@blamejs/blamejs-shop 0.5.5 → 0.5.7

package/lib/vendor/blamejs/release-notes/v0.16.0.json

@@ -0,0 +1,44 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.16.0",
+  "date": "2026-07-03",
+  "headline": "Raises the minimum Node.js engine to 24.18.0; the status-list verifier now binds the token type against a typ-confusion replay; and CI supply-chain pinning is consolidated behind committed dev/example lockfiles, `npm ci`, and a single aggregating pin tool that closes the OpenSSF Scorecard pinned-dependency gaps",
+  "summary": "This minor raises the supported Node.js floor from 24.16.0 to 24.18.0 — operators must run Node 24.18.0 or newer (24.17.0 was a security release; 24.18.0 bundles SQLite 3.53.1 and a backup-path fix, and guarantees the native OpenSSL 3.5 SLH-DSA surface). b.auth.statusList.fromJwt now enforces RFC 8725 §3.11 by binding the JWS header typ to the \"statuslist+jwt\" that toJwt stamps, so a token minted for another purpose can't be replayed as a status list. The build's supply-chain pinning is reworked so OpenSSF Scorecard sees pinned installs everywhere it can: the dev-tool, example, and fuzz manifests now ship committed lockfiles and CI installs them with `npm ci` (Scorecard keys pinning on the `ci` verb, not on an `@version` specifier), the vendored fuzz toolchain and the oss-fuzz base image are pinned, and a new scripts/pin-all.js aggregates every pin — regenerating all lockfiles, pinning the GitHub Action SHAs, and syncing the Docker base-image digests in one `--fix`, with a `--check` gate wired into CI and the release flow so no pin can silently drift. The committed lockfiles are dev/example-only and excluded from the published tarball; the zero-npm-RUNTIME-deps rule is unchanged.",
+  "sections": [
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Minimum Node.js engine raised to 24.18.0",
+          "body": "engines.node is now >=24.18.0 (was >=24.16.0). Operators must run Node 24.18.0 or newer. 24.17.0 was a security release and 24.18.0 bundles SQLite 3.53.1 plus a backup-keepalive fix; the floor also guarantees the native OpenSSL 3.5 SLH-DSA sign/verify surface. CI, the release container, and the docs are updated to the new floor."
+        },
+        {
+          "title": "Supply-chain pinning consolidated behind committed lockfiles + `npm ci` + one aggregating pin tool",
+          "body": "The root dev-tool (esbuild, postject), examples/wiki, and fuzz (jazzer.js) manifests now ship committed package-lock.json files, and CI installs them with `npm ci` instead of `npm install pkg@version` — OpenSSF Scorecard's Pinned-Dependencies check treats only the `npm ci` verb as pinned, so this is what actually clears those alerts (an exact `@version` specifier does not). The vendored fuzz toolchain is pinned to an exact jazzer version and the oss-fuzz base image is digest-pinned (mirroring the Dependabot-tracked .clusterfuzzlite digest). A new scripts/pin-all.js aggregates every pinning segment — it regenerates all committed lockfiles, pins the GitHub Action SHAs (via check-actions-currency), and syncs the Docker base-image digests in one `--fix`; a `--check` mode runs in CI and scripts/release.js so a stale lockfile or drifted digest fails closed. The committed lockfiles are dev/example-only, excluded from the published tarball's files allowlist; the zero-npm-RUNTIME-deps rule is unchanged."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Status-list verification binds the token type (RFC 8725 §3.11 typ-confusion)",
+          "body": "b.auth.statusList.fromJwt now passes expectedTyp \"statuslist+jwt\" to the JWT verifier, matching the typ that b.auth.statusList.toJwt stamps and every sibling verifier enforces. A token minted for another purpose — even one that happens to carry a status_list.lst claim — is now refused on the type binding before the claim is read, closing the typ-confusion class where such a token could be replayed as a status list."
+        }
+      ]
+    },
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "scripts/pin-all.js — aggregated supply-chain pin tool",
+          "body": "One command re-pins every supply-chain segment: `--fix` regenerates the committed lockfiles (root / examples/wiki / fuzz), pins the GitHub Action SHAs, and syncs the Docker base-image digests; `--check` (wired into CI and the release flow) verifies the lockfile and digest segments — including each lockfile's package version — are in sync and fails closed on drift. Contributor tooling — it does not ship in the tarball."
+        },
+        {
+          "title": "Project-governance and assurance documentation; OpenSSF Best Practices silver badge",
+          "body": "Adds a ROADMAP.md (documented direction plus an explicit out-of-scope list), a Developer Certificate of Origin policy in CONTRIBUTING.md (contributions carry a Signed-off-by; releases sign off through the release tooling), and an explicit security assurance case in SECURITY.md (a top security claim decomposed into evidence-backed sub-claims, with a residual-risk statement). The project earned the OpenSSF Best Practices silver badge, linked from the README."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.16.1.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.16.1",
+  "date": "2026-07-03",
+  "headline": "Every source file now carries an SPDX license + copyright header; the wiki example emits its full HSTS when it runs behind a TLS-terminating reverse proxy; and a good-first-issue on-ramp lands for new contributors",
+  "summary": "This patch stamps a per-file `SPDX-License-Identifier: Apache-2.0` and a copyright line onto every first-party source file, so the license of any single file is unambiguous when it is read, audited, or vendored in isolation. The project stays Apache-2.0 — this is a clarity change, not a license change, and vendored third-party files under lib/vendor/ keep their own upstream headers. The wiki example now passes its trusted-proxy CIDRs to the securityHeaders middleware: a deployment behind a TLS-terminating reverse proxy (Caddy or nginx) that forwards `X-Forwarded-Proto: https` now emits the framework's strong HSTS (two-year max-age, includeSubDomains, preload) instead of suppressing it on the plain-HTTP hop from the proxy — the wiki e2e asserts both the proxied-https and the direct-http cases. CONTRIBUTING gains a good-first-issue on-ramp so new contributors have a clear, small first step.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Wiki example emits its full HSTS behind a TLS-terminating reverse proxy",
+          "body": "The wiki example app now hands its trusted-proxy CIDRs to `securityHeaders`, so behind Caddy or nginx forwarding `X-Forwarded-Proto: https` it emits `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload` rather than dropping HSTS on the internal HTTP hop from the proxy. Operators modelling their own app on the example inherit the fix by declaring their proxy CIDRs via `WIKI_ADMIN_TRUSTED_PROXIES` (the production compose already defaults to the private ranges). The framework's `securityHeaders` primitive is unchanged; this closes a wiring gap in the example."
+        }
+      ]
+    },
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "Per-file SPDX license and copyright headers",
+          "body": "Every first-party source file now begins with `// SPDX-License-Identifier: Apache-2.0` and a copyright line, so the license and holder of any individual file are explicit when it is read or extracted on its own. No license change — the project remains Apache-2.0. Vendored files under `lib/vendor/` are untouched and retain their upstream license headers."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Good-first-issue on-ramp for new contributors",
+          "body": "CONTRIBUTING now points new contributors at issues labelled `good first issue` — small, self-contained tasks (a doc or wiki-example fix, a test for an uncovered branch) that are the easiest first step into the codebase."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.16.2.json

