@blamejs/blamejs-shop 0.1.29 → 0.1.31

package/lib/vendor/blamejs/release-notes/v0.12.68.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.68",
+  "date": "2026-05-26",
+  "headline": "`b.jwk` — RFC 7638 JWK thumbprint",
+  "summary": "Compute the RFC 7638 thumbprint of a JSON Web Key — the canonical base64url(SHA-256(canonical-JSON)) identifier used to name a key (DPoP jkt bindings, ACME account-key thumbprints, DBSC session pins, kid derivation). b.jwk.thumbprint(jwk) returns the digest; b.jwk.canonicalize(jwk) returns the exact JSON that is hashed — only the key-type's required members, member names in lexicographic order, no whitespace, so the same key always yields the same thumbprint regardless of how its JWK was serialized. The standard key types are supported (EC, RSA, oct, OKP per RFC 8037) plus AKP, the IANA key type Node uses for ML-DSA / SLH-DSA post-quantum public keys; SHA-256 is the default, with hash: \"sha384\" | \"sha512\" for RFC 9278 thumbprint-with-hash. Verified against the RFC 7638 §3.1 worked example. b.auth.dpop, b.acme, and b.dbsc now compute their thumbprints through this primitive.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.jwk.thumbprint` / `b.jwk.canonicalize`",
+          "body": "RFC 7638 JWK thumbprint. `thumbprint(jwk, opts)` returns `base64url(hash(canonical-JSON))` — only the key-type's required members feed the hash, so optional fields (`kid`, `use`, `alg`, …) never change the result. `canonicalize(jwk)` returns the canonical JSON string itself. Supports EC / RSA / oct / OKP and the AKP post-quantum key type; SHA-256 default, `hash` selects SHA-384 / SHA-512. Throws `JwkError` on an invalid key or unknown hash."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "DPoP, ACME, and DBSC compose `b.jwk`",
+          "body": "`b.auth.dpop` (the `jkt` proof-key thumbprint), `b.acme` (the RFC 8555 account-key authorization), and `b.dbsc` (the session-pin thumbprint) now compute RFC 7638 thumbprints through `b.jwk` instead of carrying their own implementations. Behavior is unchanged — DPoP still refuses symmetric key types, and each surface keeps its own error codes."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.12.69.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.69",
+  "date": "2026-05-26",
+  "headline": "`b.middleware.botGuard` no longer blocks browsers that omit Sec-Fetch-Mode",
+  "summary": "b.middleware.botGuard treated a missing Sec-Fetch-Mode header as a bot signal and returned 403 Forbidden, which refused legitimate browsers on any origin where the browser does not emit Fetch Metadata: every plain-HTTP non-localhost origin (Umbrel apps, LAN and *.local reverse-proxy deployments) and Safari before 16.4 even over HTTPS. Browsers only send Sec-Fetch-* in a secure context, so its absence is normal there — not a bot. Sec-Fetch-Mode is now advisory only: it never blocks, and it sets req.suspectedBot in mode:\"tag\" only on a secure-context HTML GET where a modern browser would have sent it. Drive-by bots are still blocked by the missing-Accept-Language and User-Agent heuristics. No configuration change is needed; if you had widened skipPaths or disabled bot-guard to work around this, you can revert that.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.middleware.botGuard` no longer 403s browsers over plain HTTP or older Safari",
+          "body": "A missing `Sec-Fetch-Mode` was a blocking heuristic, but browsers omit Fetch Metadata outside a secure context (every plain-HTTP non-localhost origin — Umbrel, LAN, `*.local` proxies) and Safari < 16.4 omits it even over HTTPS. Those legitimate browsers were refused with `403 Forbidden`. `Sec-Fetch-Mode` is now advisory: it never blocks, and only sets `req.suspectedBot` in `mode: \"tag\"` on a secure-context HTML GET. The `Accept-Language` and User-Agent heuristics (which catch the same bots) are unchanged."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "reserved-hostname trailing-dot detector recognizes regex strips",
+          "body": "The codebase-patterns gate that requires stripping the RFC 1034 trailing root-zone dot before a reserved-hostname comparison now also recognizes end-anchored regex strips (`.replace(/\\.$/, …)`), not only the `charAt` / `while`-loop forms."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/base32.test.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * Layer 0 — b.base32 (RFC 4648).
+ * Oracle: the RFC 4648 §10 test vectors for both the standard Base32
+ * alphabet and the extended-hex alphabet.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+// RFC 4648 §10 — standard Base32.
