@blamejs/blamejs-shop 0.1.25 → 0.1.26

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.1.x
 
+- v0.1.26 (2026-05-25) — **Fix the container build gate that rejected a manifest absent from the image.** The asset-integrity drift gate added last release checked both the container and edge copies of the manifest. The container image excludes the edge worker directory from its build context, so when the gate runs inside the image build it can't see the worker copy and read it as empty — failing the build. The gate now skips a manifest that isn't present in the current build context; its drift is still caught wherever the file exists (the full-tree CI run checks both). **Fixed:** *Asset-manifest drift gate no longer fails the container build* — `generate-asset-manifest.js --check` compared both manifest copies (`lib/` for the container, `worker/` for the edge) against a fresh rebuild. The container image's build context excludes the `worker/` tree, so inside the image the worker copy is absent and the gate read it as empty — reporting false drift and failing `node test/smoke.js`, which is a build gate, so the container image never built. The check now treats a manifest that isn't present in the current context as not-applicable and skips it (requiring at least one copy to be present), so the same drift detection still runs in CI and at the edge build where both files exist, without breaking the container image build.
+
 - v0.1.25 (2026-05-25) — **Asset integrity and the cache-buster are correct in production now.** The renderers stamped a Subresource Integrity digest and a `?v=` cache-buster onto the theme stylesheet and island scripts by hashing the files at render time — which silently produced nothing in production, where the container image doesn't ship the theme files and the edge has no filesystem to read them. So the integrity attribute was absent live and edge-rendered pages pinned a `0.0.0` version that never changed between releases (a stylesheet update would render against a browser-cached copy). Both now come from a manifest built at release time and read directly by both runtimes. **Fixed:** *Subresource Integrity now applied on server-rendered pages* — The `integrity="sha384-…"` attribute on the default theme's stylesheet and island scripts was computed by reading the asset off disk during the render. That read fails in the deployed container (its image carries the code, not the `themes/` tree) and at the edge (no filesystem), so the attribute was silently dropped — the tamper-evidence it's meant to provide wasn't active. The digests are now computed once at release time into `lib/asset-manifest.json` (bundled for both the container and the edge worker) and read from there, so the browser actually verifies the served bytes against the pinned hash. · *Edge-rendered pages no longer pin a 0.0.0 cache-buster* — Pages rendered at the edge (home, product, search, the empty cart, blog) appended `?v=0.0.0` to the stylesheet URL because the worker had no release version to stamp — so the cache-buster never changed across deploys and a browser could keep serving an old stylesheet after a CSS update (markup against stale styling). The version now comes from the release manifest, so each release invalidates the cached asset as intended. The drift between the manifest and the on-disk assets is caught by a smoke gate (`generate-asset-manifest.js --check`).
 
 - v0.1.23 (2026-05-25) — **The admin console renders styled again, and both surfaces now self-host their fonts.** The admin console shipped its design system as an inline <style> block, inline style="" attributes, and a cross-origin Google Fonts link — all three of which the strict `style-src 'self'` / `font-src 'self'` CSP that governs container-served routes refuses, so the console rendered as an unstyled page in production. Its styling now lives in an external stylesheet served from /assets (like the storefront's), and the typeface is self-hosted, so the console renders as designed under the same CSP that protects it. Both the storefront and the console now serve Inter from /assets rather than naming it and hoping the visitor has it installed. **Changed:** *Inter is self-hosted on both the storefront and the console* — The default theme named Inter / Inter Tight first in its font stack but shipped no font files, so the intended typography only rendered for visitors who happened to have Inter installed locally — everyone else fell back to a system sans-serif. The latin subset of Inter (400/500/600) and Inter Tight (600/700) now ships under `themes/default/assets/fonts` and is referenced via `@font-face`, so the typeface renders for every visitor and loads same-origin under `font-src 'self'` — no cross-origin font CDN on any page. The fonts are SIL OFL 1.1 (license alongside the files); `font-display:swap` paints text immediately in the system fallback and swaps when the file arrives. · *Admin console visual refresh* — With the stylesheet external it also got a pass: a proper centered sign-in card (replacing the bare form that was the first thing an operator saw), softer surfaces and shadows on cards and panels, a sticky console nav, and consistent spacing. The brand palette (ink + the storefront's accent) and every screen's structure are unchanged — this is presentation only. **Fixed:** *Admin console renders unstyled in production* — Every `/admin` screen built its design system three ways the strict CSP refuses: an inline `<style>` block, inline `style=""` attributes, and a `<link>` to fonts.googleapis.com. Container-served routes run under `style-src 'self'` / `font-src 'self'`, which drops all three — so the console arrived as unstyled HTML (a plain page) once deployed, even though it looked correct in isolation. The styling now ships as `/assets/themes/default/css/admin.css`, an external file `'self'` allows, linked with a `sha384` Subresource Integrity digest so the browser rejects a tampered or stale object; the inline attributes are gone, folded into that stylesheet. A render-shell test asserts every admin screen links the external stylesheet, carries no inline styles, and pulls no third-party font host, so the regression can't return. Operators redeploy to pick this up — `npm run deploy` uploads the new stylesheet (and the fonts below) to R2 as part of the asset sync.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.25",
+  "version": "0.1.26",
   "assets": {
     "css/admin.css": "sha384-rvjL1QySBgNJGEUDusbbMCkL3fsjmzcwUvTp9pljo/0Nn/lErxq2AbY8EYvDF9Ch",
     "css/main.css": "sha384-qBY97FWZDGOploZRppwrDi0A/+R4R3iCFtyS1dfrAlqHNEPluPmY0R3HB9cJntyV",

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.12.62",
-      "tag": "v0.12.62",
+      "version": "0.12.63",
+      "tag": "v0.12.63",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.12.x
 