@@ -0,0 +1,71 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.16.2",
+  "date": "2026-07-03",
+  "headline": "Security hardening across the mail, OAuth/SAML, ACME, keychain and router primitives — six fail-open / injection / bypass fixes and seven correctness fixes — alongside a large expansion of the automated test suite",
+  "summary": "This patch closes a batch of security and correctness defects surfaced while substantially expanding the test suite across the framework's mail-authentication, federated-identity, ACME, keychain, backup, CLI and router primitives. The security fixes: SPF evaluation no longer throws (and thus can no longer be laundered into a temperror that a permissive inbound policy accepts) on a malformed `ip4:` CIDR mask; the Authentication-Results builder now refuses CR/LF/NUL in the `version` field, closing the last header-injection gap left by the earlier mail-header sweep; `res.redirect` now rejects a horizontal TAB (which user agents strip before URL parsing, turning `/\\t/evil.example` into a protocol-relative redirect to an attacker origin); the OAuth refresh-token one-time-use replay gate now treats any truthy `seen()` result as seen (a Redis `1` / SQL `COUNT` no longer slips a stolen refresh token past a `=== true` compare) — with the same normalization applied to its sibling replay checks; SAML Single-Logout over HTTP-POST/SOAP now fails closed (throws) when a verification key is supplied without its algorithm, matching the redirect binding instead of silently skipping signature verification; and the OAuth authorization-URL / PAR builders now refuse operator `extraParams` that collide with framework-managed parameters (`redirect_uri`, `state`, `code_challenge`, …). The correctness fixes: concurrent keychain file-store writes are serialized under the existing file lock (no more lost bindings); TLS-RPT submission reads the real `statusCode` (successful reports are no longer misreported as failures); ACME account key-rollover stops double-encoding its inner JWS payload (rollover was always rejected by the CA); the response-schema validator now also validates JSON bodies sent via `res.end`; keychain `remove` validates a relative fallback path like `store`/`retrieve`; `bundleAdapterStorage` honors the ambient compliance posture like `create`; and a refused `dev --ignore` pattern now returns exit code 2 instead of rejecting the CLI promise.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "SPF `ip4:` with a malformed CIDR mask fails closed instead of throwing (fail-open)",
+          "body": "`_ipv4InCidr` lacked the finite-mask guard its IPv6 sibling has, so an `ip4:` mechanism with a non-numeric prefix (e.g. `ip4:192.0.2.0/`) reached `BigInt(32 - NaN)` and threw an uncaught `RangeError` out of `b.mail.spf.verify` / `b.mail.inbound.verify`. Upstream mail handling catches that throw as a temperror, and an inbound policy configured to accept on temperror would then admit a sender that should have been evaluated. SPF now returns a `permerror` result for a malformed mask, honoring the primitive's documented never-throw-on-message-content contract."
+        },
+        {
+          "title": "Authentication-Results builder refuses CR/LF/NUL in the `version` field (header injection)",
+          "body": "`b.mail.authResults.emit` validated the `authserv-id` against control characters but not the operator-supplied `version`, which is interpolated onto the `Authentication-Results:` header line — the last field left unguarded by the earlier mail-header CRLF sweep. A `version` containing CRLF could smuggle an arbitrary header. It is now refused with a typed error, like every other field on that line."
+        },
+        {
+          "title": "`res.redirect` rejects horizontal TAB (open-redirect / same-origin bypass)",
+          "body": "The redirect target's control-character guard rejected CR/LF/NUL but not TAB (0x09). Node permits a TAB in a header value, but the WHATWG URL parser strips ASCII TAB/LF/CR from a URL before resolving it, so a `Location: /\\t/evil.example` collapses to the protocol-relative `//evil.example` and navigates to the attacker origin — bypassing the same-origin/allowlist heuristic. TAB is now rejected alongside CR/LF/NUL."
+        },
+        {
+          "title": "OAuth refresh-token replay gate treats any truthy `seen()` result as seen (fail-open)",
+          "body": "The legacy `seen(refreshToken)` replay gate compared the callback's return with `=== true`, but the documented contract is that it returns a truthy value when the token was presented before. A store returning a truthy non-`true` value — a Redis `EXISTS`/`SISMEMBER` `1`, a SQL `COUNT` — slipped a replayed (stolen) refresh token past the one-time-use gate. Any truthy result now counts as seen; the same normalization was applied to the sibling replay checks in the module."
+        },
+        {
+          "title": "SAML Single-Logout over HTTP-POST/SOAP fails closed on a key without its algorithm",
+          "body": "The POST and SOAP SLO parsers gated signature verification with an OR condition and the verify helper early-returned when the algorithm was absent, so supplying a verification key without `idpVerifyAlg` silently accepted a forged, unsigned LogoutRequest — while the HTTP-Redirect binding failed closed. All four SLO parse paths now route through one config check that throws when a key is supplied without its algorithm."
+        },
+        {
+          "title": "OAuth authorization-URL / PAR builders refuse `extraParams` that collide with managed parameters",
+          "body": "`authorizationUrl` and `pushAuthorizationRequest` merged operator `extraParams` with `URLSearchParams.set`, which replaces — so an `extraParams` entry for `redirect_uri`, `state`, or `code_challenge` overwrote the framework-generated value while the call still returned the framework's `state`/PKCE verifier, diverging the returned session seed from the emitted URL. Reserved parameter keys in `extraParams` are now refused with a typed error at both builders."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Concurrent keychain file-store writes no longer drop bindings",
+          "body": "`store` and the file-remove path performed an unlocked read-modify-write of the fallback file, so two concurrent stores could each read the pre-update document and the later write would clobber the earlier binding. Both read-modify-write sequences are now serialized under the file's existing lock."
+        },
+        {
+          "title": "TLS-RPT submission reads the response `statusCode`",
+          "body": "`tlsRpt.submit` read `status` from the HTTP client response, but the client resolves `statusCode`, so a successful (2xx) report POST was reported as `{ ok: false, error: 'HTTP undefined' }`. It now reads `statusCode`, so delivered reports are distinguished from rejected ones."
+        },
+        {
+          "title": "ACME account key-rollover no longer double-encodes its inner JWS payload",
+          "body": "`accountKeyRollover` passed an already-stringified payload to a signer that stringifies internally, so the inner keyChange JWS payload encoded a JSON string instead of the JSON object and every rollover was rejected by the CA (RFC 8555 §7.3.5). The payload is now passed once."
+        },
+        {
+          "title": "Response-schema validator also validates `res.end` JSON bodies",
+          "body": "The response validator wrapped only `res.json`, so a handler shipping an invalid body via `res.end(JSON.stringify(...))` escaped validation despite the documented contract. JSON-shaped `res.end` bodies are now validated on the same path."
+        },
+        {
+          "title": "keychain `remove` validates a relative fallback path like `store`/`retrieve`",
+          "body": "`remove` checked file existence before validating the fallback path, so a relative path silently no-op'd instead of throwing the config error that `store`/`retrieve` raise. It now validates first, consistent with the other file-fallback paths."
+        },
+        {
+          "title": "`bundleAdapterStorage` honors the ambient compliance posture",
+          "body": "`bundleAdapterStorage` only refused an unencrypted strategy when an explicit posture was passed, unlike `create`, which reads the ambient `b.compliance` posture and refuses `encrypt:false` under HIPAA. `bundleAdapterStorage` now falls back to the ambient posture, closing the asymmetry."
+        },
+        {
+          "title": "`dev --ignore` pattern refusal returns exit code 2",
+          "body": "A `dev --ignore` pattern that exceeded the length cap or was refused by the regex guard threw out of the CLI promise instead of writing to stderr and returning exit code 2 like every other CLI validation failure. It now returns the standard non-zero exit."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/scripts/build-vendored-sbom.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // Build a CycloneDX 1.6 SBOM covering lib/vendor/* bundles.
 //

package/lib/vendor/blamejs/scripts/check-actions-currency.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * GitHub-Actions-currency gate — the sibling of
@@ -14,6 +16,14 @@
  *   node scripts/check-actions-currency.js
  *   node scripts/check-actions-currency.js --json     // structured output
  *   node scripts/check-actions-currency.js --warn     // exit 0, print only
+ *   node scripts/check-actions-currency.js --fix       // rewrite stale pins
+ *                                                       // to the latest SHA +
+ *                                                       // version comment,
+ *                                                       // then exit 0
+ *
+ * `--fix` applies the same latest-release SHA the gate already resolves —
+ * every `owner/repo[/subpath]@<sha>  # vX.Y.Z` reference to a stale action
+ * is rewritten in place. Re-run without `--fix` (or let CI) to verify.
  *
  * Run in CI: the workflow passes GITHUB_TOKEN in the environment so the
  * GitHub API gives the authenticated 5000/hour budget instead of the
@@ -34,6 +44,7 @@ var WORKFLOWS_DIR = path.join(__dirname, "..", ".github", "workflows");
 
 var WARN_ONLY  = process.argv.indexOf("--warn") !== -1;
 var JSON_OUT   = process.argv.indexOf("--json") !== -1;
+var DO_FIX     = process.argv.indexOf("--fix") !== -1;
 var TIMEOUT_MS = 10000;
 
