@blamejs/blamejs-shop 0.1.20 → 0.1.22

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -2253,6 +2253,24 @@ async function testNoDuplicateCodeBlocks() {
       ],
       reason: "v0.12.33 — opts / structure validation prelude (`validateOpts(allowedKeys) + chained required-field + typeof guards + typed-error throw`). cose.verify validates a COSE_Sign1 opts blob + decoded structure (RFC 9052); the peers each validate a distinct spec's shape (SD-JWT-VC issuer opts / break-glass policy set / JSCalendar object / DDL dual-control declaration / DSR request / FedCM well-known manifest / Android Asset Links / heartbeat config). Each throws a primitive-specific typed error; the shingle is the validateOpts-then-guard idiom, not behaviour. Same family as the v0.12.29 input-shape-validation cluster.",
     },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/json-path.js:_Parser",
+        "lib/parsers/safe-ini.js:_unquote",
+        "lib/template.js:_tokenizeExpr",
+      ],
+      reason: "v0.12.61 — recursive-descent / cursor-based tokenizers over DIFFERENT grammars: json-path._Parser walks the RFC 9535 JSONPath ABNF, safe-ini._unquote unwraps an INI quoted value, template._tokenizeExpr tokenizes a template expression. The shared shingle is the `index cursor + peek/advance + per-char dispatch` parser idiom; each consumes a distinct grammar with its own token set, so there is no shared parse behaviour to extract.",
+    },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/link-header.js:_splitLinks",
+        "lib/safe-ical.js:_splitUnquoted",
+        "lib/safe-vcard.js:_splitUnquoted",
+      ],
+      reason: "v0.12.57 — format-specific delimiter splitters that track DIFFERENT enclosing state than the generic structuredFields.splitTopLevel: link-header._splitLinks tracks RFC 8288 `<uri-reference>` angle brackets AND quoted strings (a comma inside a URI must not split); safe-ical._splitUnquoted / safe-vcard._splitUnquoted track RFC 5545 / 6350 DQUOTE state with their own escaping. The shared shingle is the `for-loop + inQuote/escape state-machine + slice on the delimiter` idiom; the per-format enclosing rules (angle brackets vs none) are exactly why each can't call the shared splitter.",
+    },
     {
       mode:  "family-subset",
       files: [

package/lib/vendor/blamejs/test/layer-0-primitives/json-merge-patch.test.js

@@ -0,0 +1,81 @@
+"use strict";
+/**
+ * Layer 0 — b.jsonMergePatch (RFC 7396 JSON Merge Patch).
+ * Oracle: every test case from RFC 7396 Appendix A (target + patch →
+ * result), plus immutability and prototype-pollution checks.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+var jmp = b.jsonMergePatch;
+function eq(a, c) { return b.canonicalJson.stringify(a) === b.canonicalJson.stringify(c); }
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+// RFC 7396 Appendix A example test cases.
+var CASES = [
+  { original: { a: "b" }, patch: { a: "c" }, result: { a: "c" } },
+  { original: { a: "b" }, patch: { b: "c" }, result: { a: "b", b: "c" } },
+  { original: { a: "b" }, patch: { a: null }, result: {} },
+  { original: { a: "b", b: "c" }, patch: { a: null }, result: { b: "c" } },
+  { original: { a: ["b"] }, patch: { a: "c" }, result: { a: "c" } },
+  { original: { a: "c" }, patch: { a: ["b"] }, result: { a: ["b"] } },
+  { original: { a: { b: "c" } }, patch: { a: { b: "d", c: null } }, result: { a: { b: "d" } } },
+  { original: { a: [{ b: "c" }] }, patch: { a: [1] }, result: { a: [1] } },
+  { original: ["a", "b"], patch: ["c", "d"], result: ["c", "d"] },
+  { original: { a: "b" }, patch: ["c"], result: ["c"] },
+  { original: { a: "foo" }, patch: null, result: null },
+  { original: { a: "foo" }, patch: "bar", result: "bar" },
+  { original: { e: null }, patch: { a: 1 }, result: { e: null, a: 1 } },
+  { original: [1, 2], patch: { a: "b", c: null }, result: { a: "b" } },
+  { original: {}, patch: { a: { bb: { ccc: null } } }, result: { a: { bb: {} } } },
+];
+
+function testSurface() {
+  check("b.jsonMergePatch.merge is a function", typeof jmp.merge === "function");
+}
+
+function testRfc7396Conformance() {
+  var pass = 0;
+  CASES.forEach(function (c, i) {
+    var got = jmp.merge(c.original, c.patch);
+    if (eq(got, c.result)) pass++;
+    else check("RFC 7396 case #" + (i + 1) + " got " + JSON.stringify(got), false);
+  });
+  check("RFC 7396 Appendix A: all " + CASES.length + " cases match", pass === CASES.length);
+}
+
+function testImmutableAndSafe() {
+  var orig = { a: "b", c: { d: "e" } };
+  var out = jmp.merge(orig, { a: "z", c: { d: null, f: 1 } });
+  check("merge: result is correct", eq(out, { a: "z", c: { f: 1 } }));
+  check("merge: target is not mutated", eq(orig, { a: "b", c: { d: "e" } }));
+
+  // Prototype pollution: a "__proto__" member is a literal own key.
+  var poll = jmp.merge({}, JSON.parse('{"__proto__":{"polluted":true}}'));
+  check("merge: __proto__ is a literal own key", Object.prototype.hasOwnProperty.call(poll, "__proto__"));
+  check("merge: Object.prototype not polluted", ({}).polluted === undefined);
+
+  // Nested __proto__ merge does not pollute.
+  jmp.merge({}, JSON.parse('{"x":{"__proto__":{"polluted":true}}}'));
+  check("merge: nested __proto__ does not pollute", ({}).polluted === undefined);
+
+  // undefined patch refused (null is the explicit "replace with null").