+- v0.12.63 (2026-05-25) — **`b.cloudEvents` gains the JSON event format, batch, and the HTTP binding.** b.cloudEvents grows beyond wrap / parse into a full CloudEvents 1.0.2 surface. b.cloudEvents.validate / isValid check an envelope against the spec without throwing (the non-throwing companion to parse). toJSON / fromJSON serialize and parse the JSON event format, and toJSONBatch / fromJSONBatch handle the JSON batch format; untrusted bodies parse through the framework's bounded, prototype-pollution-safe JSON reader. The new http.* binding speaks both content modes the spec defines — binary mode spreads context attributes across percent-encoded ce-* headers with the data in the body, structured mode carries the whole event as application/cloudevents+json — plus the batch mode, and http.decode auto-detects the incoming mode from Content-Type exactly as a conformant receiver does. Verified against the spec's normative example events. **Added:** *`b.cloudEvents` JSON event format, batch, and HTTP binding* — `validate` / `isValid` report spec violations without throwing (the non-throwing companion to `parse`). `toJSON` / `fromJSON` and `toJSONBatch` / `fromJSONBatch` serialize and parse the JSON event and batch formats over the existing envelope shape. `http.encodeBinary` / `http.encodeStructured` / `http.encodeBatch` render the three HTTP content modes — binary spreads attributes across percent-encoded `ce-*` headers, structured and batched carry the event(s) as `application/cloudevents+json` / `application/cloudevents-batch+json` — and `http.decode` parses a request back into an envelope (or array) by auto-detecting the mode from `Content-Type`. `b.jtd` or `b.safeSchema` still validate the event's `data` payload. **Fixed:** *`b.csp.build` accepts `fenced-frame-src` and `webrtc`* — The CSP3 `fenced-frame-src` directive — which the default security-headers policy emits to block `<fencedframe>` embeds — was missing from the builder's recognized-directive set, so the default policy could not round-trip through `b.csp.build` (it threw `csp/unknown-directive`). Both `fenced-frame-src` and the CSP3 `webrtc` directive are now recognized.
+
 - v0.12.62 (2026-05-26) — **`b.jtd` — JSON Type Definition validation (RFC 8927).** Validate JSON against a JSON Type Definition schema (RFC 8927) — a small, portable, cross-implementation schema language, the interop-friendly companion to the framework's fluent b.safeSchema builder. b.jtd.validate(schema, instance) returns an array of { instancePath, schemaPath } errors (empty = valid); b.jtd.isValid is the boolean form. All eight schema forms are supported — empty, type, enum, elements, properties (with optional / additional properties and nullable), values, discriminator (with mapping), and ref (with definitions) — including the integer-range and RFC 3339 timestamp types. A malformed schema is rejected at compile time with jtd/bad-schema rather than silently mis-validating. Verified against the official json-typedef-spec suites: all 316 validation cases and all 49 invalid-schema cases. **Added:** *`b.jtd.validate(schema, instance)` / `b.jtd.isValid(schema, instance)`* — `validate` returns the RFC 8927 error list — each `{ instancePath, schemaPath }` naming the offending value and the broken schema rule — and `isValid` is the boolean convenience form. Supports every JTD form and type: the numeric types enforce their exact ranges (int8 … uint32, float32 / float64), `timestamp` requires an RFC 3339 date-time, `properties` honours `optionalProperties` / `additionalProperties` / `nullable`, and `discriminator` selects a `mapping` schema by a tag property. The schema is checked for well-formedness before validation, so unknown keywords, multiple forms, bad refs, or a discriminator over a non-properties mapping all throw `jtd/bad-schema`. Use JTD for schemas you share across implementations or generate code from; use `b.safeSchema` for in-process fluent validation.
 
 - v0.12.61 (2026-05-26) — **`b.jsonPath` — JSONPath query (RFC 9535).** A full RFC 9535 JSONPath query evaluator, complementing the framework's JSONPath guards (which screen path strings). b.jsonPath.query(doc, path) compiles a path and returns the matched node values; b.jsonPath.paths returns their normalized locations. The complete surface is implemented: name / wildcard / index / slice selectors, descendant segments (..), filter selectors (?) with comparison and logical operators, relative (@) and absolute ($) embedded queries, and the five standard functions length / count / match / search / value — with the spec's well-typedness rules enforced at compile time so a malformed or ill-typed query is rejected rather than silently mis-evaluated. Descendant walks are node-capped to bound work on hostile input. Verified against all 703 cases of the official jsonpath-compliance-test-suite. **Added:** *`b.jsonPath.query(doc, path)` / `b.jsonPath.paths(doc, path)`* — `query` returns the array of node values selected by an RFC 9535 JSONPath; `paths` returns the normalized-path string of each match (e.g. `$['a'][1]['p']`). Supports every selector (name, wildcard `*`, index incl. negative, slice `start:end:step` incl. negative step, comma-separated selections), child and descendant (`..`) segments, and filter expressions with `==` / `!=` / `<` / `<=` / `>` / `>=`, `&&` / `||` / `!`, existence tests, and the standard functions. The well-typedness rules are checked when the path is compiled — a non-singular query used as a comparison operand, an ill-typed function argument, or a value-typed function used as a test all throw `json-path/invalid`. Pairs with `b.guardJsonPath`, which screens operator-supplied path strings before they reach the evaluator.

package/lib/vendor/blamejs/README.md

@@ -158,7 +158,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **WebSockets (server)** — channel/room fan-out across cluster replicas; RFC 6455 §5.5 control-frame size + FIN enforcement on inbound (defends 1 MiB-PING-as-PONG amplification) (`b.websocket`, `b.websocketChannels`)
 - **WebSockets (client)** — `b.wsClient` with PQC-TLS handshake, permessage-deflate negotiation with decompression-bomb cap, fatal UTF-8 validation, permanent-error classifier (skips reconnect on 4xx / accept mismatch / bad-subprotocol), exponential-backoff with full jitter
 - **Pub/sub + events** — distributed pub/sub with cluster-table / Redis PUB/SUB / custom backends (`b.pubsub`); framework-emitted signal bus for breach / integrity events (`b.events`)
-- **CloudEvents + SSE** — CloudEvents 1.0 envelope for AWS EventBridge / Knative / Azure Event Grid / Google Eventarc / CNCF (`b.cloudEvents`); Server-Sent Events with newline-injection refusal in `event:` / `id:` / `data:` / `Last-Event-ID` (CVE-2026-33128 / 29085 / 44217 class) (`b.sse`, `b.middleware.sse`)
+- **CloudEvents + SSE** — CloudEvents 1.0.2 for AWS EventBridge / Knative / Azure Event Grid / Google Eventarc / CNCF: `wrap` / `parse` envelopes, non-throwing `validate` / `isValid`, the JSON event + batch formats (`toJSON` / `fromJSON` / `toJSONBatch` / `fromJSONBatch`), and the HTTP binding in both binary and structured content modes with auto-detecting `http.decode` (`b.cloudEvents`); Server-Sent Events with newline-injection refusal in `event:` / `id:` / `data:` / `Last-Event-ID` (CVE-2026-33128 / 29085 / 44217 class) (`b.sse`, `b.middleware.sse`)
 - **Mail (outbound)** — multipart + attachments + DKIM + calendar invites; bounce intake (`b.mail`, `b.mailBounce`)
 - **Mail (outbound delivery)** — turnkey MX-lookup → MTA-STS-fetch → DANE-TLSA → REQUIRETLS handshake → SMTP wire layer → RFC 3464 DSN-on-permanent-failure → deferred-retry scheduling, all wired once (`b.mail.send.deliver`)
 - **Mail (inbound auth)** — SPF / DMARC / ARC verify + ARC chain signing for relays (`b.mail.spf`, `b.mail.dmarc`, `b.mail.arc`)

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.12.62",
-  "createdAt": "2026-05-26T02:49:26.197Z",
+  "frameworkVersion": "0.12.63",
+  "createdAt": "2026-05-26T04:30:08.809Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -6233,10 +6233,59 @@
           "type": "primitive",
           "valueType": "string"
         },
+        "fromJSON": {
+          "type": "function",
+          "arity": 2
+        },
+        "fromJSONBatch": {
+          "type": "function",
+          "arity": 2
+        },
+        "http": {
+          "type": "object",
+          "members": {
+            "decode": {
+              "type": "function",
+              "arity": 3
+            },
+            "decodeBinary": {
+              "type": "function",
+              "arity": 3
+            },
+            "encodeBatch": {
+              "type": "function",
+              "arity": 1
+            },
+            "encodeBinary": {
+              "type": "function",
+              "arity": 1
+            },
+            "encodeStructured": {
+              "type": "function",
+              "arity": 1
+            }
+          }
+        },
+        "isValid": {
+          "type": "function",
+          "arity": 1
+        },
         "parse": {
           "type": "function",
           "arity": 1
         },
+        "toJSON": {
+          "type": "function",
+          "arity": 2
+        },
+        "toJSONBatch": {
+          "type": "function",
+          "arity": 2
+        },
+        "validate": {
+          "type": "function",
+          "arity": 1
+        },
         "wrap": {
           "type": "function",
           "arity": 1
@@ -46100,6 +46149,10 @@
           "type": "instance",
           "ctorName": "RegExp"
         },
+        "BASE64_RE": {
+          "type": "instance",
+          "ctorName": "RegExp"
+        },
         "CRLF_RE": {
           "type": "instance",
           "ctorName": "RegExp"

package/lib/vendor/blamejs/lib/backup/manifest.js

@@ -95,7 +95,7 @@ var VALID_KINDS = { "raw": 1, "vault-sealed": 1, "plaintext": 1 };
 // in the manifest, so the hex string is 128 chars long.
 var SHA3_512_HEX_LENGTH = 128;
 var HEX_RE = safeBuffer.HEX_RE;
-var BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+var BASE64_RE = safeBuffer.BASE64_RE;
 
 function _isHex(s, evenLength) {
   if (typeof s !== "string" || s.length === 0) return false;

package/lib/vendor/blamejs/lib/cloud-events.js

@@ -36,11 +36,16 @@
 
 var nodeCrypto = require("node:crypto");
 var validateOpts = require("./validate-opts");
+var rfc3339 = require("./rfc3339");
+var safeJson = require("./safe-json");
+var safeBuffer = require("./safe-buffer");
+var C = require("./constants");
 var { defineClass } = require("./framework-error");
 
 var CloudEventsError = defineClass("CloudEventsError", { alwaysPermanent: true });
 
 var SPECVERSION = "1.0";
+var DEFAULT_MAX_BYTES = C.BYTES.mib(1);   // fromJSON / http.decode input cap
 
 // CloudEvents §3.1 — required string attributes.
 var REQUIRED_ATTRS = ["id", "source", "specversion", "type"];
@@ -268,9 +273,459 @@ function parse(envelope) {
   };
 }
 
