@blamejs/blamejs-shop 0.1.29 → 0.1.30

package/lib/storefront.js

@@ -748,6 +748,7 @@ var PRODUCT_PAGE =
   "    </div>\n" +
   "  </div>\n" +
   "  RAW_REVIEWS_PLACEHOLDER\n" +
+  "  RAW_QA_PLACEHOLDER\n" +
   "</section>\n";
 
 // PDP gallery markup — composed once per render call from the
@@ -969,6 +970,132 @@ function _reviewMessagePage(opts, heading, message, cta) {
   });
 }
 
+// Builds the PDP Product Q&A block from the published questions + their
+// approved answers. Renders the "no questions yet" empty state when the
+// product has none; `ctaHtml` is the "Ask a question" call-to-action
+// (resolved by the route). Reuses the reviews section's theme classes
+// so no new CSS ships. Mirrors the edge renderer
+// (`worker/render/product.js`) byte-for-byte so both render paths stay
+// in sync.
+function _buildProductQa(questions, ctaHtml) {
+  var esc = b.template.escapeHtml;
+  questions = questions || [];
+
+  var head;
+  if (questions.length > 0) {
+    head = "<p class=\"reviews__count\">" + questions.length +
+      (questions.length === 1 ? " question answered" : " questions answered") + "</p>";
+  } else {
+    head = "<p class=\"reviews__empty\">No questions yet. Be the first to ask about this product.</p>";
+  }
+
+  var list = "";
+  for (var i = 0; i < questions.length; i += 1) {
+    var q = questions[i];
+    var answers = q.answers || [];
+    var answerHtml = "";
+    for (var j = 0; j < answers.length; j += 1) {
+      var a = answers[j];
+      var who = Number(a.is_operator) === 1
+        ? "<span class=\"review__verified\">Answered by the seller</span>"
+        : (a.author === "system"
+            ? "<span class=\"review__verified\">Automated answer</span>"
+            : "<span class=\"review__verified\">Customer answer</span>");
+      var pinned = Number(a.pinned) === 1
+        ? "<span class=\"review__verified\">Top answer</span>"
+        : "";
+      answerHtml +=
+        "<li class=\"review qa__answer\">" +
+          "<div class=\"review__meta\">" + who + pinned + "</div>" +
+          "<p class=\"review__body\">" + esc(String(a.body)) + "</p>" +
+        "</li>";
+    }
+    var answerList = answerHtml
+      ? "<ul class=\"reviews__list qa__answers\">" + answerHtml + "</ul>"
+      : "<p class=\"reviews__empty\">Awaiting an answer.</p>";
+    list +=
+      "<li class=\"review qa__question\">" +
+        "<div class=\"review__head\">" +
+          "<h3 class=\"review__title\">" + esc(String(q.body)) + "</h3>" +
+        "</div>" +
+        answerList +
+      "</li>";
+  }
+  var listHtml = list ? "<ul class=\"reviews__list\">" + list + "</ul>" : "";
+
+  return "<section class=\"reviews qa\" aria-labelledby=\"qa-title\">" +
+           "<h2 id=\"qa-title\" class=\"reviews__heading\">Questions &amp; answers</h2>" +
+           head +
+           listHtml +
+           (ctaHtml || "") +
+         "</section>";
+}
+
+var QA_FORM_PAGE =
+  "<section class=\"review-form-page\">\n" +
+  "  <nav class=\"breadcrumb\" aria-label=\"Breadcrumb\">\n" +
+  "    <ol>\n" +
+  "      <li><a href=\"/\">Shop</a></li>\n" +
+  "      <li><a href=\"/products/{{slug}}\">{{title}}</a></li>\n" +
+  "      <li aria-current=\"page\">Ask a question</li>\n" +
+  "    </ol>\n" +
+  "  </nav>\n" +
+  "  <h1 class=\"review-form-page__title\">Ask about {{title}}</h1>\n" +
+  "  RAW_NOTICE_PLACEHOLDER\n" +
+  "  <form class=\"review-form\" method=\"post\" action=\"/products/{{slug}}/question\">\n" +
+  "    <label class=\"form-field\">\n" +
+  "      <span class=\"form-field__label\">Your question</span>\n" +
+  "      <textarea name=\"body\" maxlength=\"4000\" rows=\"6\" required></textarea>\n" +
+  "    </label>\n" +
+  "    <button type=\"submit\" class=\"btn-primary\">Submit question</button>\n" +
+  "  </form>\n" +
+  "</section>\n";
+
+// Auth-gated question form. `opts.product` carries { title, slug };
+// `opts.notice` is an optional error string rendered above the form
+// (e.g. a validation rejection bounced back from POST).
+function renderQuestionForm(opts) {
+  var esc = b.template.escapeHtml;
+  var notice = opts.notice
+    ? "<p class=\"form-notice form-notice--error\" role=\"alert\">" + esc(String(opts.notice)) + "</p>"
+    : "";
+  var body = _render(QA_FORM_PAGE, {
+    title: opts.product.title,
+    slug:  opts.product.slug,
+  })
+    .replace("RAW_NOTICE_PLACEHOLDER", notice);
+  return _wrap({
+    title:      "Ask about " + opts.product.title,
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
+// Generic single-message page for the Q&A flow (submission thank-you).
+// `cta` is an optional { href, label }. Reuses the review-message
+// layout classes.
+function _qaMessagePage(opts, heading, message, cta) {
+  var esc = b.template.escapeHtml;
+  var ctaHtml = cta
+    ? "<a class=\"btn-primary\" href=\"" + esc(cta.href) + "\">" + esc(cta.label) + "</a>"
+    : "";
+  var body =
+    "<section class=\"review-message\">" +
+      "<h1 class=\"review-message__title\">" + esc(heading) + "</h1>" +
+      "<p class=\"review-message__lede\">" + esc(message) + "</p>" +
+      ctaHtml +
+    "</section>";
+  return _wrap({
+    title:      heading,
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Remove control for a wishlist entry — a form POST back through the
 // toggle route with `return_to` so the customer lands back on the
 // account page (not the product PDP the default toggle returns to).
@@ -1999,6 +2126,7 @@ function renderProduct(opts) {
       // theme's `{{{ reviews_html }}}` raw slot. The bundled themes
       // include the slot; a custom theme opts in by adding it.
       reviews_html:   _buildReviews(opts.review_summary, opts.reviews, opts.review_cta),
+      qa_html:        _buildProductQa(opts.qa_questions, opts.qa_cta),
       wishlist_html:  _buildWishlist(opts.product.id, opts.wishlist_count),
       asset_css_main: opts.theme.assetUrl("css/main.css"),
     });
@@ -2009,6 +2137,7 @@ function renderProduct(opts) {
   if (!rows) rows = "<tr><td colspan=\"4\" class=\"empty\">No variants available.</td></tr>";
   var galleryHtml = _buildPdpGallery(opts.product, opts.media || [], opts.asset_prefix || "/assets/");
   var reviewsHtml = _buildReviews(opts.review_summary, opts.reviews, opts.review_cta);
+  var qaHtml = _buildProductQa(opts.qa_questions, opts.qa_cta);
   var wishlistHtml = _buildWishlist(opts.product.id, opts.wishlist_count);
   var body = _render(PRODUCT_PAGE, {
     title:        opts.product.title,
@@ -2018,7 +2147,8 @@ function renderProduct(opts) {
     .replace("RAW_GALLERY_PLACEHOLDER", galleryHtml)
     .replace("RAW_ROWS_PLACEHOLDER", rows)
     .replace("RAW_WISHLIST_PLACEHOLDER", wishlistHtml)
-    .replace("RAW_REVIEWS_PLACEHOLDER", reviewsHtml);
+    .replace("RAW_REVIEWS_PLACEHOLDER", reviewsHtml)
+    .replace("RAW_QA_PLACEHOLDER", qaHtml);
   // Product-specific OpenGraph + Twitter Card values so shares
   // unfurl as "Operator Tee — blamejs.shop" with the SVG hero, not
   // the default shop-level description + brand logo.
@@ -3407,6 +3537,27 @@ function mount(router, deps) {
       try { wishlistCount = await deps.wishlist.countForProduct(product.id); }
       catch (_e) { wishlistCount = 0; }
     }
+    // Published Q&A — approved questions + their approved answers. A
+    // failed read (e.g. the product_qa tables not yet migrated) degrades
+    // to the empty state rather than 500-ing the PDP — Q&A is
+    // supplementary to the buy path, like reviews. Mirrors the edge
+    // renderer's missing-table resilience.
+    var qaQuestions, qaCta;
+    if (deps.productQa) {
+      qaQuestions = [];
+      try {
+        var qList = (await deps.productQa.questionsForProduct({ product_id: product.id, limit: 20 })).rows;
+        for (var qi = 0; qi < qList.length; qi += 1) {
+          var qrow = qList[qi];
+          qrow.answers = await deps.productQa.answersForQuestion(qrow.id, { limit: 20 });
+          qaQuestions.push(qrow);
+        }
+      } catch (_e) { qaQuestions = []; }
+      // The form route enforces auth, so the CTA links there
+      // unconditionally; logged-out shoppers get redirected to login.
+      qaCta = "<a class=\"btn-secondary reviews__cta\" href=\"/products/" +
+        b.template.escapeHtml(product.slug) + "/question\">Ask a question</a>";
+    }
     // Log the view for a signed-in customer so it surfaces on their
     // "Recently viewed" account page. Drop-silent — a recording failure
     // (table not migrated, write contention) must never break the PDP
@@ -3428,6 +3579,8 @@ function mount(router, deps) {
       review_summary: reviewSummary,
       reviews:        reviewRows,
       review_cta:     reviewCta,
+      qa_questions:   qaQuestions,
+      qa_cta:         qaCta,
       wishlist_count: wishlistCount,
       shop_name:      shopName,
       cart_count:     cartCount,
@@ -5475,6 +5628,77 @@ function mount(router, deps) {
         ));
       });
     }
+
+    // Product Q&A — asking a question requires a logged-in customer (no
+    // verified-purchase gate; any signed-in shopper can ask). The
+    // question lands `pending` and surfaces on the PDP once an operator
+    // approves it. Customer-authored answers aren't accepted from the
+    // storefront — answering is an operator action in the admin console
+    // (the lib models customer answers, but exposing a public answer
+    // form invites an unmoderated reply surface we don't ship in v1;
+    // operators post the authoritative answer). Only mounts when the
+    // productQa primitive is wired.
+    if (deps.productQa) {
+      async function _qaGateContext(req, res) {
+        var slug = req.params && req.params.slug;
+        var product = slug ? await deps.catalog.products.bySlug(slug) : null;
+        if (!product) { _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme })); return null; }
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") { _serviceUnavailable(res, "auth not configured"); return null; }
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          res.end ? res.end() : res.send("");
+          return null;
+        }
+        var cartCount = await _cartCountForReq(req);
+        return { product: product, auth: auth, cartCount: cartCount };
+      }
+
+      router.get("/products/:slug/question", async function (req, res) {
+        var ctx = await _qaGateContext(req, res);
+        if (!ctx) return;
+        _send(res, 200, renderQuestionForm({
+          product:    { title: ctx.product.title, slug: ctx.product.slug },
+          shop_name:  shopName,
+          cart_count: ctx.cartCount,
+        }));
+      });
+
+      router.post("/products/:slug/question", async function (req, res) {
+        var ctx = await _qaGateContext(req, res);
+        if (!ctx) return;
+        var body = req.body || {};
+        try {
+          await deps.productQa.submitQuestion({
+            product_id:  ctx.product.id,
+            customer_id: ctx.auth.customer_id,
+            body:        body.body,
+          });
+        } catch (e) {
+          // Shape rejections bounce back to the form with the reason;
+          // anything else is a real 500.
+          if (e instanceof TypeError) {
+            return _send(res, 400, renderQuestionForm({
+              product:    { title: ctx.product.title, slug: ctx.product.slug },
+              notice:     (e && e.message) || "Please check your question and try again.",
+              shop_name:  shopName,
+              cart_count: ctx.cartCount,
+            }));
+          }
+          throw e;
+        }
+        _send(res, 200, _qaMessagePage(
+          { shop_name: shopName, cart_count: ctx.cartCount },
+          "Thanks for your question",
+          "Your question has been submitted and is pending moderation. It will appear on the product page once an operator approves and answers it.",
+          { href: "/products/" + ctx.product.slug, label: "Back to product" },
+        ));
+      });
+    }
   }
 
   // POST /cart/lines — add a line. Reads variant_id + qty from the

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.12.63",
-      "tag": "v0.12.63",
+      "version": "0.12.66",
+      "tag": "v0.12.66",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,12 @@ upgrading across more than a few patches at a time.
 
 ## v0.12.x
 
+- v0.12.66 (2026-05-26) — **`b.uriTemplate` — RFC 6570 URI Template expansion.** Expand RFC 6570 URI Templates — the {var} syntax that OpenAPI links, HAL _links, and hypermedia API clients use to turn a template plus a set of variables into a concrete URI. The full Level 4 grammar is supported: every operator ({+var} reserved, {#var} fragment, {.var} label, {/var} path, {;var} path-style parameters, {?var} query, {&var} query continuation), the {var:3} prefix modifier, and the {var*} explode modifier for lists and associative arrays. b.uriTemplate.expand(template, vars) returns the expanded string; b.uriTemplate.compile(template) parses once for templates applied to many variable sets. A malformed template (unclosed expression, reserved operator, non-numeric prefix, unmatched brace) throws UriTemplateError. Verified against the official uritemplate-test conformance suite (all 135 spec, extended, and negative cases). **Added:** *`b.uriTemplate.expand` / `b.uriTemplate.compile`* — RFC 6570 URI Template expansion, full Level 4. `expand(template, vars)` substitutes variables into a template and returns the URI; `compile(template)` returns a reusable `{ expand }` for repeated use. Variable values may be strings, numbers, booleans, arrays (lists), or plain objects (associative arrays); undefined, null, and empty list/map variables are omitted. All eight operators, the `:N` prefix modifier, and the `*` explode modifier follow §3.2, including reserved-set encoding for `{+var}` / `{#var}`. Composes naturally with `b.hal`, `b.linkHeader`, and `b.openapi` link objects. A malformed template throws `UriTemplateError`.
+
+- v0.12.65 (2026-05-26) — **`b.base32` — RFC 4648 Base32 encode / decode.** Encode and decode RFC 4648 Base32 — the case-insensitive alphabet behind TOTP / 2FA secrets, DNSSEC NSEC3 hashes, and human-transcribable identifiers. Both RFC 4648 variants are supported: the standard alphabet (the default) and the extended-hex alphabet. b.base32.encode pads to an 8-character boundary by default (pass padding: false for the bare form TOTP key URIs use); b.base32.decode is strict by default but accepts the real-world shapes humans produce — lower-case, embedded spaces and dashes, missing padding — under loose: true. Verified against the RFC 4648 §10 test vectors for both alphabets. The TOTP primitive now composes this codec instead of carrying its own Base32 implementation. **Added:** *`b.base32.encode` / `b.base32.decode`* — RFC 4648 Base32 codec. `encode(buf, opts)` takes a Buffer or Uint8Array and returns a Base32 string, padded to an 8-character boundary unless `padding: false`; `decode(str, opts)` returns a Buffer. The `variant` option selects the standard (`"rfc4648"`, default) or extended-hex (`"rfc4648-hex"`) alphabet. Decoding is strict by default — any character outside the alphabet throws `Base32Error` — and `loose: true` up-cases the input and ignores embedded spaces, dashes, and missing padding, which is how copied TOTP keys and hand-typed codes arrive. **Changed:** *TOTP composes `b.base32`* — `b.auth.totp` now encodes and decodes its secrets through `b.base32` rather than a private Base32 implementation. Behavior is unchanged — secrets are still emitted unpadded and parsed leniently (case-insensitive, ignoring spaces and dashes).
+
+- v0.12.64 (2026-05-25) — **`b.jsonSchema` — JSON Schema 2020-12 validation.** Validate JSON against a JSON Schema 2020-12 document — the dialect OpenAPI 3.1 adopted and the most widely implemented schema language. b.jsonSchema.compile(schema) returns a reusable validator; b.jsonSchema.validate(schema, instance) compiles and runs in one call, returning { valid, errors } where each error names the failing instance location, keyword, and schema path. The full 2020-12 vocabulary is supported: every applicator (allOf / anyOf / oneOf / not / if-then-else, properties / patternProperties / additionalProperties / prefixItems / items / contains), the annotation-aware unevaluatedProperties / unevaluatedItems, every assertion keyword, and reference resolution ($ref / $anchor / $dynamicRef / $dynamicAnchor / $defs / $id base URIs). format is an annotation by default (opt in to assertion with assertFormat). External references resolve through an operator-supplied schema map — never a network fetch. Verified against the official JSON-Schema-Test-Suite (1292 of 1295 draft2020-12 cases; the remainder need the bundled dialect metaschema or $vocabulary selection, both opt-in). This is the standards-track counterpart to the fluent b.safeSchema builder and the portable b.jtd. **Added:** *`b.jsonSchema` — JSON Schema 2020-12* — `compile(schema, opts)` returns `{ validate, isValid }`; `validate(schema, instance, opts)` and `isValid(schema, instance, opts)` compile and run in one call. `validate` returns `{ valid, errors }`, each error a `{ instancePath, keyword, schemaPath, message }`. The full 2020-12 vocabulary is implemented — applicators, annotation-aware `unevaluatedProperties` / `unevaluatedItems`, every assertion keyword, and `$ref` / `$anchor` / `$dynamicRef` / `$dynamicAnchor` / `$defs` / `$id` resolution. `format` is an annotation by default (`assertFormat: true` to assert). External references resolve through `opts.schemas` (a URI→schema map), never a network fetch. Reach for it when the schema is an existing JSON Schema document (an API contract, OpenAPI component, or config schema); `b.safeSchema` remains the fluent in-process builder and `b.jtd` the portable codegen-friendly option. Validating a schema document against the dialect metaschema requires supplying that metaschema via `opts.schemas`, and `$vocabulary`-based keyword selection is not honored (every standard keyword always asserts).
+
 - v0.12.63 (2026-05-25) — **`b.cloudEvents` gains the JSON event format, batch, and the HTTP binding.** b.cloudEvents grows beyond wrap / parse into a full CloudEvents 1.0.2 surface. b.cloudEvents.validate / isValid check an envelope against the spec without throwing (the non-throwing companion to parse). toJSON / fromJSON serialize and parse the JSON event format, and toJSONBatch / fromJSONBatch handle the JSON batch format; untrusted bodies parse through the framework's bounded, prototype-pollution-safe JSON reader. The new http.* binding speaks both content modes the spec defines — binary mode spreads context attributes across percent-encoded ce-* headers with the data in the body, structured mode carries the whole event as application/cloudevents+json — plus the batch mode, and http.decode auto-detects the incoming mode from Content-Type exactly as a conformant receiver does. Verified against the spec's normative example events. **Added:** *`b.cloudEvents` JSON event format, batch, and HTTP binding* — `validate` / `isValid` report spec violations without throwing (the non-throwing companion to `parse`). `toJSON` / `fromJSON` and `toJSONBatch` / `fromJSONBatch` serialize and parse the JSON event and batch formats over the existing envelope shape. `http.encodeBinary` / `http.encodeStructured` / `http.encodeBatch` render the three HTTP content modes — binary spreads attributes across percent-encoded `ce-*` headers, structured and batched carry the event(s) as `application/cloudevents+json` / `application/cloudevents-batch+json` — and `http.decode` parses a request back into an envelope (or array) by auto-detecting the mode from `Content-Type`. `b.jtd` or `b.safeSchema` still validate the event's `data` payload. **Fixed:** *`b.csp.build` accepts `fenced-frame-src` and `webrtc`* — The CSP3 `fenced-frame-src` directive — which the default security-headers policy emits to block `<fencedframe>` embeds — was missing from the builder's recognized-directive set, so the default policy could not round-trip through `b.csp.build` (it threw `csp/unknown-directive`). Both `fenced-frame-src` and the CSP3 `webrtc` directive are now recognized.
 