+  check("merge: undefined patch refused", code(function () { jmp.merge({ a: 1 }); }) === "json-merge-patch/bad-patch");
+  check("b.jsonMergePatch.JsonMergePatchError is the typed error", typeof jmp.JsonMergePatchError === "function");
+}
+
+async function run() {
+  testSurface();
+  testRfc7396Conformance();
+  testImmutableAndSafe();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[json-merge-patch] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/json-patch.test.js

@@ -0,0 +1,184 @@
+"use strict";
+/**
+ * Layer 0 — b.jsonPointer (RFC 6901) + b.jsonPatch (RFC 6902).
+ * The oracle is the official json-patch/json-patch-tests conformance
+ * suite (every enabled case with an expected result or error) plus the
+ * RFC 6901 §5 pointer-evaluation examples.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn){try{fn();return "NO-THROW";}catch(e){return e.code||"THREW";}}
+function eq(a,c){return b.canonicalJson.stringify(a)===b.canonicalJson.stringify(c);}
+
+// Official json-patch-tests conformance cases (doc + patch + expected|error).
+var PATCH_CASES = [
+  {"doc":{},"patch":[],"expected":{}},
+  {"doc":{"foo":1},"patch":[],"expected":{"foo":1}},
+  {"doc":{"foo":1,"bar":2},"patch":[],"expected":{"bar":2,"foo":1}},
+  {"doc":[{"foo":1,"bar":2}],"patch":[],"expected":[{"bar":2,"foo":1}]},
+  {"doc":{"foo":{"foo":1,"bar":2}},"patch":[],"expected":{"foo":{"bar":2,"foo":1}}},
+  {"doc":{"foo":null},"patch":[{"op":"add","path":"/foo","value":1}],"expected":{"foo":1}},
+  {"doc":[],"patch":[{"op":"add","path":"/0","value":"foo"}],"expected":["foo"]},
+  {"doc":["foo"],"patch":[],"expected":["foo"]},
+  {"doc":{},"patch":[{"op":"add","path":"/foo","value":"1"}],"expected":{"foo":"1"}},
+  {"doc":{},"patch":[{"op":"add","path":"/foo","value":1}],"expected":{"foo":1}},
+  {"doc":{},"patch":[{"op":"add","path":"","value":[]}],"expected":[]},
+  {"doc":[],"patch":[{"op":"add","path":"","value":{}}],"expected":{}},
+  {"doc":[],"patch":[{"op":"add","path":"/-","value":"hi"}],"expected":["hi"]},
+  {"doc":{},"patch":[{"op":"add","path":"/","value":1}],"expected":{"":1}},
+  {"doc":{"foo":{}},"patch":[{"op":"add","path":"/foo/","value":1}],"expected":{"foo":{"":1}}},
+  {"doc":{"foo":1},"patch":[{"op":"add","path":"/bar","value":[1,2]}],"expected":{"foo":1,"bar":[1,2]}},
+  {"doc":{"foo":1,"baz":[{"qux":"hello"}]},"patch":[{"op":"add","path":"/baz/0/foo","value":"world"}],"expected":{"foo":1,"baz":[{"qux":"hello","foo":"world"}]}},
+  {"doc":{"bar":[1,2]},"patch":[{"op":"add","path":"/bar/8","value":"5"}],"error":true},
+  {"doc":{"bar":[1,2]},"patch":[{"op":"add","path":"/bar/-1","value":"5"}],"error":true},
+  {"doc":{"foo":1},"patch":[{"op":"add","path":"/bar","value":true}],"expected":{"foo":1,"bar":true}},
+  {"doc":{"foo":1},"patch":[{"op":"add","path":"/bar","value":false}],"expected":{"foo":1,"bar":false}},
+  {"doc":{"foo":1},"patch":[{"op":"add","path":"/bar","value":null}],"expected":{"foo":1,"bar":null}},
+  {"doc":{"foo":1},"patch":[{"op":"add","path":"/0","value":"bar"}],"expected":{"0":"bar","foo":1}},
+  {"doc":["foo"],"patch":[{"op":"add","path":"/1","value":"bar"}],"expected":["foo","bar"]},
+  {"doc":["foo","sil"],"patch":[{"op":"add","path":"/1","value":"bar"}],"expected":["foo","bar","sil"]},
+  {"doc":["foo","sil"],"patch":[{"op":"add","path":"/0","value":"bar"}],"expected":["bar","foo","sil"]},
+  {"doc":["foo","sil"],"patch":[{"op":"add","path":"/2","value":"bar"}],"expected":["foo","sil","bar"]},
+  {"doc":["foo","sil"],"patch":[{"op":"add","path":"/3","value":"bar"}],"error":true},
+  {"doc":{"1e0":"foo"},"patch":[{"op":"test","path":"/1e0","value":"foo"}],"expected":{"1e0":"foo"}},
+  {"doc":["foo","bar"],"patch":[{"op":"test","path":"/1e0","value":"bar"}],"error":true},
+  {"doc":["foo","sil"],"patch":[{"op":"add","path":"/bar","value":42}],"error":true},
+  {"doc":["foo","sil"],"patch":[{"op":"add","path":"/1","value":["bar","baz"]}],"expected":["foo",["bar","baz"],"sil"]},
+  {"doc":{"foo":1,"bar":[1,2,3,4]},"patch":[{"op":"remove","path":"/bar"}],"expected":{"foo":1}},
+  {"doc":{"foo":1,"baz":[{"qux":"hello"}]},"patch":[{"op":"remove","path":"/baz/0/qux"}],"expected":{"foo":1,"baz":[{}]}},
+  {"doc":{"foo":1,"baz":[{"qux":"hello"}]},"patch":[{"op":"replace","path":"/foo","value":[1,2,3,4]}],"expected":{"foo":[1,2,3,4],"baz":[{"qux":"hello"}]}},
+  {"doc":{"foo":[1,2,3,4],"baz":[{"qux":"hello"}]},"patch":[{"op":"replace","path":"/baz/0/qux","value":"world"}],"expected":{"foo":[1,2,3,4],"baz":[{"qux":"world"}]}},
+  {"doc":["foo"],"patch":[{"op":"replace","path":"/0","value":"bar"}],"expected":["bar"]},
+  {"doc":[""],"patch":[{"op":"replace","path":"/0","value":0}],"expected":[0]},
+  {"doc":[""],"patch":[{"op":"replace","path":"/0","value":true}],"expected":[true]},
+  {"doc":[""],"patch":[{"op":"replace","path":"/0","value":false}],"expected":[false]},
+  {"doc":[""],"patch":[{"op":"replace","path":"/0","value":null}],"expected":[null]},
+  {"doc":["foo","sil"],"patch":[{"op":"replace","path":"/1","value":["bar","baz"]}],"expected":["foo",["bar","baz"]]},
+  {"doc":{"foo":"bar"},"patch":[{"op":"replace","path":"","value":{"baz":"qux"}}],"expected":{"baz":"qux"}},
+  {"doc":{"bar":"baz"},"patch":[{"op":"replace","path":"/foo/bar","value":false}],"error":true},
+  {"doc":{"foo":1},"patch":[{"op":"test","path":"/foo","value":1,"spurious":1}],"expected":{"foo":1}},
+  {"doc":{"foo":null},"patch":[{"op":"test","path":"/foo","value":null}],"expected":{"foo":null}},
+  {"doc":{"foo":null},"patch":[{"op":"replace","path":"/foo","value":"truthy"}],"expected":{"foo":"truthy"}},
+  {"doc":{"foo":null},"patch":[{"op":"move","from":"/foo","path":"/bar"}],"expected":{"bar":null}},
+  {"doc":{"foo":null},"patch":[{"op":"copy","from":"/foo","path":"/bar"}],"expected":{"foo":null,"bar":null}},
+  {"doc":{"foo":null},"patch":[{"op":"remove","path":"/foo"}],"expected":{}},
+  {"doc":{"foo":"bar"},"patch":[{"op":"replace","path":"/foo","value":null}],"expected":{"foo":null}},
+  {"doc":{"foo":{"foo":1,"bar":2}},"patch":[{"op":"test","path":"/foo","value":{"bar":2,"foo":1}}],"expected":{"foo":{"foo":1,"bar":2}}},
+  {"doc":{"foo":[{"foo":1,"bar":2}]},"patch":[{"op":"test","path":"/foo","value":[{"bar":2,"foo":1}]}],"expected":{"foo":[{"foo":1,"bar":2}]}},
+  {"doc":{"foo":{"bar":[1,2,5,4]}},"patch":[{"op":"test","path":"/foo","value":{"bar":[1,2,5,4]}}],"expected":{"foo":{"bar":[1,2,5,4]}}},
+  {"doc":{"foo":{"bar":[1,2,5,4]}},"patch":[{"op":"test","path":"/foo","value":[1,2]}],"error":true},
+  {"doc":{"":1},"patch":[{"op":"test","path":"/","value":1}],"expected":{"":1}},
+  {"doc":{"foo":["bar","baz"],"":0,"a/b":1,"c%d":2,"e^f":3,"g|h":4,"i\\j":5,"k\"l":6," ":7,"m~n":8},"patch":[{"op":"test","path":"/foo","value":["bar","baz"]},{"op":"test","path":"/foo/0","value":"bar"},{"op":"test","path":"/","value":0},{"op":"test","path":"/a~1b","value":1},{"op":"test","path":"/c%d","value":2},{"op":"test","path":"/e^f","value":3},{"op":"test","path":"/g|h","value":4},{"op":"test","path":"/i\\j","value":5},{"op":"test","path":"/k\"l","value":6},{"op":"test","path":"/ ","value":7},{"op":"test","path":"/m~0n","value":8}],"expected":{"":0," ":7,"a/b":1,"c%d":2,"e^f":3,"foo":["bar","baz"],"g|h":4,"i\\j":5,"k\"l":6,"m~n":8}},
+  {"doc":{"foo":1},"patch":[{"op":"move","from":"/foo","path":"/foo"}],"expected":{"foo":1}},
+  {"doc":{"foo":1,"baz":[{"qux":"hello"}]},"patch":[{"op":"move","from":"/foo","path":"/bar"}],"expected":{"baz":[{"qux":"hello"}],"bar":1}},
+  {"doc":{"baz":[{"qux":"hello"}],"bar":1},"patch":[{"op":"move","from":"/baz/0/qux","path":"/baz/1"}],"expected":{"baz":[{},"hello"],"bar":1}},
+  {"doc":{"baz":[{"qux":"hello"}],"bar":1},"patch":[{"op":"copy","from":"/baz/0","path":"/boo"}],"expected":{"baz":[{"qux":"hello"}],"bar":1,"boo":{"qux":"hello"}}},
+  {"doc":{"foo":"bar"},"patch":[{"op":"add","path":"","value":{"baz":"qux"}}],"expected":{"baz":"qux"}},
+  {"doc":[1,2],"patch":[{"op":"add","path":"/-","value":{"foo":["bar","baz"]}}],"expected":[1,2,{"foo":["bar","baz"]}]},
+  {"doc":[1,2,[3,[4,5]]],"patch":[{"op":"add","path":"/2/1/-","value":{"foo":["bar","baz"]}}],"expected":[1,2,[3,[4,5,{"foo":["bar","baz"]}]]]},
+  {"doc":{"foo":1,"baz":[{"qux":"hello"}]},"patch":[{"op":"remove","path":"/baz/1e0/qux"}],"error":true},
+  {"doc":[1,2,3,4],"patch":[{"op":"remove","path":"/0"}],"expected":[2,3,4]},
+  {"doc":[1,2,3,4],"patch":[{"op":"remove","path":"/1"},{"op":"remove","path":"/2"}],"expected":[1,3]},
+  {"doc":[1,2,3,4],"patch":[{"op":"remove","path":"/1e0"}],"error":true},
+  {"doc":[""],"patch":[{"op":"replace","path":"/1e0","value":false}],"error":true},
+  {"doc":{"baz":[1,2,3],"bar":1},"patch":[{"op":"copy","from":"/baz/1e0","path":"/boo"}],"error":true},
+  {"doc":{"foo":1,"baz":[1,2,3,4]},"patch":[{"op":"move","from":"/baz/1e0","path":"/foo"}],"error":true},
+  {"doc":["foo","sil"],"patch":[{"op":"add","path":"/1e0","value":"bar"}],"error":true},
+  {"doc":{},"patch":[{"op":"add","value":"bar"}],"error":true},
+  {"doc":{},"patch":[{"op":"add","path":null,"value":"bar"}],"error":true},
+  {"doc":{},"patch":[{"op":"add","path":"foo","value":"bar"}],"error":true},
+  {"doc":[1],"patch":[{"op":"add","path":"/-"}],"error":true},
+  {"doc":[1],"patch":[{"op":"replace","path":"/0"}],"error":true},
+  {"doc":[null],"patch":[{"op":"test","path":"/0"}],"error":true},
+  {"doc":[false],"patch":[{"op":"test","path":"/0"}],"error":true},
+  {"doc":[1],"patch":[{"op":"copy","path":"/-"}],"error":true},
+  {"doc":{"foo":1},"patch":[{"op":"copy","from":"/bar","path":"/foo"}],"error":true},
+  {"doc":{"foo":1},"patch":[{"op":"move","path":""}],"error":true},
+  {"doc":{"foo":1},"patch":[{"op":"move","from":"/bar","path":"/foo"}],"error":true},
+  {"doc":{"foo":1},"patch":[{"op":"spam","path":"/foo","value":1}],"error":true},
+  {"doc":["foo","bar"],"patch":[{"op":"test","path":"/00","value":"foo"}],"error":true},
+  {"doc":["foo","bar"],"patch":[{"op":"test","path":"/01","value":"bar"}],"error":true},
+  {"doc":{"foo":"bar"},"patch":[{"op":"remove","path":"/baz"}],"error":true},
+  {"doc":{"foo":"bar"},"patch":[{"op":"remove","path":"/missing1/missing2"}],"error":true},
+  {"doc":["foo","bar"],"patch":[{"op":"remove","path":"/2"}],"error":true},
+  {"doc":{"foo":"bar"},"patch":[{"op":"add","path":"/FOO","value":"BAR"}],"expected":{"foo":"bar","FOO":"BAR"}},
+  {"doc":{"foo":{"bar":{"baz":[{"boo":"net"}]}}},"patch":[{"op":"copy","from":"/foo","path":"/bak"},{"op":"replace","path":"/bak/bar/baz/0/boo","value":"qux"}],"expected":{"foo":{"bar":{"baz":[{"boo":"net"}]}},"bak":{"bar":{"baz":[{"boo":"qux"}]}}}},
+  {"doc":{"foo":{"bar":{"baz":[{"boo":"net"}]}}},"patch":[{"op":"copy","from":"/foo","path":"/bak"},{"op":"replace","path":"/foo/bar/baz/0/boo","value":"qux"}],"expected":{"foo":{"bar":{"baz":[{"boo":"qux"}]}},"bak":{"bar":{"baz":[{"boo":"net"}]}}}}
+];
+
+
+function testPointer() {
+  // RFC 6901 §5 worked examples.
+  var doc = { "foo": ["bar", "baz"], "": 0, "a/b": 1, "c%d": 2, "e^f": 3, "g|h": 4, "i\\j": 5, "k\"l": 6, " ": 7, "m~n": 8 };
+  check("pointer: whole doc", b.jsonPointer.get(doc, "") === doc);
+  check("pointer: /foo array", b.jsonPointer.get(doc, "/foo").length === 2);
+  check("pointer: /foo/0", b.jsonPointer.get(doc, "/foo/0") === "bar");
+  check("pointer: / empty key", b.jsonPointer.get(doc, "/") === 0);
+  check("pointer: /a~1b slash escape", b.jsonPointer.get(doc, "/a~1b") === 1);
+  check("pointer: /m~0n tilde escape", b.jsonPointer.get(doc, "/m~0n") === 8);
+  check("pointer: /c%d literal", b.jsonPointer.get(doc, "/c%d") === 2);
+  check("pointer: parse decodes tokens", b.jsonPointer.parse("/a~1b/m~0n").join() === "a/b,m~n");
+  check("pointer: not-found throws", code(function(){ b.jsonPointer.get(doc, "/nope"); }) === "json-pointer/not-found");
+  check("pointer: non-/ start refused", code(function(){ b.jsonPointer.get(doc, "foo"); }) === "json-pointer/bad-pointer");
+  check("pointer: leading-zero index not-found", code(function(){ b.jsonPointer.get({a:[1]}, "/a/01"); }) === "json-pointer/not-found");
+}
+
+function testPatchConformance() {
+  var pass = 0, errs = 0;
+  PATCH_CASES.forEach(function (c, i) {
+    if (c.error) {
+      var threw = false;
+      try { b.jsonPatch.apply(c.doc, c.patch); } catch (_e) { threw = true; }
+      if (threw) errs++; else check("patch error case rejected #" + i + " " + JSON.stringify(c.patch).slice(0,60), false);
+      return;
+    }
+    var got;
+    try { got = b.jsonPatch.apply(c.doc, c.patch); } catch (e) { check("patch applies #" + i + ": " + e.message, false); return; }
+    if (eq(got, c.expected)) pass++; else check("patch result #" + i + " " + JSON.stringify(c.patch).slice(0,60) + " got " + JSON.stringify(got).slice(0,80), false);
+  });
+  var expectPass = PATCH_CASES.filter(function (c) { return !c.error; }).length;
+  var expectErr = PATCH_CASES.filter(function (c) { return c.error; }).length;
+  check("RFC 6902 conformance: all " + expectPass + " result cases match", pass === expectPass);
+  check("RFC 6902 conformance: all " + expectErr + " error cases rejected", errs === expectErr);
+}
+
+function testAtomic() {
+  // A failing op leaves the original document untouched.
+  var orig = { a: 1, b: 2 };
+  try { b.jsonPatch.apply(orig, [{ op: "remove", path: "/a" }, { op: "test", path: "/b", value: 999 }]); } catch (_e) { /* expected */ }
+  check("patch: original doc untouched on failure", orig.a === 1 && orig.b === 2);
+  check("b.jsonPatch.JsonPatchError thrown", code(function(){ b.jsonPatch.apply({}, [{op:"bogus",path:"/x"}]); }) === "json-patch/bad-op");
+  check("b.jsonPointer.JsonPointerError exists", typeof b.jsonPointer.JsonPointerError === "function" && typeof b.jsonPatch.OPS === "object" && typeof b.jsonPointer.ARRAY_INDEX_RE.test === "function");
+}
+
+function testSecurity() {
+  // Prototype pollution: add /__proto__ must create a literal own key, not
+  // touch the prototype.
+  var polluted = b.jsonPatch.apply({}, [{ op: "add", path: "/__proto__", value: { polluted: true } }]);
+  check("patch: /__proto__ becomes a literal own key", Object.prototype.hasOwnProperty.call(polluted, "__proto__") && polluted.polluted === undefined);
+  check("patch: Object.prototype not polluted", ({}).polluted === undefined);
+  // Nested __proto__ traversal is blocked (no own __proto__ to descend).
+  check("patch: descend through __proto__ refused", code(function () { b.jsonPatch.apply({}, [{ op: "add", path: "/__proto__/polluted", value: true }]); }) === "json-patch/path-not-found");
+  check("patch: Object.prototype still clean after nested attempt", ({}).polluted === undefined);
+  // Invalid tilde escapes are rejected.
+  check("pointer: invalid ~ escape (~2) refused", code(function () { b.jsonPointer.get({ x: 1 }, "/~2"); }) === "json-pointer/bad-pointer");
+  check("pointer: trailing ~ refused", code(function () { b.jsonPointer.get({ x: 1 }, "/foo~"); }) === "json-pointer/bad-pointer");
+}
+
+async function run() {
+  testPointer();
+  testPatchConformance();
+  testAtomic();
+  testSecurity();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[json-patch] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/json-path.test.js

@@ -0,0 +1,113 @@
+"use strict";
+/**
+ * Layer 0 — b.jsonPath (RFC 9535 JSONPath query).
+ * Oracle: a representative subset of the official
+ * jsonpath-compliance-test-suite (cts.json) — selectors, filters,
+ * functions, and invalid-selector rejections — plus explicit
+ * wildcard / slice / descendant / count / value / paths / DoS checks.
+ * (The full 703-case suite was run green during development.)
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+var jp = b.jsonPath;
+function code(fn){try{fn();return "NO-THROW";}catch(e){return e.code;}}
+
+// Curated cts cases (selector + document + result|results, or invalid).
+var CTS = [
+  {"name":"basic, root","selector":"$","document":["first","second"],"result":[["first","second"]]},
+  {"name":"basic, name shorthand","selector":"$.a","document":{"a":"A","b":"B"},"result":["A"]},
+  {"name":"index selector, negative","selector":"$[-1]","document":["first","second"],"result":["second"]},
+  {"name":"filter, less than or equal to null","selector":"$[?@.a<=null]","document":[{"a":null,"d":"e"},{"a":"c","d":"f"}],"result":[{"a":null,"d":"e"}]},
+  {"name":"filter, greater than or equal to true","selector":"$[?@.a>=true]","document":[{"a":true,"d":"e"},{"a":"c","d":"f"}],"result":[{"a":true,"d":"e"}]},
+  {"name":"filter, and","selector":"$[?@.a>0&&@.a<10]","document":[{"a":-10,"d":"e"},{"a":5,"d":"f"},{"a":20,"d":"f"}],"result":[{"a":5,"d":"f"}]},
+  {"name":"filter, or","selector":"$[?@.a=='b'||@.a=='d']","document":[{"a":"a","d":"e"},{"a":"b","d":"f"},{"a":"c","d":"f"},{"a":"d","d":"f"}],"result":[{"a":"b","d":"f"},{"a":"d","d":"f"}]},
+  {"name":"filter, nested","selector":"$[?@[?@>1]]","document":[[0],[0,1],[0,1,2],[42]],"result":[[0,1,2],[42]]},
+  {"name":"functions, length, string data","selector":"$[?length(@.a)>=2]","document":[{"a":"ab"},{"a":"d"}],"result":[{"a":"ab"}]},
+  {"name":"functions, match, found match","selector":"$[?match(@.a, 'a.*')]","document":[{"a":"ab"}],"result":[{"a":"ab"}]},
+  {"name":"functions, search, at the end","selector":"$[?search(@.a, 'a.*')]","document":[{"a":"the end is ab"}],"result":[{"a":"the end is ab"}]},
+  {"name":"name selector, double quotes","selector":"$[\"a\"]","document":{"a":"A","b":"B"},"result":["A"]},
+  {"name":"basic, no leading whitespace","selector":" $","invalid":true},
+  {"name":"basic, no trailing whitespace","selector":"$ ","invalid":true},
+  {"name":"basic, name shorthand, symbol","selector":"$.&","invalid":true},
+  {"name":"basic, name shorthand, number","selector":"$.1","invalid":true},
+  {"name":"basic, multiple selectors, space instead of comma","selector":"$[0 2]","invalid":true},
+  {"name":"basic, selector, leading comma","selector":"$[,0]","invalid":true},
+  {"name":"basic, selector, trailing comma","selector":"$[0,]","invalid":true},
+  {"name":"basic, empty segment","selector":"$[]","invalid":true},
+  {"name":"basic, bald descendant segment","selector":"$..","invalid":true},
+  {"name":"basic, current node identifier without filter selector","selector":"$[@.a]","invalid":true},
+  {"name":"basic, root node identifier in brackets without filter selector","selector":"$[$.a]","invalid":true},
+  {"name":"filter, non-singular query in comparison, slice","selector":"$[?@[0:0]==0]","invalid":true}
+];
+
+function testCts() {
+  var pass = 0, rej = 0, total = CTS.length, invs = 0;
+  CTS.forEach(function (t) {
+    if (t.invalid) {
+      invs++;
+      if (code(function () { jp.query(t.document || {}, t.selector); }) === "json-path/invalid") rej++;
+      else check("cts invalid rejected: " + t.name, false);
+      return;
+    }
+    var got;
+    try { got = jp.query(t.document, t.selector); } catch (e) { check("cts query: " + t.name + " — " + e.message, false); return; }
+    var ok = t.result !== undefined ? JSON.stringify(got) === JSON.stringify(t.result)
+      : t.results.some(function (r) { return JSON.stringify(got) === JSON.stringify(r); });
+    if (ok) pass++; else check("cts result: " + t.name + " got " + JSON.stringify(got).slice(0, 60), false);
+  });
+  var valid = total - invs;
+  check("cts: all " + valid + " result cases match", pass === valid);
+  check("cts: all " + invs + " invalid cases rejected", rej === invs);
+}
+
+function testFeatures() {
+  var doc = { store: { book: [{ price: 8, title: "A" }, { price: 12, title: "B" }], bicycle: { price: 20 } } };
+  check("wildcard", JSON.stringify(jp.query({ a: 1, b: 2 }, "$.*").sort()) === "[1,2]");
+  check("slice", JSON.stringify(jp.query([0, 1, 2, 3, 4], "$[1:4]")) === "[1,2,3]");
+  check("slice negative step", JSON.stringify(jp.query([0, 1, 2, 3], "$[::-1]")) === "[3,2,1,0]");
+  check("descendant", JSON.stringify(jp.query(doc, "$..price").sort(function(a,c){return a-c;})) === "[8,12,20]");
+  check("filter < ", JSON.stringify(jp.query(doc, "$.store.book[?@.price < 10].title")) === '["A"]');
+  check("count() filter", JSON.stringify(jp.query({ a: { items: [1, 2, 3] } }, "$[?count(@.items[*]) == 3]")) === JSON.stringify([{ items: [1, 2, 3] }]));
+  check("value() filter", JSON.stringify(jp.query({ x: { v: 5 } }, "$[?value(@.v) == 5]")) === JSON.stringify([{ v: 5 }]));
+  check("existence", JSON.stringify(jp.query([{ a: 1 }, { b: 2 }], "$[?@.a]")) === JSON.stringify([{ a: 1 }]));
+  // paths() normalized locations.
+  check("paths()", JSON.stringify(jp.paths({ a: [{ p: 1 }, { p: 9 }] }, "$.a[?@.p > 5].p")) === JSON.stringify(["$['a'][1]['p']"]));
+}
+
+function testRegressionAndSafety() {
+  // <= / >= include the equality case (RFC 9535 §2.3.5.2.2).
+  check("<= null matches null", JSON.stringify(jp.query([{ a: null }, { a: 1 }], "$[?@.a<=null]")) === JSON.stringify([{ a: null }]));
+  // length(Nothing) is Nothing, not 1 (the sentinel is an object).
+  check("length(missing) is Nothing", JSON.stringify(jp.query([{ a: "ab" }, { c: "d" }], "$[?length(@.a)>0]")) === JSON.stringify([{ a: "ab" }]));
+  check("b.jsonPath.JsonPathError thrown", code(function () { jp.query({}, "$["); }) === "json-path/invalid");
+  // Deep descendant on a large doc stays bounded (no crash); sanity only.
+  var big = {}; var cur = big; for (var i = 0; i < 50; i++) { cur.n = {}; cur = cur.n; }
+  check("deep descendant does not crash", Array.isArray(jp.query(big, "$..n")));
+}
+
+function testSurface() {
+  // Full b.jsonPath.* path references for the coverage gate.
+  check("b.jsonPath.query is a function", typeof b.jsonPath.query === "function");
+  check("b.jsonPath.paths is a function", typeof b.jsonPath.paths === "function");
+  check("b.jsonPath.query selects a value", JSON.stringify(b.jsonPath.query({ a: 1 }, "$.a")) === "[1]");
+  check("b.jsonPath.paths returns a normalized path", JSON.stringify(b.jsonPath.paths({ a: 1 }, "$.a")) === JSON.stringify(["$['a']"]));
+  check("b.jsonPath.JsonPathError is the typed error", typeof b.jsonPath.JsonPathError === "function");
+}
+
+async function run() {
+  testSurface();
+  testCts();
+  testFeatures();
+  testRegressionAndSafety();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[json-path] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/jtd.test.js

@@ -0,0 +1,52 @@
+"use strict";
+/**
+ * Layer 0 — b.jtd (RFC 8927 JSON Type Definition).
+ * Oracle: a curated subset of the official jsontypedef/json-typedef-spec
+ * tests — validation cases (schema + instance -> expected errors) and
+ * invalid-schema cases (must throw jtd/bad-schema). The full suites
+ * (316 validation + 49 invalid-schema) were run green during development.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn){try{fn();return "NO-THROW";}catch(e){return e.code;}}
+function norm(es){return JSON.stringify(es.map(function(e){return JSON.stringify({i:e.instancePath,s:e.schemaPath});}).sort());}
+
+var VALID = [{"schema":{},"instance":null,"errors":[]},{"schema":{"definitions":{"foo":{"type":"boolean"}},"ref":"foo"},"instance":true,"errors":[]},{"schema":{"type":"boolean"},"instance":[],"errors":[{"instancePath":[],"schemaPath":["type"]}]},{"schema":{"type":"float32"},"instance":3.14,"errors":[]},{"schema":{"type":"float64"},"instance":true,"errors":[{"instancePath":[],"schemaPath":["type"]}]},{"schema":{"type":"float64","nullable":true},"instance":{},"errors":[{"instancePath":[],"schemaPath":["type"]}]},{"schema":{"type":"int8","nullable":true},"instance":"foo","errors":[{"instancePath":[],"schemaPath":["type"]}]},{"schema":{"type":"uint8"},"instance":[],"errors":[{"instancePath":[],"schemaPath":["type"]}]},{"schema":{"type":"uint8"},"instance":256,"errors":[{"instancePath":[],"schemaPath":["type"]}]},{"schema":{"type":"int16","nullable":true},"instance":"foo","errors":[{"instancePath":[],"schemaPath":["type"]}]},{"schema":{"type":"uint16"},"instance":[],"errors":[{"instancePath":[],"schemaPath":["type"]}]},{"schema":{"type":"uint16"},"instance":65536,"errors":[{"instancePath":[],"schemaPath":["type"]}]},{"schema":{"type":"int32","nullable":true},"instance":"foo","errors":[{"instancePath":[],"schemaPath":["type"]}]},{"schema":{"type":"uint32"},"instance":[],"errors":[{"instancePath":[],"schemaPath":["type"]}]},{"schema":{"type":"uint32"},"instance":4294967296,"errors":[{"instancePath":[],"schemaPath":["type"]}]},{"schema":{"type":"string","nullable":true},"instance":"foo","errors":[]},{"schema":{"type":"timestamp","nullable":true},"instance":1,"errors":[{"instancePath":[],"schemaPath":["type"]}]},{"schema":{"enum":["foo","bar","baz"]},"instance":1,"errors":[{"instancePath":[],"schemaPath":["enum"]}]},{"schema":{"enum":["foo","bar","baz"],"nullable":true},"instance":"quux","errors":[{"instancePath":[],"schemaPath":["enum"]}]},{"schema":{"elements":{"type":"string"},"nullable":true},"instance":"foo","errors":[{"instancePath":[],"schemaPath":["elements"]}]},{"schema":{"properties":{"foo":{"type":"string"}}},"instance":"foo","errors":[{"instancePath":[],"schemaPath":["properties"]}]},{"schema":{"properties":{"foo":{"type":"string"}},"optionalProperties":{"bar":{"type":"string"}}},"instance":"foo","errors":[{"instancePath":[],"schemaPath":["properties"]}]},{"schema":{"properties":{"foo":{"type":"string"}},"additionalProperties":false},"instance":{"foo":"foo","bar":"bar"},"errors":[{"instancePath":["bar"],"schemaPath":[]}]},{"schema":{"optionalProperties":{"foo":{"type":"string"}},"additionalProperties":true},"instance":{},"errors":[]},{"schema":{"values":{"type":"string"},"nullable":true},"instance":true,"errors":[{"instancePath":[],"schemaPath":["values"]}]},{"schema":{"discriminator":"foo","mapping":{}},"instance":true,"errors":[{"instancePath":[],"schemaPath":["discriminator"]}]}];
+var INVALID = [null,3.14,{"foo":123},{"definitions":{"foo":123}},{"ref":"foo"},{"type":123},{"enum":[]},{"elements":123},{"properties":{"foo":{"definitions":{"x":{}}}}},{"properties":{},"additionalProperties":123},{"values":{"definitions":{"x":{}}}},{"discriminator":"foo","mapping":{"x":{"properties":{},"definitions":{"x":{}}}}},{"discriminator":"foo","mapping":{"x":{"properties":{"foo":{}}}}},{"type":"uint32","enum":["foo"]}];
+
+function testSurface(){
+  check("b.jtd.validate is a function", typeof b.jtd.validate === "function");
+  check("b.jtd.isValid is a function", typeof b.jtd.isValid === "function");
+  check("b.jtd.isValid true for conforming", b.jtd.isValid({type:"string"}, "x") === true);
+  check("b.jtd.isValid false for non-conforming", b.jtd.isValid({type:"string"}, 1) === false);
+  check("b.jtd.JtdError thrown on bad schema", code(function(){ b.jtd.validate({foo:1}, null); }) === "jtd/bad-schema" && typeof b.jtd.JtdError === "function");
+}
+function testValidation(){
+  var pass=0;
+  VALID.forEach(function(t,i){ var got; try{got=b.jtd.validate(t.schema,t.instance);}catch(e){check("jtd validate #"+i+": "+e.message,false);return;} if(norm(got)===norm(t.errors))pass++; else check("jtd result #"+i+" got "+JSON.stringify(got).slice(0,70),false); });
+  check("JTD validation: all "+VALID.length+" cases match", pass===VALID.length);
+}
+function testInvalidSchemas(){
+  var rej=0;
+  INVALID.forEach(function(s,i){ if(code(function(){ b.jtd.validate(s, null); })==="jtd/bad-schema") rej++; else check("jtd invalid-schema #"+i+" rejected: "+JSON.stringify(s).slice(0,60),false); });
+  check("JTD well-formedness: all "+INVALID.length+" malformed schemas rejected", rej===INVALID.length);
+}
+function testExplicit(){
+  check("uint32 rejects negative", JSON.stringify(b.jtd.validate({properties:{id:{type:"uint32"}}},{id:-1})) === JSON.stringify([{instancePath:["id"],schemaPath:["properties","id","type"]}]));
+  check("timestamp accepts RFC3339", b.jtd.isValid({type:"timestamp"}, "1985-04-12T23:20:50.52Z"));
+  check("timestamp rejects bad date", !b.jtd.isValid({type:"timestamp"}, "1985-13-12T23:20:50Z"));
+  check("additionalProperties false rejects extra", !b.jtd.isValid({properties:{a:{type:"string"}}},{a:"x",b:"y"}));
+  check("nullable allows null", b.jtd.isValid({type:"string",nullable:true}, null));
+  // RFC 3339 timezone offset range is enforced.
+  check("timestamp rejects offset hour > 23", !b.jtd.isValid({type:"timestamp"}, "2020-01-01T00:00:00+24:00"));
+  check("timestamp rejects offset minute > 59", !b.jtd.isValid({type:"timestamp"}, "2020-01-01T00:00:00+00:99"));
+  check("timestamp accepts valid offset", b.jtd.isValid({type:"timestamp"}, "2020-01-01T00:00:00+05:30"));
+  // metadata must be an object.
+  check("non-object metadata rejected", code(function(){ b.jtd.validate({type:"string",metadata:1}, "x"); }) === "jtd/bad-schema");
+  check("object metadata accepted", b.jtd.isValid({type:"string",metadata:{doc:"x"}}, "y"));
+}
+async function run(){ testSurface(); testValidation(); testInvalidSchemas(); testExplicit(); }
+module.exports={run:run};
+if(require.main===module){ run().then(function(){console.log("[jtd] OK — "+helpers.getChecks()+" checks passed");},function(e){console.error("FAIL:",e&&e.stack||e);process.exit(1);}); }

package/lib/vendor/blamejs/test/layer-0-primitives/link-header.test.js

@@ -0,0 +1,96 @@
+"use strict";
+/**
+ * Layer 0 — b.linkHeader (RFC 8288 Web Linking).
+ * Oracle: the RFC 8288 §3.5 worked examples plus GitHub-style pagination
+ * links, parsed to the documented shape and round-tripped through
+ * serialize.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+var lh = b.linkHeader;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+function testSurface() {
+  check("b.linkHeader.parse is a function", typeof lh.parse === "function");
+  check("b.linkHeader.serialize is a function", typeof lh.serialize === "function");
+  check("b.linkHeader.LinkHeaderError is the typed error class", typeof b.linkHeader.LinkHeaderError === "function");
+}
+
+function testParse() {
+  // RFC 8288 §3.5 example.
+  var parsed = lh.parse('<http://example.com/TheBook/chapter2>; rel="previous"; title="previous chapter"');
+  check("parse: single link uri", parsed.length === 1 && parsed[0].uri === "http://example.com/TheBook/chapter2");
+  check("parse: rel relation", parsed[0].rel.join() === "previous");
+  check("parse: quoted title param", parsed[0].params.title === "previous chapter");
+
+  // GitHub-style pagination — multiple links, comma-separated.
+  var page = lh.parse('<https://api.example/x?page=2>; rel="next", <https://api.example/x?page=9>; rel="last", <https://api.example/x?page=1>; rel="first"');
+  check("parse: multiple links", page.length === 3 && page[0].rel[0] === "next" && page[1].rel[0] === "last" && page[2].rel[0] === "first");
+
+  // A comma INSIDE a quoted parameter does not split the list.
+  var quoted = lh.parse('<https://x/1>; rel="next"; title="a, b, c"');
+  check("parse: comma inside quoted param does not split", quoted.length === 1 && quoted[0].params.title === "a, b, c");
+
+  // Space-separated rel values.
+  var multi = lh.parse('<https://x>; rel="start http://example.net/relation/other"');
+  check("parse: space-separated rel", multi[0].rel.length === 2 && multi[0].rel[0] === "start");
+
+  // Unquoted token param.
+  var tok = lh.parse("<https://x>; rel=next; type=text/html");
+  check("parse: unquoted token params", tok[0].rel[0] === "next" && tok[0].params.type === "text/html");
+
+  // A comma INSIDE the <uri-reference> is part of the URI, not a separator.
+  var commaUri = lh.parse('<https://example.com/a,b>; rel="next"');
+  check("parse: comma inside <uri> does not split", commaUri.length === 1 && commaUri[0].uri === "https://example.com/a,b");
+  var commaUri2 = lh.parse('<https://x/a,b>; rel="next", <https://x/c,d>; rel="prev"');
+  check("parse: comma-bearing URIs across multiple links", commaUri2.length === 2 && commaUri2[0].uri === "https://x/a,b" && commaUri2[1].uri === "https://x/c,d");
+
+  // RFC 8288 §3.3: a duplicate rel keeps the FIRST occurrence.
+  var dupRel = lh.parse('<https://x>; rel="next"; rel="prev"');
+  check("parse: duplicate rel keeps the first", dupRel[0].rel.join() === "next");
+}
+
+function testSerialize() {
+  var s = lh.serialize([
+    { uri: "https://api/x?page=2", rel: "next" },
+    { uri: "https://api/x?page=9", rel: "last", params: { title: "end" } },
+  ]);
+  check("serialize: pagination links", s === '<https://api/x?page=2>; rel="next", <https://api/x?page=9>; rel="last"; title="end"');
+  // Round-trip.
+  var rt = lh.parse(s);
+  check("serialize→parse round-trips uri/rel/params", rt.length === 2 && rt[0].uri === "https://api/x?page=2" && rt[1].params.title === "end");
+  // rel array → space-joined.
+  check("serialize: rel array", lh.serialize({ uri: "https://x", rel: ["start", "next"] }) === '<https://x>; rel="start next"');
+  // Parameter values are quoted (always valid; required for non-tokens like text/html).
+  check("serialize: param values quoted", lh.serialize({ uri: "https://x", rel: "next", params: { type: "text/html" } }) === '<https://x>; rel="next"; type="text/html"');
+}
+
+function testRefusals() {
+  check("parse: missing <uri> refused", code(function () { lh.parse('rel="next"'); }) === "link-header/bad-link");
+  check("parse: unterminated <uri> refused", code(function () { lh.parse('<https://x; rel="next"'); }) === "link-header/bad-link");
+  check("parse: non-string refused", code(function () { lh.parse(42); }) === "link-header/bad-input");
+  check("parse: control bytes refused", code(function () { lh.parse("<https://x>;\x01rel=next"); }) === "link-header/bad-input");
+  check("serialize: missing uri refused", code(function () { lh.serialize([{ rel: "next" }]); }) === "link-header/bad-link");
+  check("serialize: angle bracket in uri refused", code(function () { lh.serialize([{ uri: "https://x<y", rel: "next" }]); }) === "link-header/bad-link");
+  // LinkHeaderError is the thrown type.
+  var threw = null; try { lh.parse(42); } catch (e) { threw = e; }
+  check("LinkHeaderError is the typed error", threw instanceof lh.LinkHeaderError);
+}
+
+async function run() {
+  testSurface();
+  testParse();
+  testSerialize();
+  testRefusals();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[link-header] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/package.json

@@ -1,12 +1,14 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {
     "start": "node server.js",
     "test": "node test/smoke.js",
-    "vendor": "bash scripts/vendor-update.sh"
+    "vendor": "bash scripts/vendor-update.sh",
+    "sync-assets": "node scripts/sync-r2-assets.js",
+    "deploy": "wrangler deploy && node scripts/sync-r2-assets.js"
   },
   "engines": {
     "node": ">=24.14.1"