+// ---- validate / isValid (non-throwing spec check) ----
+
+var INT_MIN = -2147483648;                                  // allow:raw-byte-literal — CloudEvents Integer type range
+var INT_MAX = 2147483647;                                   // allow:raw-byte-literal — CloudEvents Integer type range
+// JSON-formatted media type essence (after the parameters are stripped):
+// type/json or type/anything+json. Each run is bounded by the single "/"
+// separator so the match is linear (no overlapping quantifiers → no
+// polynomial backtracking on hostile media-type strings).
+var JSON_MEDIA_RE = /^[^/]+\/(?:[^/]+\+)?json$/i;
+// Extension name MUST be lowercase ASCII alnum (the §3.1 ≤20 length is a
+// SHOULD, so validate enforces only the MUST; wrap is stricter on emit).
+var VALIDATE_EXT_NAME_RE = /^[a-z0-9]+$/;
+
+function _isPlainObject(v) { return v !== null && typeof v === "object" && !Array.isArray(v) && !Buffer.isBuffer(v); }
+function _isNonEmptyString(v) { return typeof v === "string" && v.length > 0; }
+function _isCanonicalBase64(s) { return typeof s === "string" && s.length % 4 === 0 && safeBuffer.BASE64_RE.test(s); }
+function _isJsonMedia(ct) {
+  if (ct == null) return true;   // absent datacontenttype defaults to application/json
+  var essence = String(ct).split(";")[0].trim();   // drop media-type parameters
+  return JSON_MEDIA_RE.test(essence);   // allow:regex-no-length-cap — slash-bounded classes, linear match
+}
+
+function _extIssue(name, v) {
+  if (v === null) return null;
+  if (typeof v === "string" || typeof v === "boolean") return null;
+  if (typeof v === "number") {
+    if (!isFinite(v) || Math.floor(v) !== v) return "extension '" + name + "' must be an integer (CloudEvents has no float type)";
+    if (v < INT_MIN || v > INT_MAX) return "extension '" + name + "' integer out of 32-bit range";
+    return null;
+  }
+  return "extension '" + name + "' must be a string, integer, or boolean";
+}
+
+/**
+ * @primitive b.cloudEvents.validate
+ * @signature b.cloudEvents.validate(event)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.parse, b.cloudEvents.fromJSON
+ *
+ * Check an in-memory CloudEvents v1.0 envelope against the §3.1 spec and
+ * return an array of <code>{ attribute, message }</code> issues — an empty
+ * array means the event is conformant. Unlike <code>parse</code> (which
+ * throws and decodes), this never throws, so it suits inspecting events of
+ * unknown provenance before deciding what to do with them.
+ *
+ * @example
+ *   b.cloudEvents.validate({ specversion: "1.0", id: "1",
+ *     source: "/x", type: "com.example.t" });
+ *   // → []
+ */
+function validate(event) {
+  var issues = [];
+  function bad(attribute, message) { issues.push({ attribute: attribute, message: message }); }
+  if (!_isPlainObject(event)) { bad("", "event must be an object"); return issues; }
+
+  if (event.specversion !== SPECVERSION) bad("specversion", "specversion must be the string \"" + SPECVERSION + "\"");
+  if (!_isNonEmptyString(event.id)) bad("id", "id must be a non-empty string");
+  if (!_isNonEmptyString(event.source)) bad("source", "source must be a non-empty URI-reference string");
+  if (!_isNonEmptyString(event.type)) bad("type", "type must be a non-empty string");
+
+  if (event.datacontenttype != null && !_isNonEmptyString(event.datacontenttype)) bad("datacontenttype", "datacontenttype, if present, must be a non-empty string");
+  if (event.dataschema != null && !_isNonEmptyString(event.dataschema)) bad("dataschema", "dataschema, if present, must be a non-empty URI string");
+  if (event.subject != null && !_isNonEmptyString(event.subject)) bad("subject", "subject, if present, must be a non-empty string");
+  if (event.time != null && !rfc3339.isValidDateTime(event.time)) bad("time", "time, if present, must be an RFC 3339 date-time");
+
+  if (Object.prototype.hasOwnProperty.call(event, "data") && Object.prototype.hasOwnProperty.call(event, "data_base64")) {
+    bad("data", "data and data_base64 are mutually exclusive (CloudEvents §3.1.1)");
+  }
+  if (event.data_base64 != null && !_isCanonicalBase64(event.data_base64)) bad("data_base64", "data_base64 must be canonical RFC 4648 base64");
+
+  Object.keys(event).forEach(function (k) {
+    if (REQUIRED_ATTRS.indexOf(k) !== -1 || KNOWN_OPTIONAL_ATTRS[k]) return;
+    if (!VALIDATE_EXT_NAME_RE.test(k)) { bad(k, "attribute name must match [a-z0-9]+ (lower-case letters and digits)"); return; }   // allow:regex-no-length-cap — linear class, key bounded by maxBytes
+    var ei = _extIssue(k, event[k]);
+    if (ei) bad(k, ei);
+  });
+  return issues;
+}
+
+/**
+ * @primitive b.cloudEvents.isValid
+ * @signature b.cloudEvents.isValid(event)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.validate
+ *
+ * Boolean convenience form of <code>validate</code> — <code>true</code>
+ * when the event has zero conformance issues.
+ *
+ * @example
+ *   b.cloudEvents.isValid(evt);   // → true
+ */
+function isValid(event) { return validate(event).length === 0; }
+
+function _assertValid(event, label) {
+  var issues = validate(event);
+  if (issues.length) {
+    throw new CloudEventsError("cloud-events/invalid",
+      label + ": " + issues.map(function (i) { return i.message; }).join("; "));
+  }
+}
+
+// ---- JSON event format ----
+
+/**
+ * @primitive b.cloudEvents.toJSON
+ * @signature b.cloudEvents.toJSON(event, opts?)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.fromJSON, b.cloudEvents.toJSONBatch
+ *
+ * Serialize a CloudEvents envelope (as produced by <code>wrap</code>) to a
+ * JSON event-format string — media type
+ * <code>application/cloudevents+json</code>. The envelope is already in
+ * wire shape (JSON <code>data</code> inline, binary as a
+ * <code>data_base64</code> string), so this validates it and renders the
+ * JSON. Throws <code>CloudEventsError</code> on a non-conformant event.
+ *
+ * @opts
+ *   space:   number | string,   // JSON.stringify indentation (default: none)
+ *
+ * @example
+ *   var json = b.cloudEvents.toJSON(b.cloudEvents.wrap({ source: "/x", type: "t" }));
+ */
+function toJSON(event, opts) {
+  opts = opts || {};
+  _assertValid(event, "cloudEvents.toJSON");
+  return JSON.stringify(event, null, opts.space);
+}
+
+function _coerceInput(input, label, maxBytes) {
+  if (!Buffer.isBuffer(input) && typeof input !== "string") {
+    throw new CloudEventsError("cloud-events/bad-input", label + ": input must be a string or Buffer");
+  }
+  try {
+    return safeJson.parse(input, { maxBytes: maxBytes });
+  } catch (e) {
+    if (e && e.code === "json/too-large") throw new CloudEventsError("cloud-events/too-large", label + ": input exceeds maxBytes (" + maxBytes + ")");
+    throw new CloudEventsError("cloud-events/bad-json", label + ": body is not valid JSON");
+  }
+}
+
+/**
+ * @primitive b.cloudEvents.fromJSON
+ * @signature b.cloudEvents.fromJSON(input, opts?)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.toJSON, b.cloudEvents.parse
+ *
+ * Parse a single JSON event-format document (string or Buffer) into a
+ * validated CloudEvents envelope. Untrusted bytes route through the
+ * framework's bounded, prototype-pollution-safe JSON reader. The envelope
+ * is returned in wire shape (binary stays a <code>data_base64</code>
+ * string); call <code>parse</code> instead when you want the
+ * Buffer-decoded record. Throws <code>CloudEventsError</code> on malformed
+ * or non-conformant input.
+ *
+ * @opts
+ *   maxBytes:   number,   // default: 1 MiB — reject larger inputs
+ *
+ * @example
+ *   var evt = b.cloudEvents.fromJSON(req.rawBody);
+ */
+function fromJSON(input, opts) {
+  opts = opts || {};
+  var maxBytes = opts.maxBytes == null ? DEFAULT_MAX_BYTES : opts.maxBytes;
+  var obj = _coerceInput(input, "cloudEvents.fromJSON", maxBytes);
+  if (!_isPlainObject(obj)) throw new CloudEventsError("cloud-events/invalid", "cloudEvents.fromJSON: event must be a JSON object");
+  _assertValid(obj, "cloudEvents.fromJSON");
+  return obj;
+}
+
+/**
+ * @primitive b.cloudEvents.toJSONBatch
+ * @signature b.cloudEvents.toJSONBatch(events, opts?)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.fromJSONBatch, b.cloudEvents.toJSON
+ *
+ * Serialize an array of CloudEvents envelopes to the JSON batch format
+ * (media type <code>application/cloudevents-batch+json</code>) — a JSON
+ * array of events, each rendered as by <code>toJSON</code>. An empty array
+ * yields <code>"[]"</code>.
+ *
+ * @opts
+ *   space:   number | string,   // JSON.stringify indentation (default: none)
+ *
+ * @example
+ *   var body = b.cloudEvents.toJSONBatch([evtA, evtB]);
+ */
+function toJSONBatch(events, opts) {
+  opts = opts || {};
+  if (!Array.isArray(events)) throw new CloudEventsError("cloud-events/bad-input", "cloudEvents.toJSONBatch: events must be an array");
+  events.forEach(function (event, idx) { _assertValid(event, "cloudEvents.toJSONBatch: event[" + idx + "]"); });
+  return JSON.stringify(events, null, opts.space);
+}
+
+/**
+ * @primitive b.cloudEvents.fromJSONBatch
+ * @signature b.cloudEvents.fromJSONBatch(input, opts?)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.toJSONBatch, b.cloudEvents.fromJSON
+ *
+ * Parse a JSON batch (a JSON array of events) from a string or Buffer into
+ * an array of validated CloudEvents envelopes. Each element is validated as
+ * by <code>fromJSON</code>; an empty array is valid. A non-array body,
+ * over-size input, or any non-conformant element throws
+ * <code>CloudEventsError</code>.
+ *
+ * @opts
+ *   maxBytes:   number,   // default: 1 MiB — reject larger inputs
+ *
+ * @example
+ *   var events = b.cloudEvents.fromJSONBatch(req.rawBody);
+ */
+function fromJSONBatch(input, opts) {
+  opts = opts || {};
+  var maxBytes = opts.maxBytes == null ? DEFAULT_MAX_BYTES : opts.maxBytes;
+  var arr = _coerceInput(input, "cloudEvents.fromJSONBatch", maxBytes);
+  if (!Array.isArray(arr)) throw new CloudEventsError("cloud-events/invalid", "cloudEvents.fromJSONBatch: body must be a JSON array");
+  arr.forEach(function (obj, idx) {
+    if (!_isPlainObject(obj)) throw new CloudEventsError("cloud-events/invalid", "cloudEvents.fromJSONBatch: event[" + idx + "] must be a JSON object");
+    _assertValid(obj, "cloudEvents.fromJSONBatch: event[" + idx + "]");
+  });
+  return arr;
+}
+
+// ---- HTTP protocol binding ----
+
+var STRUCTURED_CT = "application/cloudevents+json; charset=UTF-8";
+var BATCH_CT = "application/cloudevents-batch+json; charset=UTF-8";
+
+// Percent-encode a header value: everything outside printable ASCII plus
+// the spec-named space / double-quote / percent (HTTP binding §3.1). `s` is
+// always the already-stringified value from _headerValueFor.
+function _pctEncode(s) {
+  var bytes = Buffer.from(s, "utf8");
+  var out = "";
+  for (var i = 0; i < bytes.length; i += 1) {
+    var by = bytes[i];
+    if (by < 0x21 || by > 0x7E || by === 0x22 || by === 0x25) {   // allow:raw-byte-literal — printable-ASCII bounds + double-quote and percent (HTTP binding header rule)
+      out += "%" + bytes[i].toString(16).toUpperCase().padStart(2, "0");   // allow:raw-byte-literal — 16 is the hex radix
+    } else {
+      out += String.fromCharCode(by);
+    }
+  }
+  return out;
+}
+function _pctDecode(s) {
+  var bytes = [];
+  var i = 0;
+  while (i < s.length) {
+    if (s[i] === "%" && /^[0-9A-Fa-f]{2}$/.test(s.slice(i + 1, i + 3))) {
+      bytes.push(parseInt(s.slice(i + 1, i + 3), 16));   // allow:raw-byte-literal — 16 is the hex radix
+      i += 3;
+    } else {
+      var ch = Buffer.from(s[i], "utf8");
+      for (var j = 0; j < ch.length; j += 1) bytes.push(ch[j]);
+      i += 1;
+    }
+  }
+  return Buffer.from(bytes).toString("utf8");
+}
+function _headerValueFor(v) { return typeof v === "boolean" ? (v ? "true" : "false") : String(v); }
+function _lowerHeaders(headers) {
+  var out = {};
+  Object.keys(headers || {}).forEach(function (k) {
+    var v = headers[k];
+    out[k.toLowerCase()] = Array.isArray(v) ? v.join(",") : v;
+  });
+  return out;
+}
+
+/**
+ * @primitive b.cloudEvents.http.encodeBinary
+ * @signature b.cloudEvents.http.encodeBinary(event)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.http.decode, b.cloudEvents.http.encodeStructured
+ *
+ * Render a CloudEvents envelope in HTTP <em>binary</em> content mode: each
+ * context attribute (and extension) becomes a <code>ce-</code>-prefixed
+ * header with a percent-encoded value, <code>datacontenttype</code> maps to
+ * the plain <code>Content-Type</code> header (never
+ * <code>ce-datacontenttype</code>), and the payload becomes the body.
+ * Returns <code>{ headers, body }</code> where <code>body</code> is a
+ * Buffer (for <code>data_base64</code> payloads) or a string.
+ *
+ * @example
+ *   var enc = b.cloudEvents.http.encodeBinary(evt);
+ *   // enc.headers["ce-id"], enc.headers["content-type"], enc.body
+ */
+function encodeBinary(event) {
+  _assertValid(event, "cloudEvents.http.encodeBinary");
+  var headers = {};
+  Object.keys(event).forEach(function (k) {
+    if (k === "data" || k === "data_base64" || k === "datacontenttype") return;
+    if (event[k] === undefined || event[k] === null) return;
+    headers["ce-" + k] = _pctEncode(_headerValueFor(event[k]));
+  });
+  var body;
+  if (event.data_base64 != null) {
+    body = Buffer.from(event.data_base64, "base64");
+  } else if (Object.prototype.hasOwnProperty.call(event, "data")) {
+    // JSON-media payloads (including a bare string under application/json or
+    // an absent content type, which defaults to JSON) must be JSON-encoded
+    // so the body re-parses; a non-JSON media type carries the string as-is.
+    if (_isJsonMedia(event.datacontenttype)) body = JSON.stringify(event.data);
+    else body = typeof event.data === "string" ? event.data : JSON.stringify(event.data);
+  } else body = "";
+  if (event.datacontenttype != null) headers["content-type"] = event.datacontenttype;
+  else if (_isPlainObject(event.data) || Array.isArray(event.data)) headers["content-type"] = "application/json";
+  return { headers: headers, body: body };
+}
+
+/**
+ * @primitive b.cloudEvents.http.encodeStructured
+ * @signature b.cloudEvents.http.encodeStructured(event)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.http.decode, b.cloudEvents.http.encodeBinary
+ *
+ * Render a CloudEvents envelope in HTTP <em>structured</em> content mode:
+ * the whole event is serialized via the JSON event format into the body,
+ * with <code>Content-Type: application/cloudevents+json</code>. Returns
+ * <code>{ headers, body }</code>.
+ *
+ * @example
+ *   var enc = b.cloudEvents.http.encodeStructured(evt);
+ */
+function encodeStructured(event) {
+  return { headers: { "content-type": STRUCTURED_CT }, body: toJSON(event) };
+}
+
+/**
+ * @primitive b.cloudEvents.http.encodeBatch
+ * @signature b.cloudEvents.http.encodeBatch(events)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.http.decode, b.cloudEvents.toJSONBatch
+ *
+ * Render an array of CloudEvents in HTTP <em>batched</em> content mode: the
+ * JSON batch format in the body with <code>Content-Type:
+ * application/cloudevents-batch+json</code>. Returns
+ * <code>{ headers, body }</code>.
+ *
+ * @example
+ *   var enc = b.cloudEvents.http.encodeBatch([evtA, evtB]);
+ */
+function encodeBatch(events) {
+  return { headers: { "content-type": BATCH_CT }, body: toJSONBatch(events) };
+}
+
+/**
+ * @primitive b.cloudEvents.http.decodeBinary
+ * @signature b.cloudEvents.http.decodeBinary(headers, body, opts?)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.http.decode, b.cloudEvents.http.encodeBinary
+ *
+ * Parse an HTTP binary-mode request into a CloudEvents envelope. Headers are
+ * matched case-insensitively; each <code>ce-*</code> header is
+ * percent-decoded into the matching attribute, <code>Content-Type</code>
+ * becomes <code>datacontenttype</code>, and the body becomes the payload
+ * (parsed as JSON when the content type is JSON, kept as a
+ * <code>data_base64</code> string for opaque bytes). The result is
+ * validated. Binary-mode header values are strings, so extension types
+ * other than String are not recovered.
+ *
+ * @opts
+ *   maxBytes:   number,   // default: 1 MiB — reject larger bodies
+ *
+ * @example
+ *   var evt = b.cloudEvents.http.decodeBinary(req.headers, req.rawBody);
+ */
+function decodeBinary(headers, body, opts) {
+  opts = opts || {};
+  var maxBytes = opts.maxBytes == null ? DEFAULT_MAX_BYTES : opts.maxBytes;
+  var h = _lowerHeaders(headers);
+  var event = {};
+  Object.keys(h).forEach(function (k) {
+    if (k.indexOf("ce-") !== 0) return;
+    event[k.slice(3)] = _pctDecode(String(h[k]));
+  });
+  var ct = h["content-type"] != null ? h["content-type"] : null;
+  if (ct != null) event.datacontenttype = ct;
+  var raw;
+  if (body == null) raw = Buffer.alloc(0);
+  else if (Buffer.isBuffer(body)) raw = body;
+  else if (typeof body === "string") raw = Buffer.from(body, "utf8");
+  else throw new CloudEventsError("cloud-events/bad-input", "cloudEvents.http.decodeBinary: body must be a string or Buffer");
+  if (raw.length > maxBytes) throw new CloudEventsError("cloud-events/too-large", "cloudEvents.http.decodeBinary: body exceeds maxBytes (" + maxBytes + ")");
+  if (raw.length > 0) {
+    if (_isJsonMedia(ct)) {
+      try { event.data = safeJson.parse(raw, { maxBytes: maxBytes }); }
+      catch (_e) { throw new CloudEventsError("cloud-events/bad-json", "cloudEvents.http.decodeBinary: JSON body is not valid JSON"); }
+    } else if (typeof ct === "string" && /^text\//i.test(ct)) {
+      event.data = raw.toString("utf8");
+    } else {
+      event.data_base64 = raw.toString("base64");
+    }
+  }
+  _assertValid(event, "cloudEvents.http.decodeBinary");
+  return event;
+}
+
+/**
+ * @primitive b.cloudEvents.http.decode
+ * @signature b.cloudEvents.http.decode(headers, body, opts?)
+ * @since     0.12.63
+ * @status    stable
+ * @related   b.cloudEvents.http.decodeBinary, b.cloudEvents.http.encodeStructured
+ *
+ * Parse an HTTP request into a CloudEvents envelope (or array, for a batch),
+ * auto-detecting the content mode exactly as a conformant receiver does: a
+ * <code>Content-Type</code> beginning
+ * <code>application/cloudevents-batch</code> is batched, one beginning
+ * <code>application/cloudevents</code> is structured, and anything else is
+ * binary mode. Returns a single envelope for binary/structured modes and an
+ * array for batched mode.
+ *
+ * @opts
+ *   maxBytes:   number,   // default: 1 MiB — reject larger bodies
+ *
+ * @example
+ *   var evt = b.cloudEvents.http.decode(req.headers, req.rawBody);
+ */
+function decode(headers, body, opts) {
+  var h = _lowerHeaders(headers);
+  var ct = (h["content-type"] != null ? h["content-type"] : "") || "";
+  if (/^application\/cloudevents-batch\b/i.test(ct)) return fromJSONBatch(body, opts);
+  if (/^application\/cloudevents\b/i.test(ct)) return fromJSON(body, opts);
+  return decodeBinary(headers, body, opts);
+}
+
 module.exports = {
   wrap:             wrap,
   parse:            parse,
+  validate:         validate,
+  isValid:          isValid,
+  toJSON:           toJSON,
+  fromJSON:         fromJSON,
+  toJSONBatch:      toJSONBatch,
+  fromJSONBatch:    fromJSONBatch,
+  http: {
+    encodeBinary:     encodeBinary,
+    encodeStructured: encodeStructured,
+    encodeBatch:      encodeBatch,
+    decodeBinary:     decodeBinary,
+    decode:           decode,
+  },
   SPECVERSION:      SPECVERSION,
   REQUIRED_ATTRS:   REQUIRED_ATTRS,
   CloudEventsError: CloudEventsError,

package/lib/vendor/blamejs/lib/csp.js

@@ -67,9 +67,10 @@ var ALL_DIRECTIVES = [
   "default-src", "script-src", "script-src-elem", "script-src-attr",
   "style-src", "style-src-elem", "style-src-attr",
   "img-src", "media-src", "font-src", "connect-src", "object-src",
-  "frame-src", "child-src", "worker-src", "manifest-src", "prefetch-src",
+  "frame-src", "child-src", "worker-src", "fenced-frame-src",
+  "manifest-src", "prefetch-src",
   "form-action", "frame-ancestors", "navigate-to", "base-uri", "sandbox",
-  "report-to", "report-uri",
+  "webrtc", "report-to", "report-uri",
   "require-trusted-types-for", "trusted-types",
   "upgrade-insecure-requests", "block-all-mixed-content",
 ];

package/lib/vendor/blamejs/lib/jtd.js

@@ -29,6 +29,7 @@
  */
 
 var { defineClass } = require("./framework-error");
+var rfc3339 = require("./rfc3339");
 
 var JtdError = defineClass("JtdError", { alwaysPermanent: true });
 
@@ -48,21 +49,9 @@ var SHARED_KEYWORDS = { definitions: 1, nullable: 1, metadata: 1 };
 function _isPlainObject(v) { return v !== null && typeof v === "object" && !Array.isArray(v); }
 function _isInteger(v) { return typeof v === "number" && isFinite(v) && Math.floor(v) === v; }
 
-// RFC 3339 date-time (the JTD "timestamp" type).
-var RFC3339 = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
-function _validTimestamp(s) {
-  var m = RFC3339.exec(s);
-  if (!m) return false;
-  var mo = +m[2], d = +m[3], h = +m[4], mi = +m[5], se = +m[6];
-  if (mo < 1 || mo > 12 || d < 1 || d > 31 || h > 23 || mi > 59 || se > 60) return false;   // allow:raw-time-literal — RFC 3339 field ranges (60 = leap second)
-  var days = [31, ((+m[1] % 4 === 0 && +m[1] % 100 !== 0) || +m[1] % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];   // allow:raw-time-literal — days per month
-  if (d > days[mo - 1]) return false;
-  var tz = m[8];
-  if (tz !== "Z" && tz !== "z") {                            // numeric offset must be in range
-    if (+tz.slice(1, 3) > 23 || +tz.slice(4, 6) > 59) return false;   // allow:raw-time-literal — RFC 3339 offset hour/minute ranges
-  }
-  return true;
-}
+// RFC 3339 date-time (the JTD "timestamp" type) — strict form shared with
+// the other spec-driven consumers via lib/rfc3339.js.
+var _validTimestamp = rfc3339.isValidDateTime;
 
 // --- compile-time well-formedness (RFC 8927 section 2.2) ---
 function _checkSchema(schema, root, isRoot) {

package/lib/vendor/blamejs/lib/rfc3339.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * rfc3339 — strict RFC 3339 date-time validation, shared by the primitives
+ * whose specs require the full "internet date/time" form (a mandatory
+ * "T"/"t" separator and a mandatory "Z" or numeric UTC offset). b.jtd's
+ * `timestamp` type and b.cloudevents' `time` attribute both point at
+ * RFC 3339, so the field-range + leap-year + offset-range checks live here
+ * once instead of drifting between them.
+ *
+ * This is intentionally NOT the lenient validator b.guardTime ships: that
+ * one accepts a space separator and an absent offset by design (a content-
+ * safety guard tuned per profile), whereas these consumers must reject
+ * anything the spec disallows.
+ *
+ *   var rfc3339 = require("./rfc3339");
+ *   rfc3339.isValidDateTime("2018-04-05T17:31:00Z");   // → true
+ */
+
+// "T" separator required; offset ("Z"/"z" or ±HH:MM) required.
+var RFC3339_RE = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
+
+function isValidDateTime(s) {
+  if (typeof s !== "string") return false;
+  var m = RFC3339_RE.exec(s);
+  if (!m) return false;
+  var mo = +m[2], d = +m[3], h = +m[4], mi = +m[5], se = +m[6];
+  if (mo < 1 || mo > 12 || d < 1 || d > 31 || h > 23 || mi > 59 || se > 60) return false;   // allow:raw-time-literal — RFC 3339 field ranges (60 = leap second)
+  var days = [31, ((+m[1] % 4 === 0 && +m[1] % 100 !== 0) || +m[1] % 400 === 0) ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];   // allow:raw-time-literal — days per month (Gregorian)
+  if (d > days[mo - 1]) return false;
+  var tz = m[8];
+  if (tz !== "Z" && tz !== "z") {
+    if (+tz.slice(1, 3) > 23 || +tz.slice(4, 6) > 59) return false;   // allow:raw-time-literal — RFC 3339 offset hour/minute ranges
+  }
+  return true;
+}
+
+module.exports = { isValidDateTime: isValidDateTime, RFC3339_RE: RFC3339_RE };

package/lib/vendor/blamejs/lib/safe-buffer.js

@@ -372,6 +372,13 @@ var HEX_RE = /^[0-9a-fA-F]+$/;
 // is length-agnostic — callers cap length per protocol contract.
 var BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
 
+// BASE64_RE matches standard base64 (RFC 4648 §4) with the `+` / `/`
+// alphabet and canonical 0-2 chars of `=` padding (empty string allowed).
+// Shared by callers that validate padded base64 fields (backup manifest
+// digests, CloudEvents data_base64) so the alphabet check isn't reinvented.
+// Length-agnostic — callers cap length per their own contract / maxBytes.
+var BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+
 // Fixed-length hex predicates used by trace-context primitives (W3C
 // trace-id is 16 bytes = 32 hex chars; span-id / parent-id is 8
 // bytes = 16 hex chars). Extracted to keep callers length-bounded
@@ -552,6 +559,7 @@ module.exports = {
   stripTrailingHspace:   stripTrailingHspace,
   HEX_RE:                HEX_RE,
   BASE64URL_RE:          BASE64URL_RE,
+  BASE64_RE:             BASE64_RE,
   IPV6_HEXTET_RE:        IPV6_HEXTET_RE,
   TRACE_ID_HEX_RE:       TRACE_ID_HEX_RE,
   SPAN_ID_HEX_RE:        SPAN_ID_HEX_RE,

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.12.62",
+  "version": "0.12.63",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.12.63.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.63",
+  "date": "2026-05-25",
+  "headline": "`b.cloudEvents` gains the JSON event format, batch, and the HTTP binding",
+  "summary": "b.cloudEvents grows beyond wrap / parse into a full CloudEvents 1.0.2 surface. b.cloudEvents.validate / isValid check an envelope against the spec without throwing (the non-throwing companion to parse). toJSON / fromJSON serialize and parse the JSON event format, and toJSONBatch / fromJSONBatch handle the JSON batch format; untrusted bodies parse through the framework's bounded, prototype-pollution-safe JSON reader. The new http.* binding speaks both content modes the spec defines — binary mode spreads context attributes across percent-encoded ce-* headers with the data in the body, structured mode carries the whole event as application/cloudevents+json — plus the batch mode, and http.decode auto-detects the incoming mode from Content-Type exactly as a conformant receiver does. Verified against the spec's normative example events.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.cloudEvents` JSON event format, batch, and HTTP binding",
+          "body": "`validate` / `isValid` report spec violations without throwing (the non-throwing companion to `parse`). `toJSON` / `fromJSON` and `toJSONBatch` / `fromJSONBatch` serialize and parse the JSON event and batch formats over the existing envelope shape. `http.encodeBinary` / `http.encodeStructured` / `http.encodeBatch` render the three HTTP content modes — binary spreads attributes across percent-encoded `ce-*` headers, structured and batched carry the event(s) as `application/cloudevents+json` / `application/cloudevents-batch+json` — and `http.decode` parses a request back into an envelope (or array) by auto-detecting the mode from `Content-Type`. `b.jtd` or `b.safeSchema` still validate the event's `data` payload."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.csp.build` accepts `fenced-frame-src` and `webrtc`",
+          "body": "The CSP3 `fenced-frame-src` directive — which the default security-headers policy emits to block `<fencedframe>` embeds — was missing from the builder's recognized-directive set, so the default policy could not round-trip through `b.csp.build` (it threw `csp/unknown-directive`). Both `fenced-frame-src` and the CSP3 `webrtc` directive are now recognized."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/cloud-events.test.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * Layer 0 — b.cloudEvents (CloudEvents 1.0.2).
+ * Covers the existing wrap / parse envelope helpers plus the JSON event
+ * format (toJSON / fromJSON + batch), the non-throwing validate / isValid
+ * check, and the HTTP protocol binding (binary + structured + batch +
+ * auto-detect decode). Oracle: the normative example events from the
+ * CloudEvents JSON Event Format 1.0.2 spec and the HTTP binding's
+ * binary-mode example request.
+ */
+
+var helpers = require("../helpers");
+var check = helpers.check;
+var b = helpers.b;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+// Spec JSON-format example events (json-format.md), with data_base64
+// replaced by real canonical base64 for byte-exact round-trips.
+var EX_JSON_OBJECT = {
+  specversion: "1.0", type: "com.example.someevent", source: "/mycontext",
+  id: "C234-1234-1234", time: "2018-04-05T17:31:00Z",
+  comexampleextension1: "value", comexampleothervalue: 5,
+  datacontenttype: "application/json",
+  data: { appinfoA: "abc", appinfoB: 123, appinfoC: true },
+};
+var EX_XML_STRING = {
+  specversion: "1.0", type: "com.example.someevent", source: "/mycontext",
+  id: "B234-1234-1234", time: "2018-04-05T17:31:00Z",
+  comexampleextension1: "value", unsetextension: null,
+  datacontenttype: "application/xml", data: "<much wow=\"xml\"/>",
+};
+
+function testWrapParse() {
+  var ce = b.cloudEvents.wrap({ source: "/services/orders", type: "com.example.order.created", subject: "order/o-1234", data: { id: "o-1234" } });
+  check("wrap sets specversion 1.0", ce.specversion === "1.0");
+  check("wrap auto-fills UUID id", /^[0-9a-f-]{36}$/.test(ce.id));
+  check("wrap sets application/json for object data", ce.datacontenttype === "application/json");
+  var bin = b.cloudEvents.wrap({ source: "/x", type: "t", data: Buffer.from([1, 2, 3]) });
+  check("wrap routes Buffer to data_base64", bin.data_base64 === Buffer.from([1, 2, 3]).toString("base64"));
+  var rec = b.cloudEvents.parse(EX_JSON_OBJECT);
+  check("parse surfaces extensions separately", rec.extensions.comexampleothervalue === 5 && rec.data.appinfoA === "abc");
+  check("parse rejects missing required", code(function () { b.cloudEvents.parse({ specversion: "1.0", id: "1", source: "/x" }); }) === "cloud-events/missing-required");
+}
+
+function testValidate() {
+  check("isValid true for conformant", b.cloudEvents.isValid(EX_JSON_OBJECT));
+  check("validate flags bad specversion", b.cloudEvents.validate({ specversion: "0.3", id: "1", source: "/x", type: "t" }).some(function (i) { return i.attribute === "specversion"; }));
+  check("validate flags bad time", b.cloudEvents.validate({ specversion: "1.0", id: "1", source: "/x", type: "t", time: "not-a-time" }).some(function (i) { return i.attribute === "time"; }));
+  check("validate flags float extension", b.cloudEvents.validate({ specversion: "1.0", id: "1", source: "/x", type: "t", frac: 1.5 }).some(function (i) { return i.attribute === "frac"; }));
+  check("validate flags uppercase ext name", b.cloudEvents.validate({ specversion: "1.0", id: "1", source: "/x", type: "t", Foo: "v" }).some(function (i) { return i.attribute === "Foo"; }));
+  check("validate flags data + data_base64", b.cloudEvents.validate({ specversion: "1.0", id: "1", source: "/x", type: "t", data: 1, data_base64: "AA==" }).some(function (i) { return i.attribute === "data"; }));
+}
+
+function testJsonFormat() {
+  var rt = b.cloudEvents.fromJSON(b.cloudEvents.toJSON(EX_JSON_OBJECT));
+  check("toJSON/fromJSON round-trip JSON data", JSON.stringify(rt.data) === JSON.stringify(EX_JSON_OBJECT.data));
+  var rtx = b.cloudEvents.fromJSON(b.cloudEvents.toJSON(EX_XML_STRING));
+  check("xml-string data round-trips", rtx.data === "<much wow=\"xml\"/>" && rtx.unsetextension === null);
+  var binEvt = b.cloudEvents.wrap({ source: "/x", type: "t", data: Buffer.from([0, 1, 254, 255]) });
+  var binRt = b.cloudEvents.fromJSON(b.cloudEvents.toJSON(binEvt));
+  check("binary data_base64 round-trips", binRt.data_base64 === Buffer.from([0, 1, 254, 255]).toString("base64"));
+  check("fromJSON rejects non-canonical base64", code(function () { b.cloudEvents.fromJSON(JSON.stringify({ specversion: "1.0", id: "1", source: "/x", type: "t", data_base64: "!!!!" })); }) === "cloud-events/invalid");
+  check("fromJSON rejects malformed JSON", code(function () { b.cloudEvents.fromJSON("{nope"); }) === "cloud-events/bad-json");
+}
+
+function testBatch() {
+  var body = b.cloudEvents.toJSONBatch([EX_JSON_OBJECT, EX_XML_STRING]);
+  check("batch serializes a JSON array", Array.isArray(JSON.parse(body)) && JSON.parse(body).length === 2);
+  var evts = b.cloudEvents.fromJSONBatch(body);
+  check("batch round-trips two events", evts.length === 2 && evts[0].id === "C234-1234-1234");
+  check("empty batch valid both ways", b.cloudEvents.fromJSONBatch("[]").length === 0 && b.cloudEvents.toJSONBatch([]) === "[]");
+  check("non-array batch refused", code(function () { b.cloudEvents.fromJSONBatch("{}"); }) === "cloud-events/invalid");
+}
+
+function testHttpBinary() {
+  var enc = b.cloudEvents.http.encodeBinary(EX_JSON_OBJECT);
+  check("binary maps id to ce-id", enc.headers["ce-id"] === "C234-1234-1234");
+  check("binary maps specversion to ce-specversion", enc.headers["ce-specversion"] === "1.0");
+  check("binary does NOT prefix datacontenttype", enc.headers["content-type"] === "application/json" && enc.headers["ce-datacontenttype"] === undefined);
+  check("binary maps extension int to ce header string", enc.headers["ce-comexampleothervalue"] === "5");
+  check("binary body is JSON data", JSON.parse(enc.body).appinfoA === "abc");
+  // Spec HTTP binding binary-mode example request.
+  var dec = b.cloudEvents.http.decodeBinary({
+    "ce-specversion": "1.0", "ce-type": "com.example.someevent",
+    "ce-time": "2018-04-05T03:56:24Z", "ce-id": "1234-1234-1234",
+    "ce-source": "/mycontext/subcontext", "Content-Type": "application/json; charset=utf-8",
+  }, "{\"hello\":\"world\"}");
+  check("binary decode reads ce-id + body", dec.id === "1234-1234-1234" && dec.data.hello === "world");
+  check("binary decode maps Content-Type to datacontenttype", dec.datacontenttype === "application/json; charset=utf-8");
+  // Percent-encoding round-trip (space / quote / non-ASCII).
+  var pe = b.cloudEvents.http.encodeBinary(b.cloudEvents.wrap({ source: "/x", type: "t", subject: "a b\"cé" }));
+  check("header percent-encodes space/quote/unicode", /%20/.test(pe.headers["ce-subject"]) && /%22/.test(pe.headers["ce-subject"]) && /%C3%A9/.test(pe.headers["ce-subject"]));
+  check("percent-decode round-trips", b.cloudEvents.http.decodeBinary(pe.headers, "").subject === "a b\"cé");
+  // JSON-media string payloads must be JSON-encoded in the body so they
+  // re-parse — a bare string under application/json (or absent, which
+  // defaults to JSON) round-trips through binary mode.
+  var strEvt = b.cloudEvents.wrap({ source: "/x", type: "t", datacontenttype: "application/json", data: "hello" });
+  var strEnc = b.cloudEvents.http.encodeBinary(strEvt);
+  check("json string payload is JSON-encoded in body", strEnc.body === "\"hello\"");
+  check("json string payload round-trips through binary", b.cloudEvents.http.decodeBinary(strEnc.headers, strEnc.body).data === "hello");
+  // Opaque binary body becomes data_base64.
+  var ob = b.cloudEvents.http.decodeBinary({ "ce-specversion": "1.0", "ce-id": "1", "ce-source": "/x", "ce-type": "t", "content-type": "application/octet-stream" }, Buffer.from([9, 8, 7]));
+  check("opaque body decodes to data_base64", ob.data_base64 === Buffer.from([9, 8, 7]).toString("base64"));
+}
+
+function testHttpStructuredAndDetect() {
+  var s = b.cloudEvents.http.encodeStructured(EX_JSON_OBJECT);
+  check("structured uses cloudevents+json", /^application\/cloudevents\+json/.test(s.headers["content-type"]));
+  check("auto-detect decodes structured", b.cloudEvents.http.decode(s.headers, s.body).id === "C234-1234-1234");
+  var bn = b.cloudEvents.http.encodeBinary(EX_JSON_OBJECT);
+  check("auto-detect decodes binary", !Array.isArray(b.cloudEvents.http.decode(bn.headers, bn.body)) && b.cloudEvents.http.decode(bn.headers, bn.body).id === "C234-1234-1234");
+  var ba = b.cloudEvents.http.encodeBatch([EX_JSON_OBJECT, EX_XML_STRING]);
+  check("batch uses cloudevents-batch+json", /^application\/cloudevents-batch\+json/.test(ba.headers["content-type"]));
+  check("auto-detect decodes batch to array", Array.isArray(b.cloudEvents.http.decode(ba.headers, ba.body)) && b.cloudEvents.http.decode(ba.headers, ba.body).length === 2);
+}
+
+function run() {
+  testWrapParse();
+  testValidate();
+  testJsonFormat();
+  testBatch();
+  testHttpBinary();
+  testHttpStructuredAndDetect();
+}
+if (require.main === module) {
+  try { run(); console.log("[cloud-events] OK — " + helpers.getChecks() + " checks passed"); }
+  catch (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+}
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/csp-builder.test.js

