@blamejs/blamejs-shop 0.1.23 → 0.1.26

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.1.x
 
+- v0.1.26 (2026-05-25) — **Fix the container build gate that rejected a manifest absent from the image.** The asset-integrity drift gate added last release checked both the container and edge copies of the manifest. The container image excludes the edge worker directory from its build context, so when the gate runs inside the image build it can't see the worker copy and read it as empty — failing the build. The gate now skips a manifest that isn't present in the current build context; its drift is still caught wherever the file exists (the full-tree CI run checks both). **Fixed:** *Asset-manifest drift gate no longer fails the container build* — `generate-asset-manifest.js --check` compared both manifest copies (`lib/` for the container, `worker/` for the edge) against a fresh rebuild. The container image's build context excludes the `worker/` tree, so inside the image the worker copy is absent and the gate read it as empty — reporting false drift and failing `node test/smoke.js`, which is a build gate, so the container image never built. The check now treats a manifest that isn't present in the current context as not-applicable and skips it (requiring at least one copy to be present), so the same drift detection still runs in CI and at the edge build where both files exist, without breaking the container image build.
+
+- v0.1.25 (2026-05-25) — **Asset integrity and the cache-buster are correct in production now.** The renderers stamped a Subresource Integrity digest and a `?v=` cache-buster onto the theme stylesheet and island scripts by hashing the files at render time — which silently produced nothing in production, where the container image doesn't ship the theme files and the edge has no filesystem to read them. So the integrity attribute was absent live and edge-rendered pages pinned a `0.0.0` version that never changed between releases (a stylesheet update would render against a browser-cached copy). Both now come from a manifest built at release time and read directly by both runtimes. **Fixed:** *Subresource Integrity now applied on server-rendered pages* — The `integrity="sha384-…"` attribute on the default theme's stylesheet and island scripts was computed by reading the asset off disk during the render. That read fails in the deployed container (its image carries the code, not the `themes/` tree) and at the edge (no filesystem), so the attribute was silently dropped — the tamper-evidence it's meant to provide wasn't active. The digests are now computed once at release time into `lib/asset-manifest.json` (bundled for both the container and the edge worker) and read from there, so the browser actually verifies the served bytes against the pinned hash. · *Edge-rendered pages no longer pin a 0.0.0 cache-buster* — Pages rendered at the edge (home, product, search, the empty cart, blog) appended `?v=0.0.0` to the stylesheet URL because the worker had no release version to stamp — so the cache-buster never changed across deploys and a browser could keep serving an old stylesheet after a CSS update (markup against stale styling). The version now comes from the release manifest, so each release invalidates the cached asset as intended. The drift between the manifest and the on-disk assets is caught by a smoke gate (`generate-asset-manifest.js --check`).
+
 - v0.1.23 (2026-05-25) — **The admin console renders styled again, and both surfaces now self-host their fonts.** The admin console shipped its design system as an inline <style> block, inline style="" attributes, and a cross-origin Google Fonts link — all three of which the strict `style-src 'self'` / `font-src 'self'` CSP that governs container-served routes refuses, so the console rendered as an unstyled page in production. Its styling now lives in an external stylesheet served from /assets (like the storefront's), and the typeface is self-hosted, so the console renders as designed under the same CSP that protects it. Both the storefront and the console now serve Inter from /assets rather than naming it and hoping the visitor has it installed. **Changed:** *Inter is self-hosted on both the storefront and the console* — The default theme named Inter / Inter Tight first in its font stack but shipped no font files, so the intended typography only rendered for visitors who happened to have Inter installed locally — everyone else fell back to a system sans-serif. The latin subset of Inter (400/500/600) and Inter Tight (600/700) now ships under `themes/default/assets/fonts` and is referenced via `@font-face`, so the typeface renders for every visitor and loads same-origin under `font-src 'self'` — no cross-origin font CDN on any page. The fonts are SIL OFL 1.1 (license alongside the files); `font-display:swap` paints text immediately in the system fallback and swaps when the file arrives. · *Admin console visual refresh* — With the stylesheet external it also got a pass: a proper centered sign-in card (replacing the bare form that was the first thing an operator saw), softer surfaces and shadows on cards and panels, a sticky console nav, and consistent spacing. The brand palette (ink + the storefront's accent) and every screen's structure are unchanged — this is presentation only. **Fixed:** *Admin console renders unstyled in production* — Every `/admin` screen built its design system three ways the strict CSP refuses: an inline `<style>` block, inline `style=""` attributes, and a `<link>` to fonts.googleapis.com. Container-served routes run under `style-src 'self'` / `font-src 'self'`, which drops all three — so the console arrived as unstyled HTML (a plain page) once deployed, even though it looked correct in isolation. The styling now ships as `/assets/themes/default/css/admin.css`, an external file `'self'` allows, linked with a `sha384` Subresource Integrity digest so the browser rejects a tampered or stale object; the inline attributes are gone, folded into that stylesheet. A render-shell test asserts every admin screen links the external stylesheet, carries no inline styles, and pulls no third-party font host, so the regression can't return. Operators redeploy to pick this up — `npm run deploy` uploads the new stylesheet (and the fonts below) to R2 as part of the asset sync.
 
 - v0.1.22 (2026-05-25) — **Fix the container boot crash-loop, plus gift cards, subscription self-management, and a customers roster.** The deployable container could crash-loop on startup, taking every write route (add-to-cart, checkout, account, admin) down while edge-rendered reads kept working — this release fixes that boot path. It also adds gift cards (issue / balance / redeem-at-checkout with an operator ledger), customer subscription self-management at `/account/subscriptions`, and a read-only customers roster in the admin console. **Added:** *Gift cards — redeem at checkout, balance check, operator ledger* — A gift-card code can be applied at checkout as a credit against the order total: the amount due drops by the available balance (never below zero), the order still records the full total it owed, and the debit is recorded once per order behind an atomic `balance >= amount` guard so concurrent spends can't overdraw — a card that fully covers the order is marked paid with no card charge. Customers check a balance at `GET /gift-cards` (which is not a code-existence oracle — unknown / malformed / expired all return the same generic result). Operators work `/admin/gift-cards`: list issued cards (masked code, original + remaining balance, status, issued date) filtered by lifecycle status, issue a card (the bearer code shown once, right after creation), and open a card to read its full credit / debit / expire ledger. Codes are stored as a `namespaceHash` digest plus a 4-char hint — never in the clear. · *Customer subscription self-management* — Signed-in customers view and cancel their own subscriptions at `/account/subscriptions` — each row shows the plan summary, status, and renew / end date, with a Cancel control on cancelable subscriptions. Every action is ownership-checked: a subscription that doesn't belong to the signed-in customer is a 404, never another account's row. Cancellation runs through the payment provider, so the cancel control mounts only when the payment handle is wired; without it the list renders read-only. Customer-facing subscription creation — a subscription-checkout flow — remains a separate follow-up; this surface is for managing existing subscriptions. · *Customers admin roster* — `/admin/customers` renders a read-only account roster (newest first): display name, a short id, the join date, the sign-in method (passkey count plus any linked OAuth providers), and the order count, with cursor pagination in the browser and a JSON list (with `next_cursor`) for a bearer-token client. Account creation and changes stay with the storefront's passkey / OIDC ceremonies. Order counts and sign-in methods are resolved with bounded aggregate queries over each page's ids — no per-row database trips. Raw email is never stored, so it is never shown. **Changed:** *Console nav gains Customers and Gift cards* — The signed-in admin nav now includes Customers and Gift cards alongside the existing screens, each shown when its primitive is wired. All new endpoints content-negotiate like the rest of the console: a bearer-token client gets the JSON API, a signed-in browser gets HTML; a request without the bearer token returns the sign-in form on a GET and redirects on a write. The customers roster, the subscription cancel, and the gift-card balance page all degrade gracefully when an optional dependency (payment, or the primitive itself) isn't configured. · *Deploy now syncs theme assets to R2* — `npm run deploy` chains `wrangler deploy` with a new `scripts/sync-r2-assets.js` that uploads the repo's theme stylesheets to the R2 bucket the Worker serves `/assets/*` from. `wrangler deploy` alone ships the Worker + container but never touches R2, so a CSS change would silently drift from the deployed HTML — new markup against a stale stylesheet. Run `npm run sync-assets` to push the stylesheets without a full redeploy. · *Theme stylesheet and island scripts served with Subresource Integrity* — The default theme's stylesheet `<link>` and the externalized passkey island `<script>` tags now carry a `sha384` `integrity` attribute computed from the on-disk asset, so a browser refuses any `/assets/*` response whose bytes don't match — closing the window where a tampered or stale CDN object could execute against the page. The digests are computed once at boot and cached; a missing or unreadable asset degrades to no integrity attribute rather than blocking the render. **Fixed:** *Passkey sign-in / registration no longer blocked by CSP* — The WebAuthn passkey ceremonies on `/account/login` and `/account/register` were inline `<script>` blocks, which the storefront's strict `script-src 'self'` CSP refuses to execute — so on the deploy the sign-in and registration buttons did nothing (accounts are passkey-only, so this blocked all customer auth). The ceremonies now ship as external assets (`/assets/themes/default/js/passkey-login.js` + `passkey-register.js`) that `'self'` allows, served from R2 and uploaded by the deploy's asset sync. Same effect, CSP-clean — and a clearer split between the server-rendered form and its opt-in enhancement. · *Container no longer crash-loops on startup* — The container boot had three ways to fail before it could serve a request, each of which left edge-rendered reads working while every container-served route (add-to-cart, cart update / remove, checkout, `/account`, `/admin`) was unreachable. (1) The secure-default boot unlocks a wrapped vault **and** a wrapped audit-signing keypair, which the framework reads from `BLAMEJS_VAULT_PASSPHRASE` / `BLAMEJS_AUDIT_SIGNING_PASSPHRASE`, but the deploy contract documents a single `VAULT_PASSPHRASE` the framework never read — so the container had no passphrase source, no TTY to prompt, and exited. The entry point now bridges the documented secret onto the vault passphrase and derives a domain-separated audit-signing passphrase from it. (2) Encrypted-at-rest requires a tmpfs; the image now points it at `/dev/shm` rather than failing to find one. (3) The Docker liveness probe was `wget`, which bot-guard blocks as automation (403), so a healthy container was marked unhealthy and stopped — the probe is now a browser-shaped Node request (`scripts/healthcheck.js`) that passes bot-guard like real traffic, without exempting the health path from the security middleware. A boot gate (`test/layer-2-integration/server-boot.test.js`) spawns the real entry point and asserts it listens, answers the probe, and still blocks header-less clients. Operators must redeploy the container to pick this up.