+var STD = [["", ""], ["f", "MY======"], ["fo", "MZXQ===="], ["foo", "MZXW6==="],
+  ["foob", "MZXW6YQ="], ["fooba", "MZXW6YTB"], ["foobar", "MZXW6YTBOI======"]];
+// RFC 4648 §10 — Base32 extended hex.
+var HEX = [["", ""], ["f", "CO======"], ["fo", "CPNG===="], ["foo", "CPNMU==="],
+  ["foob", "CPNMUOG="], ["fooba", "CPNMUOJ1"], ["foobar", "CPNMUOJ1E8======"]];
+
+function testSurface() {
+  check("b.base32.encode is a function", typeof b.base32.encode === "function");
+  check("b.base32.decode is a function", typeof b.base32.decode === "function");
+  check("b.base32.Base32Error is a class", typeof b.base32.Base32Error === "function");
+}
+
+function testVectors() {
+  var ep = 0, dp = 0;
+  STD.forEach(function (t) {
+    if (b.base32.encode(Buffer.from(t[0])) === t[1]) ep++; else check("std encode " + JSON.stringify(t[0]), false);
+    if (b.base32.decode(t[1]).toString() === t[0]) dp++; else check("std decode " + t[1], false);
+  });
+  check("RFC 4648 standard: all encode vectors", ep === STD.length);
+  check("RFC 4648 standard: all decode vectors", dp === STD.length);
+  var hep = 0, hdp = 0;
+  HEX.forEach(function (t) {
+    if (b.base32.encode(Buffer.from(t[0]), { variant: "rfc4648-hex" }) === t[1]) hep++; else check("hex encode " + JSON.stringify(t[0]), false);
+    if (b.base32.decode(t[1], { variant: "rfc4648-hex" }).toString() === t[0]) hdp++; else check("hex decode " + t[1], false);
+  });
+  check("RFC 4648 hex: all encode vectors", hep === HEX.length);
+  check("RFC 4648 hex: all decode vectors", hdp === HEX.length);
+}
+
+function testOptions() {
+  check("padding:false omits =", b.base32.encode(Buffer.from("f"), { padding: false }) === "MY");
+  check("round-trip random 20 bytes", (function () {
+    var buf = require("crypto").randomBytes(20);
+    return b.base32.decode(b.base32.encode(buf)).equals(buf);
+  })());
+  // loose decode: lower-case, spaces, dashes, missing padding.
+  check("loose decodes lower-case + separators", b.base32.decode("mzxw 6ytb-oi", { loose: true }).toString() === "foobar");
+  check("strict rejects lower-case", code(function () { b.base32.decode("mzxw6ytb"); }) === "base32/bad-char");
+  check("strict rejects bad char", code(function () { b.base32.decode("MZXW60TB"); }) === "base32/bad-char");
+  check("bad variant throws", code(function () { b.base32.encode(Buffer.from("x"), { variant: "nope" }); }) === "base32/bad-variant");
+  check("non-buffer encode throws", code(function () { b.base32.encode("not a buffer"); }) === "base32/bad-input");
+  check("non-string decode throws", code(function () { b.base32.decode(123); }) === "base32/bad-input");
+  // Embedded / non-trailing padding is malformed and must be rejected
+  // (not silently truncated at the first "=").
+  check("rejects embedded padding then data", code(function () { b.base32.decode("MZXW=6YTB"); }) === "base32/bad-char");
+  check("rejects padding then data (loose)", code(function () { b.base32.decode("mz=xw", { loose: true }); }) === "base32/bad-char");
+  check("accepts valid trailing padding", b.base32.decode("MZXW6YQ=").toString() === "foob");
+}
+
+function testTotpComposition() {
+  // The TOTP secret produced by generateSecret must decode through b.base32.
+  var secret = b.auth.totp.generateSecret();
+  check("totp secret decodes via b.base32 (loose)", b.base32.decode(secret, { loose: true }).length > 0);
+  // The TOTP secret is unpadded standard Base32 → re-encoding the decoded
+  // bytes (unpadded) reproduces the secret exactly.
+  check("totp secret round-trips through b.base32", b.base32.encode(b.base32.decode(secret, { loose: true }), { padding: false }) === secret);
+}
+
+async function run() {
+  testSurface();
+  testVectors();
+  testOptions();
+  testTotpComposition();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[base32] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/bot-guard.test.js

@@ -0,0 +1,102 @@
+"use strict";
+/**
+ * Layer 0 — b.middleware.botGuard.
+ * Focus: the Sec-Fetch-Mode heuristic must never refuse a real browser.
+ * Browsers omit Fetch Metadata (Sec-Fetch-*) on plain-HTTP non-localhost
+ * origins (Umbrel, LAN / *.local reverse proxies) AND in Safari < 16.4
+ * even over HTTPS — so a missing Sec-Fetch-Mode is advisory-only (tags in
+ * mode:"tag", never blocks). Drive-by bots are still blocked by the
+ * missing-Accept-Language and User-Agent heuristics.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+
+var BROWSER_UA = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120 Safari/537.36";
+
+function _run(opts, reqInit) {
+  var mw = b.middleware.botGuard(opts || {});
+  var req = b.testing.mockReq(reqInit);
+  var res = b.testing.mockRes();
+  var nexted = false;
+  mw(req, res, function () { nexted = true; });
+  var cap = res._captured();
+  return { nexted: nexted, blocked: cap.status === 403, status: cap.status, body: cap.body, suspectedBot: req.suspectedBot };
+}
+
+function testSurface() {
+  check("b.middleware.botGuard is a function", typeof b.middleware.botGuard === "function");
+  check("returns a (req,res,next) middleware", b.middleware.botGuard({}).length === 3);
+}
+
+function testSecFetchNeverBlocks() {
+  // The reported defect: a real browser on a plain-HTTP non-localhost
+  // origin (Umbrel app / LAN proxy) sends Accept-Language but no Sec-Fetch-*.
+  var umbrel = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "accept-language": "en-US", "user-agent": BROWSER_UA, host: "umbrel-dev.local:3080" } });
+  check("plain-HTTP browser (Umbrel) is NOT blocked", umbrel.nexted && !umbrel.blocked);
+
+  // Safari < 16.4 omits Sec-Fetch-* even over HTTPS — must not 403 either.
+  var safari = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "accept-language": "en-US", "user-agent": "Mozilla/5.0 (Macintosh) Version/15.6 Safari/605", host: "app.example.com" }, socket: { encrypted: true } });
+  check("Safari-over-HTTPS (no Sec-Fetch) is NOT blocked", safari.nexted && !safari.blocked);
+
+  // localhost over plain HTTP, no Sec-Fetch — also fine.
+  var local = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": BROWSER_UA, host: "localhost:3000" } });
+  check("localhost browser is NOT blocked", local.nexted && !local.blocked);
+
+  // A secure-context browser that DID send Sec-Fetch-Mode passes (sanity).
+  var modern = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": BROWSER_UA, "sec-fetch-mode": "navigate", host: "app.example.com" }, socket: { encrypted: true } });
+  check("modern HTTPS browser passes", modern.nexted && !modern.blocked);
+}
+
+function testBotsStillBlocked() {
+  // Missing Accept-Language remains a hard block.
+  var noLang = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "user-agent": BROWSER_UA, host: "app.example.com" }, socket: { encrypted: true } });
+  check("missing Accept-Language is blocked", noLang.blocked && noLang.status === 403 && noLang.body === "Forbidden");
+
+  // Known automation UA remains a hard block.
+  var curl = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": "curl/8.4.0", host: "app.example.com" } });
+  check("curl UA is blocked", curl.blocked && curl.status === 403);
+
+  var py = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": "python-requests/2.31.0", host: "x" } });
+  check("python-requests UA is blocked", py.blocked);
+}
+
+function testTagModeAdvisory() {
+  // mode:"tag" — secure context, no Sec-Fetch-Mode → advisory tag, never blocks.
+  var tagged = _run({ mode: "tag" }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": BROWSER_UA, host: "app.example.com" }, socket: { encrypted: true } });
+  check("tag mode: secure-context Sec-Fetch miss tags but continues", tagged.nexted && !tagged.blocked && tagged.suspectedBot === "missing-sec-fetch-mode");
+
+  // mode:"tag" — plain-HTTP non-localhost → NOT tagged for Sec-Fetch (insecure context).
+  var untagged = _run({ mode: "tag" }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": BROWSER_UA, host: "umbrel.local" } });
+  check("tag mode: plain-HTTP origin is NOT tagged for Sec-Fetch", untagged.nexted && !untagged.suspectedBot);
+}
+
+function testOverridesAndSkips() {
+  // allowedAgents override beats the deny-list.
+  var allowed = _run({ mode: "block", allowedAgents: [/^curl\//i] }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": "curl/8.4.0", host: "x" } });
+  check("allowedAgents override lets curl through", allowed.nexted && !allowed.blocked);
+
+  // API routes skip the browser-fingerprint checks (onlyForHtml default).
+  var api = _run({ mode: "block" }, { method: "GET", url: "/api/data", pathname: "/api/data", headers: { "user-agent": BROWSER_UA, host: "x" } });
+  check("API route skips fingerprint checks", api.nexted && !api.blocked);
+
+  // skipPaths bypass.
+  var skipped = _run({ mode: "block", skipPaths: ["/healthz"] }, { method: "GET", url: "/healthz", pathname: "/healthz", headers: { "user-agent": "curl/8" } });
+  check("skipPaths bypasses bot-guard", skipped.nexted && !skipped.blocked);
+
+  // RegExp patterns are required (string patterns refused at create()).
+  var threw = null;
+  try { b.middleware.botGuard({ blockedAgents: ["badbot"] }); } catch (e) { threw = e.code; }
+  check("string blockedAgents pattern is refused", threw === "bot-guard/bad-pattern");
+}
+
+async function run() {
+  testSurface();
+  testSecFetchNeverBlocks();
+  testBotsStillBlocked();
+  testTagModeAdvisory();
+  testOverridesAndSkips();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[bot-guard] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -7963,7 +7963,10 @@ function testHostnameCompareTrailingDotNormalize() {
     catch (_e) { continue; }
     if (!reservedHostLiteralRe.test(content)) continue;
     var hasStrip = /\.charAt\([^)]*length\s*-\s*1\)\s*===\s*"\."/.test(content) ||
-                   /while[\s\S]{0,80}length\s*>\s*0[\s\S]{0,80}charAt[\s\S]{0,80}===\s*"\."/.test(content);
+                   /while[\s\S]{0,80}length\s*>\s*0[\s\S]{0,80}charAt[\s\S]{0,80}===\s*"\."/.test(content) ||
+                   // end-anchored regex strip of one-or-more trailing dots:
+                   // .replace(/\.$/, ...) / .replace(/\.+$/, ...) / .replace(/\.*$/, ...)
+                   /\.replace\(\s*\/\\\.[+*]?\$\//.test(content);
     if (hasStrip) continue;
     var m = content.match(reservedHostLiteralRe);
     var lineNum = content.slice(0, m.index).split("\n").length;

package/lib/vendor/blamejs/test/layer-0-primitives/json-schema.test.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * Layer 0 — b.jsonSchema (JSON Schema 2020-12).
+ * Oracle: the official json-schema-org/JSON-Schema-Test-Suite draft2020-12
+ * (1292 of 1295 cases pass during development; the 3 skipped require the
+ * bundled dialect metaschema or $vocabulary selection — both opt-in). This
+ * file embeds a representative slice across the vocabulary plus the surface
+ * + reference-resolution + annotation cases that exercise the tricky paths.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+function testSurface() {
+  check("b.jsonSchema.validate is a function", typeof b.jsonSchema.validate === "function");
+  check("b.jsonSchema.compile is a function", typeof b.jsonSchema.compile === "function");
+  check("b.jsonSchema.isValid is a function", typeof b.jsonSchema.isValid === "function");
+  check("b.jsonSchema.DIALECT is 2020-12", b.jsonSchema.DIALECT === "https://json-schema.org/draft/2020-12/schema");
+  check("b.jsonSchema.JsonSchemaError is a class", typeof b.jsonSchema.JsonSchemaError === "function");
+  check("compile rejects non-schema", code(function () { b.jsonSchema.compile(42); }) === "json-schema/bad-schema");
+  var v = b.jsonSchema.compile({ type: "integer" });
+  check("compiled validator has validate + isValid", typeof v.validate === "function" && typeof v.isValid === "function");
+}
+
+function testAssertions() {
+  check("type integer accepts int", b.jsonSchema.isValid({ type: "integer" }, 3));
+  check("type integer rejects float", !b.jsonSchema.isValid({ type: "integer" }, 3.5));
+  check("type rejects wrong type", !b.jsonSchema.isValid({ type: "string" }, 1));
+  check("enum", b.jsonSchema.isValid({ enum: ["a", "b"] }, "b") && !b.jsonSchema.isValid({ enum: ["a"] }, "z"));
+  check("const deep-equal", b.jsonSchema.isValid({ const: { a: [1, 2] } }, { a: [1, 2] }) && !b.jsonSchema.isValid({ const: { a: [1] } }, { a: [2] }));
+  check("multipleOf", b.jsonSchema.isValid({ multipleOf: 3 }, 9) && !b.jsonSchema.isValid({ multipleOf: 3 }, 10));
+  check("maximum/exclusiveMaximum", b.jsonSchema.isValid({ maximum: 5 }, 5) && !b.jsonSchema.isValid({ exclusiveMaximum: 5 }, 5));
+  check("minLength counts code points", !b.jsonSchema.isValid({ minLength: 2 }, "😀") && b.jsonSchema.isValid({ maxLength: 1 }, "😀"));
+  check("pattern", b.jsonSchema.isValid({ pattern: "^a+$" }, "aaa") && !b.jsonSchema.isValid({ pattern: "^a+$" }, "b"));
+}
+
+function testArrays() {
+  check("prefixItems + items", b.jsonSchema.isValid({ prefixItems: [{ type: "number" }], items: { type: "string" } }, [1, "a", "b"]));
+  check("items rejects bad tail", !b.jsonSchema.isValid({ prefixItems: [{ type: "number" }], items: { type: "string" } }, [1, 2]));
+  check("uniqueItems", b.jsonSchema.isValid({ uniqueItems: true }, [1, 2, 3]) && !b.jsonSchema.isValid({ uniqueItems: true }, [1, 1]));
+  check("contains + minContains", b.jsonSchema.isValid({ contains: { const: 2 }, minContains: 2 }, [2, 2, 3]) && !b.jsonSchema.isValid({ contains: { const: 2 }, minContains: 2 }, [2, 3]));
+  check("maxItems/minItems", !b.jsonSchema.isValid({ maxItems: 1 }, [1, 2]) && !b.jsonSchema.isValid({ minItems: 2 }, [1]));
+}
+
+function testObjects() {
+  var s = { type: "object", properties: { n: { type: "integer" } }, required: ["n"], additionalProperties: false };
+  check("properties + required pass", b.jsonSchema.isValid(s, { n: 1 }));
+  check("required missing fails", !b.jsonSchema.isValid(s, {}));
+  check("additionalProperties:false rejects extra", !b.jsonSchema.isValid(s, { n: 1, x: 2 }));
+  check("patternProperties", b.jsonSchema.isValid({ patternProperties: { "^x": { type: "number" } } }, { x1: 1 }) && !b.jsonSchema.isValid({ patternProperties: { "^x": { type: "number" } } }, { x1: "a" }));
+  check("propertyNames", !b.jsonSchema.isValid({ propertyNames: { pattern: "^a" } }, { b: 1 }));
+  check("dependentRequired", !b.jsonSchema.isValid({ dependentRequired: { a: ["b"] } }, { a: 1 }));
+  check("dependentSchemas", !b.jsonSchema.isValid({ dependentSchemas: { a: { required: ["b"] } } }, { a: 1 }));
+}
+
+function testApplicators() {
+  check("allOf", b.jsonSchema.isValid({ allOf: [{ type: "number" }, { minimum: 0 }] }, 5) && !b.jsonSchema.isValid({ allOf: [{ type: "number" }, { minimum: 0 }] }, -1));
+  check("anyOf", b.jsonSchema.isValid({ anyOf: [{ type: "string" }, { type: "number" }] }, 1) && !b.jsonSchema.isValid({ anyOf: [{ type: "string" }] }, 1));
+  check("oneOf exactly one", b.jsonSchema.isValid({ oneOf: [{ multipleOf: 2 }, { multipleOf: 3 }] }, 4) && !b.jsonSchema.isValid({ oneOf: [{ multipleOf: 2 }, { multipleOf: 3 }] }, 6));
+  check("not", b.jsonSchema.isValid({ not: { type: "string" } }, 1) && !b.jsonSchema.isValid({ not: { type: "string" } }, "x"));
+  check("if/then/else", b.jsonSchema.isValid({ if: { type: "number" }, then: { minimum: 0 }, else: { type: "string" } }, 5) && b.jsonSchema.isValid({ if: { type: "number" }, then: { minimum: 0 }, else: { type: "string" } }, "x") && !b.jsonSchema.isValid({ if: { type: "number" }, then: { minimum: 0 } }, -1));
+  check("boolean schema true/false", b.jsonSchema.isValid(true, 42) && !b.jsonSchema.isValid(false, 42));
+}
+
+function testUnevaluated() {
+  // unevaluatedProperties sees annotations from $ref inside allOf.
+  var s = {
+    $defs: { one: { properties: { a: true } } },
+    allOf: [{ $ref: "#/$defs/one" }, { properties: { b: true } }],
+    unevaluatedProperties: false,
+  };
+  check("unevaluatedProperties + ref-in-allOf accepts evaluated", b.jsonSchema.isValid(s, { a: 1, b: 2 }));
+  check("unevaluatedProperties + ref-in-allOf rejects unevaluated", !b.jsonSchema.isValid(s, { a: 1, c: 3 }));
+  check("unevaluatedItems", b.jsonSchema.isValid({ prefixItems: [{ type: "number" }], unevaluatedItems: false }, [1]) && !b.jsonSchema.isValid({ prefixItems: [{ type: "number" }], unevaluatedItems: false }, [1, 2]));
+}
+
+function testRefs() {
+  // $ref to $defs + $anchor.
+  check("$ref to $defs", b.jsonSchema.isValid({ $defs: { pos: { minimum: 0 } }, $ref: "#/$defs/pos" }, 5));
+  check("$anchor ref", b.jsonSchema.isValid({ $defs: { p: { $anchor: "pos", minimum: 0 } }, $ref: "#pos" }, 5));
+  // External schema via opts.schemas (no network).
+  var ext = { "https://example.com/int": { type: "integer" } };
+  check("external $ref via opts.schemas", b.jsonSchema.isValid({ $ref: "https://example.com/int" }, 3, { schemas: ext }));
+  check("external $ref rejects", !b.jsonSchema.isValid({ $ref: "https://example.com/int" }, "x", { schemas: ext }));
+  // $dynamicRef / $dynamicAnchor (the recursive bookend pattern).
+  var dyn = {
+    $id: "https://example.com/tree",
+    $dynamicAnchor: "node",
+    type: "object",
+    properties: { data: true, children: { type: "array", items: { $dynamicRef: "#node" } } },
+  };
+  check("$dynamicRef recursion validates", b.jsonSchema.isValid(dyn, { data: 1, children: [{ data: 2, children: [] }] }));
+}
+
+function testErrorsShape() {
+  var r = b.jsonSchema.validate({ type: "object", properties: { n: { type: "integer" } } }, { n: "bad" });
+  check("validate returns {valid, errors}", r.valid === false && Array.isArray(r.errors) && r.errors.length >= 1);
+  check("error names instancePath + keyword", r.errors[0].instancePath === "/n" && r.errors[0].keyword === "type");
+}
+
+function testFormat() {
+  // format is an annotation by default (does not assert).
+  check("format annotation by default", b.jsonSchema.isValid({ type: "string", format: "email" }, "not-an-email"));
+  // assertFormat:true turns it into an assertion.
+  check("assertFormat rejects bad email", !b.jsonSchema.isValid({ type: "string", format: "email" }, "nope", { assertFormat: true }));
+  check("assertFormat accepts good date-time", b.jsonSchema.isValid({ type: "string", format: "date-time" }, "2020-01-01T00:00:00Z", { assertFormat: true }));
+  // time requires an offset and valid ranges (RFC 3339 full-time).
+  check("time rejects missing offset", !b.jsonSchema.isValid({ format: "time" }, "12:00:00", { assertFormat: true }));
+  check("time rejects out-of-range", !b.jsonSchema.isValid({ format: "time" }, "25:61:61Z", { assertFormat: true }));
+  check("time accepts offset form", b.jsonSchema.isValid({ format: "time" }, "12:00:00+05:30", { assertFormat: true }));
+  // date enforces real field ranges.
+  check("date rejects month 13", !b.jsonSchema.isValid({ format: "date" }, "2020-13-01", { assertFormat: true }));
+  check("date accepts valid", b.jsonSchema.isValid({ format: "date" }, "2020-02-29", { assertFormat: true }));
+  // uri rejects raw spaces and relative refs.
+  check("uri rejects raw space", !b.jsonSchema.isValid({ format: "uri" }, "http://e xample.com", { assertFormat: true }));
+  check("uri rejects relative", !b.jsonSchema.isValid({ format: "uri" }, "/relative/path", { assertFormat: true }));
+  check("uri accepts absolute", b.jsonSchema.isValid({ format: "uri" }, "https://example.com/x", { assertFormat: true }));
+}
+
+async function run() {
+  testSurface();
+  testAssertions();
+  testArrays();
+  testObjects();
+  testApplicators();
+  testUnevaluated();
+  testRefs();
+  testErrorsShape();
+  testFormat();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[json-schema] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/jwk.test.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * Layer 0 — b.jwk (RFC 7638 thumbprint).
+ * Oracle: the RFC 7638 §3.1 worked example (an RSA key whose SHA-256
+ * thumbprint is "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"), plus
+ * canonicalization + per-kty + composition (DPoP / DBSC delegate here).
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+// RFC 7638 §3.1 example key (with extra members that must be ignored).
+var RFC_RSA = {
+  kty: "RSA",
+  n: "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtVT86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMstn64tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbISD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw",
+  e: "AQAB", alg: "RS256", kid: "2011-04-29", use: "sig",
+};
+var RFC_THUMB = "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs";
+
+function testSurface() {
+  check("b.jwk.thumbprint is a function", typeof b.jwk.thumbprint === "function");
+  check("b.jwk.canonicalize is a function", typeof b.jwk.canonicalize === "function");
+  check("b.jwk.JwkError is a class", typeof b.jwk.JwkError === "function");
+}
+
+function testRfc7638() {
+  check("RFC 7638 §3.1 thumbprint matches", b.jwk.thumbprint(RFC_RSA) === RFC_THUMB);
+  check("optional members are ignored", b.jwk.thumbprint({ kty: "RSA", n: RFC_RSA.n, e: "AQAB" }) === RFC_THUMB);
+  check("canonical JSON is lexicographic + minimal", b.jwk.canonicalize(RFC_RSA) === '{"e":"AQAB","kty":"RSA","n":"' + RFC_RSA.n + '"}');
+}
+
+function testKtys() {
+  // EC required members are crv, kty, x, y (lexicographic).
+  check("EC canonical", b.jwk.canonicalize({ kty: "EC", crv: "P-256", x: "X", y: "Y", d: "secret" }) === '{"crv":"P-256","kty":"EC","x":"X","y":"Y"}');
+  check("OKP canonical (RFC 8037)", b.jwk.canonicalize({ kty: "OKP", crv: "Ed25519", x: "X" }) === '{"crv":"Ed25519","kty":"OKP","x":"X"}');
+  check("oct canonical", b.jwk.canonicalize({ kty: "oct", k: "GawgguFyGrWKav7AX4VKUg" }) === '{"k":"GawgguFyGrWKav7AX4VKUg","kty":"oct"}');
+  check("AKP canonical (PQC)", b.jwk.canonicalize({ kty: "AKP", alg: "ML-DSA-87", pub: "UFVC" }) === '{"alg":"ML-DSA-87","kty":"AKP","pub":"UFVC"}');
+  check("different keys → different thumbprints", b.jwk.thumbprint({ kty: "oct", k: "AAAA" }) !== b.jwk.thumbprint({ kty: "oct", k: "BBBB" }));
+}
+
+function testHashOption() {
+  check("sha384 differs from sha256", b.jwk.thumbprint(RFC_RSA, { hash: "sha384" }) !== RFC_THUMB);
+  check("sha512 is a string", typeof b.jwk.thumbprint(RFC_RSA, { hash: "sha512" }) === "string");
+  check("bad hash throws", code(function () { b.jwk.thumbprint(RFC_RSA, { hash: "md5" }); }) === "jwk/bad-hash");
+}
+
+function testErrors() {
+  check("missing kty throws", code(function () { b.jwk.thumbprint({ n: "x", e: "y" }); }) === "jwk/bad-jwk");
+  check("unsupported kty throws", code(function () { b.jwk.thumbprint({ kty: "XYZ" }); }) === "jwk/unsupported-kty");
+  check("missing required member throws", code(function () { b.jwk.thumbprint({ kty: "EC", crv: "P-256", x: "X" }); }) === "jwk/bad-jwk");
+  check("non-object throws", code(function () { b.jwk.thumbprint("nope"); }) === "jwk/bad-jwk");
+}
+
+function testComposition() {
+  // DPoP and DBSC compute their thumbprints through b.jwk.
+  var ec = { kty: "EC", crv: "P-256", x: "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU", y: "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0" };
+  check("dpop.thumbprint composes b.jwk", b.auth.dpop.thumbprint(ec) === b.jwk.thumbprint(ec));
+  check("dpop refuses symmetric kty", code(function () { b.auth.dpop.thumbprint({ kty: "oct", k: "x" }); }) === "auth-dpop/refused-kty");
+}
+
+async function run() {
+  testSurface();
+  testRfc7638();
+  testKtys();
+  testHashOption();
+  testErrors();
+  testComposition();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[jwk] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/uri-template.test.js

@@ -0,0 +1,99 @@
+"use strict";
+/**
+ * Layer 0 — b.uriTemplate (RFC 6570).
+ * Oracle: the official uri-templates/uritemplate-test suite (spec-examples,
+ * extended-tests, negative-tests) — all 135 cases pass during development.
+ * This file embeds a representative slice across all four levels plus the
+ * surface, compile-reuse, and malformed-template paths.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+var VARS = {
+  count: ["one", "two", "three"], dom: ["example", "com"],
+  dub: "me/too", hello: "Hello World!", half: "50%", "var": "value",
+  who: "fred", base: "http://example.com/home/", path: "/foo/bar",
+  list: ["red", "green", "blue"], keys: { semi: ";", dot: ".", comma: "," },
+  v: "6", x: "1024", y: "768", empty: "", undef: undefined,
+};
+
+function testSurface() {
+  check("b.uriTemplate.expand is a function", typeof b.uriTemplate.expand === "function");
+  check("b.uriTemplate.compile is a function", typeof b.uriTemplate.compile === "function");
+  check("b.uriTemplate.UriTemplateError is a class", typeof b.uriTemplate.UriTemplateError === "function");
+}
+
+function eq(tmpl, want) { check(tmpl + " → " + want, b.uriTemplate.expand(tmpl, VARS) === want); }
+
+function testLevels() {
+  // Level 1 — simple string expansion.
+  eq("{var}", "value");
+  eq("{hello}", "Hello%20World%21");
+  // Level 2 — reserved + fragment.
+  eq("{+var}", "value");
+  eq("{+path}/here", "/foo/bar/here");
+  eq("{#path}", "#/foo/bar");
+  eq("{+half}", "50%25");
+  // Level 3 — multiple vars + path/label/params/query operators.
+  eq("{x,y}", "1024,768");
+  eq("{+x,hello,y}", "1024,Hello%20World!,768");
+  eq("{/var}", "/value");
+  eq("{.who}", ".fred");
+  eq("{;x,y}", ";x=1024;y=768");
+  eq("{?x,y}", "?x=1024&y=768");
+  eq("{&x}", "&x=1024");
+  // empty value under named operators.
+  eq("{;empty}", ";empty");
+  eq("{?empty}", "?empty=");
+}
+
+function testLevel4() {
+  // Prefix modifier.
+  eq("{var:3}", "val");
+  eq("{var:30}", "value");
+  // Explode — list.
+  eq("{list}", "red,green,blue");
+  eq("{list*}", "red,green,blue");
+  eq("{/list*}", "/red/green/blue");
+  eq("{?list*}", "?list=red&list=green&list=blue");
+  // Explode — associative array.
+  eq("{keys}", "semi,%3B,dot,.,comma,%2C");
+  eq("{;keys*}", ";semi=%3B;dot=.;comma=%2C");
+  eq("{?keys*}", "?semi=%3B&dot=.&comma=%2C");
+  // Undefined variables are omitted.
+  eq("{undef}", "");
+  eq("x{?undef}", "x");
+  // Undefined / null members of a list or map are ignored (RFC 6570 §3.2.1).
+  check("undefined list member skipped", b.uriTemplate.expand("{?l*}", { l: ["a", undefined, "b", null, "c"] }) === "?l=a&l=b&l=c");
+  check("undefined list member skipped (joined)", b.uriTemplate.expand("{l}", { l: ["a", undefined, "b"] }) === "a,b");
+  check("all-undefined list omitted", b.uriTemplate.expand("x{?l*}", { l: [undefined, null] }) === "x");
+  check("undefined map value skipped", b.uriTemplate.expand("{?m*}", { m: { a: 1, b: undefined, c: 3 } }) === "?a=1&c=3");
+  check("undefined map value skipped (joined)", b.uriTemplate.expand("{m}", { m: { a: "1", b: undefined, c: "3" } }) === "a,1,c,3");
+}
+
+function testCompileReuse() {
+  var t = b.uriTemplate.compile("/users/{id}{?fields*}");
+  check("compiled expand A", t.expand({ id: 7, fields: ["name", "email"] }) === "/users/7?fields=name&fields=email");
+  check("compiled expand B (reused)", t.expand({ id: 9 }) === "/users/9");
+}
+
+function testMalformed() {
+  check("unclosed expression throws", code(function () { b.uriTemplate.expand("{var", {}); }) === "uri-template/unclosed");
+  check("reserved operator throws", code(function () { b.uriTemplate.expand("{=var}", {}); }) === "uri-template/reserved-operator");
+  check("non-numeric prefix throws", code(function () { b.uriTemplate.expand("{var:x}", {}); }) === "uri-template/bad-prefix");
+  check("prefix on list throws", code(function () { b.uriTemplate.expand("{list:3}", VARS); }) === "uri-template/prefix-on-list");
+  check("unmatched brace throws", code(function () { b.uriTemplate.expand("/id*}", {}); }) === "uri-template/unmatched-brace");
+}
+
+async function run() {
+  testSurface();
+  testLevels();
+  testLevel4();
+  testCompileReuse();
+  testMalformed();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[uri-template] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {