@blamejs/blamejs-shop 0.1.25 → 0.1.27

package/lib/storefront.js

@@ -1413,6 +1413,186 @@ function renderReturns(opts) {
   });
 }
 
+// Loyalty transaction-type pill — reuses the `pdp__badge` class the
+// theme already styles. The type is one of the ledger's closed enum
+// (earn / redeem / expire / adjust / tier-bonus).
+function _loyaltyTxBadge(type) {
+  var esc = b.template.escapeHtml;
+  return "<span class=\"pdp__badge loyalty-tx--" + esc(String(type)) + "\">" + esc(String(type)) + "</span>";
+}
+
+// Human label for a reward `kind` + its value payload. Keeps the
+// catalog row readable without leaking the raw value_json shape.
+function _loyaltyRewardValue(reward) {
+  var v = reward.value_json || {};
+  if (reward.kind === "discount_percent") return (Number(v.percent) || 0) + "% off";
+  if (reward.kind === "discount_amount")  return pricing.format(Number(v.amount_minor) || 0, "USD") + " off";
+  if (reward.kind === "free_shipping")    return "Free shipping";
+  if (reward.kind === "free_product")     return "Free product";
+  return reward.kind;
+}
+
+// Earn-rule trigger → customer-facing phrase. Operators see slugs;
+// customers see plain language. Unknown triggers fall back to the raw
+// trigger so a future enum addition still renders something.
+var LOYALTY_TRIGGER_LABELS = {
+  per_dollar_spent:         "per $1 spent",
+  per_purchase:             "per order",
+  per_review:               "per review you write",
+  per_referral_redeemed:    "per friend you refer",
+  birthday:                 "on your birthday",
+  signup_bonus:             "when you sign up",
+  first_purchase:           "on your first order",
+  abandoned_cart_recovered: "when you complete a saved cart",
+};
+
+// The signed-in customer's loyalty surface: balance + tier, how points
+// are earned (active earn rules), the reward catalog (redeem control
+// when wired), the earn/redeem ledger (paginated), and past
+// redemptions. Reuses the account/returns layout classes — no new CSS.
+function renderLoyalty(opts) {
+  opts = opts || {};
+  var esc = b.template.escapeHtml;
+  var bal = opts.balance || { balance: 0, lifetime: 0, tier: "bronze" };
+  var ratio = Number(opts.redemption_points_per_usd) || 100;
+
+  var notice = opts.notice
+    ? "<p class=\"form-notice" + (opts.notice_kind === "error" ? " form-notice--error" : "") + "\" role=\"alert\">" +
+        esc(String(opts.notice)) + "</p>"
+    : "";
+
+  // Stats strip — balance / tier / lifetime / spendable value.
+  var spendableValue = pricing.format(Math.floor((Number(bal.balance) || 0) * 100 / ratio), "USD");
+  var stats =
+    "<dl class=\"account-dash__stats\">" +
+      "<div><dt>Points balance</dt><dd>" + esc(String(Number(bal.balance) || 0)) + "</dd></div>" +
+      "<div><dt>Tier</dt><dd>" + esc(String(bal.tier || "bronze")) + "</dd></div>" +
+      "<div><dt>Lifetime points</dt><dd>" + esc(String(Number(bal.lifetime) || 0)) + "</dd></div>" +
+      "<div><dt>Worth</dt><dd>" + esc(spendableValue) + "</dd></div>" +
+    "</dl>";
+
+  // How points are earned.
+  var rules = opts.earn_rules || [];
+  var earnInner = "";
+  for (var i = 0; i < rules.length; i += 1) {
+    var rule = rules[i];
+    var label = LOYALTY_TRIGGER_LABELS[rule.trigger] || rule.trigger;
+    earnInner +=
+      "<li class=\"return-card\"><div class=\"return-card__head\">" +
+        "<span>" + esc(String(rule.points_per_unit)) + " points " + esc(label) + "</span>" +
+      "</div></li>";
+  }
+  var earnSection = earnInner
+    ? "<h2 class=\"pdp__variants-title\">How you earn points</h2><ul class=\"return-list\">" + earnInner + "</ul>"
+    : "<h2 class=\"pdp__variants-title\">How you earn points</h2>" +
+      "<p class=\"return-empty\">Earn points on every order — your balance grows as you shop.</p>";
+
+  // Reward catalog + redeem control.
+  var rewards = opts.rewards || [];
+  var rewardSection = "";
+  if (rewards.length) {
+    var rewardItems = "";
+    for (var r = 0; r < rewards.length; r += 1) {
+      var rw = rewards[r];
+      var affordable = (Number(bal.balance) || 0) >= Number(rw.point_cost);
+      var action;
+      if (opts.can_redeem) {
+        action = "<form method=\"post\" action=\"/account/loyalty/redeem\">" +
+          "<input type=\"hidden\" name=\"reward_slug\" value=\"" + esc(rw.slug) + "\">" +
+          "<button type=\"submit\" class=\"btn-primary\"" + (affordable ? "" : " disabled") + ">" +
+          (affordable ? "Redeem" : "Not enough points") + "</button></form>";
+      } else {
+        action = "";
+      }
+      rewardItems +=
+        "<li class=\"return-card\"><div class=\"return-card__head\">" +
+          "<span class=\"return-card__rma\">" + esc(rw.title) + "</span>" +
+          "<span class=\"pdp__badge\">" + esc(_loyaltyRewardValue(rw)) + "</span>" +
+        "</div>" +
+        "<p class=\"return-card__meta\">" + esc(String(rw.point_cost)) + " points</p>" +
+        action +
+        "</li>";
+    }
+    rewardSection =
+      "<h2 class=\"pdp__variants-title\">Redeem your points</h2>" +
+      "<ul class=\"return-list\">" + rewardItems + "</ul>";
+  }
+
+  // Past redemptions.
+  var reds = opts.redemptions || [];
+  var redSection = "";
+  if (reds.length) {
+    var redItems = "";
+    for (var d = 0; d < reds.length; d += 1) {
+      var red = reds[d];
+      var rdate = red.redeemed_at ? new Date(Number(red.redeemed_at)).toISOString().slice(0, 10) : "";
+      redItems +=
+        "<li class=\"return-card\"><div class=\"return-card__head\">" +
+          "<span class=\"return-card__rma\">" + esc(red.reward_slug) + "</span>" +
+          "<span class=\"pdp__badge loyalty-tx--" + esc(String(red.status)) + "\">" + esc(String(red.status)) + "</span>" +
+        "</div>" +
+        "<p class=\"return-card__meta\">" + esc(String(red.points_debited)) + " points" +
+          (rdate ? " &middot; <time datetime=\"" + esc(rdate) + "\">" + esc(rdate) + "</time>" : "") +
+          (red.coupon_code ? " &middot; code <code>" + esc(red.coupon_code) + "</code>" : "") +
+        "</p></li>";
+    }
+    redSection = "<h2 class=\"pdp__variants-title\">Your redemptions</h2><ul class=\"return-list\">" + redItems + "</ul>";
+  }
+
+  // Earn/redeem ledger (paginated).
+  var hist = opts.history || [];
+  var histInner = "";
+  for (var h = 0; h < hist.length; h += 1) {
+    var tx = hist[h];
+    var tdate = tx.occurred_at ? new Date(Number(tx.occurred_at)).toISOString().slice(0, 10) : "";
+    var pts = Number(tx.points) || 0;
+    var ptsStr = (pts > 0 ? "+" : "") + pts;
+    histInner +=
+      "<li class=\"return-card\"><div class=\"return-card__head\">" +
+        _loyaltyTxBadge(tx.transaction_type) +
+        "<span class=\"return-card__rma\">" + esc(ptsStr) + " points</span>" +
+      "</div>" +
+      "<p class=\"return-card__meta\">" + esc(String(tx.source || "")) +
+        (tdate ? " &middot; <time datetime=\"" + esc(tdate) + "\">" + esc(tdate) + "</time>" : "") +
+        (tx.notes ? " &middot; " + esc(String(tx.notes)) : "") +
+      "</p></li>";
+  }
+  var historySection;
+  if (histInner) {
+    var more = opts.history_next_cursor != null
+      ? "<p class=\"loyalty-more\"><a class=\"btn-secondary\" href=\"/account/loyalty?cursor=" +
+          esc(String(opts.history_next_cursor)) + "\">Older activity</a></p>"
+      : "";
+    historySection = "<h2 class=\"pdp__variants-title\">Activity</h2><ul class=\"return-list\">" + histInner + "</ul>" + more;
+  } else {
+    historySection = "<h2 class=\"pdp__variants-title\">Activity</h2>" +
+      "<p class=\"return-empty\">No points activity yet. Place an order to start earning.</p>";
+  }
+
+  var body =
+    "<section class=\"account-returns\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li aria-current=\"page\">Rewards</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-returns__title\">Rewards</h1>" +
+      notice +
+      stats +
+      rewardSection +
+      earnSection +
+      redSection +
+      historySection +
+    "</section>";
+
+  return _wrap({
+    title:      "Rewards",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Subscription status pill — mirrors `_returnStatusBadge`. The status
 // string is one of Stripe's enum values (active, trialing, past_due,
 // canceled, …), surfaced as a CSS-classed badge the theme can style.
@@ -1748,6 +1928,28 @@ var CHECKOUT_PAGE =
   "  </form>\n" +
   "</section>\n";
 
+// Redeem-points-at-checkout field — appended to the checkout form for a
+// signed-in customer with a spendable balance. The customer types how
+// many points to spend; the server caps the credit at the order total
+// and at the balance (the `loyalty_redeem_points` field rides the same
+// POST as the gift-card code). The max attribute is advisory client-
+// side polish; the backend is authoritative.
+function _loyaltyCheckoutField(bal, perUsd) {
+  var esc = b.template.escapeHtml;
+  var points = Number(bal.balance) || 0;
+  var ratio = Number(perUsd) || 100;
+  // Minor-unit value of the full balance (points / ratio dollars), for
+  // the helper line. Floored to a whole point's worth.
+  var worth = pricing.format(Math.floor((points * 100) / ratio), "USD");
+  return "<div class=\"form-row\"><label class=\"form-field\">" +
+    "<span class=\"form-field__label\">Redeem loyalty points <span class=\"small\">(optional)</span></span>" +
+    "<input type=\"number\" name=\"loyalty_redeem_points\" min=\"0\" step=\"1\" max=\"" + points + "\" " +
+    "inputmode=\"numeric\" autocomplete=\"off\" placeholder=\"0\">" +
+    "<span class=\"form-field__req\">You have " + esc(String(points)) + " points (worth " + esc(worth) +
+    ") &middot; " + esc(String(ratio)) + " points = $1</span>" +
+    "</label></div>";
+}
+
 function renderCheckoutForm(opts) {
   if (!opts) throw new TypeError("storefront.renderCheckoutForm: opts required");
   var lines  = opts.lines  || [];
@@ -1764,6 +1966,19 @@ function renderCheckoutForm(opts) {
     });
   }
   var body = _render(CHECKOUT_PAGE, { subtotal: subtotal });
+  // Signed-in customer with a spendable points balance — surface a
+  // redeem-at-checkout field. The block is appended as raw HTML (the
+  // balance + value are numbers we control, the conversion ratio is the
+  // ledger's own constant) so it slots into the existing form via a
+  // small client island that copies the field into the POST. Rendered
+  // only when there's a balance to spend; absent that the checkout is
+  // unchanged for guests + zero-balance customers.
+  if (opts.loyalty_balance && opts.loyalty_balance.balance > 0) {
+    body = body.replace(
+      "</form>",
+      _loyaltyCheckoutField(opts.loyalty_balance, opts.loyalty_points_per_usd) + "</form>",
+    );
+  }
   // When PayPal is configured, append its button below the card form. The
   // block is built as raw HTML (appended after the strict render) so the SDK
   // script + handlers survive; the client-id is the only interpolation and is
@@ -2569,6 +2784,7 @@ var ACCOUNT_DASH_PAGE =
   "      <a class=\"btn-secondary\" href=\"/account/recently-viewed\">Recently viewed</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/addresses\">Addresses</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/returns\">Returns</a>\n" +
+  "      <a class=\"btn-secondary\" href=\"/account/loyalty\">Rewards</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/subscriptions\">Subscriptions</a>\n" +
   "      <form method=\"post\" action=\"/account/logout\"><button type=\"submit\" class=\"btn-ghost\">Sign out</button></form>\n" +
   "    </div>\n" +
@@ -2694,6 +2910,20 @@ function mount(router, deps) {
     res.end ? res.end(html) : res.send(html);
   }
 
+  // Defensive request-shape reader for the optional loyalty-points
+  // redeem field on the checkout form. Returns undefined for missing /
+  // empty / zero / non-numeric input (checkout treats undefined as "no
+  // redemption"); a positive integer otherwise. The backend's
+  // _resolveLoyaltyCredit is authoritative on balance + cap — this only
+  // shapes the wire value so a blank field doesn't become a "0 points"
+  // validation error.
+  function _parseRedeemPoints(raw) {
+    if (raw == null || raw === "") return undefined;
+    var n = parseInt(String(raw), 10);
+    if (!Number.isFinite(n) || n <= 0) return undefined;
+    return n;
+  }
+
   // Cart-count read shared across every handler that wraps a page in
   // the layout — the header's cart pill renders the count. Returns 0
   // for visitors with no session cookie. Defined at the top of mount
@@ -3021,7 +3251,23 @@ function mount(router, deps) {
         return res.end ? res.end() : res.send("");
       }
       var totals = pricing.totals(c, lines, {});
-      _send(res, 200, renderCheckoutForm({ lines: lines, totals: totals, shop_name: shopName, theme: theme, paypal_client_id: deps.paypal ? deps.paypal_client_id : null }));
+      // Loyalty balance — only for a signed-in customer with loyalty
+      // wired. A read failure (table not migrated) degrades to no
+      // redeem field rather than 500-ing checkout.
+      var loyaltyBalance = null;
+      if (deps.loyalty) {
+        var loyAuth = _currentCustomerEnv(req);
+        if (loyAuth) {
+          try { loyaltyBalance = await deps.loyalty.balance(loyAuth.customer_id); }
+          catch (_e) { loyaltyBalance = null; }
+        }
+      }
+      _send(res, 200, renderCheckoutForm({
+        lines: lines, totals: totals, shop_name: shopName, theme: theme,
+        paypal_client_id: deps.paypal ? deps.paypal_client_id : null,
+        loyalty_balance: loyaltyBalance,
+        loyalty_points_per_usd: deps.loyalty ? deps.loyalty.REDEMPTION_POINTS_PER_USD : null,
+      }));
     });
 
     router.post("/checkout", async function (req, res) {
@@ -3063,6 +3309,7 @@ function mount(router, deps) {
           selected_shipping_id: defaultShipId || "std",
           customer:             { email: body.email, name: body.name },
           gift_card_code:       body.gift_card_code || undefined,
+          loyalty_redeem_points: _parseRedeemPoints(body.loyalty_redeem_points),
           idempotency_key:      "checkout:" + c.id + ":" + b.uuid.v7(),
         });
         // When a gift card fully covered the order there's no Stripe
@@ -3083,11 +3330,13 @@ function mount(router, deps) {
         res.setHeader && res.setHeader("location", "/pay/" + result.order.id);
         return res.end ? res.end() : res.send("");
       } catch (e) {
-        // A bad customer input (malformed shape OR a gift-card code the
-        // customer typed that can't be applied) is a 400, not a 500 —
-        // the gift-card errors carry a GIFTCARD_* code so a fat-fingered
-        // code re-prompts rather than 500-ing the checkout.
-        var clientErr = (e instanceof TypeError) || (e && typeof e.code === "string" && e.code.indexOf("GIFTCARD_") === 0);
+        // A bad customer input (malformed shape, a gift-card code, or a
+        // loyalty-points request the customer entered that can't be
+        // applied) is a 400, not a 500 — the gift-card errors carry a
+        // GIFTCARD_* code and the loyalty errors a LOYALTY_* code so a
+        // fat-fingered value re-prompts rather than 500-ing checkout.
+        var code = (e && typeof e.code === "string") ? e.code : "";
+        var clientErr = (e instanceof TypeError) || code.indexOf("GIFTCARD_") === 0 || code.indexOf("LOYALTY_") === 0;
         res.status(clientErr ? 400 : 500);
         var msg = (e && e.message) || "checkout failed";
         return res.end ? res.end(msg) : res.send(msg);
@@ -4414,6 +4663,124 @@ function mount(router, deps) {
       });
     }
 
+    // Loyalty — the signed-in customer's points balance + tier, the
+    // earn/redeem ledger, how points are earned, and (when a reward
+    // catalog + redemption primitive are wired) a redeem-a-reward
+    // control. Login-gated; a read failure on any optional sub-read
+    // degrades that section to empty rather than 500-ing the page.
+    if (deps.loyalty) {
+      function _loyaltyAuth(req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") { _serviceUnavailable(res, "auth not configured"); return null; }
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          res.end ? res.end() : res.send("");
+          return null;
+        }
+        return auth;
+      }
+
+      // Build the full /account/loyalty render context for a customer.
+      // `opts2.cursor` is the optional history-page cursor (epoch-ms).
+      // Each optional read (earn rules, reward catalog, redemptions) is
+      // best-effort so a not-migrated table degrades that panel rather
+      // than the page.
+      async function _loyaltyView(req, auth, opts2) {
+        opts2 = opts2 || {};
+        var bal = await deps.loyalty.balance(auth.customer_id);
+        var hist = await deps.loyalty.history(auth.customer_id, { limit: 20, cursor: opts2.cursor });
+        var rules = [];
+        if (deps.loyaltyEarnRules) {
+          try { rules = await deps.loyaltyEarnRules.listRules({ active_only: true, limit: 50 }); }
+          catch (_e) { rules = []; }
+        }
+        var rewards = [];
+        var redemptions = [];
+        if (deps.loyaltyRedemption) {
+          try { rewards = await deps.loyaltyRedemption.listRewards({ active_only: true, limit: 50 }); }
+          catch (_e) { rewards = []; }
+          try {
+            var rpage = await deps.loyaltyRedemption.redemptionsForCustomer(auth.customer_id, { limit: 20 });
+            redemptions = rpage.rows;
+          } catch (_e) { redemptions = []; }
+        }
+        var cartCount = await _cartCountForReq(req);
+        return {
+          balance:        bal,
+          tiers:          deps.loyalty.TIERS,
+          tier_thresholds: deps.loyalty.TIER_THRESHOLDS,
+          redemption_points_per_usd: deps.loyalty.REDEMPTION_POINTS_PER_USD,
+          history:        hist.rows,
+          history_next_cursor: hist.next_cursor,
+          earn_rules:     rules,
+          rewards:        rewards,
+          redemptions:    redemptions,
+          can_redeem:     !!deps.loyaltyRedemption,
+          notice:         opts2.notice || null,
+          notice_kind:    opts2.notice_kind || null,
+          shop_name:      shopName,
+          cart_count:     cartCount,
+        };
+      }
+
+      router.get("/account/loyalty", async function (req, res) {
+        var auth = _loyaltyAuth(req, res); if (!auth) return;
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var cursorRaw = url && url.searchParams.get("cursor");
+        var cursor;
+        if (cursorRaw != null && cursorRaw !== "") {
+          var n = parseInt(cursorRaw, 10);
+          // A malformed cursor degrades to the first page (the lib
+          // would TypeError on a non-integer) — never 500 the page.
+          cursor = Number.isFinite(n) && n >= 0 ? n : undefined;
+        }
+        var view = await _loyaltyView(req, auth, { cursor: cursor });
+        _send(res, 200, renderLoyalty(view));
+      });
+
+      // Redeem a reward from the catalog. Mounts only when the
+      // redemption primitive is wired. The reward debits points via the
+      // composed loyalty ledger; insufficient balance / cap reached /
+      // not-redeemable surface as a 400 re-render, never a 500.
+      if (deps.loyaltyRedemption) {
+        router.post("/account/loyalty/redeem", async function (req, res) {
+          var auth = _loyaltyAuth(req, res); if (!auth) return;
+          var body = req.body || {};
+          var rewardSlug = body.reward_slug;
+          try {
+            await deps.loyaltyRedemption.redeemForCustomer({
+              customer_id: auth.customer_id,
+              reward_slug: rewardSlug,
+            });
+          } catch (e) {
+            // Customer-facing refusals (TypeError on a bad slug,
+            // LOYALTY_INSUFFICIENT_BALANCE, REWARD_NOT_REDEEMABLE,
+            // REDEMPTION_CAP_REACHED) re-render the page with the
+            // reason; anything else propagates as a 500.
+            var code = (e && typeof e.code === "string") ? e.code : "";
+            var clientErr = (e instanceof TypeError)
+              || code === "LOYALTY_INSUFFICIENT_BALANCE"
+              || code === "REWARD_NOT_REDEEMABLE"
+              || code === "REDEMPTION_CAP_REACHED";
+            if (!clientErr) throw e;
+            var msg;
+            if (code === "LOYALTY_INSUFFICIENT_BALANCE") msg = "You don't have enough points for that reward yet.";
+            else if (code === "REWARD_NOT_REDEEMABLE")   msg = "That reward isn't available right now.";
+            else if (code === "REDEMPTION_CAP_REACHED")  msg = "You've reached the redemption limit for that reward.";
+            else                                          msg = "We couldn't redeem that reward — please pick one from the list.";
+            var failView = await _loyaltyView(req, auth, { notice: msg, notice_kind: "error" });
+            return _send(res, 400, renderLoyalty(failView));
+          }
+          res.status(303); res.setHeader && res.setHeader("location", "/account/loyalty");
+          return res.end ? res.end() : res.send("");
+        });
+      }
+    }
+
     // Recently viewed — the signed-in customer's newest-first browse
     // history. Views are recorded server-side on the (container-rendered)
     // PDP; this surface lets the customer review + clear that history.

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.12.62",
-      "tag": "v0.12.62",
+      "version": "0.12.63",
+      "tag": "v0.12.63",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.12.x
 
+- v0.12.63 (2026-05-25) — **`b.cloudEvents` gains the JSON event format, batch, and the HTTP binding.** b.cloudEvents grows beyond wrap / parse into a full CloudEvents 1.0.2 surface. b.cloudEvents.validate / isValid check an envelope against the spec without throwing (the non-throwing companion to parse). toJSON / fromJSON serialize and parse the JSON event format, and toJSONBatch / fromJSONBatch handle the JSON batch format; untrusted bodies parse through the framework's bounded, prototype-pollution-safe JSON reader. The new http.* binding speaks both content modes the spec defines — binary mode spreads context attributes across percent-encoded ce-* headers with the data in the body, structured mode carries the whole event as application/cloudevents+json — plus the batch mode, and http.decode auto-detects the incoming mode from Content-Type exactly as a conformant receiver does. Verified against the spec's normative example events. **Added:** *`b.cloudEvents` JSON event format, batch, and HTTP binding* — `validate` / `isValid` report spec violations without throwing (the non-throwing companion to `parse`). `toJSON` / `fromJSON` and `toJSONBatch` / `fromJSONBatch` serialize and parse the JSON event and batch formats over the existing envelope shape. `http.encodeBinary` / `http.encodeStructured` / `http.encodeBatch` render the three HTTP content modes — binary spreads attributes across percent-encoded `ce-*` headers, structured and batched carry the event(s) as `application/cloudevents+json` / `application/cloudevents-batch+json` — and `http.decode` parses a request back into an envelope (or array) by auto-detecting the mode from `Content-Type`. `b.jtd` or `b.safeSchema` still validate the event's `data` payload. **Fixed:** *`b.csp.build` accepts `fenced-frame-src` and `webrtc`* — The CSP3 `fenced-frame-src` directive — which the default security-headers policy emits to block `<fencedframe>` embeds — was missing from the builder's recognized-directive set, so the default policy could not round-trip through `b.csp.build` (it threw `csp/unknown-directive`). Both `fenced-frame-src` and the CSP3 `webrtc` directive are now recognized.
+
 - v0.12.62 (2026-05-26) — **`b.jtd` — JSON Type Definition validation (RFC 8927).** Validate JSON against a JSON Type Definition schema (RFC 8927) — a small, portable, cross-implementation schema language, the interop-friendly companion to the framework's fluent b.safeSchema builder. b.jtd.validate(schema, instance) returns an array of { instancePath, schemaPath } errors (empty = valid); b.jtd.isValid is the boolean form. All eight schema forms are supported — empty, type, enum, elements, properties (with optional / additional properties and nullable), values, discriminator (with mapping), and ref (with definitions) — including the integer-range and RFC 3339 timestamp types. A malformed schema is rejected at compile time with jtd/bad-schema rather than silently mis-validating. Verified against the official json-typedef-spec suites: all 316 validation cases and all 49 invalid-schema cases. **Added:** *`b.jtd.validate(schema, instance)` / `b.jtd.isValid(schema, instance)`* — `validate` returns the RFC 8927 error list — each `{ instancePath, schemaPath }` naming the offending value and the broken schema rule — and `isValid` is the boolean convenience form. Supports every JTD form and type: the numeric types enforce their exact ranges (int8 … uint32, float32 / float64), `timestamp` requires an RFC 3339 date-time, `properties` honours `optionalProperties` / `additionalProperties` / `nullable`, and `discriminator` selects a `mapping` schema by a tag property. The schema is checked for well-formedness before validation, so unknown keywords, multiple forms, bad refs, or a discriminator over a non-properties mapping all throw `jtd/bad-schema`. Use JTD for schemas you share across implementations or generate code from; use `b.safeSchema` for in-process fluent validation.
 
 - v0.12.61 (2026-05-26) — **`b.jsonPath` — JSONPath query (RFC 9535).** A full RFC 9535 JSONPath query evaluator, complementing the framework's JSONPath guards (which screen path strings). b.jsonPath.query(doc, path) compiles a path and returns the matched node values; b.jsonPath.paths returns their normalized locations. The complete surface is implemented: name / wildcard / index / slice selectors, descendant segments (..), filter selectors (?) with comparison and logical operators, relative (@) and absolute ($) embedded queries, and the five standard functions length / count / match / search / value — with the spec's well-typedness rules enforced at compile time so a malformed or ill-typed query is rejected rather than silently mis-evaluated. Descendant walks are node-capped to bound work on hostile input. Verified against all 703 cases of the official jsonpath-compliance-test-suite. **Added:** *`b.jsonPath.query(doc, path)` / `b.jsonPath.paths(doc, path)`* — `query` returns the array of node values selected by an RFC 9535 JSONPath; `paths` returns the normalized-path string of each match (e.g. `$['a'][1]['p']`). Supports every selector (name, wildcard `*`, index incl. negative, slice `start:end:step` incl. negative step, comma-separated selections), child and descendant (`..`) segments, and filter expressions with `==` / `!=` / `<` / `<=` / `>` / `>=`, `&&` / `||` / `!`, existence tests, and the standard functions. The well-typedness rules are checked when the path is compiled — a non-singular query used as a comparison operand, an ill-typed function argument, or a value-typed function used as a test all throw `json-path/invalid`. Pairs with `b.guardJsonPath`, which screens operator-supplied path strings before they reach the evaluator.

package/lib/vendor/blamejs/README.md

@@ -158,7 +158,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **WebSockets (server)** — channel/room fan-out across cluster replicas; RFC 6455 §5.5 control-frame size + FIN enforcement on inbound (defends 1 MiB-PING-as-PONG amplification) (`b.websocket`, `b.websocketChannels`)
 - **WebSockets (client)** — `b.wsClient` with PQC-TLS handshake, permessage-deflate negotiation with decompression-bomb cap, fatal UTF-8 validation, permanent-error classifier (skips reconnect on 4xx / accept mismatch / bad-subprotocol), exponential-backoff with full jitter
 - **Pub/sub + events** — distributed pub/sub with cluster-table / Redis PUB/SUB / custom backends (`b.pubsub`); framework-emitted signal bus for breach / integrity events (`b.events`)
-- **CloudEvents + SSE** — CloudEvents 1.0 envelope for AWS EventBridge / Knative / Azure Event Grid / Google Eventarc / CNCF (`b.cloudEvents`); Server-Sent Events with newline-injection refusal in `event:` / `id:` / `data:` / `Last-Event-ID` (CVE-2026-33128 / 29085 / 44217 class) (`b.sse`, `b.middleware.sse`)
+- **CloudEvents + SSE** — CloudEvents 1.0.2 for AWS EventBridge / Knative / Azure Event Grid / Google Eventarc / CNCF: `wrap` / `parse` envelopes, non-throwing `validate` / `isValid`, the JSON event + batch formats (`toJSON` / `fromJSON` / `toJSONBatch` / `fromJSONBatch`), and the HTTP binding in both binary and structured content modes with auto-detecting `http.decode` (`b.cloudEvents`); Server-Sent Events with newline-injection refusal in `event:` / `id:` / `data:` / `Last-Event-ID` (CVE-2026-33128 / 29085 / 44217 class) (`b.sse`, `b.middleware.sse`)
 - **Mail (outbound)** — multipart + attachments + DKIM + calendar invites; bounce intake (`b.mail`, `b.mailBounce`)
 - **Mail (outbound delivery)** — turnkey MX-lookup → MTA-STS-fetch → DANE-TLSA → REQUIRETLS handshake → SMTP wire layer → RFC 3464 DSN-on-permanent-failure → deferred-retry scheduling, all wired once (`b.mail.send.deliver`)
 - **Mail (inbound auth)** — SPF / DMARC / ARC verify + ARC chain signing for relays (`b.mail.spf`, `b.mail.dmarc`, `b.mail.arc`)

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.12.62",
-  "createdAt": "2026-05-26T02:49:26.197Z",
+  "frameworkVersion": "0.12.63",
+  "createdAt": "2026-05-26T04:30:08.809Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -6233,10 +6233,59 @@
           "type": "primitive",
           "valueType": "string"
         },
+        "fromJSON": {
+          "type": "function",
+          "arity": 2
+        },
+        "fromJSONBatch": {
+          "type": "function",
+          "arity": 2
+        },
+        "http": {
+          "type": "object",
+          "members": {
+            "decode": {
+              "type": "function",
+              "arity": 3
+            },
+            "decodeBinary": {
+              "type": "function",
+              "arity": 3
+            },
+            "encodeBatch": {
+              "type": "function",
+              "arity": 1
+            },
+            "encodeBinary": {
+              "type": "function",
+              "arity": 1
+            },
+            "encodeStructured": {
+              "type": "function",
+              "arity": 1
+            }
+          }
+        },
+        "isValid": {
+          "type": "function",
+          "arity": 1
+        },
         "parse": {
           "type": "function",
           "arity": 1
         },
+        "toJSON": {
+          "type": "function",
+          "arity": 2
+        },
+        "toJSONBatch": {
+          "type": "function",
+          "arity": 2
+        },
+        "validate": {
+          "type": "function",
+          "arity": 1
+        },
         "wrap": {
           "type": "function",
           "arity": 1
@@ -46100,6 +46149,10 @@
           "type": "instance",
           "ctorName": "RegExp"
         },
+        "BASE64_RE": {
+          "type": "instance",
+          "ctorName": "RegExp"
+        },
         "CRLF_RE": {
           "type": "instance",
           "ctorName": "RegExp"

package/lib/vendor/blamejs/lib/backup/manifest.js

@@ -95,7 +95,7 @@ var VALID_KINDS = { "raw": 1, "vault-sealed": 1, "plaintext": 1 };
 // in the manifest, so the hex string is 128 chars long.
 var SHA3_512_HEX_LENGTH = 128;
 var HEX_RE = safeBuffer.HEX_RE;
-var BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+var BASE64_RE = safeBuffer.BASE64_RE;
 
 function _isHex(s, evenLength) {
   if (typeof s !== "string" || s.length === 0) return false;