package/lib/admin.js

@@ -44,22 +44,15 @@ var AUDIT_NAMESPACE = "shop_admin";
 // allows this file; the deploy's R2 asset sync uploads it. The `?v=` is
 // the per-release cache-buster; the sha384 Subresource Integrity digest
 // (b.crypto.sri, W3C SRI 1.0) makes the browser reject a tampered or
-// stale object. Same-origin, so no `crossorigin` is needed. Kept local
-// to this module per the admin renderer's no-cross-module convention; a
-// missing asset (e.g. a unit-test cwd) omits the attribute, never throws.
-var _assetFs = require("node:fs"); // allow:non-shop-require — one sync read of the bundled in-repo stylesheet to compute its SRI hash via b.crypto.sri (the primitive needs the bytes); no remote/write
-var _ASSET_VERSION = require("../package.json").version;
-var _SRI_CACHE = {};
+// stale object. Same-origin, so no `crossorigin` is needed. The digest +
+// version come from the build-time manifest (lib/asset-manifest.json)
+// rather than hashing the file at render time, so they're present in the
+// container image too — which doesn't ship the theme asset files. A key
+// absent from the manifest yields no attribute.
+var _assetManifest = require("./asset-manifest.json");
+var _ASSET_VERSION = _assetManifest.version;
 function _assetSri(relUnderThemeAssets) {
-  if (Object.prototype.hasOwnProperty.call(_SRI_CACHE, relUnderThemeAssets)) {
-    return _SRI_CACHE[relUnderThemeAssets];
-  }
-  var sri = null;
-  try {
-    sri = b.crypto.sri(_assetFs.readFileSync(__dirname + "/../themes/default/assets/" + relUnderThemeAssets), { algorithm: "sha384" });
-  } catch (_e) { sri = null; }
-  _SRI_CACHE[relUnderThemeAssets] = sri;
-  return sri;
+  return _assetManifest.assets[relUnderThemeAssets] || null;
 }
 function _adminStylesheetLink() {
   var sri = _assetSri("css/admin.css");

package/lib/asset-manifest.json

@@ -0,0 +1,9 @@
+{
+  "version": "0.1.26",
+  "assets": {
+    "css/admin.css": "sha384-rvjL1QySBgNJGEUDusbbMCkL3fsjmzcwUvTp9pljo/0Nn/lErxq2AbY8EYvDF9Ch",
+    "css/main.css": "sha384-qBY97FWZDGOploZRppwrDi0A/+R4R3iCFtyS1dfrAlqHNEPluPmY0R3HB9cJntyV",
+    "js/passkey-login.js": "sha384-65i1wVHIkiS2e0YiOV6oUOF9+tNR7s6QRvpnWaEne43P+B8UvKLTpDgp4MSKNGqX",
+    "js/passkey-register.js": "sha384-RaSkJbTpc6ClfPy5QyaY96doIqBqa9CLeIB1CzWnL05pSSJEA9IrIK0S7V7igRxY"
+  }
+}

package/lib/storefront.js

@@ -203,13 +203,21 @@ var LAYOUT =
 // each render call to override; absent that, every storefront page
 // references the shipped default theme — so a fresh install renders
 // styled out of the box without any wiring.
+// Asset integrity + version manifest — sha384 digests + the release
+// version, baked at build time (scripts/generate-asset-manifest.js) and
+// committed. Read here instead of hashing the files at render time so the
+// integrity attribute and the cache-buster are present in every runtime,
+// including the container image and the edge Worker, neither of which
+// ships the theme asset files to hash live. See lib/asset-manifest.json.
+var _assetManifest = require("./asset-manifest.json");
+
 // The default theme stylesheet ships from R2 at this path. The
 // `?v=` query is a build-time cache-buster — operator uploads to R2
 // rewrite the bytes at the same path, and without the version
 // param browsers happily serve the previous cached CSS for the
-// five-minute default TTL. Bumping this constant on each release
-// forces every active session to re-fetch.
-var DEFAULT_THEME_CSS_URL = "/assets/themes/default/css/main.css?v=" + require("../package.json").version;
+// five-minute default TTL. The manifest version bumps each release,
+// forcing every active session to re-fetch.
+var DEFAULT_THEME_CSS_URL = "/assets/themes/default/css/main.css?v=" + _assetManifest.version;
 
 // Footer copyright year — resolved once at module load. It's a near-static
 // value (changes once a year); a `new Date()` allocation on every page
@@ -222,30 +230,17 @@ var _COPYRIGHT_YEAR = String(new Date().getUTCFullYear());
 // 'self'` CSP blocks inline <script>, so an inline island silently fails
 // in production. `'self'` allows these /assets/ files; the R2 asset sync
 // (npm run sync-assets) uploads them alongside the stylesheets.
-var _ASSET_JS_VERSION = require("../package.json").version;
-var _assetFs = require("node:fs"); // allow:non-shop-require — one sync read of a bundled in-repo asset to compute its SRI hash via b.crypto.sri (the primitive needs the bytes); no remote/write, and b.staticServe.integrity is async so can't run at module load
-
-// Subresource Integrity for the static assets. `b.crypto.sri` (SHA-384,
-// W3C SRI 1.0) hashes the exact bytes the asset ships with; the browser
-// refuses to run/apply the resource if the served bytes don't match — a
-// defense against an R2/edge compromise or on-path injection. Computed
-// once per asset from the in-repo file (the same bytes the deploy's asset
-// sync uploads to R2), cached, and emitted as the `integrity` attribute.
-// Same-origin, so no `crossorigin` is required for the check to run.
-var _SRI_CACHE = {};
+var _ASSET_JS_VERSION = _assetManifest.version;
+
+// Subresource Integrity for the static assets — the browser refuses to
+// run/apply a resource whose served bytes don't match (defense against an
+// R2/edge compromise or on-path injection). The sha384 digest (W3C SRI
+// 1.0) is read from the build-time manifest keyed by the path under the
+// default theme's asset root; an absent key (a custom operator theme,
+// whose bytes aren't ours to hash) yields no attribute. Same-origin, so
+// no `crossorigin` is required for the check to run.
 function _assetSri(relUnderThemeAssets) {
-  if (Object.prototype.hasOwnProperty.call(_SRI_CACHE, relUnderThemeAssets)) {
-    return _SRI_CACHE[relUnderThemeAssets];
-  }
-  var sri = null;
-  try {
-    // Forward slashes resolve cross-platform for fs reads; avoids a
-    // node:path require for one join.
-    var p = __dirname + "/../themes/default/assets/" + relUnderThemeAssets;
-    sri = b.crypto.sri(_assetFs.readFileSync(p), { algorithm: "sha384" });
-  } catch (_e) { sri = null; } // asset absent (e.g. unit-test cwd) → omit integrity, don't crash render
-  _SRI_CACHE[relUnderThemeAssets] = sri;
-  return sri;
+  return _assetManifest.assets[relUnderThemeAssets] || null;
 }
 function _islandScript(name) {
   var sri = _assetSri("js/" + name);

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.12.62",
-      "tag": "v0.12.62",
+      "version": "0.12.63",
+      "tag": "v0.12.63",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.12.x
 
