@blamejs/blamejs-shop 0.1.28 → 0.1.30

package/lib/storefront.js

@@ -162,6 +162,7 @@ var LAYOUT =
   "        <ul>\n" +
   "          <li><a href=\"/\">All products</a></li>\n" +
   "          <li><a href=\"/collections\">Collections</a></li>\n" +
+  "          <li><a href=\"/categories\">Categories</a></li>\n" +
   "          <li><a href=\"/?sort=new\">New arrivals</a></li>\n" +
   "          <li><a href=\"/?sort=sale\">On sale</a></li>\n" +
   "          <li><a href=\"/cart\">Cart</a></li>\n" +
@@ -747,6 +748,7 @@ var PRODUCT_PAGE =
   "    </div>\n" +
   "  </div>\n" +
   "  RAW_REVIEWS_PLACEHOLDER\n" +
+  "  RAW_QA_PLACEHOLDER\n" +
   "</section>\n";
 
 // PDP gallery markup — composed once per render call from the
@@ -968,6 +970,132 @@ function _reviewMessagePage(opts, heading, message, cta) {
   });
 }
 
+// Builds the PDP Product Q&A block from the published questions + their
+// approved answers. Renders the "no questions yet" empty state when the
+// product has none; `ctaHtml` is the "Ask a question" call-to-action
+// (resolved by the route). Reuses the reviews section's theme classes
+// so no new CSS ships. Mirrors the edge renderer
+// (`worker/render/product.js`) byte-for-byte so both render paths stay
+// in sync.
+function _buildProductQa(questions, ctaHtml) {
+  var esc = b.template.escapeHtml;
+  questions = questions || [];
+
+  var head;
+  if (questions.length > 0) {
+    head = "<p class=\"reviews__count\">" + questions.length +
+      (questions.length === 1 ? " question answered" : " questions answered") + "</p>";
+  } else {
+    head = "<p class=\"reviews__empty\">No questions yet. Be the first to ask about this product.</p>";
+  }
+
+  var list = "";
+  for (var i = 0; i < questions.length; i += 1) {
+    var q = questions[i];
+    var answers = q.answers || [];
+    var answerHtml = "";
+    for (var j = 0; j < answers.length; j += 1) {
+      var a = answers[j];
+      var who = Number(a.is_operator) === 1
+        ? "<span class=\"review__verified\">Answered by the seller</span>"
+        : (a.author === "system"
+            ? "<span class=\"review__verified\">Automated answer</span>"
+            : "<span class=\"review__verified\">Customer answer</span>");
+      var pinned = Number(a.pinned) === 1
+        ? "<span class=\"review__verified\">Top answer</span>"
+        : "";
+      answerHtml +=
+        "<li class=\"review qa__answer\">" +
+          "<div class=\"review__meta\">" + who + pinned + "</div>" +
+          "<p class=\"review__body\">" + esc(String(a.body)) + "</p>" +
+        "</li>";
+    }
+    var answerList = answerHtml
+      ? "<ul class=\"reviews__list qa__answers\">" + answerHtml + "</ul>"
+      : "<p class=\"reviews__empty\">Awaiting an answer.</p>";
+    list +=
+      "<li class=\"review qa__question\">" +
+        "<div class=\"review__head\">" +
+          "<h3 class=\"review__title\">" + esc(String(q.body)) + "</h3>" +
+        "</div>" +
+        answerList +
+      "</li>";
+  }
+  var listHtml = list ? "<ul class=\"reviews__list\">" + list + "</ul>" : "";
+
+  return "<section class=\"reviews qa\" aria-labelledby=\"qa-title\">" +
+           "<h2 id=\"qa-title\" class=\"reviews__heading\">Questions &amp; answers</h2>" +
+           head +
+           listHtml +
+           (ctaHtml || "") +
+         "</section>";
+}
+
+var QA_FORM_PAGE =
+  "<section class=\"review-form-page\">\n" +
+  "  <nav class=\"breadcrumb\" aria-label=\"Breadcrumb\">\n" +
+  "    <ol>\n" +
+  "      <li><a href=\"/\">Shop</a></li>\n" +
+  "      <li><a href=\"/products/{{slug}}\">{{title}}</a></li>\n" +
+  "      <li aria-current=\"page\">Ask a question</li>\n" +
+  "    </ol>\n" +
+  "  </nav>\n" +
+  "  <h1 class=\"review-form-page__title\">Ask about {{title}}</h1>\n" +
+  "  RAW_NOTICE_PLACEHOLDER\n" +
+  "  <form class=\"review-form\" method=\"post\" action=\"/products/{{slug}}/question\">\n" +
+  "    <label class=\"form-field\">\n" +
+  "      <span class=\"form-field__label\">Your question</span>\n" +
+  "      <textarea name=\"body\" maxlength=\"4000\" rows=\"6\" required></textarea>\n" +
+  "    </label>\n" +
+  "    <button type=\"submit\" class=\"btn-primary\">Submit question</button>\n" +
+  "  </form>\n" +
+  "</section>\n";
+
+// Auth-gated question form. `opts.product` carries { title, slug };
+// `opts.notice` is an optional error string rendered above the form
+// (e.g. a validation rejection bounced back from POST).
+function renderQuestionForm(opts) {
+  var esc = b.template.escapeHtml;
+  var notice = opts.notice
+    ? "<p class=\"form-notice form-notice--error\" role=\"alert\">" + esc(String(opts.notice)) + "</p>"
+    : "";
+  var body = _render(QA_FORM_PAGE, {
+    title: opts.product.title,
+    slug:  opts.product.slug,
+  })
+    .replace("RAW_NOTICE_PLACEHOLDER", notice);
+  return _wrap({
+    title:      "Ask about " + opts.product.title,
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
+// Generic single-message page for the Q&A flow (submission thank-you).
+// `cta` is an optional { href, label }. Reuses the review-message
+// layout classes.
+function _qaMessagePage(opts, heading, message, cta) {
+  var esc = b.template.escapeHtml;
+  var ctaHtml = cta
+    ? "<a class=\"btn-primary\" href=\"" + esc(cta.href) + "\">" + esc(cta.label) + "</a>"
+    : "";
+  var body =
+    "<section class=\"review-message\">" +
+      "<h1 class=\"review-message__title\">" + esc(heading) + "</h1>" +
+      "<p class=\"review-message__lede\">" + esc(message) + "</p>" +
+      ctaHtml +
+    "</section>";
+  return _wrap({
+    title:      heading,
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Remove control for a wishlist entry — a form POST back through the
 // toggle route with `return_to` so the customer lands back on the
 // account page (not the product PDP the default toggle returns to).
@@ -1265,6 +1393,123 @@ function renderCollection(opts) {
   });
 }
 