 // Per-action overrides. Keyed by "owner/repo".
@@ -79,6 +90,46 @@ async function _resolveSha(ownerRepo, ref) {
   return c.sha;
 }
 
+// Fetch the supply-chain review material for a bump: the commit range
+// between the pinned SHA and the new SHA (what actually changed), plus the
+// release notes for the new tag. A human reviews this before trusting the
+// pin — a compromised release surfaces here as an unexpected commit or an
+// author/change that doesn't match the version bump.
+async function _releaseChangelog(ownerRepo, oldSha, newTag, newSha) {
+  var out = {
+    compareUrl: "https://github.com/" + ownerRepo + "/compare/" + oldSha + "..." + newSha,
+    commits: [], files: [], body: "", compareError: null,
+  };
+  try {
+    var cmp = await _githubGet("/repos/" + ownerRepo + "/compare/" + oldSha + "..." + newSha);
+    if (cmp && cmp.html_url) out.compareUrl = cmp.html_url;
+    if (cmp && Array.isArray(cmp.commits)) {
+      out.commits = cmp.commits.map(function (c) {
+        var msg = ((c.commit && c.commit.message) || "").split("\n")[0];
+        var who = (c.author && c.author.login) || (c.commit && c.commit.author && c.commit.author.name) || "?";
+        return (c.sha || "").slice(0, 10) + "  " + who + "  " + msg;
+      });
+    }
+    if (cmp && Array.isArray(cmp.files)) {
+      // The actual code change per file. GitHub omits `.patch` for files
+      // above its diff-size limit (large minified dist bundles) — those are
+      // flagged so a reviewer knows to inspect them via the compare URL.
+      out.files = cmp.files.map(function (f) {
+        return {
+          name: f.filename, status: f.status,
+          add: f.additions, del: f.deletions,
+          patch: typeof f.patch === "string" ? f.patch : null,
+        };
+      });
+    }
+  } catch (e) { out.compareError = (e && e.message) || String(e); }
+  try {
+    var rel = await _githubGet("/repos/" + ownerRepo + "/releases/tags/" + encodeURIComponent(newTag));
+    if (rel && typeof rel.body === "string") out.body = rel.body;
+  } catch (_e) { /* action ships tags without a GitHub Release body */ }
+  return out;
+}
+
 async function _latestVersion(ownerRepo) {
   // Prefer the published "latest" release tag; fall back to the
   // highest semver tag for actions that ship tags without GitHub
@@ -144,8 +195,9 @@ function _collectPinnedActions() {
       if (!m) continue;
       var ownerRepo = m[1];
       var subpath   = m[2] || "";
+      var sha       = m[3];
       var version   = m[4];
-      if (!out[ownerRepo]) out[ownerRepo] = { version: version, refs: [] };
+      if (!out[ownerRepo]) out[ownerRepo] = { version: version, sha: sha, refs: [] };
       out[ownerRepo].refs.push({ file: rel, line: L + 1, subpath: subpath });
       // If the same repo is pinned at two different versions across
       // files, record the lowest so a partial bump still flags.
@@ -176,6 +228,7 @@ async function _checkOne(ownerRepo, entry) {
     return {
       action:    ownerRepo,
       pinned:    entry.version,
+      oldSha:    entry.sha,
       latest:    info.tag,
       latestSha: info.sha,
       status:    status,
@@ -232,6 +285,65 @@ async function main() {
   var stale   = results.filter(function (r) { return r.status === "stale"; });
   var errored = results.filter(function (r) { return r.status === "api-error"; });
 
