib/vendor/blamejs/lib/ai-adverse-decision.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.ai.adverseDecision — adverse-decision wrapper for automated

package/lib/vendor/blamejs/lib/ai-aedt-bias-audit.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ai.aedtBiasAudit

package/lib/vendor/blamejs/lib/ai-capability.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ai.capability

package/lib/vendor/blamejs/lib/ai-content-detect.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ai.aiContentDetect

package/lib/vendor/blamejs/lib/ai-disclosure.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ai.disclosure

package/lib/vendor/blamejs/lib/ai-dp.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ai.dp

package/lib/vendor/blamejs/lib/ai-frontier-protocol.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ai.frontierModelProtocol

package/lib/vendor/blamejs/lib/ai-input.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ai.input

package/lib/vendor/blamejs/lib/ai-model-manifest.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ai.modelManifest

package/lib/vendor/blamejs/lib/ai-output.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ai.output

package/lib/vendor/blamejs/lib/ai-pref.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.aiPref

package/lib/vendor/blamejs/lib/ai-prompt.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ai.prompt

package/lib/vendor/blamejs/lib/ai-quota.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ai.quota

package/lib/vendor/blamejs/lib/api-key.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.apiKey

package/lib/vendor/blamejs/lib/api-snapshot.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.apiSnapshot

package/lib/vendor/blamejs/lib/app-shutdown.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.appShutdown

package/lib/vendor/blamejs/lib/app.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * createApp — factory that wires the framework's primitives into a

package/lib/vendor/blamejs/lib/archive-adapters.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.archive.adapters

package/lib/vendor/blamejs/lib/archive-entry-policy.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * lib/archive-entry-policy.js — the entry-type extraction policy shared by the

package/lib/vendor/blamejs/lib/archive-gz.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * archive-gz — gzip composition primitives. Sibling of lib/archive.js

package/lib/vendor/blamejs/lib/archive-read.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * archive-read — random-access + trusted-sequential ZIP reader.

package/lib/vendor/blamejs/lib/archive-tar-read.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * archive-tar-read — POSIX pax tar reader. Sibling of lib/archive-tar.js

package/lib/vendor/blamejs/lib/archive-tar.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * archive-tar — POSIX pax tar write + read. Sibling of lib/archive.js
@@ -70,6 +72,7 @@ var nodeStream = require("node:stream");
 var streamPromises = require("node:stream/promises");
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
+var safeBuffer = require("./safe-buffer");
 var { defineClass } = require("./framework-error");
 
 var TarError = defineClass("TarError", { alwaysPermanent: true });
@@ -240,6 +243,12 @@ function _normalizeName(name) {
   if (name.indexOf("\u0000") !== -1) {
     throw new TarError("archive-tar/bad-name", "addFile: name contains null byte");
   }
+  // A bare LF flows into the POSIX pax extended header (`len key=value\n`),
+  // where a crafted name can forge a `path=` record that OVERRIDES the
+  // ustar name and escapes the extraction root; reject CR/LF outright.
+  if (safeBuffer.hasCrlf(name)) {
+    throw new TarError("archive-tar/bad-name", "addFile: name contains CR/LF");
+  }
   var normalized = name.replace(/\\/g, "/").replace(/^\/+/, "");
   var segs = normalized.split("/");
   for (var i = 0; i < segs.length; i += 1) {

package/lib/vendor/blamejs/lib/archive-wrap.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * archive-wrap — recipient-based whole-archive encryption substrate

package/lib/vendor/blamejs/lib/archive.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.archive
@@ -59,6 +61,7 @@ var C = require("./constants");
 var { defineClass } = require("./framework-error");
 var auditEmit = require("./audit-emit");
 var atomicFile = require("./atomic-file");
+var safeBuffer = require("./safe-buffer");
 
 var ArchiveError = defineClass("ArchiveError", { alwaysPermanent: true });
 
@@ -219,6 +222,9 @@ function zip() {
     if (name.indexOf("\0") !== -1) {
       throw new ArchiveError("archive/bad-name", "addFile: name contains null byte");
     }
+    if (safeBuffer.hasCrlf(name)) {
+      throw new ArchiveError("archive/bad-name", "addFile: name contains CR/LF");
+    }
     // No path traversal — relative paths only, no leading slash, no ".." segments.
     var normalized = name.replace(/\\/g, "/").replace(/^\/+/, "");
     var segs = normalized.split("/");

package/lib/vendor/blamejs/lib/arg-parser.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.argParser

package/lib/vendor/blamejs/lib/argon2-builtin.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Thin wrapper over Node's built-in `crypto.argon2` that produces and

package/lib/vendor/blamejs/lib/asn1-der.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * asn1-der — minimal ASN.1 DER walker for the framework's narrow

package/lib/vendor/blamejs/lib/asyncapi-bindings.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * AsyncAPI 3.0 protocol bindings.

package/lib/vendor/blamejs/lib/asyncapi-traits.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * AsyncAPI 3.0 traits — reusable fragments that operations and

package/lib/vendor/blamejs/lib/asyncapi.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.asyncapi

package/lib/vendor/blamejs/lib/atomic-file.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.atomicFile

package/lib/vendor/blamejs/lib/audit-chain.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.auditChain

package/lib/vendor/blamejs/lib/audit-daily-review.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.auditDailyReview

package/lib/vendor/blamejs/lib/audit-emit.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 // audit-emit — the stateless drop-silent audit emitter with a metadata-first,

package/lib/vendor/blamejs/lib/audit-sign.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.auditSign

package/lib/vendor/blamejs/lib/audit-tools.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.auditTools

package/lib/vendor/blamejs/lib/audit.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.audit