 - v0.12.62 (2026-05-26) — **`b.jtd` — JSON Type Definition validation (RFC 8927).** Validate JSON against a JSON Type Definition schema (RFC 8927) — a small, portable, cross-implementation schema language, the interop-friendly companion to the framework's fluent b.safeSchema builder. b.jtd.validate(schema, instance) returns an array of { instancePath, schemaPath } errors (empty = valid); b.jtd.isValid is the boolean form. All eight schema forms are supported — empty, type, enum, elements, properties (with optional / additional properties and nullable), values, discriminator (with mapping), and ref (with definitions) — including the integer-range and RFC 3339 timestamp types. A malformed schema is rejected at compile time with jtd/bad-schema rather than silently mis-validating. Verified against the official json-typedef-spec suites: all 316 validation cases and all 49 invalid-schema cases. **Added:** *`b.jtd.validate(schema, instance)` / `b.jtd.isValid(schema, instance)`* — `validate` returns the RFC 8927 error list — each `{ instancePath, schemaPath }` naming the offending value and the broken schema rule — and `isValid` is the boolean convenience form. Supports every JTD form and type: the numeric types enforce their exact ranges (int8 … uint32, float32 / float64), `timestamp` requires an RFC 3339 date-time, `properties` honours `optionalProperties` / `additionalProperties` / `nullable`, and `discriminator` selects a `mapping` schema by a tag property. The schema is checked for well-formedness before validation, so unknown keywords, multiple forms, bad refs, or a discriminator over a non-properties mapping all throw `jtd/bad-schema`. Use JTD for schemas you share across implementations or generate code from; use `b.safeSchema` for in-process fluent validation.

package/lib/vendor/blamejs/README.md

@@ -99,7 +99,10 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **Signed webhooks + API encryption** — SLH-DSA-SHAKE-256f default; ML-DSA-65 opt-in; ECIES API encryption (`b.webhook`, `b.crypto`)
 - **HPKE / HTTP signatures** — RFC 9180 HPKE with ML-KEM-1024 + HKDF-SHA3-512 + ChaCha20-Poly1305 (`b.crypto.hpke`); RFC 9421 HTTP Message Signatures with derived components and ed25519 / ML-DSA-65 (`b.crypto.httpSig`); RFC 9530 Content-Digest / Repr-Digest body-integrity fields (SHA-256 / SHA-512, legacy algorithms refused — `b.contentDigest`) to sign the digest rather than the whole body
 - **Link header** — RFC 8288 Web Linking codec (`b.linkHeader.parse` / `serialize`): parse and build `Link: <uri>; rel="next"` relations, the standard REST pagination mechanism; quote-aware (a comma inside a quoted parameter never splits the list)
+- **URI Templates** — RFC 6570 expansion (`b.uriTemplate.expand` / `compile`): full Level 4 — every operator, the `:N` prefix and `*` explode modifiers — turning `{/path}{?q*}` plus variables into a concrete URI; validated against the official uritemplate-test suite. The `{var}` syntax behind OpenAPI links and HAL `_links`
 - **JSON Type Definition** — RFC 8927 validation (`b.jtd.validate` / `isValid`): portable, cross-implementation schema validation (all eight forms — type / enum / elements / properties / values / discriminator / ref / empty), returning instancePath / schemaPath errors; validated against the official 316-case suite. Interop companion to the fluent `b.safeSchema` builder
+- **JSON Schema 2020-12** — the OpenAPI 3.1 dialect (`b.jsonSchema.compile` / `validate` / `isValid`): full vocabulary including every applicator, annotation-aware `unevaluatedProperties` / `unevaluatedItems`, and `$ref` / `$dynamicRef` / `$anchor` / `$id` resolution (external refs via an operator-supplied schema map, never a network fetch); `format` is an annotation unless `assertFormat` is set; returns located `{ valid, errors }`. Validated against the official JSON-Schema-Test-Suite. Standards-track counterpart to `b.safeSchema` and `b.jtd`
+- **Base32** — RFC 4648 codec (`b.base32.encode` / `decode`): standard + extended-hex alphabets, padded or bare, strict or lenient decode (case-insensitive, ignoring spaces / dashes for copied TOTP keys); validated against the RFC 4648 §10 vectors. The codec behind `b.auth.totp` secrets
 - **JSONPath** — full RFC 9535 query evaluator (`b.jsonPath.query` / `paths`): name / wildcard / index / slice / descendant selectors, `?filter` expressions, and the five standard functions, with compile-time well-typedness checks (validated against the official 703-case compliance suite); complements the JSONPath guards
 - **JSON Pointer / Patch** — RFC 6901 `b.jsonPointer.get` (reference a value by `/foo/0/bar`) + RFC 6902 `b.jsonPatch.apply` (atomic add / remove / replace / move / copy / test for HTTP PATCH; the input document is never mutated, structural `test` comparison) + RFC 7396 `b.jsonMergePatch.merge` (the `merge-patch+json` partial-document format; both PATCH formats are prototype-pollution-safe)
 - **Canonical JSON** — RFC 8785 JSON Canonicalization Scheme (`b.canonicalJson.stringifyJcs`): the deterministic, sorted-key byte form to hash or sign (custom credentials, receipts, deterministic request signing); UTF-16 key ordering + ECMAScript number formatting, with a lenient `stringify` variant for Buffers / Dates / BigInts

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.12.63",
-  "createdAt": "2026-05-26T04:30:08.809Z",
+  "frameworkVersion": "0.12.66",
+  "createdAt": "2026-05-26T09:03:41.849Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -4781,6 +4781,36 @@
         }
       }
     },
+    "base32": {
+      "type": "object",
+      "members": {
+        "ALPHABETS": {
+          "type": "object",
+          "members": {
+            "rfc4648": {
+              "type": "primitive",
+              "valueType": "string"
+            },
+            "rfc4648-hex": {
+              "type": "primitive",
+              "valueType": "string"
+            }
+          }
+        },
+        "Base32Error": {
+          "type": "function",
+          "arity": 4
+        },
+        "decode": {
+          "type": "function",
+          "arity": 2
+        },
+        "encode": {
+          "type": "function",
+          "arity": 2
+        }
+      }
+    },
     "bootGates": {
       "type": "object",
       "members": {
@@ -37108,6 +37138,31 @@
         }
       }
     },
+    "jsonSchema": {
+      "type": "object",
+      "members": {
+        "DIALECT": {
+          "type": "primitive",
+          "valueType": "string"
+        },
+        "JsonSchemaError": {
+          "type": "function",
+          "arity": 4
+        },
+        "compile": {
+          "type": "function",
+          "arity": 2
+        },
+        "isValid": {
+          "type": "function",
+          "arity": 3
+        },
+        "validate": {
+          "type": "function",
+          "arity": 3
+        }
+      }
+    },
     "jtd": {
       "type": "object",
       "members": {
@@ -49338,6 +49393,23 @@
         }
       }
     },
+    "uriTemplate": {
+      "type": "object",
+      "members": {
+        "UriTemplateError": {
+          "type": "function",
+          "arity": 4
+        },
+        "compile": {
+          "type": "function",
+          "arity": 1
+        },
+        "expand": {
+          "type": "function",
+          "arity": 2
+        }
+      }
+    },
     "uuid": {
       "type": "object",
       "members": {

package/lib/vendor/blamejs/index.js

@@ -403,6 +403,9 @@ var jsonPatch = require("./lib/json-patch");
 var jsonMergePatch = require("./lib/json-merge-patch");
 var jsonPath = require("./lib/json-path");
 var jtd = require("./lib/jtd");
+var jsonSchema = require("./lib/json-schema");
+var base32 = require("./lib/base32");
+var uriTemplate = require("./lib/uri-template");
 var standardWebhooks = require("./lib/standard-webhooks");
 var lro = require("./lib/lro");
 var jsonApi = require("./lib/jsonapi");
@@ -427,6 +430,9 @@ module.exports = {
   jsonMergePatch:   jsonMergePatch,
   jsonPath:         jsonPath,
   jtd:              jtd,
+  jsonSchema:       jsonSchema,
+  base32:           base32,
+  uriTemplate:      uriTemplate,
   standardWebhooks: standardWebhooks,
   lro:              lro,
   jsonApi:          jsonApi,

package/lib/vendor/blamejs/lib/base32.js

@@ -0,0 +1,154 @@
+"use strict";
+/**
+ * @module b.base32
+ * @nav    Data
+ * @title  Base32
+ *
+ * @intro
+ *   Encode and decode <a href="https://www.rfc-editor.org/rfc/rfc4648">RFC
+ *   4648</a> Base32 — the case-insensitive, digit-light alphabet used for
+ *   TOTP / 2FA secrets, DNSSEC NSEC3 hashes, and human-transcribable
+ *   identifiers. Both RFC 4648 variants are supported: the standard
+ *   alphabet (<code>variant: "rfc4648"</code>, default) and the
+ *   extended-hex alphabet (<code>variant: "rfc4648-hex"</code>, which sorts
+ *   in the same order as the underlying bytes).
+ *
+ *   <code>encode</code> pads to an 8-character boundary with
+ *   <code>=</code> by default (pass <code>padding: false</code> for the
+ *   bare form TOTP key URIs use). <code>decode</code> is strict by default
+ *   — it rejects any character outside the alphabet — but
+ *   <code>loose: true</code> accepts the real-world shapes humans produce:
+ *   lower-case input, embedded spaces and dashes, and missing padding.
+ *
+ * @card
+ *   RFC 4648 Base32 encode / decode (standard + extended-hex alphabets,
+ *   padded or bare, strict or lenient) — the codec behind TOTP secrets and
+ *   transcribable identifiers.
+ */
+
+var { defineClass } = require("./framework-error");
+
+var Base32Error = defineClass("Base32Error", { alwaysPermanent: true });
+
+var ALPHABETS = {
+  "rfc4648": "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567",
+  "rfc4648-hex": "0123456789ABCDEFGHIJKLMNOPQRSTUV",
+};
+// Reverse lookups per variant: char-code → 5-bit value.
+var LOOKUPS = {};
+Object.keys(ALPHABETS).forEach(function (v) {
+  var map = {};
+  for (var i = 0; i < ALPHABETS[v].length; i++) map[ALPHABETS[v].charAt(i)] = i;
+  LOOKUPS[v] = map;
+});
+
+var GROUP = 8;                                              // allow:raw-byte-literal — Base32 emits 8 chars per 5 input bytes (RFC 4648 §6)
+var BITS = 5;                                               // 5 bits per Base32 symbol
+
+function _alphabet(variant) {
+  var a = ALPHABETS[variant || "rfc4648"];
+  if (!a) throw new Base32Error("base32/bad-variant", "base32: variant must be 'rfc4648' or 'rfc4648-hex'");
+  return a;
+}
+
+/**
+ * @primitive  b.base32.encode
+ * @signature  b.base32.encode(input, opts?)
+ * @since      0.12.65
+ * @status     stable
+ * @related    b.base32.decode
+ *
+ * Encode a Buffer (or Uint8Array) to an RFC 4648 Base32 string. Output is
+ * padded to an 8-character boundary with <code>=</code> unless
+ * <code>padding: false</code>. The empty input encodes to the empty string.
+ *
+ * @opts
+ *   variant:   "rfc4648" | "rfc4648-hex",   // default: "rfc4648"
+ *   padding:   boolean,                      // default: true
+ *
+ * @example
+ *   b.base32.encode(Buffer.from("foobar"));
+ *   // → "MFRGGZDFMZTWQ===="
+ */
+function encode(input, opts) {
+  opts = opts || {};
+  var buf;
+  if (Buffer.isBuffer(input)) buf = input;
+  else if (input instanceof Uint8Array) buf = Buffer.from(input);
+  else throw new Base32Error("base32/bad-input", "base32.encode: input must be a Buffer or Uint8Array");
+  var alphabet = _alphabet(opts.variant);
+  var pad = opts.padding !== false;
+
+  var out = "";
+  var value = 0, bits = 0;
+  for (var i = 0; i < buf.length; i++) {
+    value = (value << 8) | buf[i];                          // allow:raw-byte-literal — shift in one input byte
+    bits += 8;                                              // allow:raw-byte-literal — eight bits per input byte
+    while (bits >= BITS) {
+      out += alphabet.charAt((value >>> (bits - BITS)) & 31);   // allow:raw-byte-literal — low 5 bits mask (2^5 - 1)
+      bits -= BITS;
+    }
+  }
+  if (bits > 0) out += alphabet.charAt((value << (BITS - bits)) & 31);   // allow:raw-byte-literal — final partial group, low 5 bits
+  if (pad) while (out.length % GROUP !== 0) out += "=";
+  return out;
+}
+
+/**
+ * @primitive  b.base32.decode
+ * @signature  b.base32.decode(str, opts?)
+ * @since      0.12.65
+ * @status     stable
+ * @related    b.base32.encode
+ *
+ * Decode an RFC 4648 Base32 string to a Buffer. Strict by default: any
+ * character outside the variant's alphabet (other than trailing
+ * <code>=</code> padding) throws <code>Base32Error</code>. With
+ * <code>loose: true</code> the decoder up-cases the input and ignores
+ * embedded spaces and dashes (and missing padding) — the shapes TOTP keys
+ * and hand-typed codes take.
+ *
+ * @opts
+ *   variant:   "rfc4648" | "rfc4648-hex",   // default: "rfc4648"
+ *   loose:     boolean,                      // default: false
+ *
+ * @example
+ *   b.base32.decode("MFRGGZDFMZTWQ====").toString();
+ *   // → "foobar"
+ */
+function decode(str, opts) {
+  opts = opts || {};
+  if (typeof str !== "string") throw new Base32Error("base32/bad-input", "base32.decode: input must be a string");
+  _alphabet(opts.variant);
+  var lookup = LOOKUPS[opts.variant || "rfc4648"];
+  var loose = opts.loose === true;
+
+  var bytes = [];
+  var value = 0, bits = 0;
+  var inPad = false;   // once "=" padding starts, only more "=" may follow
+  for (var i = 0; i < str.length; i++) {
+    var ch = str.charAt(i);
+    if (ch === "=") { inPad = true; continue; }             // trailing padding
+    if (loose && (ch === " " || ch === "-")) continue;      // ignore separators
+    // A data character after padding is malformed in either mode — the "="
+    // run must be trailing (rejects "M=Y======" / "MZXW=6YTB").
+    if (inPad) throw new Base32Error("base32/bad-char", "base32.decode: data character '" + ch + "' after padding at index " + i);
+    if (loose) ch = ch.toUpperCase();
+    var idx = lookup[ch];
+    if (idx === undefined) throw new Base32Error("base32/bad-char", "base32.decode: invalid Base32 character '" + str.charAt(i) + "' at index " + i);
+    value = (value << BITS) | idx;
+    bits += BITS;
+    if (bits >= 8) {                                        // allow:raw-byte-literal — emit a full output byte
+      bytes.push((value >>> (bits - 8)) & 0xff);            // allow:raw-byte-literal — eight-bit output byte mask
+      bits -= 8;                                            // allow:raw-byte-literal — consumed eight bits
+    }
+  }
+  return Buffer.from(bytes);
+}
+
+module.exports = {
+  encode:      encode,
+  decode:      decode,
+  ALPHABETS:   ALPHABETS,
+  Base32Error: Base32Error,
+};