+- v0.12.63 (2026-05-25) — **`b.cloudEvents` gains the JSON event format, batch, and the HTTP binding.** b.cloudEvents grows beyond wrap / parse into a full CloudEvents 1.0.2 surface. b.cloudEvents.validate / isValid check an envelope against the spec without throwing (the non-throwing companion to parse). toJSON / fromJSON serialize and parse the JSON event format, and toJSONBatch / fromJSONBatch handle the JSON batch format; untrusted bodies parse through the framework's bounded, prototype-pollution-safe JSON reader. The new http.* binding speaks both content modes the spec defines — binary mode spreads context attributes across percent-encoded ce-* headers with the data in the body, structured mode carries the whole event as application/cloudevents+json — plus the batch mode, and http.decode auto-detects the incoming mode from Content-Type exactly as a conformant receiver does. Verified against the spec's normative example events. **Added:** *`b.cloudEvents` JSON event format, batch, and HTTP binding* — `validate` / `isValid` report spec violations without throwing (the non-throwing companion to `parse`). `toJSON` / `fromJSON` and `toJSONBatch` / `fromJSONBatch` serialize and parse the JSON event and batch formats over the existing envelope shape. `http.encodeBinary` / `http.encodeStructured` / `http.encodeBatch` render the three HTTP content modes — binary spreads attributes across percent-encoded `ce-*` headers, structured and batched carry the event(s) as `application/cloudevents+json` / `application/cloudevents-batch+json` — and `http.decode` parses a request back into an envelope (or array) by auto-detecting the mode from `Content-Type`. `b.jtd` or `b.safeSchema` still validate the event's `data` payload. **Fixed:** *`b.csp.build` accepts `fenced-frame-src` and `webrtc`* — The CSP3 `fenced-frame-src` directive — which the default security-headers policy emits to block `<fencedframe>` embeds — was missing from the builder's recognized-directive set, so the default policy could not round-trip through `b.csp.build` (it threw `csp/unknown-directive`). Both `fenced-frame-src` and the CSP3 `webrtc` directive are now recognized.
+
 - v0.12.62 (2026-05-26) — **`b.jtd` — JSON Type Definition validation (RFC 8927).** Validate JSON against a JSON Type Definition schema (RFC 8927) — a small, portable, cross-implementation schema language, the interop-friendly companion to the framework's fluent b.safeSchema builder. b.jtd.validate(schema, instance) returns an array of { instancePath, schemaPath } errors (empty = valid); b.jtd.isValid is the boolean form. All eight schema forms are supported — empty, type, enum, elements, properties (with optional / additional properties and nullable), values, discriminator (with mapping), and ref (with definitions) — including the integer-range and RFC 3339 timestamp types. A malformed schema is rejected at compile time with jtd/bad-schema rather than silently mis-validating. Verified against the official json-typedef-spec suites: all 316 validation cases and all 49 invalid-schema cases. **Added:** *`b.jtd.validate(schema, instance)` / `b.jtd.isValid(schema, instance)`* — `validate` returns the RFC 8927 error list — each `{ instancePath, schemaPath }` naming the offending value and the broken schema rule — and `isValid` is the boolean convenience form. Supports every JTD form and type: the numeric types enforce their exact ranges (int8 … uint32, float32 / float64), `timestamp` requires an RFC 3339 date-time, `properties` honours `optionalProperties` / `additionalProperties` / `nullable`, and `discriminator` selects a `mapping` schema by a tag property. The schema is checked for well-formedness before validation, so unknown keywords, multiple forms, bad refs, or a discriminator over a non-properties mapping all throw `jtd/bad-schema`. Use JTD for schemas you share across implementations or generate code from; use `b.safeSchema` for in-process fluent validation.
 
 - v0.12.61 (2026-05-26) — **`b.jsonPath` — JSONPath query (RFC 9535).** A full RFC 9535 JSONPath query evaluator, complementing the framework's JSONPath guards (which screen path strings). b.jsonPath.query(doc, path) compiles a path and returns the matched node values; b.jsonPath.paths returns their normalized locations. The complete surface is implemented: name / wildcard / index / slice selectors, descendant segments (..), filter selectors (?) with comparison and logical operators, relative (@) and absolute ($) embedded queries, and the five standard functions length / count / match / search / value — with the spec's well-typedness rules enforced at compile time so a malformed or ill-typed query is rejected rather than silently mis-evaluated. Descendant walks are node-capped to bound work on hostile input. Verified against all 703 cases of the official jsonpath-compliance-test-suite. **Added:** *`b.jsonPath.query(doc, path)` / `b.jsonPath.paths(doc, path)`* — `query` returns the array of node values selected by an RFC 9535 JSONPath; `paths` returns the normalized-path string of each match (e.g. `$['a'][1]['p']`). Supports every selector (name, wildcard `*`, index incl. negative, slice `start:end:step` incl. negative step, comma-separated selections), child and descendant (`..`) segments, and filter expressions with `==` / `!=` / `<` / `<=` / `>` / `>=`, `&&` / `||` / `!`, existence tests, and the standard functions. The well-typedness rules are checked when the path is compiled — a non-singular query used as a comparison operand, an ill-typed function argument, or a value-typed function used as a test all throw `json-path/invalid`. Pairs with `b.guardJsonPath`, which screens operator-supplied path strings before they reach the evaluator.

package/lib/vendor/blamejs/README.md

@@ -158,7 +158,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **WebSockets (server)** — channel/room fan-out across cluster replicas; RFC 6455 §5.5 control-frame size + FIN enforcement on inbound (defends 1 MiB-PING-as-PONG amplification) (`b.websocket`, `b.websocketChannels`)
 - **WebSockets (client)** — `b.wsClient` with PQC-TLS handshake, permessage-deflate negotiation with decompression-bomb cap, fatal UTF-8 validation, permanent-error classifier (skips reconnect on 4xx / accept mismatch / bad-subprotocol), exponential-backoff with full jitter
 - **Pub/sub + events** — distributed pub/sub with cluster-table / Redis PUB/SUB / custom backends (`b.pubsub`); framework-emitted signal bus for breach / integrity events (`b.events`)
-- **CloudEvents + SSE** — CloudEvents 1.0 envelope for AWS EventBridge / Knative / Azure Event Grid / Google Eventarc / CNCF (`b.cloudEvents`); Server-Sent Events with newline-injection refusal in `event:` / `id:` / `data:` / `Last-Event-ID` (CVE-2026-33128 / 29085 / 44217 class) (`b.sse`, `b.middleware.sse`)
+- **CloudEvents + SSE** — CloudEvents 1.0.2 for AWS EventBridge / Knative / Azure Event Grid / Google Eventarc / CNCF: `wrap` / `parse` envelopes, non-throwing `validate` / `isValid`, the JSON event + batch formats (`toJSON` / `fromJSON` / `toJSONBatch` / `fromJSONBatch`), and the HTTP binding in both binary and structured content modes with auto-detecting `http.decode` (`b.cloudEvents`); Server-Sent Events with newline-injection refusal in `event:` / `id:` / `data:` / `Last-Event-ID` (CVE-2026-33128 / 29085 / 44217 class) (`b.sse`, `b.middleware.sse`)
 - **Mail (outbound)** — multipart + attachments + DKIM + calendar invites; bounce intake (`b.mail`, `b.mailBounce`)
 - **Mail (outbound delivery)** — turnkey MX-lookup → MTA-STS-fetch → DANE-TLSA → REQUIRETLS handshake → SMTP wire layer → RFC 3464 DSN-on-permanent-failure → deferred-retry scheduling, all wired once (`b.mail.send.deliver`)
 - **Mail (inbound auth)** — SPF / DMARC / ARC verify + ARC chain signing for relays (`b.mail.spf`, `b.mail.dmarc`, `b.mail.arc`)