+  if (DO_FIX) {
+    var byFile = {};
+    var fixable = stale.filter(function (r) { return r.latestSha && r.latest; });
+    for (var fx = 0; fx < fixable.length; fx++) {
+      var fr = fixable[fx];
+      var tag = /^v/.test(fr.latest) ? fr.latest : "v" + fr.latest;
+      // Supply-chain review material — printed BEFORE applying so the change
+      // between the pinned SHA and the new SHA (the actual commits + authors)
+      // and the release notes can be validated. A compromised release shows
+      // up here as an unexpected commit / author / change.
+      var cl = await _releaseChangelog(fr.action, fr.oldSha, tag, fr.latestSha);
+      process.stdout.write("\n=== " + fr.action + "  " + fr.pinned + " -> " + fr.latest + " ===\n");
+      process.stdout.write("  old sha: " + fr.oldSha + "\n  new sha: " + fr.latestSha + "\n");
+      process.stdout.write("  compare: " + cl.compareUrl + "\n");
+      if (cl.commits.length) {
+        process.stdout.write("  commits between the two SHAs (" + cl.commits.length + ") [sha  author  subject]:\n");
+        for (var ci = 0; ci < cl.commits.length; ci++) process.stdout.write("    " + cl.commits[ci] + "\n");
+      } else if (cl.compareError) {
+        process.stdout.write("  commits: (compare unavailable: " + cl.compareError + ")\n");
+      }
+      if (cl.files.length) {
+        process.stdout.write("  changed files (" + cl.files.length + "):\n");
+        for (var sfi = 0; sfi < cl.files.length; sfi++) {
+          var sf = cl.files[sfi];
+          process.stdout.write("    [" + sf.status + " +" + sf.add + "/-" + sf.del + "] " + sf.name + "\n");
+        }
+        process.stdout.write("  code diff (per file, capped at 200 lines):\n");
+        for (var dfi = 0; dfi < cl.files.length; dfi++) {
+          var df = cl.files[dfi];
+          process.stdout.write("    ----- " + df.name + " -----\n");
+          if (df.patch === null) {
+            process.stdout.write("      (patch omitted by GitHub — file too large / binary; inspect via the compare URL above)\n");
+          } else {
+            var dl = df.patch.split("\n");
+            for (var dk = 0; dk < Math.min(dl.length, 200); dk++) process.stdout.write("      " + dl[dk] + "\n");
+            if (dl.length > 200) process.stdout.write("      ... (" + (dl.length - 200) + " more diff line(s) — see compare URL)\n");
+          }
+        }
+      }
+      if (cl.body) {
+        process.stdout.write("  release notes for " + tag + ":\n");
+        var bl = cl.body.split("\n");
+        for (var bi = 0; bi < Math.min(bl.length, 40); bi++) process.stdout.write("    " + bl[bi] + "\n");
+        if (bl.length > 40) process.stdout.write("    ... (" + (bl.length - 40) + " more line(s))\n");
+      }
+      var esc = fr.action.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      var re2 = new RegExp("(" + esc + "(?:/[^@\\s]+)?@)[0-9a-f]{40}(\\s*#\\s*)v?\\d+(?:\\.\\d+){0,2}", "g");
+      for (var rj = 0; rj < (fr.refs || []).length; rj++) {
+        var abs = path.join(__dirname, "..", fr.refs[rj].file);
+        if (!(abs in byFile)) byFile[abs] = fs.readFileSync(abs, "utf8");
+        byFile[abs] = byFile[abs].replace(re2, "$1" + fr.latestSha + "$2" + tag);
+      }
+    }
+    Object.keys(byFile).forEach(function (abs) { fs.writeFileSync(abs, byFile[abs]); });
+    process.stdout.write("\n[actions-currency] --fix: rewrote " + fixable.length + " stale action(s) across " +
+      Object.keys(byFile).length + " workflow file(s). REVIEW the changelogs above for supply-chain integrity before committing; re-run without --fix to verify.\n");
+    process.exit(0);
+  }
+
   if (WARN_ONLY) {
     if (stale.length || errored.length) {
       process.stdout.write("[actions-currency] --warn: " + stale.length + " stale, " +

package/lib/vendor/blamejs/scripts/check-api-snapshot.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * scripts/check-api-snapshot.js

package/lib/vendor/blamejs/scripts/check-changelog-extract.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Pre-push static gate — exercise the awk-extract that

package/lib/vendor/blamejs/scripts/check-esbuild-pin.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 // Enforces that the SEA-build tool versions installed across the build artifacts
@@ -27,18 +29,15 @@ var ROOT = path.resolve(__dirname, "..");
 var PIN_PATH = path.join(__dirname, "esbuild-binary-pin.json");
 var HEX64_RE = /^[0-9a-f]{64}$/;
 
-// Workflows whose SEA-build step installs the pinned tool versions. Each MUST
-// carry an exact `<tool>@<version>` spec for every required tool: an install
-// line that drops the version (e.g. `npm install esbuild postject`) would let CI
+// The SEA-build workflows install the pinned tool versions with `npm ci`, so the
+// committed root package-lock.json is the version pin CI resolves against. This
+// check asserts the lockfile pins each required tool at exactly the package.json
+// devDependencies version — a lockfile that drifts (or is absent) would let CI
 // resolve an unreviewed esbuild and silently fall back to the binary-hash smoke
-// gate's skip path, so a missing pinned spec is itself a violation (fail-closed).
-// If the SEA build legitimately moves out of one of these, update this list in
-// the same change.
-var WORKFLOWS = [
-  ".github/workflows/ci.yml",
-  ".github/workflows/npm-publish.yml",
-];
-var REQUIRED_TOOLS = ["esbuild", "postject"];
+// gate's skip path, so a drift/absence is a violation (fail-closed). Scorecard
+// flags any `npm install pkg@ver` as unpinned (it keys on the `npm ci` verb, not
+// the specifier), which is why the workflows use `npm ci` + this lockfile pin.
+var LOCKFILE = "package-lock.json";
 
 // Returns { ok: boolean, violations: [{ file, line, content }] }. Never throws on
 // expected-missing inputs — a missing file is reported as a violation so the
@@ -82,41 +81,35 @@ function checkEsbuildPin() {
     }
   }
 
-  // Every scoped workflow installs the exact package.json versions — and MUST
-  // pin each required tool with a `<tool>@<version>` spec (a missing spec means
-  // an unpinned, unreviewed install slips through).
+  // The committed root lockfile pins the exact package.json versions that
+  // `npm ci` installs in the SEA-build workflows — assert it agrees.
   var expectedFor = { esbuild: esbuildVer, postject: postjectVer };
-  WORKFLOWS.forEach(function (rel) {
-    var src;
-    try { src = fs.readFileSync(path.join(ROOT, rel), "utf8"); }
-    catch (e) { push(rel, "unreadable: " + (e && e.message)); return; }
-    REQUIRED_TOOLS.forEach(function (tool) {
-      var expected = expectedFor[tool];
-      if (!expected) return; // already reported as a missing package.json devDep above
-      checkSpec(bad, rel, src, tool, expected);
-    });
-  });
+  checkLockfile(bad, expectedFor);
 
   return { ok: bad.length === 0, violations: bad };
 }
 
-function checkSpec(bad, rel, src, tool, expected) {
-  var re = new RegExp(tool + "@([0-9][\\w.-]*)", "g");
-  var m;
-  var found = [];
-  while ((m = re.exec(src)) !== null) { found.push(m[1]); }
-  if (found.length === 0) {
-    bad.push({ file: rel, line: 0,
-      content: rel + " has no pinned " + tool + "@<version> spec — the SEA-build install must pin " +
-        tool + "@" + expected + " (an unpinned install resolves an unreviewed version and the " +
-        "binary-hash smoke gate falls back to its skip path)" });
+function checkLockfile(bad, expectedFor) {
+  var lock;
+  try { lock = JSON.parse(fs.readFileSync(path.join(ROOT, LOCKFILE), "utf8")); }
+  catch (e) {
+    bad.push({ file: LOCKFILE, line: 0,
+      content: LOCKFILE + " unreadable (" + (e && e.message) + ") — commit the root lockfile so `npm ci` " +
+        "pins the reviewed SEA-build tool versions; without it Scorecard flags the install and the " +
+        "binary-hash smoke gate falls back to its skip path" });
     return;
   }
-  found.forEach(function (ver) {
-    if (ver !== expected) {
-      bad.push({ file: rel, line: 0,
-        content: rel + " installs " + tool + "@" + ver + " but package.json devDependencies pins " +
-          tool + "@" + expected + " — bump the pin (and re-review the esbuild binary hash) or fix the workflow" });
+  var pkgs = lock.packages || {};
+  Object.keys(expectedFor).forEach(function (tool) {
+    var expected = expectedFor[tool];
+    if (!expected) return; // already reported as a missing package.json devDep above
+    var node = pkgs["node_modules/" + tool];
+    var got = node && node.version;
+    if (got !== expected) {
+      bad.push({ file: LOCKFILE, line: 0,
+        content: LOCKFILE + " pins " + tool + "@" + (got || "<absent>") + " but package.json devDependencies pins " +
+          tool + "@" + expected + " — regenerate the lockfile (`npm install --package-lock-only`) and re-review " +
+          "the esbuild binary hash so `npm ci` installs the reviewed version" });
     }
   });
 }
@@ -130,5 +123,5 @@ if (require.main === module) {
     process.exit(1);
   }
   console.log("[check-esbuild-pin] OK — esbuild/postject pinned consistently across package.json + " +
-    WORKFLOWS.length + " workflow(s); reviewed per-platform hashes present.");
+    LOCKFILE + " (npm ci); reviewed per-platform hashes present.");
 }

package/lib/vendor/blamejs/scripts/check-pack-against-gitignore.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // prepack guard — fail the publish if any packed path is gitignored
 // (repo + global). `--ignore-scripts` on the inner pack call avoids

package/lib/vendor/blamejs/scripts/check-services.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * scripts/check-services.js

package/lib/vendor/blamejs/scripts/check-vendor-currency.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Vendor-currency gate.

package/lib/vendor/blamejs/scripts/consolidate-release-notes.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Roll up per-patch `release-notes/v<X>.<Y>.<Z>.json` files for any

package/lib/vendor/blamejs/scripts/gen-migrating.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // scripts/gen-migrating.js — generate MIGRATING.md from deprecate() calls
 // across lib/. Walks the tree, finds every `deprecate.warn|wrap|alias`

package/lib/vendor/blamejs/scripts/generate-changelog-entry.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Generate the CHANGELOG.md section for a release from a structured

package/lib/vendor/blamejs/scripts/generate-release-signing-key.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * One-time setup: generate the ML-DSA-65 release-signing keypair

package/lib/vendor/blamejs/scripts/generate-ssdf-attestation.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // Emit a NIST SP 800-218 (SSDF) / OMB M-22-18 producer self-attestation
 // as a machine-readable JSON artifact, attached to each GitHub release.