+// Storefront category index — the top-level category tree. Each card
+// links into a category browse page. Reuses the collection-index card
+// shell (same visual contract) so no new CSS ships. `opts.categories`
+// is the hydrated [{ slug, title, description, hero_image_url }] list of
+// active top-level categories (archived rows are dropped by the lib).
+function renderCategoryIndex(opts) {
+  var esc = b.template.escapeHtml;
+  var cats = opts.categories || [];
+  var cardsHtml = "";
+  for (var i = 0; i < cats.length; i += 1) {
+    var c = cats[i];
+    var media = c.hero_image_url
+      ? "<figure class=\"collection-index-card__media\"><img src=\"" + esc(_categoryHeroSrc(c.hero_image_url, opts.asset_prefix)) + "\" alt=\"" + esc(c.title) + "\" loading=\"lazy\"></figure>"
+      : "<figure class=\"collection-index-card__media collection-index-card__media--empty\" aria-hidden=\"true\"></figure>";
+    cardsHtml +=
+      "<a class=\"collection-index-card\" href=\"/categories/" + esc(c.slug) + "\">" +
+        media +
+        "<div class=\"collection-index-card__meta\">" +
+          "<h2 class=\"collection-index-card__title\">" + esc(c.title) + "</h2>" +
+          (c.description ? "<p class=\"collection-index-card__desc\">" + esc(c.description) + "</p>" : "") +
+        "</div>" +
+      "</a>";
+  }
+  var inner = cardsHtml
+    ? "<div class=\"collection-index-grid\">" + cardsHtml + "</div>"
+    : "<p class=\"collection-empty\">No categories yet.</p>";
+  var body =
+    "<section class=\"collection-index\">" +
+      "<header class=\"section-head\"><p class=\"eyebrow\">Browse</p>" +
+        "<h1 class=\"section-head__title\">Categories</h1></header>" +
+      inner +
+    "</section>";
+  return _wrap({
+    title: "Categories", shop_name: opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count, theme_css: opts.theme_css, body: body,
+  });
+}
+
+// A single category's page — breadcrumb (root -> current), title,
+// optional description + hero, and a grid of the category's direct
+// child sub-categories. `opts.breadcrumbs` is the root->current chain
+// (the last entry is the current category, rendered as plain text);
+// `opts.children` is the hydrated direct-child list (empty -> graceful
+// empty state). Reuses the collection-page + collection-index card
+// shells so no new CSS ships.
+function renderCategory(opts) {
+  var esc = b.template.escapeHtml;
+  var cat = opts.category;
+  var crumbs = opts.breadcrumbs || [];
+  var children = opts.children || [];
+
+  var crumbHtml = "<li><a href=\"/\">Shop</a></li><li><a href=\"/categories\">Categories</a></li>";
+  for (var ci = 0; ci < crumbs.length; ci += 1) {
+    var bc = crumbs[ci];
+    if (ci === crumbs.length - 1) {
+      crumbHtml += "<li aria-current=\"page\">" + esc(bc.title) + "</li>";
+    } else {
+      crumbHtml += "<li><a href=\"/categories/" + esc(bc.slug) + "\">" + esc(bc.title) + "</a></li>";
+    }
+  }
+
+  // Hero reuses the collection-index card media shell (aspect-ratio +
+  // object-fit cover) so no new CSS ships; it's a standalone figure
+  // rather than a card link here.
+  var hero = cat.hero_image_url
+    ? "<figure class=\"collection-index-card__media\"><img src=\"" + esc(_categoryHeroSrc(cat.hero_image_url, opts.asset_prefix)) + "\" alt=\"" + esc(cat.title) + "\"></figure>"
+    : "";
+
+  var cardsHtml = "";
+  for (var i = 0; i < children.length; i += 1) {
+    var ch = children[i];
+    var media = ch.hero_image_url
+      ? "<figure class=\"collection-index-card__media\"><img src=\"" + esc(_categoryHeroSrc(ch.hero_image_url, opts.asset_prefix)) + "\" alt=\"" + esc(ch.title) + "\" loading=\"lazy\"></figure>"
+      : "<figure class=\"collection-index-card__media collection-index-card__media--empty\" aria-hidden=\"true\"></figure>";
+    cardsHtml +=
+      "<a class=\"collection-index-card\" href=\"/categories/" + esc(ch.slug) + "\">" +
+        media +
+        "<div class=\"collection-index-card__meta\">" +
+          "<h2 class=\"collection-index-card__title\">" + esc(ch.title) + "</h2>" +
+          (ch.description ? "<p class=\"collection-index-card__desc\">" + esc(ch.description) + "</p>" : "") +
+        "</div>" +
+      "</a>";
+  }
+  var grid = cardsHtml
+    ? "<div class=\"collection-index-grid\">" + cardsHtml + "</div>"
+    : "<p class=\"collection-empty\">No sub-categories here yet.</p>";
+
+  var body =
+    "<section class=\"collection-page\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        crumbHtml +
+      "</ol></nav>" +
+      "<header class=\"collection-page__head\">" +
+        "<h1 class=\"collection-page__title\">" + esc(cat.title) + "</h1>" +
+        (cat.description ? "<p class=\"collection-page__desc\">" + esc(cat.description) + "</p>" : "") +
+      "</header>" +
+      hero +
+      grid +
+    "</section>";
+  return _wrap({
+    title: cat.title, shop_name: opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count, theme_css: opts.theme_css, body: body,
+  });
+}
+
+// Resolve a category hero_image_url into a renderable src. The lib gates
+// hero_image_url to https:// OR a /-rooted absolute path at write time,
+// so an absolute https URL or a /-rooted path is used as-is; any other
+// value (a bare R2 key) is prefixed with the card asset prefix the same
+// way collection hero media resolves.
+function _categoryHeroSrc(url, assetPrefix) {
+  if (typeof url !== "string" || !url.length) return "";
+  if (url.charCodeAt(0) === 47 /* "/" */) return url;
+  if (/^https:\/\//i.test(url)) return url;
+  return (assetPrefix || "/assets/") + url;
+}
+
 // Account "Recently viewed" page — a newest-first grid of products the
 // signed-in customer has opened, reusing the standard product card.
 // `opts.products` is a resolved [{ slug, title, price, image_url,
@@ -1881,6 +2126,7 @@ function renderProduct(opts) {
       // theme's `{{{ reviews_html }}}` raw slot. The bundled themes
       // include the slot; a custom theme opts in by adding it.
       reviews_html:   _buildReviews(opts.review_summary, opts.reviews, opts.review_cta),
+      qa_html:        _buildProductQa(opts.qa_questions, opts.qa_cta),
       wishlist_html:  _buildWishlist(opts.product.id, opts.wishlist_count),
       asset_css_main: opts.theme.assetUrl("css/main.css"),
     });
@@ -1891,6 +2137,7 @@ function renderProduct(opts) {
   if (!rows) rows = "<tr><td colspan=\"4\" class=\"empty\">No variants available.</td></tr>";
   var galleryHtml = _buildPdpGallery(opts.product, opts.media || [], opts.asset_prefix || "/assets/");
   var reviewsHtml = _buildReviews(opts.review_summary, opts.reviews, opts.review_cta);
+  var qaHtml = _buildProductQa(opts.qa_questions, opts.qa_cta);
   var wishlistHtml = _buildWishlist(opts.product.id, opts.wishlist_count);
   var body = _render(PRODUCT_PAGE, {
     title:        opts.product.title,
@@ -1900,7 +2147,8 @@ function renderProduct(opts) {
     .replace("RAW_GALLERY_PLACEHOLDER", galleryHtml)
     .replace("RAW_ROWS_PLACEHOLDER", rows)
     .replace("RAW_WISHLIST_PLACEHOLDER", wishlistHtml)
-    .replace("RAW_REVIEWS_PLACEHOLDER", reviewsHtml);
+    .replace("RAW_REVIEWS_PLACEHOLDER", reviewsHtml)
+    .replace("RAW_QA_PLACEHOLDER", qaHtml);
   // Product-specific OpenGraph + Twitter Card values so shares
   // unfurl as "Operator Tee — blamejs.shop" with the SVG hero, not
   // the default shop-level description + brand logo.
@@ -3289,6 +3537,27 @@ function mount(router, deps) {
       try { wishlistCount = await deps.wishlist.countForProduct(product.id); }
       catch (_e) { wishlistCount = 0; }
     }
+    // Published Q&A — approved questions + their approved answers. A
+    // failed read (e.g. the product_qa tables not yet migrated) degrades
+    // to the empty state rather than 500-ing the PDP — Q&A is
+    // supplementary to the buy path, like reviews. Mirrors the edge
+    // renderer's missing-table resilience.
+    var qaQuestions, qaCta;
+    if (deps.productQa) {
+      qaQuestions = [];
+      try {
+        var qList = (await deps.productQa.questionsForProduct({ product_id: product.id, limit: 20 })).rows;
+        for (var qi = 0; qi < qList.length; qi += 1) {
+          var qrow = qList[qi];
+          qrow.answers = await deps.productQa.answersForQuestion(qrow.id, { limit: 20 });
+          qaQuestions.push(qrow);
+        }
+      } catch (_e) { qaQuestions = []; }
+      // The form route enforces auth, so the CTA links there
+      // unconditionally; logged-out shoppers get redirected to login.
+      qaCta = "<a class=\"btn-secondary reviews__cta\" href=\"/products/" +
+        b.template.escapeHtml(product.slug) + "/question\">Ask a question</a>";
+    }
     // Log the view for a signed-in customer so it surfaces on their
     // "Recently viewed" account page. Drop-silent — a recording failure
     // (table not migrated, write contention) must never break the PDP
@@ -3310,6 +3579,8 @@ function mount(router, deps) {
       review_summary: reviewSummary,
       reviews:        reviewRows,
       review_cta:     reviewCta,
+      qa_questions:   qaQuestions,
+      qa_cta:         qaCta,
       wishlist_count: wishlistCount,
       shop_name:      shopName,
       cart_count:     cartCount,
@@ -3356,6 +3627,60 @@ function mount(router, deps) {
     });
   }
 
+  // Category navigation — the hierarchical category tree surfaced as
+  // public browse pages. The index lists the top-level categories; each
+  // category page renders its breadcrumb chain + direct child sub-
+  // categories. Mounted when the categoryNavigation primitive is wired.
+  if (deps.categoryNavigation) {
+    router.get("/categories", async function (req, res) {
+      // Top-level categories only (parent_slug omitted). The lib drops
+      // archived rows from every read, so the index is fresh against the
+      // active tree.
+      var cats = await deps.categoryNavigation.categoriesByParent({});
+      var active = [];
+      for (var i = 0; i < cats.length; i += 1) {
+        if (cats[i].active) active.push(cats[i]);
+      }
+      var cartCount = await _cartCountForReq(req);
+      _send(res, 200, renderCategoryIndex({
+        categories: active, shop_name: shopName, cart_count: cartCount, asset_prefix: _cardAssetPrefix,
+      }));
+    });
+
+    router.get("/categories/:slug", async function (req, res) {
+      var slug = req.params && req.params.slug;
+      // getCategory() / breadcrumbsFor() / categoriesByParent() throw a
+      // TypeError on a malformed slug shape (the primitive validates the
+      // slug regex). A bad path segment, an unknown slug, or an archived
+      // category is a 404, not a 500 — this is a defensive request-shape
+      // reader.
+      var cat, crumbs, children;
+      try {
+        cat = slug ? await deps.categoryNavigation.getCategory(slug) : null;
+        if (!cat || !cat.active) return _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+        crumbs = await deps.categoryNavigation.breadcrumbsFor({ slug: slug });
+        children = await deps.categoryNavigation.categoriesByParent({ parent_slug: slug });
+      } catch (e) {
+        if (e instanceof TypeError) return _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+        // A CATEGORY_NOT_FOUND from breadcrumbsFor / categoriesByParent
+        // (e.g. the row was archived between reads) is also a 404.
+        if (e && e.code === "CATEGORY_NOT_FOUND") return _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+        throw e;
+      }
+      // Only surface active sub-categories (the lib already drops archived
+      // rows; this also hides operator-unpublished ones).
+      var activeChildren = [];
+      for (var i = 0; i < children.length; i += 1) {
+        if (children[i].active) activeChildren.push(children[i]);
+      }
+      var cartCount = await _cartCountForReq(req);
+      _send(res, 200, renderCategory({
+        category: cat, breadcrumbs: crumbs, children: activeChildren,
+        shop_name: shopName, cart_count: cartCount, asset_prefix: _cardAssetPrefix,
+      }));
+    });
+  }
+
   router.get("/cart", async function (req, res) {
     var sid = _readSidCookie(req);
     if (!sid) {
@@ -5303,6 +5628,77 @@ function mount(router, deps) {
         ));
       });
     }
+
+    // Product Q&A — asking a question requires a logged-in customer (no
+    // verified-purchase gate; any signed-in shopper can ask). The
+    // question lands `pending` and surfaces on the PDP once an operator
+    // approves it. Customer-authored answers aren't accepted from the
+    // storefront — answering is an operator action in the admin console
+    // (the lib models customer answers, but exposing a public answer
+    // form invites an unmoderated reply surface we don't ship in v1;
+    // operators post the authoritative answer). Only mounts when the
+    // productQa primitive is wired.
+    if (deps.productQa) {
+      async function _qaGateContext(req, res) {
+        var slug = req.params && req.params.slug;
+        var product = slug ? await deps.catalog.products.bySlug(slug) : null;
+        if (!product) { _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme })); return null; }
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") { _serviceUnavailable(res, "auth not configured"); return null; }
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          res.end ? res.end() : res.send("");
+          return null;
+        }
+        var cartCount = await _cartCountForReq(req);
+        return { product: product, auth: auth, cartCount: cartCount };
+      }
+
+      router.get("/products/:slug/question", async function (req, res) {
+        var ctx = await _qaGateContext(req, res);
+        if (!ctx) return;
+        _send(res, 200, renderQuestionForm({
+          product:    { title: ctx.product.title, slug: ctx.product.slug },
+          shop_name:  shopName,
+          cart_count: ctx.cartCount,
+        }));
+      });
+
+      router.post("/products/:slug/question", async function (req, res) {
+        var ctx = await _qaGateContext(req, res);
+        if (!ctx) return;
+        var body = req.body || {};
+        try {
+          await deps.productQa.submitQuestion({
+            product_id:  ctx.product.id,
+            customer_id: ctx.auth.customer_id,
+            body:        body.body,
+          });
+        } catch (e) {
+          // Shape rejections bounce back to the form with the reason;
+          // anything else is a real 500.
+          if (e instanceof TypeError) {
+            return _send(res, 400, renderQuestionForm({
+              product:    { title: ctx.product.title, slug: ctx.product.slug },
+              notice:     (e && e.message) || "Please check your question and try again.",
+              shop_name:  shopName,
+              cart_count: ctx.cartCount,
+            }));
+          }
+          throw e;
+        }
+        _send(res, 200, _qaMessagePage(
+          { shop_name: shopName, cart_count: ctx.cartCount },
+          "Thanks for your question",
+          "Your question has been submitted and is pending moderation. It will appear on the product page once an operator approves and answers it.",
+          { href: "/products/" + ctx.product.slug, label: "Back to product" },
+        ));
+      });
+    }
   }
 
   // POST /cart/lines — add a line. Reads variant_id + qty from the

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.12.63",
-      "tag": "v0.12.63",
+      "version": "0.12.66",
+      "tag": "v0.12.66",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,12 @@ upgrading across more than a few patches at a time.
 
 ## v0.12.x
 
+- v0.12.66 (2026-05-26) — **`b.uriTemplate` — RFC 6570 URI Template expansion.** Expand RFC 6570 URI Templates — the {var} syntax that OpenAPI links, HAL _links, and hypermedia API clients use to turn a template plus a set of variables into a concrete URI. The full Level 4 grammar is supported: every operator ({+var} reserved, {#var} fragment, {.var} label, {/var} path, {;var} path-style parameters, {?var} query, {&var} query continuation), the {var:3} prefix modifier, and the {var*} explode modifier for lists and associative arrays. b.uriTemplate.expand(template, vars) returns the expanded string; b.uriTemplate.compile(template) parses once for templates applied to many variable sets. A malformed template (unclosed expression, reserved operator, non-numeric prefix, unmatched brace) throws UriTemplateError. Verified against the official uritemplate-test conformance suite (all 135 spec, extended, and negative cases). **Added:** *`b.uriTemplate.expand` / `b.uriTemplate.compile`* — RFC 6570 URI Template expansion, full Level 4. `expand(template, vars)` substitutes variables into a template and returns the URI; `compile(template)` returns a reusable `{ expand }` for repeated use. Variable values may be strings, numbers, booleans, arrays (lists), or plain objects (associative arrays); undefined, null, and empty list/map variables are omitted. All eight operators, the `:N` prefix modifier, and the `*` explode modifier follow §3.2, including reserved-set encoding for `{+var}` / `{#var}`. Composes naturally with `b.hal`, `b.linkHeader`, and `b.openapi` link objects. A malformed template throws `UriTemplateError`.
+
+- v0.12.65 (2026-05-26) — **`b.base32` — RFC 4648 Base32 encode / decode.** Encode and decode RFC 4648 Base32 — the case-insensitive alphabet behind TOTP / 2FA secrets, DNSSEC NSEC3 hashes, and human-transcribable identifiers. Both RFC 4648 variants are supported: the standard alphabet (the default) and the extended-hex alphabet. b.base32.encode pads to an 8-character boundary by default (pass padding: false for the bare form TOTP key URIs use); b.base32.decode is strict by default but accepts the real-world shapes humans produce — lower-case, embedded spaces and dashes, missing padding — under loose: true. Verified against the RFC 4648 §10 test vectors for both alphabets. The TOTP primitive now composes this codec instead of carrying its own Base32 implementation. **Added:** *`b.base32.encode` / `b.base32.decode`* — RFC 4648 Base32 codec. `encode(buf, opts)` takes a Buffer or Uint8Array and returns a Base32 string, padded to an 8-character boundary unless `padding: false`; `decode(str, opts)` returns a Buffer. The `variant` option selects the standard (`"rfc4648"`, default) or extended-hex (`"rfc4648-hex"`) alphabet. Decoding is strict by default — any character outside the alphabet throws `Base32Error` — and `loose: true` up-cases the input and ignores embedded spaces, dashes, and missing padding, which is how copied TOTP keys and hand-typed codes arrive. **Changed:** *TOTP composes `b.base32`* — `b.auth.totp` now encodes and decodes its secrets through `b.base32` rather than a private Base32 implementation. Behavior is unchanged — secrets are still emitted unpadded and parsed leniently (case-insensitive, ignoring spaces and dashes).
+
+- v0.12.64 (2026-05-25) — **`b.jsonSchema` — JSON Schema 2020-12 validation.** Validate JSON against a JSON Schema 2020-12 document — the dialect OpenAPI 3.1 adopted and the most widely implemented schema language. b.jsonSchema.compile(schema) returns a reusable validator; b.jsonSchema.validate(schema, instance) compiles and runs in one call, returning { valid, errors } where each error names the failing instance location, keyword, and schema path. The full 2020-12 vocabulary is supported: every applicator (allOf / anyOf / oneOf / not / if-then-else, properties / patternProperties / additionalProperties / prefixItems / items / contains), the annotation-aware unevaluatedProperties / unevaluatedItems, every assertion keyword, and reference resolution ($ref / $anchor / $dynamicRef / $dynamicAnchor / $defs / $id base URIs). format is an annotation by default (opt in to assertion with assertFormat). External references resolve through an operator-supplied schema map — never a network fetch. Verified against the official JSON-Schema-Test-Suite (1292 of 1295 draft2020-12 cases; the remainder need the bundled dialect metaschema or $vocabulary selection, both opt-in). This is the standards-track counterpart to the fluent b.safeSchema builder and the portable b.jtd. **Added:** *`b.jsonSchema` — JSON Schema 2020-12* — `compile(schema, opts)` returns `{ validate, isValid }`; `validate(schema, instance, opts)` and `isValid(schema, instance, opts)` compile and run in one call. `validate` returns `{ valid, errors }`, each error a `{ instancePath, keyword, schemaPath, message }`. The full 2020-12 vocabulary is implemented — applicators, annotation-aware `unevaluatedProperties` / `unevaluatedItems`, every assertion keyword, and `$ref` / `$anchor` / `$dynamicRef` / `$dynamicAnchor` / `$defs` / `$id` resolution. `format` is an annotation by default (`assertFormat: true` to assert). External references resolve through `opts.schemas` (a URI→schema map), never a network fetch. Reach for it when the schema is an existing JSON Schema document (an API contract, OpenAPI component, or config schema); `b.safeSchema` remains the fluent in-process builder and `b.jtd` the portable codegen-friendly option. Validating a schema document against the dialect metaschema requires supplying that metaschema via `opts.schemas`, and `$vocabulary`-based keyword selection is not honored (every standard keyword always asserts).
+
 - v0.12.63 (2026-05-25) — **`b.cloudEvents` gains the JSON event format, batch, and the HTTP binding.** b.cloudEvents grows beyond wrap / parse into a full CloudEvents 1.0.2 surface. b.cloudEvents.validate / isValid check an envelope against the spec without throwing (the non-throwing companion to parse). toJSON / fromJSON serialize and parse the JSON event format, and toJSONBatch / fromJSONBatch handle the JSON batch format; untrusted bodies parse through the framework's bounded, prototype-pollution-safe JSON reader. The new http.* binding speaks both content modes the spec defines — binary mode spreads context attributes across percent-encoded ce-* headers with the data in the body, structured mode carries the whole event as application/cloudevents+json — plus the batch mode, and http.decode auto-detects the incoming mode from Content-Type exactly as a conformant receiver does. Verified against the spec's normative example events. **Added:** *`b.cloudEvents` JSON event format, batch, and HTTP binding* — `validate` / `isValid` report spec violations without throwing (the non-throwing companion to `parse`). `toJSON` / `fromJSON` and `toJSONBatch` / `fromJSONBatch` serialize and parse the JSON event and batch formats over the existing envelope shape. `http.encodeBinary` / `http.encodeStructured` / `http.encodeBatch` render the three HTTP content modes — binary spreads attributes across percent-encoded `ce-*` headers, structured and batched carry the event(s) as `application/cloudevents+json` / `application/cloudevents-batch+json` — and `http.decode` parses a request back into an envelope (or array) by auto-detecting the mode from `Content-Type`. `b.jtd` or `b.safeSchema` still validate the event's `data` payload. **Fixed:** *`b.csp.build` accepts `fenced-frame-src` and `webrtc`* — The CSP3 `fenced-frame-src` directive — which the default security-headers policy emits to block `<fencedframe>` embeds — was missing from the builder's recognized-directive set, so the default policy could not round-trip through `b.csp.build` (it threw `csp/unknown-directive`). Both `fenced-frame-src` and the CSP3 `webrtc` directive are now recognized.
 
 - v0.12.62 (2026-05-26) — **`b.jtd` — JSON Type Definition validation (RFC 8927).** Validate JSON against a JSON Type Definition schema (RFC 8927) — a small, portable, cross-implementation schema language, the interop-friendly companion to the framework's fluent b.safeSchema builder. b.jtd.validate(schema, instance) returns an array of { instancePath, schemaPath } errors (empty = valid); b.jtd.isValid is the boolean form. All eight schema forms are supported — empty, type, enum, elements, properties (with optional / additional properties and nullable), values, discriminator (with mapping), and ref (with definitions) — including the integer-range and RFC 3339 timestamp types. A malformed schema is rejected at compile time with jtd/bad-schema rather than silently mis-validating. Verified against the official json-typedef-spec suites: all 316 validation cases and all 49 invalid-schema cases. **Added:** *`b.jtd.validate(schema, instance)` / `b.jtd.isValid(schema, instance)`* — `validate` returns the RFC 8927 error list — each `{ instancePath, schemaPath }` naming the offending value and the broken schema rule — and `isValid` is the boolean convenience form. Supports every JTD form and type: the numeric types enforce their exact ranges (int8 … uint32, float32 / float64), `timestamp` requires an RFC 3339 date-time, `properties` honours `optionalProperties` / `additionalProperties` / `nullable`, and `discriminator` selects a `mapping` schema by a tag property. The schema is checked for well-formedness before validation, so unknown keywords, multiple forms, bad refs, or a discriminator over a non-properties mapping all throw `jtd/bad-schema`. Use JTD for schemas you share across implementations or generate code from; use `b.safeSchema` for in-process fluent validation.

package/lib/vendor/blamejs/README.md

@@ -99,7 +99,10 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **Signed webhooks + API encryption** — SLH-DSA-SHAKE-256f default; ML-DSA-65 opt-in; ECIES API encryption (`b.webhook`, `b.crypto`)
 - **HPKE / HTTP signatures** — RFC 9180 HPKE with ML-KEM-1024 + HKDF-SHA3-512 + ChaCha20-Poly1305 (`b.crypto.hpke`); RFC 9421 HTTP Message Signatures with derived components and ed25519 / ML-DSA-65 (`b.crypto.httpSig`); RFC 9530 Content-Digest / Repr-Digest body-integrity fields (SHA-256 / SHA-512, legacy algorithms refused — `b.contentDigest`) to sign the digest rather than the whole body
 - **Link header** — RFC 8288 Web Linking codec (`b.linkHeader.parse` / `serialize`): parse and build `Link: <uri>; rel="next"` relations, the standard REST pagination mechanism; quote-aware (a comma inside a quoted parameter never splits the list)
+- **URI Templates** — RFC 6570 expansion (`b.uriTemplate.expand` / `compile`): full Level 4 — every operator, the `:N` prefix and `*` explode modifiers — turning `{/path}{?q*}` plus variables into a concrete URI; validated against the official uritemplate-test suite. The `{var}` syntax behind OpenAPI links and HAL `_links`
 - **JSON Type Definition** — RFC 8927 validation (`b.jtd.validate` / `isValid`): portable, cross-implementation schema validation (all eight forms — type / enum / elements / properties / values / discriminator / ref / empty), returning instancePath / schemaPath errors; validated against the official 316-case suite. Interop companion to the fluent `b.safeSchema` builder
+- **JSON Schema 2020-12** — the OpenAPI 3.1 dialect (`b.jsonSchema.compile` / `validate` / `isValid`): full vocabulary including every applicator, annotation-aware `unevaluatedProperties` / `unevaluatedItems`, and `$ref` / `$dynamicRef` / `$anchor` / `$id` resolution (external refs via an operator-supplied schema map, never a network fetch); `format` is an annotation unless `assertFormat` is set; returns located `{ valid, errors }`. Validated against the official JSON-Schema-Test-Suite. Standards-track counterpart to `b.safeSchema` and `b.jtd`
+- **Base32** — RFC 4648 codec (`b.base32.encode` / `decode`): standard + extended-hex alphabets, padded or bare, strict or lenient decode (case-insensitive, ignoring spaces / dashes for copied TOTP keys); validated against the RFC 4648 §10 vectors. The codec behind `b.auth.totp` secrets
 - **JSONPath** — full RFC 9535 query evaluator (`b.jsonPath.query` / `paths`): name / wildcard / index / slice / descendant selectors, `?filter` expressions, and the five standard functions, with compile-time well-typedness checks (validated against the official 703-case compliance suite); complements the JSONPath guards
 - **JSON Pointer / Patch** — RFC 6901 `b.jsonPointer.get` (reference a value by `/foo/0/bar`) + RFC 6902 `b.jsonPatch.apply` (atomic add / remove / replace / move / copy / test for HTTP PATCH; the input document is never mutated, structural `test` comparison) + RFC 7396 `b.jsonMergePatch.merge` (the `merge-patch+json` partial-document format; both PATCH formats are prototype-pollution-safe)
 - **Canonical JSON** — RFC 8785 JSON Canonicalization Scheme (`b.canonicalJson.stringifyJcs`): the deterministic, sorted-key byte form to hash or sign (custom credentials, receipts, deterministic request signing); UTF-16 key ordering + ECMAScript number formatting, with a lenient `stringify` variant for Buffers / Dates / BigInts

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.12.63",
-  "createdAt": "2026-05-26T04:30:08.809Z",
+  "frameworkVersion": "0.12.66",
+  "createdAt": "2026-05-26T09:03:41.849Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -4781,6 +4781,36 @@
         }
       }
     },
+    "base32": {
+      "type": "object",
+      "members": {
+        "ALPHABETS": {
+          "type": "object",
+          "members": {
+            "rfc4648": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "rfc4648-hex": {
+              "type": "primitive",
+              "valueType": "string"
+            }
+          }
+        },
+        "Base32Error": {
+          "type": "function",
+          "arity": 4
+        },
+        "decode": {
+          "type": "function",
+          "arity": 2
+        },
+        "encode": {
+          "type": "function",
+          "arity": 2
+        }
+      }
+    },
     "bootGates": {
       "type": "object",
       "members": {
@@ -37108,6 +37138,31 @@
         }
       }
     },
+    "jsonSchema": {
+      "type": "object",
+      "members": {
+        "DIALECT": {
+          "type": "primitive",
+          "valueType": "string"
+        },
+        "JsonSchemaError": {
+          "type": "function",
+          "arity": 4
+        },
+        "compile": {
+          "type": "function",
+          "arity": 2
+        },
+        "isValid": {
+          "type": "function",
+          "arity": 3
+        },
+        "validate": {
+          "type": "function",
+          "arity": 3
+        }
+      }
+    },
     "jtd": {
       "type": "object",
       "members": {
@@ -49338,6 +49393,23 @@
         }
       }
     },
+    "uriTemplate": {
+      "type": "object",
+      "members": {
+        "UriTemplateError": {
+          "type": "function",
+          "arity": 4
+        },
+        "compile": {
+          "type": "function",
+          "arity": 1
+        },
+        "expand": {
+          "type": "function",
+          "arity": 2
+        }
+      }
+    },
     "uuid": {
       "type": "object",
       "members": {

package/lib/vendor/blamejs/index.js

@@ -403,6 +403,9 @@ var jsonPatch = require("./lib/json-patch");
 var jsonMergePatch = require("./lib/json-merge-patch");
 var jsonPath = require("./lib/json-path");
 var jtd = require("./lib/jtd");
+var jsonSchema = require("./lib/json-schema");
+var base32 = require("./lib/base32");
+var uriTemplate = require("./lib/uri-template");
 var standardWebhooks = require("./lib/standard-webhooks");
 var lro = require("./lib/lro");
 var jsonApi = require("./lib/jsonapi");
@@ -427,6 +430,9 @@ module.exports = {
   jsonMergePatch:   jsonMergePatch,
   jsonPath:         jsonPath,
   jtd:              jtd,
+  jsonSchema:       jsonSchema,
+  base32:           base32,
+  uriTemplate:      uriTemplate,
   standardWebhooks: standardWebhooks,
   lro:              lro,
   jsonApi:          jsonApi,