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.12.62",
-  "createdAt": "2026-05-26T02:49:26.197Z",
+  "frameworkVersion": "0.12.63",
+  "createdAt": "2026-05-26T04:30:08.809Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -6233,10 +6233,59 @@
           "type": "primitive",
           "valueType": "string"
         },
+        "fromJSON": {
+          "type": "function",
+          "arity": 2
+        },
+        "fromJSONBatch": {
+          "type": "function",
+          "arity": 2
+        },
+        "http": {
+          "type": "object",
+          "members": {
+            "decode": {
+              "type": "function",
+              "arity": 3
+            },
+            "decodeBinary": {
+              "type": "function",
+              "arity": 3
+            },
+            "encodeBatch": {
+              "type": "function",
+              "arity": 1
+            },
+            "encodeBinary": {
+              "type": "function",
+              "arity": 1
+            },
+            "encodeStructured": {
+              "type": "function",
+              "arity": 1
+            }
+          }
+        },
+        "isValid": {
+          "type": "function",
+          "arity": 1
+        },
         "parse": {
           "type": "function",
           "arity": 1
         },
+        "toJSON": {
+          "type": "function",
+          "arity": 2
+        },
+        "toJSONBatch": {
+          "type": "function",
+          "arity": 2
+        },
+        "validate": {
+          "type": "function",
+          "arity": 1
+        },
         "wrap": {
           "type": "function",
           "arity": 1
@@ -46100,6 +46149,10 @@
           "type": "instance",
           "ctorName": "RegExp"
         },
+        "BASE64_RE": {
+          "type": "instance",
+          "ctorName": "RegExp"
+        },
         "CRLF_RE": {
           "type": "instance",
           "ctorName": "RegExp"

package/lib/vendor/blamejs/lib/backup/manifest.js

@@ -95,7 +95,7 @@ var VALID_KINDS = { "raw": 1, "vault-sealed": 1, "plaintext": 1 };
 // in the manifest, so the hex string is 128 chars long.
 var SHA3_512_HEX_LENGTH = 128;
 var HEX_RE = safeBuffer.HEX_RE;
-var BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+var BASE64_RE = safeBuffer.BASE64_RE;
 
 function _isHex(s, evenLength) {
   if (typeof s !== "string" || s.length === 0) return false;

package/lib/vendor/blamejs/lib/cloud-events.js

@@ -36,11 +36,16 @@
 
 var nodeCrypto = require("node:crypto");
 var validateOpts = require("./validate-opts");
+var rfc3339 = require("./rfc3339");
+var safeJson = require("./safe-json");
+var safeBuffer = require("./safe-buffer");
+var C = require("./constants");
 var { defineClass } = require("./framework-error");
 
 var CloudEventsError = defineClass("CloudEventsError", { alwaysPermanent: true });
 
 var SPECVERSION = "1.0";
+var DEFAULT_MAX_BYTES = C.BYTES.mib(1);   // fromJSON / http.decode input cap
 
 // CloudEvents §3.1 — required string attributes.
 var REQUIRED_ATTRS = ["id", "source", "specversion", "type"];
@@ -268,9 +273,459 @@ function parse(envelope) {
   };
 }
 
+// ---- validate / isValid (non-throwing spec check) ----
+
+var INT_MIN = -2147483648;                                  // allow:raw-byte-literal — CloudEvents Integer type range
+var INT_MAX = 2147483647;                                   // allow:raw-byte-literal — CloudEvents Integer type range
+// JSON-formatted media type essence (after the parameters are stripped):
+// type/json or type/anything+json. Each run is bounded by the single "/"
+// separator so the match is linear (no overlapping quantifiers → no
+// polynomial backtracking on hostile media-type strings).
+var JSON_MEDIA_RE = /^[^/]+\/(?:[^/]+\+)?json$/i;
+// Extension name MUST be lowercase ASCII alnum (the §3.1 ≤20 length is a
+// SHOULD, so validate enforces only the MUST; wrap is stricter on emit).
+var VALIDATE_EXT_NAME_RE = /^[a-z0-9]+$/;
+
+function _isPlainObject(v) { return v !== null && typeof v === "object" && !Array.isArray(v) && !Buffer.isBuffer(v); }
+function _isNonEmptyString(v) { return typeof v === "string" && v.length > 0; }
+function _isCanonicalBase64(s) { return typeof s === "string" && s.length % 4 === 0 && safeBuffer.BASE64_RE.test(s); }
+function _isJsonMedia(ct) {
+  if (ct == null) return true;   // absent datacontenttype defaults to application/json
+  var essence = String(ct).split(";")[0].trim();   // drop media-type parameters
+  return JSON_MEDIA_RE.test(essence);   // allow:regex-no-length-cap — slash-bounded classes, linear match
+}
+
+function _extIssue(name, v) {
+  if (v === null) return null;
+  if (typeof v === "string" || typeof v === "boolean") return null;
+  if (typeof v === "number") {
+    if (!isFinite(v) || Math.floor(v) !== v) return "extension '" + name + "' must be an integer (CloudEvents has no float type)";
+    if (v < INT_MIN || v > INT_MAX) return "extension '" + name + "' integer out of 32-bit range";
+    return null;
+  }
+  return "extension '" + name + "' must be a string, integer, or boolean";
+}
+
+/**
+ * @primitive b.cloudEvents.validate
+ * @signature b.cloudEvents.validate(event)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.parse, b.cloudEvents.fromJSON
+ *
+ * Check an in-memory CloudEvents v1.0 envelope against the §3.1 spec and
+ * return an array of <code>{ attribute, message }</code> issues — an empty
+ * array means the event is conformant. Unlike <code>parse</code> (which
+ * throws and decodes), this never throws, so it suits inspecting events of
+ * unknown provenance before deciding what to do with them.
+ *
+ * @example
+ *   b.cloudEvents.validate({ specversion: "1.0", id: "1",
+ *     source: "/x", type: "com.example.t" });
+ *   // → []
+ */
+function validate(event) {
+  var issues = [];
+  function bad(attribute, message) { issues.push({ attribute: attribute, message: message }); }
+  if (!_isPlainObject(event)) { bad("", "event must be an object"); return issues; }
+
+  if (event.specversion !== SPECVERSION) bad("specversion", "specversion must be the string \"" + SPECVERSION + "\"");
+  if (!_isNonEmptyString(event.id)) bad("id", "id must be a non-empty string");
+  if (!_isNonEmptyString(event.source)) bad("source", "source must be a non-empty URI-reference string");
+  if (!_isNonEmptyString(event.type)) bad("type", "type must be a non-empty string");
+
+  if (event.datacontenttype != null && !_isNonEmptyString(event.datacontenttype)) bad("datacontenttype", "datacontenttype, if present, must be a non-empty string");
+  if (event.dataschema != null && !_isNonEmptyString(event.dataschema)) bad("dataschema", "dataschema, if present, must be a non-empty URI string");
+  if (event.subject != null && !_isNonEmptyString(event.subject)) bad("subject", "subject, if present, must be a non-empty string");
+  if (event.time != null && !rfc3339.isValidDateTime(event.time)) bad("time", "time, if present, must be an RFC 3339 date-time");
+
+  if (Object.prototype.hasOwnProperty.call(event, "data") && Object.prototype.hasOwnProperty.call(event, "data_base64")) {
+    bad("data", "data and data_base64 are mutually exclusive (CloudEvents §3.1.1)");
+  }
+  if (event.data_base64 != null && !_isCanonicalBase64(event.data_base64)) bad("data_base64", "data_base64 must be canonical RFC 4648 base64");
+
+  Object.keys(event).forEach(function (k) {
+    if (REQUIRED_ATTRS.indexOf(k) !== -1 || KNOWN_OPTIONAL_ATTRS[k]) return;
+    if (!VALIDATE_EXT_NAME_RE.test(k)) { bad(k, "attribute name must match [a-z0-9]+ (lower-case letters and digits)"); return; }   // allow:regex-no-length-cap — linear class, key bounded by maxBytes
+    var ei = _extIssue(k, event[k]);
+    if (ei) bad(k, ei);
+  });
+  return issues;
+}
+
+/**
+ * @primitive b.cloudEvents.isValid
+ * @signature b.cloudEvents.isValid(event)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.validate
+ *
+ * Boolean convenience form of <code>validate</code> — <code>true</code>
+ * when the event has zero conformance issues.
+ *
+ * @example
+ *   b.cloudEvents.isValid(evt);   // → true
+ */
+function isValid(event) { return validate(event).length === 0; }
+
+function _assertValid(event, label) {
+  var issues = validate(event);
+  if (issues.length) {
+    throw new CloudEventsError("cloud-events/invalid",
+      label + ": " + issues.map(function (i) { return i.message; }).join("; "));
+  }
+}
+
+// ---- JSON event format ----
+
+/**
+ * @primitive b.cloudEvents.toJSON
+ * @signature b.cloudEvents.toJSON(event, opts?)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.fromJSON, b.cloudEvents.toJSONBatch
+ *
+ * Serialize a CloudEvents envelope (as produced by <code>wrap</code>) to a
+ * JSON event-format string — media type
+ * <code>application/cloudevents+json</code>. The envelope is already in
+ * wire shape (JSON <code>data</code> inline, binary as a
+ * <code>data_base64</code> string), so this validates it and renders the
+ * JSON. Throws <code>CloudEventsError</code> on a non-conformant event.
+ *
+ * @opts
+ *   space:   number | string,   // JSON.stringify indentation (default: none)
+ *
+ * @example
+ *   var json = b.cloudEvents.toJSON(b.cloudEvents.wrap({ source: "/x", type: "t" }));
+ */
+function toJSON(event, opts) {
+  opts = opts || {};
+  _assertValid(event, "cloudEvents.toJSON");
+  return JSON.stringify(event, null, opts.space);
+}
+
+function _coerceInput(input, label, maxBytes) {
+  if (!Buffer.isBuffer(input) && typeof input !== "string") {
+    throw new CloudEventsError("cloud-events/bad-input", label + ": input must be a string or Buffer");
+  }
+  try {
+    return safeJson.parse(input, { maxBytes: maxBytes });
+  } catch (e) {
+    if (e && e.code === "json/too-large") throw new CloudEventsError("cloud-events/too-large", label + ": input exceeds maxBytes (" + maxBytes + ")");
+    throw new CloudEventsError("cloud-events/bad-json", label + ": body is not valid JSON");
+  }
+}
+
+/**
+ * @primitive b.cloudEvents.fromJSON
+ * @signature b.cloudEvents.fromJSON(input, opts?)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.toJSON, b.cloudEvents.parse
+ *
+ * Parse a single JSON event-format document (string or Buffer) into a
+ * validated CloudEvents envelope. Untrusted bytes route through the
+ * framework's bounded, prototype-pollution-safe JSON reader. The envelope
+ * is returned in wire shape (binary stays a <code>data_base64</code>
+ * string); call <code>parse</code> instead when you want the
+ * Buffer-decoded record. Throws <code>CloudEventsError</code> on malformed
+ * or non-conformant input.
+ *
+ * @opts
+ *   maxBytes:   number,   // default: 1 MiB — reject larger inputs
+ *
+ * @example
+ *   var evt = b.cloudEvents.fromJSON(req.rawBody);
+ */
+function fromJSON(input, opts) {
+  opts = opts || {};
+  var maxBytes = opts.maxBytes == null ? DEFAULT_MAX_BYTES : opts.maxBytes;
+  var obj = _coerceInput(input, "cloudEvents.fromJSON", maxBytes);
+  if (!_isPlainObject(obj)) throw new CloudEventsError("cloud-events/invalid", "cloudEvents.fromJSON: event must be a JSON object");
+  _assertValid(obj, "cloudEvents.fromJSON");
+  return obj;
+}
+
+/**
+ * @primitive b.cloudEvents.toJSONBatch
+ * @signature b.cloudEvents.toJSONBatch(events, opts?)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.fromJSONBatch, b.cloudEvents.toJSON
+ *
+ * Serialize an array of CloudEvents envelopes to the JSON batch format
+ * (media type <code>application/cloudevents-batch+json</code>) — a JSON
+ * array of events, each rendered as by <code>toJSON</code>. An empty array
+ * yields <code>"[]"</code>.
+ *
+ * @opts
+ *   space:   number | string,   // JSON.stringify indentation (default: none)
+ *
+ * @example
+ *   var body = b.cloudEvents.toJSONBatch([evtA, evtB]);
+ */
+function toJSONBatch(events, opts) {
+  opts = opts || {};
+  if (!Array.isArray(events)) throw new CloudEventsError("cloud-events/bad-input", "cloudEvents.toJSONBatch: events must be an array");
+  events.forEach(function (event, idx) { _assertValid(event, "cloudEvents.toJSONBatch: event[" + idx + "]"); });
+  return JSON.stringify(events, null, opts.space);
+}
+
+/**
+ * @primitive b.cloudEvents.fromJSONBatch
+ * @signature b.cloudEvents.fromJSONBatch(input, opts?)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.toJSONBatch, b.cloudEvents.fromJSON
+ *
+ * Parse a JSON batch (a JSON array of events) from a string or Buffer into
+ * an array of validated CloudEvents envelopes. Each element is validated as
+ * by <code>fromJSON</code>; an empty array is valid. A non-array body,
+ * over-size input, or any non-conformant element throws
+ * <code>CloudEventsError</code>.
+ *
+ * @opts
+ *   maxBytes:   number,   // default: 1 MiB — reject larger inputs
+ *
+ * @example
+ *   var events = b.cloudEvents.fromJSONBatch(req.rawBody);
+ */
+function fromJSONBatch(input, opts) {
+  opts = opts || {};
+  var maxBytes = opts.maxBytes == null ? DEFAULT_MAX_BYTES : opts.maxBytes;
+  var arr = _coerceInput(input, "cloudEvents.fromJSONBatch", maxBytes);
+  if (!Array.isArray(arr)) throw new CloudEventsError("cloud-events/invalid", "cloudEvents.fromJSONBatch: body must be a JSON array");
+  arr.forEach(function (obj, idx) {
+    if (!_isPlainObject(obj)) throw new CloudEventsError("cloud-events/invalid", "cloudEvents.fromJSONBatch: event[" + idx + "] must be a JSON object");
+    _assertValid(obj, "cloudEvents.fromJSONBatch: event[" + idx + "]");
+  });
+  return arr;
+}
+
+// ---- HTTP protocol binding ----
+
+var STRUCTURED_CT = "application/cloudevents+json; charset=UTF-8";
+var BATCH_CT = "application/cloudevents-batch+json; charset=UTF-8";
+
+// Percent-encode a header value: everything outside printable ASCII plus
+// the spec-named space / double-quote / percent (HTTP binding §3.1). `s` is
+// always the already-stringified value from _headerValueFor.
+function _pctEncode(s) {
+  var bytes = Buffer.from(s, "utf8");
+  var out = "";
+  for (var i = 0; i < bytes.length; i += 1) {
+    var by = bytes[i];
+    if (by < 0x21 || by > 0x7E || by === 0x22 || by === 0x25) {   // allow:raw-byte-literal — printable-ASCII bounds + double-quote and percent (HTTP binding header rule)
+      out += "%" + bytes[i].toString(16).toUpperCase().padStart(2, "0");   // allow:raw-byte-literal — 16 is the hex radix
+    } else {
+      out += String.fromCharCode(by);
+    }
+  }
+  return out;
+}
+function _pctDecode(s) {
+  var bytes = [];
+  var i = 0;
+  while (i < s.length) {
+    if (s[i] === "%" && /^[0-9A-Fa-f]{2}$/.test(s.slice(i + 1, i + 3))) {
+      bytes.push(parseInt(s.slice(i + 1, i + 3), 16));   // allow:raw-byte-literal — 16 is the hex radix
+      i += 3;
+    } else {
+      var ch = Buffer.from(s[i], "utf8");
+      for (var j = 0; j < ch.length; j += 1) bytes.push(ch[j]);
+      i += 1;
+    }
+  }
+  return Buffer.from(bytes).toString("utf8");
+}
+function _headerValueFor(v) { return typeof v === "boolean" ? (v ? "true" : "false") : String(v); }
+function _lowerHeaders(headers) {
+  var out = {};
+  Object.keys(headers || {}).forEach(function (k) {
+    var v = headers[k];
+    out[k.toLowerCase()] = Array.isArray(v) ? v.join(",") : v;
+  });
+  return out;
+}
+
+/**
+ * @primitive b.cloudEvents.http.encodeBinary
+ * @signature b.cloudEvents.http.encodeBinary(event)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.http.decode, b.cloudEvents.http.encodeStructured
+ *
+ * Render a CloudEvents envelope in HTTP <em>binary</em> content mode: each
+ * context attribute (and extension) becomes a <code>ce-</code>-prefixed
+ * header with a percent-encoded value, <code>datacontenttype</code> maps to
+ * the plain <code>Content-Type</code> header (never
+ * <code>ce-datacontenttype</code>), and the payload becomes the body.
+ * Returns <code>{ headers, body }</code> where <code>body</code> is a
+ * Buffer (for <code>data_base64</code> payloads) or a string.
+ *
+ * @example
+ *   var enc = b.cloudEvents.http.encodeBinary(evt);
+ *   // enc.headers["ce-id"], enc.headers["content-type"], enc.body
+ */
+function encodeBinary(event) {
+  _assertValid(event, "cloudEvents.http.encodeBinary");
+  var headers = {};
+  Object.keys(event).forEach(function (k) {
+    if (k === "data" || k === "data_base64" || k === "datacontenttype") return;
+    if (event[k] === undefined || event[k] === null) return;
+    headers["ce-" + k] = _pctEncode(_headerValueFor(event[k]));
+  });
+  var body;
+  if (event.data_base64 != null) {
+    body = Buffer.from(event.data_base64, "base64");
+  } else if (Object.prototype.hasOwnProperty.call(event, "data")) {
+    // JSON-media payloads (including a bare string under application/json or
+    // an absent content type, which defaults to JSON) must be JSON-encoded
+    // so the body re-parses; a non-JSON media type carries the string as-is.
+    if (_isJsonMedia(event.datacontenttype)) body = JSON.stringify(event.data);
+    else body = typeof event.data === "string" ? event.data : JSON.stringify(event.data);
+  } else body = "";
+  if (event.datacontenttype != null) headers["content-type"] = event.datacontenttype;
+  else if (_isPlainObject(event.data) || Array.isArray(event.data)) headers["content-type"] = "application/json";
+  return { headers: headers, body: body };
+}
+
+/**
+ * @primitive b.cloudEvents.http.encodeStructured
+ * @signature b.cloudEvents.http.encodeStructured(event)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.http.decode, b.cloudEvents.http.encodeBinary
+ *
+ * Render a CloudEvents envelope in HTTP <em>structured</em> content mode:
+ * the whole event is serialized via the JSON event format into the body,
+ * with <code>Content-Type: application/cloudevents+json</code>. Returns
+ * <code>{ headers, body }</code>.
+ *
+ * @example
+ *   var enc = b.cloudEvents.http.encodeStructured(evt);
+ */
+function encodeStructured(event) {
+  return { headers: { "content-type": STRUCTURED_CT }, body: toJSON(event) };
+}
+
+/**
+ * @primitive b.cloudEvents.http.encodeBatch
+ * @signature b.cloudEvents.http.encodeBatch(events)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.http.decode, b.cloudEvents.toJSONBatch
+ *
+ * Render an array of CloudEvents in HTTP <em>batched</em> content mode: the
+ * JSON batch format in the body with <code>Content-Type:
+ * application/cloudevents-batch+json</code>. Returns
+ * <code>{ headers, body }</code>.
+ *
+ * @example
+ *   var enc = b.cloudEvents.http.encodeBatch([evtA, evtB]);
+ */
+function encodeBatch(events) {
+  return { headers: { "content-type": BATCH_CT }, body: toJSONBatch(events) };
+}
+
+/**
+ * @primitive b.cloudEvents.http.decodeBinary
+ * @signature b.cloudEvents.http.decodeBinary(headers, body, opts?)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.http.decode, b.cloudEvents.http.encodeBinary
+ *
+ * Parse an HTTP binary-mode request into a CloudEvents envelope. Headers are
+ * matched case-insensitively; each <code>ce-*</code> header is
+ * percent-decoded into the matching attribute, <code>Content-Type</code>
+ * becomes <code>datacontenttype</code>, and the body becomes the payload
+ * (parsed as JSON when the content type is JSON, kept as a
+ * <code>data_base64</code> string for opaque bytes). The result is
+ * validated. Binary-mode header values are strings, so extension types
+ * other than String are not recovered.
+ *
+ * @opts
+ *   maxBytes:   number,   // default: 1 MiB — reject larger bodies
+ *
+ * @example
+ *   var evt = b.cloudEvents.http.decodeBinary(req.headers, req.rawBody);
+ */
+function decodeBinary(headers, body, opts) {
+  opts = opts || {};
+  var maxBytes = opts.maxBytes == null ? DEFAULT_MAX_BYTES : opts.maxBytes;
+  var h = _lowerHeaders(headers);
+  var event = {};
+  Object.keys(h).forEach(function (k) {
+    if (k.indexOf("ce-") !== 0) return;
+    event[k.slice(3)] = _pctDecode(String(h[k]));
+  });
+  var ct = h["content-type"] != null ? h["content-type"] : null;
+  if (ct != null) event.datacontenttype = ct;
+  var raw;
+  if (body == null) raw = Buffer.alloc(0);
+  else if (Buffer.isBuffer(body)) raw = body;
+  else if (typeof body === "string") raw = Buffer.from(body, "utf8");
+  else throw new CloudEventsError("cloud-events/bad-input", "cloudEvents.http.decodeBinary: body must be a string or Buffer");
+  if (raw.length > maxBytes) throw new CloudEventsError("cloud-events/too-large", "cloudEvents.http.decodeBinary: body exceeds maxBytes (" + maxBytes + ")");
+  if (raw.length > 0) {
+    if (_isJsonMedia(ct)) {
+      try { event.data = safeJson.parse(raw, { maxBytes: maxBytes }); }
+      catch (_e) { throw new CloudEventsError("cloud-events/bad-json", "cloudEvents.http.decodeBinary: JSON body is not valid JSON"); }
+    } else if (typeof ct === "string" && /^text\//i.test(ct)) {
+      event.data = raw.toString("utf8");
+    } else {
+      event.data_base64 = raw.toString("base64");
+    }
+  }
+  _assertValid(event, "cloudEvents.http.decodeBinary");
+  return event;
+}
+
+/**
+ * @primitive b.cloudEvents.http.decode
+ * @signature b.cloudEvents.http.decode(headers, body, opts?)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.http.decodeBinary, b.cloudEvents.http.encodeStructured
+ *
+ * Parse an HTTP request into a CloudEvents envelope (or array, for a batch),
+ * auto-detecting the content mode exactly as a conformant receiver does: a
+ * <code>Content-Type</code> beginning
+ * <code>application/cloudevents-batch</code> is batched, one beginning
+ * <code>application/cloudevents</code> is structured, and anything else is
+ * binary mode. Returns a single envelope for binary/structured modes and an
+ * array for batched mode.
+ *
+ * @opts
+ *   maxBytes:   number,   // default: 1 MiB — reject larger bodies
+ *
+ * @example
+ *   var evt = b.cloudEvents.http.decode(req.headers, req.rawBody);
+ */
+function decode(headers, body, opts) {
+  var h = _lowerHeaders(headers);
+  var ct = (h["content-type"] != null ? h["content-type"] : "") || "";
+  if (/^application\/cloudevents-batch\b/i.test(ct)) return fromJSONBatch(body, opts);
+  if (/^application\/cloudevents\b/i.test(ct)) return fromJSON(body, opts);
+  return decodeBinary(headers, body, opts);
+}
+
 module.exports = {
   wrap:             wrap,
   parse:            parse,
+  validate:         validate,
+  isValid:          isValid,
+  toJSON:           toJSON,
+  fromJSON:         fromJSON,
+  toJSONBatch:      toJSONBatch,
+  fromJSONBatch:    fromJSONBatch,
+  http: {
+    encodeBinary:     encodeBinary,
+    encodeStructured: encodeStructured,
+    encodeBatch:      encodeBatch,
+    decodeBinary:     decodeBinary,
+    decode:           decode,
+  },
   SPECVERSION:      SPECVERSION,
   REQUIRED_ATTRS:   REQUIRED_ATTRS,
   CloudEventsError: CloudEventsError,

package/lib/vendor/blamejs/lib/csp.js

@@ -67,9 +67,10 @@ var ALL_DIRECTIVES = [
   "default-src", "script-src", "script-src-elem", "script-src-attr",
   "style-src", "style-src-elem", "style-src-attr",
   "img-src", "media-src", "font-src", "connect-src", "object-src",
-  "frame-src", "child-src", "worker-src", "manifest-src", "prefetch-src",
+  "frame-src", "child-src", "worker-src", "fenced-frame-src",
+  "manifest-src", "prefetch-src",
   "form-action", "frame-ancestors", "navigate-to", "base-uri", "sandbox",
-  "report-to", "report-uri",
+  "webrtc", "report-to", "report-uri",
   "require-trusted-types-for", "trusted-types",
   "upgrade-insecure-requests", "block-all-mixed-content",
 ];

package/lib/vendor/blamejs/lib/jtd.js

@@ -29,6 +29,7 @@
  */
 
 var { defineClass } = require("./framework-error");
+var rfc3339 = require("./rfc3339");
 
 var JtdError = defineClass("JtdError", { alwaysPermanent: true });
 
@@ -48,21 +49,9 @@ var SHARED_KEYWORDS = { definitions: 1, nullable: 1, metadata: 1 };
 function _isPlainObject(v) { return v !== null && typeof v === "object" && !Array.isArray(v); }
 function _isInteger(v) { return typeof v === "number" && isFinite(v) && Math.floor(v) === v; }
 
-// RFC 3339 date-time (the JTD "timestamp" type).
-var RFC3339 = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
-function _validTimestamp(s) {
-  var m = RFC3339.exec(s);
-  if (!m) return false;
-  var mo = +m[2], d = +m[3], h = +m[4], mi = +m[5], se = +m[6];
-  if (mo < 1 || mo > 12 || d < 1 || d > 31 || h > 23 || mi > 59 || se > 60) return false;   // allow:raw-time-literal — RFC 3339 field ranges (60 = leap second)
-  var days = [31, ((+m[1] % 4 === 0 && +m[1] % 100 !== 0) || +m[1] % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];   // allow:raw-time-literal — days per month
-  if (d > days[mo - 1]) return false;
-  var tz = m[8];
-  if (tz !== "Z" && tz !== "z") {                            // numeric offset must be in range
-    if (+tz.slice(1, 3) > 23 || +tz.slice(4, 6) > 59) return false;   // allow:raw-time-literal — RFC 3339 offset hour/minute ranges
-  }
-  return true;
-}
+// RFC 3339 date-time (the JTD "timestamp" type) — strict form shared with
+// the other spec-driven consumers via lib/rfc3339.js.
+var _validTimestamp = rfc3339.isValidDateTime;
 
 // --- compile-time well-formedness (RFC 8927 section 2.2) ---
 function _checkSchema(schema, root, isRoot) {

package/lib/vendor/blamejs/lib/rfc3339.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * rfc3339 — strict RFC 3339 date-time validation, shared by the primitives
+ * whose specs require the full "internet date/time" form (a mandatory
+ * "T"/"t" separator and a mandatory "Z" or numeric UTC offset). b.jtd's
+ * `timestamp` type and b.cloudevents' `time` attribute both point at
+ * RFC 3339, so the field-range + leap-year + offset-range checks live here
+ * once instead of drifting between them.
+ *
+ * This is intentionally NOT the lenient validator b.guardTime ships: that
+ * one accepts a space separator and an absent offset by design (a content-
+ * safety guard tuned per profile), whereas these consumers must reject
+ * anything the spec disallows.
+ *
+ *   var rfc3339 = require("./rfc3339");
+ *   rfc3339.isValidDateTime("2018-04-05T17:31:00Z");   // → true
+ */
+
+// "T" separator required; offset ("Z"/"z" or ±HH:MM) required.
+var RFC3339_RE = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
+
+function isValidDateTime(s) {
+  if (typeof s !== "string") return false;
+  var m = RFC3339_RE.exec(s);
+  if (!m) return false;
+  var mo = +m[2], d = +m[3], h = +m[4], mi = +m[5], se = +m[6];
+  if (mo < 1 || mo > 12 || d < 1 || d > 31 || h > 23 || mi > 59 || se > 60) return false;   // allow:raw-time-literal — RFC 3339 field ranges (60 = leap second)
+  var days = [31, ((+m[1] % 4 === 0 && +m[1] % 100 !== 0) || +m[1] % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];   // allow:raw-time-literal — days per month (Gregorian)
+  if (d > days[mo - 1]) return false;
+  var tz = m[8];
+  if (tz !== "Z" && tz !== "z") {
+    if (+tz.slice(1, 3) > 23 || +tz.slice(4, 6) > 59) return false;   // allow:raw-time-literal — RFC 3339 offset hour/minute ranges
+  }
+  return true;
+}
+
+module.exports = { isValidDateTime: isValidDateTime, RFC3339_RE: RFC3339_RE };

package/lib/vendor/blamejs/lib/safe-buffer.js

@@ -372,6 +372,13 @@ var HEX_RE = /^[0-9a-fA-F]+$/;
 // is length-agnostic — callers cap length per protocol contract.
 var BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
 
+// BASE64_RE matches standard base64 (RFC 4648 §4) with the `+` / `/`
+// alphabet and canonical 0-2 chars of `=` padding (empty string allowed).
+// Shared by callers that validate padded base64 fields (backup manifest
+// digests, CloudEvents data_base64) so the alphabet check isn't reinvented.
+// Length-agnostic — callers cap length per their own contract / maxBytes.
+var BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+
 // Fixed-length hex predicates used by trace-context primitives (W3C
 // trace-id is 16 bytes = 32 hex chars; span-id / parent-id is 8
 // bytes = 16 hex chars). Extracted to keep callers length-bounded
@@ -552,6 +559,7 @@ module.exports = {
   stripTrailingHspace:   stripTrailingHspace,
   HEX_RE:                HEX_RE,
   BASE64URL_RE:          BASE64URL_RE,
+  BASE64_RE:             BASE64_RE,
   IPV6_HEXTET_RE:        IPV6_HEXTET_RE,
   TRACE_ID_HEX_RE:       TRACE_ID_HEX_RE,
   SPAN_ID_HEX_RE:        SPAN_ID_HEX_RE,

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.12.62",
+  "version": "0.12.63",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.12.63.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.63",
+  "date": "2026-05-25",
+  "headline": "`b.cloudEvents` gains the JSON event format, batch, and the HTTP binding",
+  "summary": "b.cloudEvents grows beyond wrap / parse into a full CloudEvents 1.0.2 surface. b.cloudEvents.validate / isValid check an envelope against the spec without throwing (the non-throwing companion to parse). toJSON / fromJSON serialize and parse the JSON event format, and toJSONBatch / fromJSONBatch handle the JSON batch format; untrusted bodies parse through the framework's bounded, prototype-pollution-safe JSON reader. The new http.* binding speaks both content modes the spec defines — binary mode spreads context attributes across percent-encoded ce-* headers with the data in the body, structured mode carries the whole event as application/cloudevents+json — plus the batch mode, and http.decode auto-detects the incoming mode from Content-Type exactly as a conformant receiver does. Verified against the spec's normative example events.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.cloudEvents` JSON event format, batch, and HTTP binding",
+          "body": "`validate` / `isValid` report spec violations without throwing (the non-throwing companion to `parse`). `toJSON` / `fromJSON` and `toJSONBatch` / `fromJSONBatch` serialize and parse the JSON event and batch formats over the existing envelope shape. `http.encodeBinary` / `http.encodeStructured` / `http.encodeBatch` render the three HTTP content modes — binary spreads attributes across percent-encoded `ce-*` headers, structured and batched carry the event(s) as `application/cloudevents+json` / `application/cloudevents-batch+json` — and `http.decode` parses a request back into an envelope (or array) by auto-detecting the mode from `Content-Type`. `b.jtd` or `b.safeSchema` still validate the event's `data` payload."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.csp.build` accepts `fenced-frame-src` and `webrtc`",
+          "body": "The CSP3 `fenced-frame-src` directive — which the default security-headers policy emits to block `<fencedframe>` embeds — was missing from the builder's recognized-directive set, so the default policy could not round-trip through `b.csp.build` (it threw `csp/unknown-directive`). Both `fenced-frame-src` and the CSP3 `webrtc` directive are now recognized."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/cloud-events.test.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * Layer 0 — b.cloudEvents (CloudEvents 1.0.2).
+ * Covers the existing wrap / parse envelope helpers plus the JSON event
+ * format (toJSON / fromJSON + batch), the non-throwing validate / isValid
+ * check, and the HTTP protocol binding (binary + structured + batch +
+ * auto-detect decode). Oracle: the normative example events from the
+ * CloudEvents JSON Event Format 1.0.2 spec and the HTTP binding's
+ * binary-mode example request.
+ */
+
+var helpers = require("../helpers");
+var check = helpers.check;
+var b = helpers.b;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+// Spec JSON-format example events (json-format.md), with data_base64
+// replaced by real canonical base64 for byte-exact round-trips.
+var EX_JSON_OBJECT = {
+  specversion: "1.0", type: "com.example.someevent", source: "/mycontext",
+  id: "C234-1234-1234", time: "2018-04-05T17:31:00Z",
+  comexampleextension1: "value", comexampleothervalue: 5,
+  datacontenttype: "application/json",
+  data: { appinfoA: "abc", appinfoB: 123, appinfoC: true },
+};
+var EX_XML_STRING = {
+  specversion: "1.0", type: "com.example.someevent", source: "/mycontext",
+  id: "B234-1234-1234", time: "2018-04-05T17:31:00Z",
+  comexampleextension1: "value", unsetextension: null,
+  datacontenttype: "application/xml", data: "<much wow=\"xml\"/>",
+};
+
+function testWrapParse() {
+  var ce = b.cloudEvents.wrap({ source: "/services/orders", type: "com.example.order.created", subject: "order/o-1234", data: { id: "o-1234" } });
+  check("wrap sets specversion 1.0", ce.specversion === "1.0");
+  check("wrap auto-fills UUID id", /^[0-9a-f-]{36}$/.test(ce.id));
+  check("wrap sets application/json for object data", ce.datacontenttype === "application/json");
+  var bin = b.cloudEvents.wrap({ source: "/x", type: "t", data: Buffer.from([1, 2, 3]) });
+  check("wrap routes Buffer to data_base64", bin.data_base64 === Buffer.from([1, 2, 3]).toString("base64"));
+  var rec = b.cloudEvents.parse(EX_JSON_OBJECT);
+  check("parse surfaces extensions separately", rec.extensions.comexampleothervalue === 5 && rec.data.appinfoA === "abc");
+  check("parse rejects missing required", code(function () { b.cloudEvents.parse({ specversion: "1.0", id: "1", source: "/x" }); }) === "cloud-events/missing-required");
+}
+
+function testValidate() {
+  check("isValid true for conformant", b.cloudEvents.isValid(EX_JSON_OBJECT));
+  check("validate flags bad specversion", b.cloudEvents.validate({ specversion: "0.3", id: "1", source: "/x", type: "t" }).some(function (i) { return i.attribute === "specversion"; }));
+  check("validate flags bad time", b.cloudEvents.validate({ specversion: "1.0", id: "1", source: "/x", type: "t", time: "not-a-time" }).some(function (i) { return i.attribute === "time"; }));
+  check("validate flags float extension", b.cloudEvents.validate({ specversion: "1.0", id: "1", source: "/x", type: "t", frac: 1.5 }).some(function (i) { return i.attribute === "frac"; }));
+  check("validate flags uppercase ext name", b.cloudEvents.validate({ specversion: "1.0", id: "1", source: "/x", type: "t", Foo: "v" }).some(function (i) { return i.attribute === "Foo"; }));
+  check("validate flags data + data_base64", b.cloudEvents.validate({ specversion: "1.0", id: "1", source: "/x", type: "t", data: 1, data_base64: "AA==" }).some(function (i) { return i.attribute === "data"; }));
+}
+
+function testJsonFormat() {
+  var rt = b.cloudEvents.fromJSON(b.cloudEvents.toJSON(EX_JSON_OBJECT));
+  check("toJSON/fromJSON round-trip JSON data", JSON.stringify(rt.data) === JSON.stringify(EX_JSON_OBJECT.data));
+  var rtx = b.cloudEvents.fromJSON(b.cloudEvents.toJSON(EX_XML_STRING));
+  check("xml-string data round-trips", rtx.data === "<much wow=\"xml\"/>" && rtx.unsetextension === null);
+  var binEvt = b.cloudEvents.wrap({ source: "/x", type: "t", data: Buffer.from([0, 1, 254, 255]) });
+  var binRt = b.cloudEvents.fromJSON(b.cloudEvents.toJSON(binEvt));
+  check("binary data_base64 round-trips", binRt.data_base64 === Buffer.from([0, 1, 254, 255]).toString("base64"));
+  check("fromJSON rejects non-canonical base64", code(function () { b.cloudEvents.fromJSON(JSON.stringify({ specversion: "1.0", id: "1", source: "/x", type: "t", data_base64: "!!!!" })); }) === "cloud-events/invalid");
+  check("fromJSON rejects malformed JSON", code(function () { b.cloudEvents.fromJSON("{nope"); }) === "cloud-events/bad-json");
+}
+
+function testBatch() {
+  var body = b.cloudEvents.toJSONBatch([EX_JSON_OBJECT, EX_XML_STRING]);
+  check("batch serializes a JSON array", Array.isArray(JSON.parse(body)) && JSON.parse(body).length === 2);
+  var evts = b.cloudEvents.fromJSONBatch(body);
+  check("batch round-trips two events", evts.length === 2 && evts[0].id === "C234-1234-1234");
+  check("empty batch valid both ways", b.cloudEvents.fromJSONBatch("[]").length === 0 && b.cloudEvents.toJSONBatch([]) === "[]");
+  check("non-array batch refused", code(function () { b.cloudEvents.fromJSONBatch("{}"); }) === "cloud-events/invalid");
+}
+
+function testHttpBinary() {
+  var enc = b.cloudEvents.http.encodeBinary(EX_JSON_OBJECT);
+  check("binary maps id to ce-id", enc.headers["ce-id"] === "C234-1234-1234");
+  check("binary maps specversion to ce-specversion", enc.headers["ce-specversion"] === "1.0");
+  check("binary does NOT prefix datacontenttype", enc.headers["content-type"] === "application/json" && enc.headers["ce-datacontenttype"] === undefined);
+  check("binary maps extension int to ce header string", enc.headers["ce-comexampleothervalue"] === "5");
+  check("binary body is JSON data", JSON.parse(enc.body).appinfoA === "abc");
+  // Spec HTTP binding binary-mode example request.
+  var dec = b.cloudEvents.http.decodeBinary({
+    "ce-specversion": "1.0", "ce-type": "com.example.someevent",
+    "ce-time": "2018-04-05T03:56:24Z", "ce-id": "1234-1234-1234",
+    "ce-source": "/mycontext/subcontext", "Content-Type": "application/json; charset=utf-8",
+  }, "{\"hello\":\"world\"}");
+  check("binary decode reads ce-id + body", dec.id === "1234-1234-1234" && dec.data.hello === "world");
+  check("binary decode maps Content-Type to datacontenttype", dec.datacontenttype === "application/json; charset=utf-8");
+  // Percent-encoding round-trip (space / quote / non-ASCII).
+  var pe = b.cloudEvents.http.encodeBinary(b.cloudEvents.wrap({ source: "/x", type: "t", subject: "a b\"cé" }));
+  check("header percent-encodes space/quote/unicode", /%20/.test(pe.headers["ce-subject"]) && /%22/.test(pe.headers["ce-subject"]) && /%C3%A9/.test(pe.headers["ce-subject"]));
+  check("percent-decode round-trips", b.cloudEvents.http.decodeBinary(pe.headers, "").subject === "a b\"cé");
+  // JSON-media string payloads must be JSON-encoded in the body so they
+  // re-parse — a bare string under application/json (or absent, which
+  // defaults to JSON) round-trips through binary mode.
+  var strEvt = b.cloudEvents.wrap({ source: "/x", type: "t", datacontenttype: "application/json", data: "hello" });
+  var strEnc = b.cloudEvents.http.encodeBinary(strEvt);
+  check("json string payload is JSON-encoded in body", strEnc.body === "\"hello\"");
+  check("json string payload round-trips through binary", b.cloudEvents.http.decodeBinary(strEnc.headers, strEnc.body).data === "hello");
+  // Opaque binary body becomes data_base64.
+  var ob = b.cloudEvents.http.decodeBinary({ "ce-specversion": "1.0", "ce-id": "1", "ce-source": "/x", "ce-type": "t", "content-type": "application/octet-stream" }, Buffer.from([9, 8, 7]));
+  check("opaque body decodes to data_base64", ob.data_base64 === Buffer.from([9, 8, 7]).toString("base64"));
+}
+
+function testHttpStructuredAndDetect() {
+  var s = b.cloudEvents.http.encodeStructured(EX_JSON_OBJECT);
+  check("structured uses cloudevents+json", /^application\/cloudevents\+json/.test(s.headers["content-type"]));
+  check("auto-detect decodes structured", b.cloudEvents.http.decode(s.headers, s.body).id === "C234-1234-1234");
+  var bn = b.cloudEvents.http.encodeBinary(EX_JSON_OBJECT);
+  check("auto-detect decodes binary", !Array.isArray(b.cloudEvents.http.decode(bn.headers, bn.body)) && b.cloudEvents.http.decode(bn.headers, bn.body).id === "C234-1234-1234");
+  var ba = b.cloudEvents.http.encodeBatch([EX_JSON_OBJECT, EX_XML_STRING]);
+  check("batch uses cloudevents-batch+json", /^application\/cloudevents-batch\+json/.test(ba.headers["content-type"]));
+  check("auto-detect decodes batch to array", Array.isArray(b.cloudEvents.http.decode(ba.headers, ba.body)) && b.cloudEvents.http.decode(ba.headers, ba.body).length === 2);
+}
+
+function run() {
+  testWrapParse();
+  testValidate();
+  testJsonFormat();
+  testBatch();
+  testHttpBinary();
+  testHttpStructuredAndDetect();
+}
+if (require.main === module) {
+  try { run(); console.log("[cloud-events] OK — " + helpers.getChecks() + " checks passed"); }
+  catch (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+}
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/csp-builder.test.js

@@ -4,6 +4,30 @@
 var helpers = require("../helpers");
 var check = helpers.check;
 var b = helpers.b;
+var DEFAULT_CSP = require("../../lib/middleware/security-headers").DEFAULT_CSP;
+
+// Every directive the framework's own DEFAULT_CSP emits must be a
+// directive b.csp.build recognizes — otherwise the default policy can't
+// round-trip through the builder (regression: fenced-frame-src shipped in
+// DEFAULT_CSP but was missing from ALL_DIRECTIVES).
+function testDefaultCspRoundTrips() {
+  var directives = {};
+  DEFAULT_CSP.split(";").forEach(function (part) {
+    var tokens = part.trim().split(/\s+/);
+    if (!tokens[0]) return;
+    directives[tokens[0]] = tokens.slice(1);
+  });
+  check("DEFAULT_CSP names fenced-frame-src", Object.prototype.hasOwnProperty.call(directives, "fenced-frame-src"));
+  var threw = null;
+  try { b.csp.build(directives, { acknowledgeUnsafe: true, allowDataImages: true, trustedTypesPolicies: ["default"] }); }
+  catch (e) { threw = e.code + ": " + e.message; }
+  check("DEFAULT_CSP round-trips through b.csp.build", threw === null);
+}
+
+function testWebrtcDirective() {
+  var policy = b.csp.build({ "default-src": ["'self'"], "webrtc": ["'block'"] });
+  check("csp.build accepts webrtc directive", policy.indexOf("webrtc 'block'") !== -1);
+}
 
 function testBuild() {
   var policy = b.csp.build({
@@ -79,6 +103,8 @@ function testCspErrorClass() {
 }
 
 function run() {
+  testDefaultCspRoundTrips();
+  testWebrtcDirective();
   testBuild();
   testRefusesUnsafeKeywords();
   testRefusesCatchAll();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.23",
+  "version": "0.1.26",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {