@blamejs/blamejs-shop 0.1.20 → 0.1.23

package/lib/vendor/blamejs/lib/json-pointer.js

@@ -0,0 +1,109 @@
+"use strict";
+/**
+ * @module b.jsonPointer
+ * @nav    Data
+ * @title  JSON Pointer
+ *
+ * @intro
+ *   Reference a single value within a JSON document by path (RFC 6901) —
+ *   <code>/foo/0/bar</code> walks <code>doc.foo[0].bar</code>. A pointer
+ *   is a sequence of <code>/</code>-prefixed reference tokens; the empty
+ *   string points at the whole document. The two escapes
+ *   (<code>~1</code> → <code>/</code>, <code>~0</code> → <code>~</code>)
+ *   let a token contain a literal slash or tilde.
+ *
+ *   <code>get</code> returns the referenced value or throws when the path
+ *   does not resolve; <code>parse</code> exposes the decoded reference
+ *   tokens. It is the path language JSON Patch (<code>b.jsonPatch</code>)
+ *   builds on.
+ *
+ * @card
+ *   JSON Pointer (RFC 6901) — reference a value inside a JSON document by
+ *   <code>/path/0/token</code>, with the <code>~1</code> / <code>~0</code>
+ *   escapes. The path language behind JSON Patch.
+ */
+
+var { defineClass } = require("./framework-error");
+
+var JsonPointerError = defineClass("JsonPointerError", { alwaysPermanent: true });
+
+var ARRAY_INDEX_RE = /^(?:0|[1-9][0-9]*)$/;                  // no leading zeros (RFC 6901 §4)
+
+/**
+ * @primitive b.jsonPointer.parse
+ * @signature b.jsonPointer.parse(pointer)
+ * @since     0.12.58
+ * @status    stable
+ * @related   b.jsonPointer.get, b.jsonPatch.apply
+ *
+ * Decode an RFC 6901 JSON Pointer string into its array of reference
+ * tokens, unescaping <code>~1</code> → <code>/</code> and <code>~0</code>
+ * → <code>~</code>. The empty string yields an empty array (the whole
+ * document); a non-empty pointer must begin with <code>/</code>.
+ *
+ * @example
+ *   b.jsonPointer.parse("/a~1b/m~0n");
+ *   // → ["a/b", "m~n"]
+ */
+function parse(pointer) {
+  if (typeof pointer !== "string") throw new JsonPointerError("json-pointer/bad-pointer", "jsonPointer: pointer must be a string");
+  if (pointer === "") return [];
+  if (pointer.charAt(0) !== "/") throw new JsonPointerError("json-pointer/bad-pointer", "jsonPointer: a non-empty pointer must start with '/'");
+  return pointer.split("/").slice(1).map(function (tok) {
+    // RFC 6901 §3: the only valid `~` escapes are ~0 and ~1; a tilde
+    // followed by anything else (or at end of token) is malformed.
+    if (/~(?![01])/.test(tok)) throw new JsonPointerError("json-pointer/bad-pointer", "jsonPointer: invalid '~' escape (only ~0 and ~1 are allowed)");
+    return tok.replace(/~1/g, "/").replace(/~0/g, "~");      // ~1 before ~0 (RFC 6901 §4)
+  });
+}
+
+// Resolve a token against the current node; returns { found, value }.
+function _step(node, token) {
+  if (Array.isArray(node)) {
+    if (!ARRAY_INDEX_RE.test(token)) return { found: false };   // allow:regex-no-length-cap — anchored linear index regex (no backtracking); tokens are short JSON Pointer segments
+    var idx = Number(token);
+    if (idx >= node.length) return { found: false };
+    return { found: true, value: node[idx] };
+  }
+  if (node !== null && typeof node === "object") {
+    if (!Object.prototype.hasOwnProperty.call(node, token)) return { found: false };
+    return { found: true, value: node[token] };
+  }
+  return { found: false };
+}
+
+/**
+ * @primitive b.jsonPointer.get
+ * @signature b.jsonPointer.get(doc, pointer)
+ * @since     0.12.58
+ * @status    stable
+ * @related   b.jsonPointer.parse, b.jsonPatch.apply
+ *
+ * Return the value an RFC 6901 pointer references within a JSON document,
+ * walking object keys and array indices. Throws
+ * <code>json-pointer/not-found</code> when a token does not resolve (a
+ * missing key, an out-of-range or non-numeric array index, or descending
+ * into a primitive). The whole document is returned for the empty
+ * pointer.
+ *
+ * @example
+ *   b.jsonPointer.get({ foo: ["a", "b"] }, "/foo/1");
+ *   // → "b"
+ */
+function get(doc, pointer) {
+  var tokens = parse(pointer);
+  var cur = doc;
+  for (var i = 0; i < tokens.length; i += 1) {
+    var r = _step(cur, tokens[i]);
+    if (!r.found) throw new JsonPointerError("json-pointer/not-found", "jsonPointer.get: pointer does not resolve at token '" + tokens[i] + "'");
+    cur = r.value;
+  }
+  return cur;
+}
+
+module.exports = {
+  parse:            parse,
+  get:              get,
+  ARRAY_INDEX_RE:   ARRAY_INDEX_RE,
+  JsonPointerError: JsonPointerError,
+};

package/lib/vendor/blamejs/lib/jtd.js

@@ -0,0 +1,234 @@
+"use strict";
+/**
+ * @module b.jtd
+ * @nav    Data
+ * @title  JSON Type Definition
+ *
+ * @intro
+ *   Validate a JSON value against a JSON Type Definition schema (RFC
+ *   8927) — a small, portable, cross-implementation schema language.
+ *   Unlike the framework's fluent <code>b.safeSchema</code> builder, a
+ *   JTD schema is plain JSON you can share with any JTD implementation
+ *   (and generate code from), which makes it the right choice for
+ *   interop contracts.
+ *
+ *   <code>validate(schema, instance)</code> returns an array of errors,
+ *   each a <code>{ instancePath, schemaPath }</code> pair pointing at the
+ *   offending value and the schema rule it broke (an empty array means
+ *   valid). All eight schema forms are supported — empty, <code>type</code>,
+ *   <code>enum</code>, <code>elements</code>, <code>properties</code>,
+ *   <code>values</code>, <code>discriminator</code>, and <code>ref</code>
+ *   (with <code>definitions</code>) — and a malformed schema is rejected
+ *   at compile time rather than mis-validating.
+ *
+ * @card
+ *   JSON Type Definition (RFC 8927) — validate JSON against a portable,
+ *   standardized schema (all eight forms), returning instancePath /
+ *   schemaPath errors. The interop-friendly companion to the fluent
+ *   <code>b.safeSchema</code> builder.
+ */
+
+var { defineClass } = require("./framework-error");
+
+var JtdError = defineClass("JtdError", { alwaysPermanent: true });
+
+var MAX_DEPTH = 10000;                                       // allow:raw-time-literal — recursion cap for self-referential refs
+
+var TYPES = {
+  boolean: 1, string: 1, timestamp: 1, float32: 1, float64: 1,
+  int8: 1, uint8: 1, int16: 1, uint16: 1, int32: 1, uint32: 1,
+};
+var INT_RANGES = {
+  int8: [-128, 127], uint8: [0, 255], int16: [-32768, 32767],                              // allow:raw-byte-literal — RFC 8927 integer type bounds
+  uint16: [0, 65535], int32: [-2147483648, 2147483647], uint32: [0, 4294967295],            // allow:raw-byte-literal — RFC 8927 integer type bounds
+};
+var FORM_KEYWORDS = ["ref", "type", "enum", "elements", "properties", "optionalProperties", "values", "discriminator"];
+var SHARED_KEYWORDS = { definitions: 1, nullable: 1, metadata: 1 };
+
+function _isPlainObject(v) { return v !== null && typeof v === "object" && !Array.isArray(v); }
+function _isInteger(v) { return typeof v === "number" && isFinite(v) && Math.floor(v) === v; }
+
+// RFC 3339 date-time (the JTD "timestamp" type).
+var RFC3339 = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
+function _validTimestamp(s) {
+  var m = RFC3339.exec(s);
+  if (!m) return false;
+  var mo = +m[2], d = +m[3], h = +m[4], mi = +m[5], se = +m[6];
+  if (mo < 1 || mo > 12 || d < 1 || d > 31 || h > 23 || mi > 59 || se > 60) return false;   // allow:raw-time-literal — RFC 3339 field ranges (60 = leap second)
+  var days = [31, ((+m[1] % 4 === 0 && +m[1] % 100 !== 0) || +m[1] % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];   // allow:raw-time-literal — days per month
+  if (d > days[mo - 1]) return false;
+  var tz = m[8];
+  if (tz !== "Z" && tz !== "z") {                            // numeric offset must be in range
+    if (+tz.slice(1, 3) > 23 || +tz.slice(4, 6) > 59) return false;   // allow:raw-time-literal — RFC 3339 offset hour/minute ranges
+  }
+  return true;
+}
+
+// --- compile-time well-formedness (RFC 8927 section 2.2) ---
+function _checkSchema(schema, root, isRoot) {
+  if (!_isPlainObject(schema)) throw new JtdError("jtd/bad-schema", "jtd: schema must be an object");
+  if (!isRoot && Object.prototype.hasOwnProperty.call(schema, "definitions")) throw new JtdError("jtd/bad-schema", "jtd: 'definitions' is allowed only at the root");
+  Object.keys(schema).forEach(function (k) {
+    if (FORM_KEYWORDS.indexOf(k) === -1 && !SHARED_KEYWORDS[k] && k !== "additionalProperties" && k !== "mapping") throw new JtdError("jtd/bad-schema", "jtd: unknown keyword '" + k + "'");
+  });
+  if (Object.prototype.hasOwnProperty.call(schema, "nullable") && typeof schema.nullable !== "boolean") throw new JtdError("jtd/bad-schema", "jtd: 'nullable' must be a boolean");
+  if (Object.prototype.hasOwnProperty.call(schema, "metadata") && !_isPlainObject(schema.metadata)) throw new JtdError("jtd/bad-schema", "jtd: 'metadata' must be an object");
+  if (Object.prototype.hasOwnProperty.call(schema, "definitions")) {
+    if (!_isPlainObject(schema.definitions)) throw new JtdError("jtd/bad-schema", "jtd: 'definitions' must be an object");
+    Object.keys(schema.definitions).forEach(function (k) { _checkSchema(schema.definitions[k], root, false); });
+  }
+  if (Object.prototype.hasOwnProperty.call(schema, "mapping") && !Object.prototype.hasOwnProperty.call(schema, "discriminator")) throw new JtdError("jtd/bad-schema", "jtd: 'mapping' is only valid with 'discriminator'");
+  var formSet = {};
+  FORM_KEYWORDS.forEach(function (k) { if (Object.prototype.hasOwnProperty.call(schema, k)) formSet[(k === "optionalProperties") ? "properties" : k] = 1; });
+  var formNames = Object.keys(formSet);
+  if (formNames.length > 1) throw new JtdError("jtd/bad-schema", "jtd: a schema may use only one form (got " + formNames.join(", ") + ")");
+
+  if ("ref" in schema) {
+    if (typeof schema.ref !== "string" || !root.definitions || !Object.prototype.hasOwnProperty.call(root.definitions, schema.ref)) throw new JtdError("jtd/bad-schema", "jtd: 'ref' must name a key in the root definitions");
+  }
+  if ("type" in schema && !TYPES[schema.type]) throw new JtdError("jtd/bad-schema", "jtd: unknown type '" + schema.type + "'");
+  if ("enum" in schema) {
+    if (!Array.isArray(schema.enum) || schema.enum.length === 0) throw new JtdError("jtd/bad-schema", "jtd: 'enum' must be a non-empty array");
+    var seen = Object.create(null);
+    schema.enum.forEach(function (e) { if (typeof e !== "string") throw new JtdError("jtd/bad-schema", "jtd: 'enum' values must be strings"); if (seen[e]) throw new JtdError("jtd/bad-schema", "jtd: duplicate enum value"); seen[e] = 1; });
+  }
+  if ("elements" in schema) _checkSchema(schema.elements, root, false);
+  if ("values" in schema) _checkSchema(schema.values, root, false);
+  if ("properties" in schema || "optionalProperties" in schema) {
+    var props = schema.properties || {}, opt = schema.optionalProperties || {};
+    if (!_isPlainObject(props) || !_isPlainObject(opt)) throw new JtdError("jtd/bad-schema", "jtd: properties / optionalProperties must be objects");
+    Object.keys(props).forEach(function (k) { if (Object.prototype.hasOwnProperty.call(opt, k)) throw new JtdError("jtd/bad-schema", "jtd: '" + k + "' in both properties and optionalProperties"); _checkSchema(props[k], root, false); });
+    Object.keys(opt).forEach(function (k) { _checkSchema(opt[k], root, false); });
+    if ("additionalProperties" in schema && typeof schema.additionalProperties !== "boolean") throw new JtdError("jtd/bad-schema", "jtd: 'additionalProperties' must be a boolean");
+  }
+  if ("discriminator" in schema) {
+    if (typeof schema.discriminator !== "string") throw new JtdError("jtd/bad-schema", "jtd: 'discriminator' must be a string");
+    if (!_isPlainObject(schema.mapping)) throw new JtdError("jtd/bad-schema", "jtd: 'discriminator' requires a 'mapping' object");
+    Object.keys(schema.mapping).forEach(function (k) {
+      var sub = schema.mapping[k];
+      _checkSchema(sub, root, false);
+      if (!_isPlainObject(sub) || (!("properties" in sub) && !("optionalProperties" in sub))) throw new JtdError("jtd/bad-schema", "jtd: discriminator mapping schemas must use the properties form");
+      if (sub.nullable === true) throw new JtdError("jtd/bad-schema", "jtd: discriminator mapping schemas must not be nullable");
+      var p = sub.properties || {}, o = sub.optionalProperties || {};
+      if (Object.prototype.hasOwnProperty.call(p, schema.discriminator) || Object.prototype.hasOwnProperty.call(o, schema.discriminator)) throw new JtdError("jtd/bad-schema", "jtd: discriminator tag must not appear in a mapping schema's properties");
+    });
+  }
+  if ("additionalProperties" in schema && !("properties" in schema) && !("optionalProperties" in schema)) throw new JtdError("jtd/bad-schema", "jtd: 'additionalProperties' requires a properties form");
+}
+
+// --- validation (RFC 8927 section 3.3) ---
+function _typeOk(type, v) {
+  if (type === "boolean") return typeof v === "boolean";
+  if (type === "string") return typeof v === "string";
+  if (type === "timestamp") return typeof v === "string" && _validTimestamp(v);
+  if (type === "float32" || type === "float64") return typeof v === "number" && isFinite(v);
+  var range = INT_RANGES[type];
+  return _isInteger(v) && v >= range[0] && v <= range[1];
+}
+
+function _val(schema, inst, ip, sp, root, depth, errors, discrimTag) {
+  if (depth > MAX_DEPTH) throw new JtdError("jtd/too-deep", "jtd: schema recursion exceeded the depth cap");
+  if (schema.nullable === true && inst === null) return;
+
+  if ("ref" in schema) { _val(root.definitions[schema.ref], inst, ip, ["definitions", schema.ref], root, depth + 1, errors, undefined); return; }
+
+  if ("type" in schema) {
+    if (!_typeOk(schema.type, inst)) errors.push({ instancePath: ip.slice(), schemaPath: sp.concat("type") });
+    return;
+  }
+  if ("enum" in schema) {
+    if (typeof inst !== "string" || schema.enum.indexOf(inst) === -1) errors.push({ instancePath: ip.slice(), schemaPath: sp.concat("enum") });
+    return;
+  }
+  if ("elements" in schema) {
+    if (!Array.isArray(inst)) { errors.push({ instancePath: ip.slice(), schemaPath: sp.concat("elements") }); return; }
+    for (var i = 0; i < inst.length; i++) _val(schema.elements, inst[i], ip.concat(String(i)), sp.concat("elements"), root, depth + 1, errors, undefined);
+    return;
+  }
+  if ("properties" in schema || "optionalProperties" in schema) {
+    if (!_isPlainObject(inst)) {
+      errors.push({ instancePath: ip.slice(), schemaPath: sp.concat("properties" in schema ? "properties" : "optionalProperties") });
+      return;
+    }
+    var props = schema.properties || {}, opt = schema.optionalProperties || {};
+    Object.keys(props).forEach(function (k) {
+      if (Object.prototype.hasOwnProperty.call(inst, k)) _val(props[k], inst[k], ip.concat(k), sp.concat("properties", k), root, depth + 1, errors, undefined);
+      else errors.push({ instancePath: ip.slice(), schemaPath: sp.concat("properties", k) });
+    });
+    Object.keys(opt).forEach(function (k) {
+      if (Object.prototype.hasOwnProperty.call(inst, k)) _val(opt[k], inst[k], ip.concat(k), sp.concat("optionalProperties", k), root, depth + 1, errors, undefined);
+    });
+    if (schema.additionalProperties !== true) {
+      Object.keys(inst).forEach(function (k) {
+        if (!Object.prototype.hasOwnProperty.call(props, k) && !Object.prototype.hasOwnProperty.call(opt, k) && k !== discrimTag) {
+          errors.push({ instancePath: ip.concat(k), schemaPath: sp.slice() });
+        }
+      });
+    }
+    return;
+  }
+  if ("values" in schema) {
+    if (!_isPlainObject(inst)) { errors.push({ instancePath: ip.slice(), schemaPath: sp.concat("values") }); return; }
+    Object.keys(inst).forEach(function (k) { _val(schema.values, inst[k], ip.concat(k), sp.concat("values"), root, depth + 1, errors, undefined); });
+    return;
+  }
+  if ("discriminator" in schema) {
+    if (!_isPlainObject(inst)) { errors.push({ instancePath: ip.slice(), schemaPath: sp.concat("discriminator") }); return; }
+    var tag = schema.discriminator;
+    if (!Object.prototype.hasOwnProperty.call(inst, tag)) { errors.push({ instancePath: ip.slice(), schemaPath: sp.concat("discriminator") }); return; }
+    if (typeof inst[tag] !== "string") { errors.push({ instancePath: ip.concat(tag), schemaPath: sp.concat("discriminator") }); return; }
+    if (!Object.prototype.hasOwnProperty.call(schema.mapping, inst[tag])) { errors.push({ instancePath: ip.concat(tag), schemaPath: sp.concat("mapping") }); return; }
+    _val(schema.mapping[inst[tag]], inst, ip, sp.concat("mapping", inst[tag]), root, depth + 1, errors, tag);
+    return;
+  }
+  // empty form: accepts anything
+}
+
+/**
+ * @primitive b.jtd.validate
+ * @signature b.jtd.validate(schema, instance)
+ * @since     0.12.62
+ * @status    stable
+ * @compliance soc2
+ * @related   b.safeSchema, b.jsonPointer.get
+ *
+ * Validate a JSON value against a JSON Type Definition schema (RFC 8927)
+ * and return the array of validation errors — each a
+ * <code>{ instancePath, schemaPath }</code> pair of token arrays naming
+ * the offending value and the schema rule it broke. An empty array means
+ * the instance is valid. All eight schema forms are supported. The schema
+ * itself is checked for well-formedness first; a malformed schema throws
+ * <code>jtd/bad-schema</code> rather than silently mis-validating.
+ *
+ * @example
+ *   b.jtd.validate({ properties: { id: { type: "uint32" } } }, { id: -1 });
+ *   // -> [ { instancePath: ["id"], schemaPath: ["properties", "id", "type"] } ]
+ */
+function validate(schema, instance) {
+  _checkSchema(schema, schema, true);
+  var errors = [];
+  _val(schema, instance, [], [], schema, 0, errors, undefined);
+  return errors;
+}
+
+/**
+ * @primitive b.jtd.isValid
+ * @signature b.jtd.isValid(schema, instance)
+ * @since     0.12.62
+ * @status    stable
+ * @related   b.jtd.validate
+ *
+ * Convenience boolean form of <code>validate</code> — <code>true</code>
+ * when the instance conforms to the JTD schema (no errors). Throws
+ * <code>jtd/bad-schema</code> on a malformed schema.
+ *
+ * @example
+ *   b.jtd.isValid({ type: "string" }, "hello");   // -> true
+ */
+function isValid(schema, instance) { return validate(schema, instance).length === 0; }
+
+module.exports = {
+  validate: validate,
+  isValid:  isValid,
+  JtdError: JtdError,
+};

package/lib/vendor/blamejs/lib/link-header.js

@@ -0,0 +1,169 @@
+"use strict";
+/**
+ * @module b.linkHeader
+ * @nav    HTTP
+ * @title  Link header
+ *
+ * @intro
+ *   Parse and build the HTTP <code>Link</code> header (RFC 8288 Web
+ *   Linking) — the standard way to convey relations between resources,
+ *   most visibly REST pagination
+ *   (<code>Link: &lt;…?page=2&gt;; rel="next"</code>). A header carries
+ *   one or more comma-separated links, each an angle-bracketed URI
+ *   reference followed by <code>;</code>-separated parameters
+ *   (<code>rel</code>, <code>title</code>, <code>type</code>, …).
+ *
+ *   <code>parse</code> returns one object per link with its
+ *   <code>uri</code>, the (space-split) <code>rel</code> relation types,
+ *   and the remaining <code>params</code>; <code>serialize</code> is the
+ *   inverse. The comma split and quoted-parameter unwrapping reuse the
+ *   framework's RFC 8941 structured-field helpers so a comma inside a
+ *   quoted <code>title</code> never fake-splits the list.
+ *
+ * @card
+ *   HTTP Link header codec (RFC 8288 Web Linking) — parse and build
+ *   <code>Link: &lt;uri&gt;; rel="next"</code> relations, the standard
+ *   REST pagination mechanism. Quote-aware so a comma inside a quoted
+ *   parameter never splits the list.
+ */
+
+var structuredFields = require("./structured-fields");
+var { defineClass } = require("./framework-error");
+
+var LinkHeaderError = defineClass("LinkHeaderError", { alwaysPermanent: true });
+
+var MAX_HEADER_BYTES = 16384;                                // allow:raw-byte-literal — defensive cap on a parsed Link header
+
+// Split a Link header on the commas that separate links — those OUTSIDE
+// a <uri-reference> and outside a quoted-string. structuredFields'
+// splitter is quote-aware but not angle-bracket-aware, so a comma inside
+// a URI (`<https://x/a,b>`) must not split the list (RFC 8288 §3.5).
+function _splitLinks(s) {
+  var out = [], start = 0, inUri = false, inQuote = false, esc = false;
+  for (var i = 0; i < s.length; i += 1) {
+    var c = s.charAt(i);
+    if (esc) { esc = false; continue; }
+    if (inQuote) { if (c === "\\") esc = true; else if (c === "\"") inQuote = false; continue; }
+    if (c === "\"") { inQuote = true; }
+    else if (c === "<") { inUri = true; }
+    else if (c === ">") { inUri = false; }
+    else if (c === "," && !inUri) { out.push(s.slice(start, i)); start = i + 1; }
+  }
+  out.push(s.slice(start));
+  return out;
+}
+
+/**
+ * @primitive b.linkHeader.parse
+ * @signature b.linkHeader.parse(headerValue)
+ * @since     0.12.57
+ * @status    stable
+ * @related   b.linkHeader.serialize, b.pagination.cursor
+ *
+ * Parse an HTTP <code>Link</code> header value (RFC 8288) into an array
+ * of <code>{ uri, rel, params }</code> — one per link. <code>uri</code>
+ * is the angle-bracketed target, <code>rel</code> is the array of
+ * (space-separated) relation types, and <code>params</code> is the
+ * remaining parameters with quoted values unwrapped. A comma inside a
+ * quoted parameter value does not split the list. A link without a
+ * bracketed URI is refused.
+ *
+ * @example
+ *   b.linkHeader.parse('<https://api/x?page=2>; rel="next", <https://api/x?page=9>; rel="last"');
+ *   // → [ { uri: "https://api/x?page=2", rel: ["next"], params: {} },
+ *   //     { uri: "https://api/x?page=9", rel: ["last"], params: {} } ]
+ */
+function parse(headerValue) {
+  if (typeof headerValue !== "string") throw new LinkHeaderError("link-header/bad-input", "linkHeader.parse: headerValue must be a string");
+  if (headerValue.length > MAX_HEADER_BYTES) throw new LinkHeaderError("link-header/too-large", "linkHeader.parse: Link header exceeds " + MAX_HEADER_BYTES + " bytes");
+  structuredFields.refuseControlBytes(headerValue, { ErrorClass: LinkHeaderError, code: "link-header/bad-input", label: "Link header" });
+  var out = [];
+  var members = _splitLinks(headerValue);
+  for (var i = 0; i < members.length; i++) {
+    var raw = members[i].trim();
+    if (raw === "") continue;
+    if (raw.charAt(0) !== "<") throw new LinkHeaderError("link-header/bad-link", "linkHeader.parse: link must start with a <uri-reference>");
+    var close = raw.indexOf(">");
+    if (close === -1) throw new LinkHeaderError("link-header/bad-link", "linkHeader.parse: unterminated <uri-reference>");
+    var uri = raw.slice(1, close);
+    var rest = raw.slice(close + 1);
+    var paramParts = structuredFields.splitTopLevel(rest, ";");
+    var rel = [], relSet = false, params = Object.create(null);
+    for (var p = 0; p < paramParts.length; p++) {
+      var piece = paramParts[p].trim();
+      if (piece === "") continue;
+      var eq = piece.indexOf("=");
+      var name = (eq === -1 ? piece : piece.slice(0, eq)).trim().toLowerCase();
+      if (name === "") continue;
+      var value = eq === -1 ? "" : structuredFields.unquoteSfString(piece.slice(eq + 1).trim());
+      if (value === null) throw new LinkHeaderError("link-header/bad-link", "linkHeader.parse: unterminated quoted parameter on '" + name + "'");
+      // RFC 8288 §3.3 / §3.4: a repeated rel (or any parameter) keeps the
+      // FIRST occurrence; later ones are ignored.
+      if (name === "rel") { if (!relSet) { rel = value.split(/\s+/).filter(Boolean); relSet = true; } continue; }
+      if (!(name in params)) params[name] = value;
+    }
+    out.push({ uri: uri, rel: rel, params: params });
+  }
+  return out;
+}
+
+// Quote every parameter value (always valid RFC 8288, and required for
+// space-separated multi-rel and non-token values like "text/html"); the
+// common convention (RFC 8288 examples, REST pagination) quotes too.
+function _serParam(name, value) {
+  if (value === "" || value === true) return name;            // valueless parameter
+  return name + "=\"" + String(value).replace(/\\/g, "\\\\").replace(/"/g, "\\\"") + "\"";
+}
+
+/**
+ * @primitive b.linkHeader.serialize
+ * @signature b.linkHeader.serialize(links)
+ * @since     0.12.57
+ * @status    stable
+ * @related   b.linkHeader.parse
+ *
+ * Build an HTTP <code>Link</code> header value from an array of
+ * <code>{ uri, rel, params? }</code> (or a single such object). The URI
+ * is angle-bracketed, <code>rel</code> (string or array) is emitted
+ * first, and parameters are token-valued when they fit RFC 7230 token
+ * grammar or double-quoted otherwise. Useful for emitting standard REST
+ * pagination links.
+ *
+ * @example
+ *   b.linkHeader.serialize([
+ *     { uri: "https://api/x?page=2", rel: "next" },
+ *     { uri: "https://api/x?page=9", rel: "last", params: { title: "end" } },
+ *   ]);
+ *   // → '<https://api/x?page=2>; rel="next", <https://api/x?page=9>; rel="last"; title="end"'
+ */
+function serialize(links) {
+  var arr = Array.isArray(links) ? links : [links];
+  var parts = [];
+  for (var i = 0; i < arr.length; i++) {
+    var link = arr[i];
+    if (!link || typeof link !== "object" || typeof link.uri !== "string" || link.uri === "") {
+      throw new LinkHeaderError("link-header/bad-link", "linkHeader.serialize: links[" + i + "] requires a non-empty uri");
+    }
+    if (link.uri.indexOf(">") !== -1 || link.uri.indexOf("<") !== -1) {
+      throw new LinkHeaderError("link-header/bad-link", "linkHeader.serialize: uri must not contain angle brackets");
+    }
+    var seg = "<" + link.uri + ">";
+    var rel = Array.isArray(link.rel) ? link.rel.join(" ") : (link.rel || "");
+    if (rel !== "") seg += "; " + _serParam("rel", rel);
+    if (link.params && typeof link.params === "object") {
+      var keys = Object.keys(link.params);
+      for (var k = 0; k < keys.length; k++) {
+        if (keys[k].toLowerCase() === "rel") continue;        // rel is emitted from link.rel
+        seg += "; " + _serParam(keys[k].toLowerCase(), link.params[keys[k]]);
+      }
+    }
+    parts.push(seg);
+  }
+  return parts.join(", ");
+}
+
+module.exports = {
+  parse:           parse,
+  serialize:       serialize,
+  LinkHeaderError: LinkHeaderError,
+};

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.12.56",
+  "version": "0.12.62",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.12.57.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.57",
+  "date": "2026-05-25",
+  "headline": "`b.linkHeader` — RFC 8288 Web Linking (HTTP Link header) codec",
+  "summary": "Parse and build the HTTP Link header (RFC 8288) — the standard way to convey resource relations, most visibly REST pagination (Link: <…?page=2>; rel=\"next\"). b.linkHeader.parse returns one { uri, rel, params } per link, splitting multiple links on top-level commas and unwrapping quoted parameter values via the framework's RFC 8941 structured-field helpers, so a comma inside a quoted title never fake-splits the list; rel is exposed as its array of space-separated relation types. b.linkHeader.serialize is the inverse, angle-bracketing the URI, emitting rel first, and double-quoting parameter values. Verified against the RFC 8288 §3.5 examples and GitHub-style pagination links.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.linkHeader.parse(headerValue)` / `b.linkHeader.serialize(links)`",
+          "body": "`parse` reads an HTTP Link header into `[{ uri, rel, params }]` — `uri` is the angle-bracketed target, `rel` the array of space-separated relation types, `params` the remaining parameters with quoted values unwrapped (a repeated parameter keeps the first occurrence per RFC 8288 §3.4). It refuses a link without a bracketed URI, an unterminated URI or quoted parameter, control bytes, and oversized headers. `serialize` builds the header value from `{ uri, rel, params? }` objects (or a single one), angle-bracketing the URI and double-quoting parameter values. Composes the framework's structured-field splitter so quoting is handled consistently; pair with `b.pagination` to emit standard `rel=\"next\"` / `rel=\"prev\"` navigation."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.12.58.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.58",
+  "date": "2026-05-25",
+  "headline": "`b.jsonPointer` (RFC 6901) + `b.jsonPatch` (RFC 6902) — JSON Pointer + Patch",
+  "summary": "Two related JSON primitives. b.jsonPointer.get references a value within a JSON document by RFC 6901 path (/foo/0/bar), handling the ~1 / ~0 escapes and array indices, and refusing pointers that do not resolve. b.jsonPatch.apply applies an RFC 6902 patch — add / remove / replace / move / copy / test — the standard HTTP PATCH payload (application/json-patch+json). It is atomic: operations run against a deep copy, so a failure at any step (an out-of-range index, a missing source, or a failed test) throws and leaves the input document untouched, and test compares values structurally. Verified against the official json-patch/json-patch-tests conformance suite (every enabled result and error case) plus the RFC 6901 §5 pointer examples.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.jsonPointer.get(doc, pointer)` / `b.jsonPointer.parse(pointer)`",
+          "body": "Resolve an RFC 6901 JSON Pointer against a document — walking object keys and array indices, decoding `~1` → `/` and `~0` → `~`, and returning the whole document for the empty pointer. Throws `json-pointer/not-found` for a missing key, an out-of-range or non-numeric (leading-zero) array index, or descent into a primitive, and `json-pointer/bad-pointer` for a non-`/`-prefixed pointer. `parse` exposes the decoded reference tokens."
+        },
+        {
+          "title": "`b.jsonPatch.apply(doc, operations)`",
+          "body": "Apply an RFC 6902 patch and return the result. Supports `add` (insert / append with `-` for arrays, set for objects, whole-document for `\"\"`), `remove`, `replace` (overwrite an existing location), `move`, `copy`, and `test` (structural equality). Atomic — the patch runs on a deep copy, so the input `doc` is never mutated and any failure (unknown op, missing `path` / `value` / `from`, bad index, failed `test`, or moving a location into its own child) throws a typed error. Paths are RFC 6901 pointers resolved through `b.jsonPointer`; suitable for HTTP PATCH endpoints."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.12.60.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.60",
+  "date": "2026-05-25",
+  "headline": "`b.jsonMergePatch` — JSON Merge Patch (RFC 7396)",
+  "summary": "The simpler companion to JSON Patch: b.jsonMergePatch.merge applies an RFC 7396 merge patch (application/merge-patch+json), the partial-document PATCH body. A member present in the patch replaces or — for nested objects — merges into the target, a member whose value is null removes that key, and a patch that is itself an array, scalar, or null replaces the target wholesale. The inputs are never mutated (the merge runs on a deep copy) and member keys are written as literal own properties, so a \"__proto__\" member cannot reach any prototype. Verified against every RFC 7396 Appendix A test case.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.jsonMergePatch.merge(target, patch)`",
+          "body": "Applies a JSON Merge Patch to a target document and returns the result without mutating either input. When the patch is an object it overlays the target (a null member deletes the key, a nested object merges recursively, any other value replaces); when the patch is an array, scalar, or null it replaces the whole target. Member keys are set via `Object.defineProperty`, so a `\"__proto__\"` member becomes a literal own key rather than altering a prototype. Pairs with `b.jsonPatch` — merge patch reads like the resource you want, JSON Patch expresses precise operations (array reordering, literal-null values)."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.12.61.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.61",
+  "date": "2026-05-26",
+  "headline": "`b.jsonPath` — JSONPath query (RFC 9535)",
+  "summary": "A full RFC 9535 JSONPath query evaluator, complementing the framework's JSONPath guards (which screen path strings). b.jsonPath.query(doc, path) compiles a path and returns the matched node values; b.jsonPath.paths returns their normalized locations. The complete surface is implemented: name / wildcard / index / slice selectors, descendant segments (..), filter selectors (?) with comparison and logical operators, relative (@) and absolute ($) embedded queries, and the five standard functions length / count / match / search / value — with the spec's well-typedness rules enforced at compile time so a malformed or ill-typed query is rejected rather than silently mis-evaluated. Descendant walks are node-capped to bound work on hostile input. Verified against all 703 cases of the official jsonpath-compliance-test-suite.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.jsonPath.query(doc, path)` / `b.jsonPath.paths(doc, path)`",
+          "body": "`query` returns the array of node values selected by an RFC 9535 JSONPath; `paths` returns the normalized-path string of each match (e.g. `$['a'][1]['p']`). Supports every selector (name, wildcard `*`, index incl. negative, slice `start:end:step` incl. negative step, comma-separated selections), child and descendant (`..`) segments, and filter expressions with `==` / `!=` / `<` / `<=` / `>` / `>=`, `&&` / `||` / `!`, existence tests, and the standard functions. The well-typedness rules are checked when the path is compiled — a non-singular query used as a comparison operand, an ill-typed function argument, or a value-typed function used as a test all throw `json-path/invalid`. Pairs with `b.guardJsonPath`, which screens operator-supplied path strings before they reach the evaluator."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.12.62.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.62",
+  "date": "2026-05-26",
+  "headline": "`b.jtd` — JSON Type Definition validation (RFC 8927)",
+  "summary": "Validate JSON against a JSON Type Definition schema (RFC 8927) — a small, portable, cross-implementation schema language, the interop-friendly companion to the framework's fluent b.safeSchema builder. b.jtd.validate(schema, instance) returns an array of { instancePath, schemaPath } errors (empty = valid); b.jtd.isValid is the boolean form. All eight schema forms are supported — empty, type, enum, elements, properties (with optional / additional properties and nullable), values, discriminator (with mapping), and ref (with definitions) — including the integer-range and RFC 3339 timestamp types. A malformed schema is rejected at compile time with jtd/bad-schema rather than silently mis-validating. Verified against the official json-typedef-spec suites: all 316 validation cases and all 49 invalid-schema cases.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.jtd.validate(schema, instance)` / `b.jtd.isValid(schema, instance)`",
+          "body": "`validate` returns the RFC 8927 error list — each `{ instancePath, schemaPath }` naming the offending value and the broken schema rule — and `isValid` is the boolean convenience form. Supports every JTD form and type: the numeric types enforce their exact ranges (int8 … uint32, float32 / float64), `timestamp` requires an RFC 3339 date-time, `properties` honours `optionalProperties` / `additionalProperties` / `nullable`, and `discriminator` selects a `mapping` schema by a tag property. The schema is checked for well-formedness before validation, so unknown keywords, multiple forms, bad refs, or a discriminator over a non-properties mapping all throw `jtd/bad-schema`. Use JTD for schemas you share across implementations or generate code from; use `b.safeSchema` for in-process fluent validation."
+        }
+      ]
+    }
+  ]
+}