@blamejs/blamejs-shop 0.5.5 → 0.5.6

package/lib/vendor/blamejs/lib/network-dns-resolver.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.network.dns.resolver
@@ -232,6 +234,7 @@ function create(opts) {
   }
 
   var cache = new Map();                  // key → { response, parsed, ttl, expiresAt, staleUntil }
+  var inflight = new Map();               // key → Promise (single-flight: coalesce concurrent misses)
 
   // CWE-400/770. LRU eviction on insert when the cache is at
   // capacity. v8 Map preserves insertion order; oldest key is the
@@ -291,11 +294,53 @@ function create(opts) {
       return _result(hit.parsed, hit.ttl, true, false, hit.validated);
     }
 
-    // Cache miss / expired — fetch from upstream, bounded by the
-    // per-query wall-clock deadline. withTimeout rejects the await so a
-    // non-responsive / stalling endpoint can't hold the request pending
-    // forever; the default _wireLookup also tears the socket down on its
-    // own req.setTimeout so the underlying fd is released.
+    // Cache miss / expired. Single-flight: coalesce concurrent misses for the
+    // same key so N simultaneous callers trigger ONE upstream lookup instead
+    // of a thundering herd (cache stampede). The winner fills the cache; the
+    // others await it and re-derive their own verdict from the shared entry
+    // (applying their own validate gate — a non-validating fill mustn't hand a
+    // validating caller an AD=0 pass).
+    if (inflight.has(key)) {
+      try { await inflight.get(key).promise; } catch (_e) { /* winner failed — re-check cache, else fetch ourselves below */ }
+      var shared = cache.get(key);
+      if (shared && shared.expiresAt > Date.now()) {
+        if (validate && !shared.validated) {
+          throw new ResolverError("resolver/validate-failed",
+            "query: validate: true but cached response was AD=0 for " + name + "/" + qtype);
+        }
+        _touch(key, shared);
+        return _result(shared.parsed, shared.ttl, true, false, shared.validated);
+      }
+      // No fresh shared entry (winner errored / served stale) — fetch ourselves.
+    }
+
+    // Wrap the fill promise in a plain entry object so the finally-guard below
+    // compares object identity, not promise identity: if this fill errors and a
+    // follower re-registers its own fresh entry for the same key before this
+    // finally runs, the winner deletes only its OWN slot, never the follower's.
+    var entry = { promise: _fetchFill(name, qtype, key, hit, now) };
+    inflight.set(key, entry);
+    var filled;
+    try { filled = await entry.promise; }
+    finally { if (inflight.get(key) === entry) inflight.delete(key); }
+    if (filled.stale) return filled.result;
+    if (validate && !filled.validated) {
+      throw new ResolverError("resolver/validate-failed",
+        "query: validate: true but upstream returned AD=0 for " + name + "/" + qtype);
+    }
+    return _result(filled.parsed, filled.ttl, false, false, filled.validated);
+  }
+
+  // The single upstream fetch + parse + cache fill, shared by all coalesced
+  // callers. Returns { stale:false, parsed, ttl, validated } on a fresh fill,
+  // { stale:true, result } when serving stale on an upstream/parse failure, or
+  // throws on an unrecoverable error. Does NOT apply the per-caller validate
+  // gate — that stays with the caller so callers with different validate flags
+  // share one lookup.
+  async function _fetchFill(name, qtype, key, hit, now) {
+    // withTimeout rejects the await so a non-responsive / stalling endpoint
+    // can't hold the request pending forever; the default _wireLookup also
+    // tears the socket down on its own req.setTimeout so the fd is released.
     var wireResponse;
     try {
       wireResponse = await safeAsync.withTimeout(
@@ -307,7 +352,7 @@ function create(opts) {
       // Upstream failure — serve stale if we have it within window.
       if (hit && serveStale > 0 && hit.staleUntil > now) {
         _safeEmit("served_stale", { name: name, qtype: qtype, reason: "upstream-failure" });
-        return _result(hit.parsed, hit.ttl, true, true, hit.validated);
+        return { stale: true, result: _result(hit.parsed, hit.ttl, true, true, hit.validated) };
       }
       throw new ResolverError("resolver/upstream-failed",
         "query: upstream lookup failed for " + name + "/" + qtype + ": " + (e && e.message || String(e)));
@@ -320,7 +365,7 @@ function create(opts) {
       // Malformed upstream response — serve stale if within window.
       if (hit && serveStale > 0 && hit.staleUntil > now) {
         _safeEmit("served_stale", { name: name, qtype: qtype, reason: "parse-failed" });
-        return _result(hit.parsed, hit.ttl, true, true, hit.validated);
+        return { stale: true, result: _result(hit.parsed, hit.ttl, true, true, hit.validated) };
       }
       throw e;
     }
@@ -332,18 +377,10 @@ function create(opts) {
     }
 
     // AD bit (RFC 4035 §3.2.3) — set by upstream after chain validation.
-    // Bit 5 of byte 3 of header; parsed.flags is the full 16-bit flags
-    // field at offset 2..3. AD is bit 5 within byte 3 = bit 5 of the
-    // low byte of the 16-bit flags value.
     var ad = (parsed.flags & 0x0020) !== 0;                                                              // RFC 4035 §3.2.3 AD-bit mask within DNS header flags
-    if (validate && !ad) {
-      throw new ResolverError("resolver/validate-failed",
-        "query: validate: true but upstream returned AD=0 for " + name + "/" + qtype);
-    }
 
-    // Compute effective TTL — min across answer RRs (RFC 2181 §5.2:
-    // RRset TTL is the minimum of the included RR TTLs), then clamped
-    // to [minTtlMs, maxTtlMs] to bound any single RR's TTL from
+    // Compute effective TTL — min across answer RRs (RFC 2181 §5.2), then
+    // clamped to [minTtlMs, maxTtlMs] to bound any single RR's TTL from
     // pinning a poisoned entry past operator policy.
     var rrTtl = _minTtl(parsed.answer);
     var ttlMs = Math.max(minTtlMs, Math.min(maxTtlMs, rrTtl * C.TIME.seconds(1)));
@@ -358,7 +395,7 @@ function create(opts) {
       validated:  ad,
     });
     _safeEmit("cached", { name: name, qtype: qtype, ttlMs: ttlMs, adBit: ad });
-    return _result(parsed, ttlMs, false, false, ad);
+    return { stale: false, parsed: parsed, ttl: ttlMs, validated: ad };
   }
 
   function _result(parsed, ttlMs, fromCache, stale, validated) {

package/lib/vendor/blamejs/lib/network-dns.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var dns = require("node:dns");

package/lib/vendor/blamejs/lib/network-dnssec.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.network.dns.dnssec
@@ -295,8 +297,19 @@ function verifyRrset(opts) {
   validateOpts.optionalDate(opts.at, "dnssec.verifyRrset: opts.at", DnssecError, "dnssec/bad-at");
   var atMs = (opts.at !== undefined && opts.at !== null) ? opts.at.getTime() : Date.now();
   var nowSec = Math.floor(atMs / 1000);
-  if (nowSec < (rrsig.inception >>> 0)) throw new DnssecError("dnssec/not-yet-valid", "dnssec.verifyRrset: RRSIG inception is in the future");
-  if (nowSec > (rrsig.expiration >>> 0)) throw new DnssecError("dnssec/expired", "dnssec.verifyRrset: RRSIG has expired");
+  // RFC 4034 §3.1.5: the RRSIG inception/expiration fields are 32-bit and
+  // MUST be compared with RFC 1982 serial-number arithmetic, not magnitude.
+  // A plain `<` / `>` agrees with serial arithmetic only while both operands
+  // stay under 2^31; it mis-orders any window that straddles the 2^31 (Jan
+  // 2038) or 2^32 (Feb 2106) boundary — accepting an expired signature or
+  // rejecting a valid one. Mask the clock into the same 32-bit serial space
+  // and compare the wrapped signed delta: a negative (now - inception) means
+  // inception is in the future; a negative (expiration - now) means expired.
+  var nowSer = nowSec >>> 0;
+  var incepSer = rrsig.inception >>> 0;
+  var expirSer = rrsig.expiration >>> 0;
+  if (((nowSer - incepSer) | 0) < 0) throw new DnssecError("dnssec/not-yet-valid", "dnssec.verifyRrset: RRSIG inception is in the future");
+  if (((expirSer - nowSer) | 0) < 0) throw new DnssecError("dnssec/expired", "dnssec.verifyRrset: RRSIG has expired");
 
   var klass = typeof opts.class === "number" ? opts.class : 1;
   var ownerWire = _canonicalName(opts.name);

package/lib/vendor/blamejs/lib/network-heartbeat.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var net = require("node:net");

package/lib/vendor/blamejs/lib/network-nts.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var nodeTls = require("node:tls");

package/lib/vendor/blamejs/lib/network-proxy.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var http = require("node:http");

package/lib/vendor/blamejs/lib/network-smtp-policy.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.network.smtp.policy — MTA-STS + DANE + TLS-RPT outbound SMTP gates.
@@ -673,7 +675,10 @@ async function tlsRptSubmit(report, opts) {
           body:    gzipped,
           timeoutMs: timeoutMs,
         });
-        entry.status = rv && rv.status;
+        // The framework httpClient resolves { statusCode, headers, body }
+        // (same shape mtaSts.fetch reads above) — not { status }. Reading
+        // the wrong field marked every real 2xx submission as a failure.
+        entry.status = rv && rv.statusCode;
         entry.ok = entry.status >= 200 && entry.status < 300;                  // HTTP 2xx range
         if (!entry.ok) entry.error = "HTTP " + entry.status;
       } else if (/^mailto:/i.test(uri)) {

package/lib/vendor/blamejs/lib/network-tls.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var nodeTls = require("node:tls");
@@ -857,6 +859,16 @@ var OID_BASIC_OCSP_RESPONSE = "1.3.6.1.5.5.7.48.1.1";
 // OCSP nonce extension — id-pkix-ocsp-nonce.
 var OID_OCSP_NONCE          = "1.3.6.1.5.5.7.48.1.2";
 var OID_SHA1                = "1.3.14.3.2.26";                                   // SHA-1 algorithm OID arc
+// RFC 6960 §4.1.1 CertID hashAlgorithm OIDs → node hash name. SHA-1 is the
+// universally-supported default (buildOcspRequest emits it); the SHA-2 family is
+// §4.3-optional but accepted when a responder uses it. An unknown OID is refused
+// (fail closed) rather than skipping the issuer binding.
+var OCSP_CERTID_HASH_OID_TO_NODE = {
+  "1.3.14.3.2.26":          "sha1",     // id-sha1
+  "2.16.840.1.101.3.4.2.1": "sha256",   // id-sha256
+  "2.16.840.1.101.3.4.2.2": "sha384",   // id-sha384
+  "2.16.840.1.101.3.4.2.3": "sha512",   // id-sha512
+};
 var OID_RSA_SHA256          = "1.2.840.113549.1.1.11";
 var OID_RSA_SHA384          = "1.2.840.113549.1.1.12";
 var OID_RSA_SHA512          = "1.2.840.113549.1.1.13";
@@ -1032,7 +1044,20 @@ function parseOcspResponse(der) {
     if (sr.length < 3) continue;                                                 // minimum SingleResponse fields
     // sr[0] = certID SEQUENCE, sr[1] = certStatus CHOICE, sr[2] = thisUpdate.
     var certIdChildren = asn1.readSequence(sr[0].value);
-    // certID = SEQUENCE { hashAlgorithm, issuerNameHash, issuerKeyHash, serialNumber }
+    // certID = SEQUENCE { hashAlgorithm AlgorithmIdentifier, issuerNameHash
+    //                     OCTET STRING, issuerKeyHash OCTET STRING,
+    //                     serialNumber INTEGER }  (RFC 6960 §4.1.1)
+    // Capture ALL FOUR fields. A response binds to the cert under validation by
+    // (issuerNameHash, issuerKeyHash, serialNumber): a serial is unique only
+    // PER ISSUER, so a "good" for serial-S under a different issuer (a delegated
+    // responder, or a CA key spanning issuer identities) must not be accepted as
+    // proof for serial-S under the issuer we actually asked about.
+    var certIdHashAlgOid = certIdChildren.length >= 1
+      ? asn1.readOid(asn1.readSequence(certIdChildren[0].value)[0]) : null;
+    var issuerNameHash = certIdChildren.length >= 2
+      ? asn1.readOctetString(certIdChildren[1]) : null;
+    var issuerKeyHash = certIdChildren.length >= 3
+      ? asn1.readOctetString(certIdChildren[2]) : null;
     var serialHex = certIdChildren.length >= 4
       ? certIdChildren[3].value.toString("hex")
       : null;
@@ -1053,10 +1078,13 @@ function parseOcspResponse(der) {
       nextUpdate = _parseTime(asn1.readNode(sr[3].value, 0));
     }
     responses.push({
-      certIdSerialHex: serialHex,
-      certStatus:      certStatus,
-      thisUpdate:      thisUpdate,
-      nextUpdate:      nextUpdate,
+      certIdSerialHex:  serialHex,
+      certIdHashAlgOid: certIdHashAlgOid,
+      issuerNameHash:   issuerNameHash,
+      issuerKeyHash:    issuerKeyHash,
+      certStatus:       certStatus,
+      thisUpdate:       thisUpdate,
+      nextUpdate:       nextUpdate,
     });
   }
 
@@ -1169,6 +1197,40 @@ function evaluateOcspResponse(ocspDer, opts) {
     return { ok: false, status: parsed.status, signatureValid: true,
              errors: ["OCSP response has no entry for the requested cert serial"] };
   }
+  // Bind the matched SingleResponse to the ISSUER of the cert under validation,
+  // not the serial alone. RFC 6960 §4.1.1: CertID is (hashAlgorithm,
+  // issuerNameHash, issuerKeyHash, serialNumber); a serial is unique only per
+  // issuer. Without this, a "good" for serial-S signed by a key that also serves
+  // a DIFFERENT issuer (delegated responder, or a CA key spanning issuer
+  // identities) is accepted as proof for serial-S under the issuer we asked
+  // about. opts.issuerCertDer is the issuer cert (DER) whose DN + SPKI we hash;
+  // both built-in consumer paths forward it from the issuer cert they hold.
+  if (opts.issuerCertDer) {
+    if (!Buffer.isBuffer(opts.issuerCertDer)) {
+      return { ok: false, status: parsed.status, signatureValid: true,
+               errors: ["evaluateOcspResponse: opts.issuerCertDer must be a Buffer (issuer cert DER)"] };
+    }
+    if (!match.issuerNameHash || !match.issuerKeyHash) {
+      return { ok: false, status: parsed.status, signatureValid: true,
+               errors: ["OCSP CertID is missing issuerNameHash/issuerKeyHash — cannot bind the response to the issuer"] };
+    }
+    var expected;
+    try { expected = _expectedOcspCertIdHashes(opts.issuerCertDer, match.certIdHashAlgOid); }
+    catch (e) {
+      return { ok: false, status: parsed.status, signatureValid: true,
+               errors: [(e && e.message) || String(e)] };
+    }
+    if (expected.nameHash.length !== match.issuerNameHash.length ||
+        !bCrypto.timingSafeEqual(expected.nameHash, match.issuerNameHash)) {
+      return { ok: false, status: parsed.status, signatureValid: true,
+               errors: ["OCSP CertID issuerNameHash does not match the issuer of the cert under validation (RFC 6960 §4.1.1 — wrong-issuer response)"] };
+    }
+    if (expected.keyHash.length !== match.issuerKeyHash.length ||
+        !bCrypto.timingSafeEqual(expected.keyHash, match.issuerKeyHash)) {
+      return { ok: false, status: parsed.status, signatureValid: true,
+               errors: ["OCSP CertID issuerKeyHash does not match the issuer of the cert under validation (RFC 6960 §4.1.1 — wrong-issuer response)"] };
+    }
+  }
   // Optional nonce echo verification (RFC 8954 / RFC 6960 §4.4.1).
   // When opts.expectedNonce is supplied, the response MUST carry an
   // OCSP nonce extension equal to the expected bytes — defends against
@@ -1321,6 +1383,27 @@ function _extractIssuerNameDerAndKeyBitString(certDer) {
   };
 }
 
+// Compute the EXPECTED CertID issuerNameHash + issuerKeyHash for an issuer cert
+// (DER), under the hash algorithm the responder used. RFC 6960 §4.1.1:
+// issuerNameHash = Hash(issuer DN, DER); issuerKeyHash = Hash(issuer
+// subjectPublicKey BIT STRING contents — the key bytes, not the SPKI SEQUENCE).
+// Reuses _extractIssuerNameDerAndKeyBitString (the same inputs buildOcspRequest
+// hashes) so the request-build and the response-bind hash IDENTICAL bytes.
+function _expectedOcspCertIdHashes(issuerCertDer, certIdHashAlgOid) {
+  var nodeHash = OCSP_CERTID_HASH_OID_TO_NODE[certIdHashAlgOid];
+  if (!nodeHash) {
+    throw new TlsTrustError("tls/ocsp-bad-certid-hash-alg",
+      "OCSP CertID hashAlgorithm OID '" + certIdHashAlgOid +
+      "' is not a recognized hash (RFC 6960 §4.1.1)");
+  }
+  var iss = _extractIssuerNameDerAndKeyBitString(issuerCertDer);
+  // lgtm[js/weak-cryptographic-algorithm] — RFC 6960 §4.1.1 CertID lookup hash over the PUBLIC issuer name; a name/key lookup, not an integrity or secrecy operation.
+  var nameHash = nodeCrypto.createHash(nodeHash).update(iss.issuerNameDer).digest(); // lgtm[js/weak-cryptographic-algorithm]
+  // lgtm[js/weak-cryptographic-algorithm] — RFC 6960 §4.1.1 CertID lookup hash over the PUBLIC issuer key; a name/key lookup, not an integrity or secrecy operation.
+  var keyHash = nodeCrypto.createHash(nodeHash).update(iss.issuerKey).digest(); // lgtm[js/weak-cryptographic-algorithm]
+  return { nameHash: nameHash, keyHash: keyHash };
+}
+
 function _extractLeafSerial(leafCertDer) {
   var top = asn1.readNode(leafCertDer);
   if (top.tag !== asn1.TAG.SEQUENCE) {
@@ -1470,6 +1553,9 @@ async function fetchOcspResponse(opts) {
   }
   var evald = evaluateOcspResponse(res.body, {
     issuerPem:     opts.issuerPem,
+    // Bind the response's CertID to the actual issuer (RFC 6960 §4.1.1), not
+    // the serial alone — issuerX is the issuer cert we already parsed.
+    issuerCertDer: issuerX.raw,
     // Bind to the leaf being checked (its serial), not whatever the response
     // happens to carry — defaults to leafX.serialNumber when not overridden.
     serialHex:     opts.serialHex || leafX.serialNumber,
@@ -1510,8 +1596,16 @@ var ocsp = Object.freeze({
       throw new TlsTrustError("tls/ocsp-empty",
         "OCSP response was empty");
     }
+    // opts.issuerPem is the OCSP-SIGNING cert, which may be a DELEGATED responder
+    // (not the leaf's issuing CA). The CertID issuer hashes are computed over the
+    // leaf's issuer, so the RFC 6960 §4.1.1 binding needs the actual issuer cert,
+    // supplied explicitly as opts.issuerCertDer. Deriving it from issuerPem would
+    // hash the responder and wrongly reject valid delegated-responder staples, so
+    // when issuerCertDer is absent the bind stays on serial + signature only.
+    var rgIssuerCertDer = Buffer.isBuffer(opts.issuerCertDer) ? opts.issuerCertDer : null;
     var evald = evaluateOcspResponse(rv.ocspBytes, {
       issuerPem: opts.issuerPem,
+      issuerCertDer: rgIssuerCertDer,
       // Bind to the connected peer's certificate serial (not the response's own
       // entry) — without it evaluateOcspResponse fails closed.
       serialHex: opts.serialHex || (rv.peerCert && rv.peerCert.serialNumber) || null,

package/lib/vendor/blamejs/lib/network-tsig.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.network.dns.tsig
@@ -232,9 +234,19 @@ function sign(message, opts) {
   var originalId = opts.originalId == null ? message.readUInt16BE(0) : opts.originalId;
   var algName = alg.name + ".";
 
+  // RFC 8945 §5.3.1/§5.3.2 — the canonical digest is over the message with the
+  // header ID set to the Original ID (verify() restores it before digesting,
+  // line ~363, so a forwarder may rewrite the on-wire ID). Digest the same
+  // Original-ID form here; when originalId == the message's current ID (the
+  // default) this is byte-identical to digesting `message` as-is.
+  var digestMessage = message;
+  if (originalId !== message.readUInt16BE(0)) {
+    digestMessage = Buffer.from(message);
+    digestMessage.writeUInt16BE(originalId, 0);
+  }
   var digest = Buffer.concat([
     _requestMacPrefix(opts.requestMac),
-    message,
+    digestMessage,
     _tsigVariables(opts.keyName, algName, time, fudge, error, otherData),
   ]);
   var mac = nodeCrypto.createHmac(alg.hash, secret).update(digest).digest();

package/lib/vendor/blamejs/lib/network.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.network

package/lib/vendor/blamejs/lib/nis2-report.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.nis2.report — NIS2 Directive incident-reporting wrapper.

package/lib/vendor/blamejs/lib/nist-crosswalk.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.nistCrosswalk

package/lib/vendor/blamejs/lib/nonce-store.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * nonce-store — pluggable replay-protection store.

package/lib/vendor/blamejs/lib/notify.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.notify

package/lib/vendor/blamejs/lib/ntp-check.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ntpCheck

package/lib/vendor/blamejs/lib/numeric-bounds.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * numeric-bounds — shared validators for operator-tunable numeric opts.

package/lib/vendor/blamejs/lib/numeric-checks.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * numeric-checks — predicate helpers for opts / arg validation.

package/lib/vendor/blamejs/lib/object-store/azure-blob-bucket-ops.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * azure-blob-bucket-ops — container-level operations for Azure Blob.

package/lib/vendor/blamejs/lib/object-store/azure-blob.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Azure Blob Storage protocol adapter — Shared Key auth (account-level).

package/lib/vendor/blamejs/lib/object-store/gcs-bucket-ops.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * gcs-bucket-ops — bucket-level operations for Google Cloud Storage.

package/lib/vendor/blamejs/lib/object-store/gcs.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Google Cloud Storage (GCS) protocol adapter — native JSON API.

package/lib/vendor/blamejs/lib/object-store/http-put.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Generic HTTP PUT/GET protocol adapter.

package/lib/vendor/blamejs/lib/object-store/http-request.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Shared HTTP-request helper for object-store backends.

package/lib/vendor/blamejs/lib/object-store/index.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Object-store dispatcher — protocol-agnostic remote (and local) storage.

package/lib/vendor/blamejs/lib/object-store/local.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Local-filesystem protocol adapter for object-store.

package/lib/vendor/blamejs/lib/object-store/sigv4-bucket-ops.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * sigv4-bucket-ops — bucket-level operations for SigV4 backends.

package/lib/vendor/blamejs/lib/object-store/sigv4.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * SigV4 protocol adapter — AWS Signature Version 4.

package/lib/vendor/blamejs/lib/observability-otlp-exporter.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.observability.otlpExporter — OTLP/HTTP JSON span exporter.
@@ -161,7 +163,7 @@ function _spanToOtlp(span) {
     droppedAttributesCount: span.droppedAttributesCount || 0,
     events: (span.events || []).map(function (e) {
       return {
-        name:         e.name,
+        name:         _redactWireString("otel.event.name", e.name),
         timeUnixNano: e.timeUnixNano,
         attributes:   _attrToOtlp(e.attributes),
         droppedAttributesCount: 0,
@@ -357,7 +359,7 @@ function _spanToProto(span) {
   var eventsRepeated = pb.repeatedMessage(11, span.events || [], function (e) {
     return Buffer.concat([
       pb.fixed64(1, e.timeUnixNano || 0),
-      pb.string(2, e.name || ""),
+      pb.string(2, _redactWireString("otel.event.name", e.name || "")),
       pb.repeatedMessage(3, _attrsToProto(e.attributes), _keyValueToProto),
       pb.uint32(4, 0),
     ]);

package/lib/vendor/blamejs/lib/observability-tracer.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.observability.tracer — OTel-shaped distributed-tracing span builder.

package/lib/vendor/blamejs/lib/observability.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.observability

package/lib/vendor/blamejs/lib/openapi-paths-builder.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * OpenAPI 3.1 / 3.2 — paths / operations + webhooks builder.

package/lib/vendor/blamejs/lib/openapi-schema-walk.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * OpenAPI 3.1 — converts a b.safeSchema description into the JSON

package/lib/vendor/blamejs/lib/openapi-security.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * OpenAPI 3.1 — security-scheme builders.

package/lib/vendor/blamejs/lib/openapi-yaml.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * OpenAPI 3.1 — minimal YAML 1.2 emitter for the document JSON.

package/lib/vendor/blamejs/lib/openapi.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.openapi

package/lib/vendor/blamejs/lib/otel-export.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * otel-export — OTLP/HTTP-JSON exporter for `b.observability` events.

package/lib/vendor/blamejs/lib/outbox.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Transactional outbox — at-least-once event publication without

package/lib/vendor/blamejs/lib/pagination.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.pagination

package/lib/vendor/blamejs/lib/parsers/index.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Multi-format safe parsers — apply the same security defaults blamejs's

package/lib/vendor/blamejs/lib/parsers/safe-env.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Security-focused .env loader.

package/lib/vendor/blamejs/lib/parsers/safe-ini.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * INI parser — same security defaults as the framework's other parsers.

package/lib/vendor/blamejs/lib/parsers/safe-toml.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Security-focused TOML 1.0 parser.