@blamejs/blamejs-shop 0.5.5 → 0.5.6

package/lib/vendor/blamejs/lib/tls-exporter.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.tlsExporter

package/lib/vendor/blamejs/lib/totp.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * TOTP (Time-based One-Time Password) — RFC 6238 / RFC 4226.

package/lib/vendor/blamejs/lib/tracing.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.tracing

package/lib/vendor/blamejs/lib/tsa.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.tsa

package/lib/vendor/blamejs/lib/uri-template.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.uriTemplate

package/lib/vendor/blamejs/lib/uuid.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.uuid

package/lib/vendor/blamejs/lib/validate-opts.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * validate-opts — shared call-site helper for primitive create() functions

package/lib/vendor/blamejs/lib/vault/index.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.vault

package/lib/vendor/blamejs/lib/vault/passphrase-ops.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * vault-passphrase-ops — seal / unseal / rotate the vault's passphrase wrap.

package/lib/vendor/blamejs/lib/vault/passphrase-source.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Passphrase source drivers — env / file / stdin.

package/lib/vendor/blamejs/lib/vault/rotate.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * vault-rotate — vault key rotation primitives.

package/lib/vendor/blamejs/lib/vault/seal-pem-file.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * vault/seal-pem-file — seal a PEM file at rest with file-watch auto-

package/lib/vendor/blamejs/lib/vault/wrap.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Vault-key wrapping — passphrase-derived AEAD wrap for the framework's vault key.

package/lib/vendor/blamejs/lib/vault-aad.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.vault.aad — AAD-bound sealed-column primitive.

package/lib/vendor/blamejs/lib/vc.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.vc
@@ -69,6 +71,32 @@ var JOSE_ALGS = {
   "EdDSA": { nodeHash: null },
 };
 
+// RFC 7518 §3.4 binds each ECDSA alg to a specific curve. The verifier must
+// reject a signature whose header alg does not match the resolved key's type
+// / curve — otherwise the attacker picks the alg (hash + encoding) from the
+// header independent of the key an ECDSA curve/type confusion (CWE-347).
+var _ES_ALG_CURVE = { "ES256": "prime256v1", "ES384": "secp384r1", "ES512": "secp521r1" };
+
+function _assertJoseAlgKey(algName, key) {
+  var kt = key && key.asymmetricKeyType;
+  if (algName === "EdDSA") {
+    if (kt !== "ed25519" && kt !== "ed448") {
+      throw new VcError("vc/alg-key-mismatch",
+        "vc.verify: alg EdDSA requires an Ed25519/Ed448 key, got " + (kt || "?"));
+    }
+    return;
+  }
+  var wantCurve = _ES_ALG_CURVE[algName];
+  if (wantCurve) {
+    var gotCurve = key && key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve;
+    if (kt !== "ec" || gotCurve !== wantCurve) {
+      throw new VcError("vc/alg-key-mismatch",
+        "vc.verify: alg " + algName + " requires an EC " + wantCurve + " key, got " +
+        (kt || "?") + "/" + (gotCurve || "?"));
+    }
+  }
+}
+
 function _b64urlJson(obj) {
   return Buffer.from(JSON.stringify(obj), "utf8").toString("base64url");
 }
@@ -234,6 +262,9 @@ function _verifyJose(token, opts, expectedTyp) {
   }
   var params = JOSE_ALGS[header.alg];
   var pub = opts.publicKey ? _toKey(opts.publicKey, "public") : _toKey(opts.keyResolver(header), "public");
+  // Bind the header-declared alg to the resolved key's type/curve before
+  // verifying — reject an alg the attacker chose that doesn't match the key.
+  _assertJoseAlgKey(header.alg, pub);
   var signingInput = parts[0] + "." + parts[1];
   var sig = Buffer.from(parts[2], "base64url");
   var ok = params.nodeHash === null

package/lib/vendor/blamejs/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:5d539dfc9ef47121d4c09bd7256d76448a1f5ac47ee09ac44c78ff6a062af9ab"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:ebf254d5eb56aef8705a1c4af9603f47987b4870a9bb5e657e06907b701e2731"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9190309daadca4c2e2cc2b76beaa6b96e463429cc3c390bd9f0ceaf7b588c68"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:49411d893f5e9b0e2fcaa564b4ec7921f73a9a06229b5e53d49c1453ea1a365c"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -154,12 +154,12 @@
       "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
       "bundledAt": "2026-06-24T00:00:00Z",
       "hashes": {
-        "server": "sha256:42c4f3544726fa2feb4f304c889c5e391feb5d28080c9b6356ff82e267a93706",
-        "data_js": "sha256:c840d9ae5c6bf4a07967340a5c649df2c6a66a287db41e408461c46cc32348e6"
+        "server": "sha256:5afbeea28737514a69a0bdca7cd3818979e67c443444de4d19f2f8713cf5372e",
+        "data_js": "sha256:6ed61937db12f148494db7c336498740bf4458cd9f49ec73d887eda83529f207"
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     },
     "peculiar-pki": {
       "version": "2.0.0+pkijs-3.4.0",
@@ -190,7 +190,7 @@
       "hashes": {
         "server": "sha256:9bbc191afaaa2b1e5757f00480457c08134cdc2c55d541df18d9155bba9cbf77"
       },
-      "refreshedAt": "2026-06-25T02:57:00.483Z"
+      "refreshedAt": "2026-07-02T23:54:12.403Z"
     }
   }
 }

package/lib/vendor/blamejs/lib/vendor/public-suffix-list.dat

@@ -5,8 +5,8 @@
 // Please pull this list from, and only from https://publicsuffix.org/list/public_suffix_list.dat,
 // rather than any other VCS sites. Pulling from any other URL is not guaranteed to be supported.
 
-// VERSION: 2026-06-24_06-18-09_UTC
-// COMMIT: 18ecca5d54471f21918798da451dd8d03a18f3c7
+// VERSION: 2026-07-02_09-58-14_UTC
+// COMMIT: d67b6cb8e70e9c76b0803809b66e7ffdd09484bd
 
 // Instructions on pulling and using this list can be found at https://publicsuffix.org/list/.
 
@@ -14614,7 +14614,6 @@ polyspace.com
 // May First - People Link : https://mayfirst.org/
 // Submitted by Jamie McClelland <info@mayfirst.org>
 mayfirst.info
-mayfirst.org
 
 // McHost : https://mchost.ru
 // Submitted by Evgeniy Subbotin <e.subbotin@mchost.ru>
@@ -16411,7 +16410,6 @@ zabc.net
 
 // ===END PRIVATE DOMAINS===
 
-
 // ===BEGIN blamejs canary===
 // Honeytoken — vendor-data integrity defense (lib/vendor-data.js).
 _blamejs_canary_v0_9_8_.local