{
  "_comment": "Vendored dependencies — no npm runtime packages. Use scripts/vendor-update.sh to update.",
  "packages": {
    "@noble/ciphers": {
      "version": "2.2.0",
      "license": "MIT",
      "author": "Paul Miller",
      "source": "https://github.com/paulmillr/noble-ciphers",
      "exports": [
        "xchacha20poly1305"
      ],
      "files": {
        "server": "lib/vendor/noble-ciphers.cjs"
      },
      "bundler": "esbuild --format=cjs --platform=node",
      "bundledAt": "2026-07-13T00:00:00Z",
      "cpe": "cpe:2.3:a:paulmillr:noble-ciphers:2.2.0:*:*:*:*:node.js:*:*",
      "hashes": {
        "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
      },
      "refreshedAt": "2026-07-27T03:18:03.695Z"
    },
    "@noble/curves": {
      "version": "2.2.0",
      "license": "MIT",
      "author": "Paul Miller",
      "source": "https://github.com/paulmillr/noble-curves",
      "exports": [
        "ristretto255_oprf",
        "p256_oprf",
        "p384_oprf",
        "p521_oprf"
      ],
      "files": {
        "server": "lib/vendor/noble-curves.cjs"
      },
      "bundler": "esbuild --format=cjs --platform=node",
      "bundledAt": "2026-07-13T00:00:00Z",
      "cpe": "cpe:2.3:a:paulmillr:noble-curves:2.2.0:*:*:*:*:node.js:*:*",
      "hashes": {
        "server": "sha256:2880c288b1285ef51d356d057bee6f0c8a00de36638cf47b47617e8c1faf10d5"
      },
      "refreshedAt": "2026-07-27T03:18:03.695Z"
    },
    "@noble/post-quantum": {
      "version": "0.6.1",
      "license": "MIT",
      "author": "Paul Miller",
      "source": "https://github.com/paulmillr/noble-post-quantum",
      "_about": "FIPS 203 / 204 / 205 PQC algorithms in pure JS. First-class on both server-side and client-side — interoperable with Node's built-in WebCrypto ML-KEM (a ciphertext encapsulated with Node ML-KEM-1024 decapsulates correctly with b.pqcSoftware.ml_kem_1024 and vice versa). Operators wire it server-side via `b.pqcSoftware.{ml_kem_1024,ml_dsa_87,slh_dsa_shake_256f,...}` (security-first defaults are the highest cat-5 levels), or re-bundle for browser / mobile clients shipping b.middleware.apiEncrypt.client. Older Node versions without the experimental WebCrypto ML-KEM extension can use the vendored bundle as the primary PQC path.",
      "exports": [
        "ml_kem512",
        "ml_kem768",
        "ml_kem1024",
        "ml_dsa44",
        "ml_dsa65",
        "ml_dsa87",
        "slh_dsa_sha2_128f",
        "slh_dsa_sha2_192f",
        "slh_dsa_sha2_256f",
        "slh_dsa_shake_128f",
        "slh_dsa_shake_192f",
        "slh_dsa_shake_256f"
      ],
      "files": {
        "server": "lib/vendor/noble-post-quantum.cjs"
      },
      "bundler": "esbuild --format=cjs --platform=node",
      "bundledAt": "2026-07-13T00:00:00Z",
      "cpe": "cpe:2.3:a:paulmillr:noble-post-quantum:0.6.1:*:*:*:*:node.js:*:*",
      "hashes": {
        "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
      },
      "refreshedAt": "2026-07-27T03:18:03.695Z"
    },
    "@simplewebauthn/server": {
      "version": "13.3.2",
      "license": "MIT",
      "author": "Matthew Miller",
      "source": "https://github.com/MasterKale/SimpleWebAuthn",
      "exports": [
        "generateRegistrationOptions",
        "verifyRegistrationResponse",
        "generateAuthenticationOptions",
        "verifyAuthenticationResponse",
        "MetadataService"
      ],
      "files": {
        "server": "lib/vendor/simplewebauthn-server.cjs"
      },
      "bundler": "esbuild --format=cjs --platform=node --alias:reflect-metadata=reflect-metadata/lite --external:crypto --external:node:crypto",
      "bundledAt": "2026-07-13T00:00:00Z",
      "cpe": "cpe:2.3:a:simplewebauthn:server:13.3.2:*:*:*:*:node.js:*:*",
      "hashes": {
        "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
      },
      "refreshedAt": "2026-07-27T03:18:03.695Z"
    },
    "SecLists-common-passwords-top-10000": {
      "version": "10k-most-common (master)",
      "license": "CC-BY-3.0",
      "author": "Daniel Miessler / SecLists contributors",
      "source": "https://github.com/danielmiessler/SecLists",
      "_about": "Top 10,000 most-common passwords (breach-derived). Loaded by b.auth.password.policy() to satisfy NIST 800-63B §5.1.1.2 'previously breached' check. Operators with deeper enforcement (HIBP downloads, NCSC 100k) layer on top via opts.forbidCommon — the bundled set is additive.",
      "files": {
        "server": "lib/vendor/common-passwords-top-10000.txt",
        "data_js": "lib/vendor/common-passwords-top-10000.data.js"
      },
      "bundler": "curl https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Common-Credentials/10k-most-common.txt",
      "bundledAt": "2026-05-13T00:00:00Z",
      "hashes": {
        "server": "sha256:3c04e3cec775a7d0e21e544d33810dd434cccdb02e98903ba12e506dd9cd01bd",
        "data_js": "sha256:87b223beca89f33d2c2c32a2cfda0bc187e58061de40e7127bb5ffc4258c6e2a"
      },
      "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
      "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
      "refreshedAt": "2026-07-27T03:18:03.695Z"
    },
    "bimi-trust-anchors": {
      "version": "operator-managed",
      "license": "BIMI Group / per-issuer",
      "license_is_spdx": false,
      "author": "BIMI Group / DigiCert / Entrust",
      "source": "https://bimigroup.org/",
      "_about": "RFC 9091 BIMI Group Verified Mark trust-anchor bundle (PEM, concatenated). Loaded by lib/mail-bimi.js for VMC + CMC chain validation. Source-tree default is empty-of-PEM — operators populate via the documented refresh procedure in the file header below; call-site overrides via b.mail.bimi.fetchAndVerifyMark({ trustAnchorsPem }) are supported. Refresh procedure pulls https://www.digicert.com/CACerts/DigiCertVerifiedMarkRootCA.pem + https://web.entrust.com/root-certificates/entrust_verified_mark_root_g3.cer and concatenates them into the file. The empty default ships with a runtime warning when b.mail.bimi loads it absent any operator-supplied trustAnchorsPem call-site override — the canary skip is intentional (the dual-hash + SLH-DSA signature cover the threat for a non-empty bundle; an empty bundle has no canary to verify).",
      "_warning": "Empty PEM default — populate before invoking b.mail.bimi.fetchAndVerifyMark in production. b.mail.bimi emits a `bimi.trust-anchors.empty` runtime warning when this default is used without an operator-supplied trustAnchorsPem call-site override.",
      "exports": [
        "bimi-vmc-trust-anchors"
      ],
      "files": {
        "server": "lib/vendor/bimi-trust-anchors.pem",
        "data_js": "lib/vendor/bimi-trust-anchors.data.js"
      },
      "bundler": "operator-managed (see file header for refresh procedure)",
      "bundledAt": "2026-05-13T00:00:00Z",
      "hashes": {
        "server": "sha256:81ff9f5ab3c9774132c845684e783be95cf73146f8b670d964105f0a3765b4b4",
        "data_js": "sha256:aa7a4d33b65a68422a2a2c1670177689f66fdcaa08bd2514d78798b827bd1608"
      },
      "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
      "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
      "refreshedAt": "2026-07-27T03:18:03.695Z"
    },
    "publicsuffix-list": {
      "version": "master",
      "license": "MPL-2.0",
      "author": "Mozilla Foundation",
      "source": "https://publicsuffix.org/list/public_suffix_list.dat",
      "_about": "Mozilla Public Suffix List — canonical catalog of effective top-level domains used by b.publicSuffix to derive organizational domains for DMARCbis (psd= / np=), BIMI, cookie-scope checks, and same-site policies. Loaded at module-init from lib/vendor/public-suffix-list.dat; the file is the data, not a code bundle.",
      "files": {
        "server": "lib/vendor/public-suffix-list.dat",
        "data_js": "lib/vendor/public-suffix-list.data.js"
      },
      "bundler": "curl https://publicsuffix.org/list/public_suffix_list.dat",
      "bundledAt": "2026-07-25T00:00:00Z",
      "hashes": {
        "server": "sha256:0240b3f1e8c90ecd4af5b94597afb5ba89997ad395f292f87318caefb7e10413",
        "data_js": "sha256:7994e24e1865f197540a988783de567fe20fb29e7f6c3a5c142766bb0cfd9bfd"
      },
      "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
      "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
      "refreshedAt": "2026-07-27T03:18:03.695Z"
    },
    "@blamejs/pki": {
      "version": "0.3.25",
      "license": "Apache-2.0",
      "author": "blamejs",
      "source": "https://github.com/blamejs/pki",
      "exports": [
        "x509",
        "crl",
        "pkcs12",
        "key",
        "webcrypto",
        "schema",
        "csr",
        "cms",
        "ocsp",
        "tsp"
      ],
      "files": {
        "server": "lib/vendor/blamejs-pki.cjs"
      },
      "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
      "bundledAt": "2026-07-26T00:00:00Z",
      "cpe": "cpe:2.3:a:blamejs:pki:0.3.25:*:*:*:*:node.js:*:*",
      "hashes": {
        "server": "sha256:ca475ca19f86eb9cce5ad185132b9e69fea49d1e72bae404c4845cc80727f5be"
      },
      "refreshedAt": "2026-07-27T03:18:03.695Z"
    }
  }
}