@@ -4,6 +4,30 @@
 var helpers = require("../helpers");
 var check = helpers.check;
 var b = helpers.b;
+var DEFAULT_CSP = require("../../lib/middleware/security-headers").DEFAULT_CSP;
+
+// Every directive the framework's own DEFAULT_CSP emits must be a
+// directive b.csp.build recognizes — otherwise the default policy can't
+// round-trip through the builder (regression: fenced-frame-src shipped in
+// DEFAULT_CSP but was missing from ALL_DIRECTIVES).
+function testDefaultCspRoundTrips() {
+  var directives = {};
+  DEFAULT_CSP.split(";").forEach(function (part) {
+    var tokens = part.trim().split(/\s+/);
+    if (!tokens[0]) return;
+    directives[tokens[0]] = tokens.slice(1);
+  });
+  check("DEFAULT_CSP names fenced-frame-src", Object.prototype.hasOwnProperty.call(directives, "fenced-frame-src"));
+  var threw = null;
+  try { b.csp.build(directives, { acknowledgeUnsafe: true, allowDataImages: true, trustedTypesPolicies: ["default"] }); }
+  catch (e) { threw = e.code + ": " + e.message; }
+  check("DEFAULT_CSP round-trips through b.csp.build", threw === null);
+}
+
+function testWebrtcDirective() {
+  var policy = b.csp.build({ "default-src": ["'self'"], "webrtc": ["'block'"] });
+  check("csp.build accepts webrtc directive", policy.indexOf("webrtc 'block'") !== -1);
+}
 
 function testBuild() {
   var policy = b.csp.build({
@@ -79,6 +103,8 @@ function testCspErrorClass() {
 }
 
 function run() {
+  testDefaultCspRoundTrips();
+  testWebrtcDirective();
   testBuild();
   testRefusesUnsafeKeywords();
   testRefusesCatchAll();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {