@blamejs/blamejs-shop 0.1.30 → 0.1.31

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.1.x
 
+- v0.1.31 (2026-05-26) — **Product compare — a side-by-side comparison table any shopper can build from the product pages.** Shoppers can now line products up against each other. Every product page gains an "Add to compare" control; a "Compare" link in the footer opens a side-by-side table of the chosen products — image, price, availability, and each product's attributes in aligned rows. No sign-in is required: the comparison basket rides the visitor's existing sealed session cookie, and a signed-in shopper's customer id is carried alongside. The basket holds up to four products (a fifth add is refused with a notice rather than quietly dropping one), the toggle is idempotent, and a product that goes archived or out of stock resolves out of the table with a remove control instead of breaking the page. The control and table render identically from the edge and the container, and the comparison page reuses the catalog grid styling, so no new stylesheet ships. **Added:** *Add to compare on the product page* — Each product page shows an "Add to compare" / "Remove from compare" control reflecting whether the product is already in the basket. `POST /compare/toggle` adds or removes it and redirects back to where the shopper was (the redirect target is validated, so a crafted `return_to` can't bounce the visitor off-site). Comparing needs no account — the basket is keyed on the visitor's existing sealed session cookie; a signed-in shopper's customer id is captured alongside. The basket is capped at four products: a fifth add is refused with a notice and the basket is left unchanged. · *The comparison table* — `GET /compare` renders the selected products side by side — image, title, price, availability, and the per-product attributes resolved through the catalog, in aligned rows. Each column has a remove control, and `POST /compare/clear` empties the whole basket. A product that has since been archived or sold out shows in a gone/out-of-stock state with a remove control rather than failing the render. An empty basket shows a friendly empty state and mints no cookie. A "Compare" link sits in the footer on every page.
+
 - v0.1.30 (2026-05-26) — **Product Q&A — customer questions and seller answers on the product page.** Products gain a question-and-answer thread alongside reviews. A signed-in shopper asks a question from the product page; it lands pending and surfaces only after an operator approves it. Operators moderate at `/admin/questions`: a status-filtered queue of every question across the catalog, and a per-question detail page where they approve or reject the question, post the authoritative seller answer, approve / reject individual answers, and pin one answer as the definitive 'top answer'. Approved questions and their approved answers render on the product page in both the edge and container render paths, reusing the reviews section's styling so no new CSS ships. As with reviews, a missing Q&A table degrades the product page to an empty Q&A state rather than failing the render. **Added:** *Ask a question on the product page* — `GET /products/:slug/question` renders an auth-gated question form; `POST /products/:slug/question` submits it. Asking requires a signed-in customer — a logged-out shopper is redirected to sign in. The question is stored pending and is not shown on the product page until an operator approves it. A malformed submission re-renders the form with the reason and a 400; an unknown product is a 404. · *Published Q&A on the product page* — The product page shows approved questions with their approved answers below the reviews section. Each answer carries a source badge — 'Answered by the seller', 'Customer answer', or 'Automated answer' — and the operator-pinned answer is flagged 'Top answer'. The empty state invites the first question. Rendered identically by the edge worker and the container so the page is the same whichever serves it; the read degrades to the empty state when the Q&A tables aren't present. · *Q&A moderation console* — `/admin/questions` is the question queue across all products, with pending / approved / rejected status-filter chips. Each question opens a detail page showing its full answer thread (every status), an approve / reject control for the question, a form to post the seller's answer, and per-answer approve / reject / pin controls. Posting an answer leaves it pending; approving it publishes it on the product page. Pinning floats one operator answer to the top of the thread. Every path content-negotiates: a bearer-token client gets a JSON contract, a signed-in browser gets the HTML console. An unknown id or a refused transition redirects back with a notice, never a 500. · *productQA read APIs for the storefront and console* — `answersForQuestion` returns the approved answers under a question (pinned first) for the product-page thread; `listAnswersForQuestion` returns every answer regardless of status for the moderation detail; `listQuestionsByStatus` and `listAnswersByStatus` return the cross-product moderation queues. **Changed:** *Console nav gains Q&A; product page wires the Q&A primitive* — The signed-in admin nav includes Q&A, shown only when the Q&A primitive is wired so the link never points at an unmounted route. The storefront and admin share one Q&A instance, wired with the customer primitive so an authenticated questioner's id is verified before the row is stored.
 
 - v0.1.29 (2026-05-26) — **Category navigation goes live — public browse pages for the storefront's category tree, with breadcrumbs and sub-category grids.** The category tree now has a customer-facing surface. A new /categories index lists the active top-level categories as a card grid, and a new /categories/<slug> page renders a single category: its title and optional description, a breadcrumb chain from the catalog root down to the current category, and a grid of the category's direct child sub-categories. Each page reads fresh against the active tree, so archived or unpublished categories drop out of every surface. An unknown, archived, or malformed slug returns a 404, and a category with no children renders a graceful empty state. The pages are linked from the site footer's Shop column. **Added:** *Category index at /categories* — A public page listing the active top-level categories as a card grid, each card carrying the category's title, optional description, and optional hero image, and linking into its browse page. Archived and unpublished categories are excluded. Linked from the site footer's Shop column. · *Category browse page at /categories/<slug>* — A public page for a single category showing its title and optional description, a breadcrumb chain from the catalog root down to the current category (each ancestor linked, the current category shown as plain text), an optional hero image, and a card grid of the category's direct child sub-categories. A category with no children renders a graceful empty state. An unknown, archived, or malformed slug returns a 404.

package/README.md

@@ -71,6 +71,7 @@ Every primitive is composed on the vendored blamejs surface — no npm runtime d
 | **`lib/returns.js`** | Self-serve RMAs. Customer requests a return against their own order at `/account/orders/:id/return` (items + reason, ownership-checked, lines built from the order's own records) and tracks status at `/account/returns`. Operators work `/admin/returns` — approve (refund amount) / mark received / refund / reject — over the pending → approved → received → refunded FSM; illegal transitions are 409, bad ids 404. |
 | **`lib/loyalty.js`** + **`lib/loyalty-earn-rules.js`** + **`lib/loyalty-redemption.js`** | Customer rewards. `loyalty` owns the points balance, lifetime total, tier (bronze → platinum on operator-tunable thresholds), and an audited transaction ledger. `loyalty-earn-rules` defines how points are minted (per-dollar-spent, per-order, signup, birthday, …) keyed to lifecycle events; `loyalty-redemption` is the reward catalog customers spend points against. Customers see all of it at `/account/loyalty` — balance + tier, the earn rules in plain language, the reward catalog with a one-click Redeem, past redemptions, and the paginated earn/redeem ledger (login-gated). Paid orders award points automatically: the order FSM's paid transition fans out to the earn rules fire-and-forget, deduped on the order id so a re-delivered payment webhook never double-credits. At checkout a signed-in customer can spend points for a credit against the order total — valued by the redemption ratio (100 points = $1 default), capped at the order's worth and the balance, debited once behind a balance-guarded SQL decrement, stacking with any gift-card credit; surplus points stay in the balance. |
 | **`lib/referrals.js`** + **`lib/referral-leaderboard.js`** | Refer-a-friend with two-sided rewards. `referrals` issues each customer an 8-character code (32-glyph confusion-resistant alphabet via `b.crypto.generateBytes`) and tracks each referred friend through the funnel (invited → visited → joined → converted); referred emails are stored hash-only (`b.crypto.namespaceHash`), never plaintext. `referral-leaderboard` sits on top for top-referrer rankings + operator-tunable tier bonuses. Customers see all of it at `/account/referrals` — their code, an absolute shareable link, the friends they've referred (funnel stage + dates, no personal data), and an in-account leaderboard (rank + initials only). A public `/r/<code>` landing captures an inbound referral into a short-lived sealed first-party cookie (first-touch), which attributes the new customer to the referrer when they sign up by passkey / Google / Apple — self-referral and double-attribution guarded. When a referred customer's first order reaches paid, the order FSM's paid transition marks that referral converted and bumps the referrer's count fire-and-forget, deduped on the order id so a re-delivered webhook never double-counts; guest orders and a customer's later orders don't qualify. Issuing the payout itself (gift card / store credit / loyalty points) is an explicit operator action via the referrals reward API, so the reward instrument and any fraud review stay the operator's. |
+| **`lib/product-compare.js`** | Side-by-side product comparison, no sign-in required. Each product page gets an "Add to compare" / "Remove from compare" control; `POST /compare/toggle` adds or removes the product and `GET /compare` renders the comparison table — image, price, availability, and the per-product attributes resolved through the catalog. The basket is keyed on the visitor's existing sealed session cookie (a signed-in shopper's customer id rides alongside), capped at four products (a fifth add is refused with a notice rather than silently dropping one), and is idempotent. Products that go archived or out of stock resolve out of the table with a remove control instead of breaking the render; an empty basket shows a friendly empty state. `POST /compare/clear` empties it. Linked from the footer on every page. |
 | **`lib/recently-viewed.js`** | Signed-in customer browse history. A product-page visit records the view server-side against the customer's account (drop-silent — never blocks the page); `/account/recently-viewed` lists them newest-first as a grid with a Clear-history control. De-duped + capped per customer, archived products drop out, login-gated. Guest/session history is opt-in (a client beacon) and not shipped — the lib's `forSession` + `merge` support it. |
 | **`lib/recommendations.js`** | Product-recommendation engine. Operator-curated override pins first (`setOverride` — "when viewing A, show B", kind-scoped + weight-ordered), then a signal-based fallback: co-purchase (products bought in the same orders), category-popular, and in-stock-random filler. `recommendForProduct` / `recommendForCart` / `recommendForCustomer` / `recommendForCategory` each return renderable picks (active + in-stock, source product excluded). The order confirmation page (`/orders/:id`) renders a "Customers also bought" rail from it — best-effort, anchored on the order's items, excluding what was just bought. |
 | **`lib/collections.js`** | Curated + smart product groupings. `GET /collections` lists the shop's active collections; `GET /collections/:slug` renders the grid — manual collections list hand-picked members, smart collections evaluate stored rules against the active catalog and apply the collection's sort strategy. Each product resolves fresh, so archived products drop out. Public, no sign-in; a bad or unknown slug is a 404 (never a 500). Linked from the footer on every page. |

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.30",
+  "version": "0.1.31",
   "assets": {
     "css/admin.css": "sha384-rvjL1QySBgNJGEUDusbbMCkL3fsjmzcwUvTp9pljo/0Nn/lErxq2AbY8EYvDF9Ch",
     "css/main.css": "sha384-qBY97FWZDGOploZRppwrDi0A/+R4R3iCFtyS1dfrAlqHNEPluPmY0R3HB9cJntyV",

package/lib/storefront.js

@@ -165,6 +165,7 @@ var LAYOUT =
   "          <li><a href=\"/categories\">Categories</a></li>\n" +
   "          <li><a href=\"/?sort=new\">New arrivals</a></li>\n" +
   "          <li><a href=\"/?sort=sale\">On sale</a></li>\n" +
+  "          <li><a href=\"/compare\">Compare</a></li>\n" +
   "          <li><a href=\"/cart\">Cart</a></li>\n" +
   "        </ul>\n" +
   "      </div>\n" +
@@ -745,6 +746,7 @@ var PRODUCT_PAGE =
   "        </div>\n" +
   "      </div>\n" +
   "      RAW_WISHLIST_PLACEHOLDER\n" +
+  "      RAW_COMPARE_PLACEHOLDER\n" +
   "    </div>\n" +
   "  </div>\n" +
   "  RAW_REVIEWS_PLACEHOLDER\n" +
@@ -1162,6 +1164,177 @@ function renderWishlist(opts) {
   });
 }
 
+// Compare page notice banner — surfaced after a toggle / a full-basket
+// refusal. The route passes a short message key; unknown keys render
+// nothing so a forged `?notice=` query can't inject arbitrary copy.
+var COMPARE_NOTICES = {
+  added:   "Added to your comparison.",
+  removed: "Removed from your comparison.",
+  full:    "Your comparison is full (4 products max). Remove one to add another.",
+  cleared: "Comparison cleared.",
+};
+function _compareNotice(key) {
+  var msg = COMPARE_NOTICES[key];
+  if (!msg) return "";
+  return "<p class=\"compare-page__notice\" role=\"status\">" + b.template.escapeHtml(msg) + "</p>";
+}
+
+// Side-by-side comparison table. `opts.columns` is the resolved per-
+// product column list in basket order:
+//   { product_id, product, hero_media, price, available }
+// where `product` is null for a product archived / deleted between the
+// add and this render (orphan-tolerant — the column renders "no longer
+// available" and a remove control, never crashes the table). `opts.rows`
+// is the attribute matrix from product-compare's `compareTable`:
+//   [ { attribute: { slug, label, format }, values_per_product: [...] } ]
+// each `values_per_product` entry positionally aligned with `columns`.
+// The currency/number/boolean formatting happens here (the display
+// layer), not in the primitive.
+function _compareCellValue(value, format) {
+  var esc = b.template.escapeHtml;
+  if (value == null) return "<span class=\"compare-cell--empty\" aria-hidden=\"true\">—</span><span class=\"sr-only\">Not specified</span>";
+  if (format === "currency") {
+    var minor = Number(value);
+    if (!Number.isFinite(minor)) return esc(String(value));
+    return esc(pricing.format(Math.round(minor), "USD"));
+  }
+  if (format === "boolean") {
+    return value ? "Yes" : "No";
+  }
+  return esc(String(value));
+}
+
+function renderCompare(opts) {
+  var esc = b.template.escapeHtml;
+  var columns = opts.columns || [];
+  var attrRows = opts.rows || [];
+  var prefix = opts.asset_prefix || "/assets/";
+  var notice = _compareNotice(opts.notice);
+
+  if (!columns.length) {
+    var empty =
+      "<section class=\"compare-page\">" +
+        "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+          "<li><a href=\"/\">Shop</a></li>" +
+          "<li aria-current=\"page\">Compare</li>" +
+        "</ol></nav>" +
+        "<h1 class=\"compare-page__title\">Compare products</h1>" +
+        notice +
+        "<p class=\"compare-page__empty\">You haven't added anything to compare yet. Browse the shop and tap " +
+          "<strong>Add to compare</strong> on up to four products to line them up side by side.</p>" +
+        "<p><a class=\"btn-secondary\" href=\"/\">Browse the shop →</a></p>" +
+      "</section>";
+    return _wrap({
+      title:      "Compare products",
+      shop_name:  opts.shop_name || "blamejs.shop",
+      cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+      theme_css:  opts.theme_css,
+      body:       empty,
+    });
+  }
+
+  // Per-column header cell — image + title + remove form. A column whose
+  // product resolved out (archived / deleted) renders the gone-state
+  // header and still offers the remove control so the shopper can clear
+  // the dangling entry.
+  function _headerCell(col) {
+    var removeForm =
+      "<form class=\"compare-col__remove\" method=\"post\" action=\"/compare/toggle\">" +
+        "<input type=\"hidden\" name=\"product_id\" value=\"" + esc(col.product_id) + "\">" +
+        "<input type=\"hidden\" name=\"return_to\" value=\"/compare\">" +
+        "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">Remove</button>" +
+      "</form>";
+    if (!col.product) {
+      return "<th scope=\"col\" class=\"compare-col compare-col--gone\">" +
+               "<span class=\"compare-col__title\">No longer available</span>" +
+               removeForm +
+             "</th>";
+    }
+    var slug = esc(col.product.slug);
+    var thumb = col.hero_media
+      ? "<img src=\"" + esc(prefix + col.hero_media.r2_key) + "\" alt=\"" + esc(col.hero_media.alt_text || col.product.title) + "\" loading=\"lazy\">"
+      : "<span class=\"compare-col__mark\" aria-hidden=\"true\">" + esc((col.product.title || "?").trim().charAt(0).toUpperCase() || "?") + "</span>";
+    return "<th scope=\"col\" class=\"compare-col\">" +
+             "<a class=\"compare-col__media\" href=\"/products/" + slug + "\">" + thumb + "</a>" +
+             "<a class=\"compare-col__title\" href=\"/products/" + slug + "\">" + esc(col.product.title) + "</a>" +
+             removeForm +
+           "</th>";
+  }
+
+  var headerCells = "";
+  for (var h = 0; h < columns.length; h += 1) headerCells += _headerCell(columns[h]);
+
+  // Fixed display rows resolved directly (richer than the attribute
+  // matrix): price + availability. Price for a gone column renders "—".
+  function _priceCell(col) {
+    if (!col.product) return "<td class=\"compare-cell compare-cell--gone\">—</td>";
+    return "<td class=\"compare-cell\">" + esc(col.price || "—") + "</td>";
+  }
+  function _availCell(col) {
+    if (!col.product) return "<td class=\"compare-cell compare-cell--gone\">—</td>";
+    return col.available
+      ? "<td class=\"compare-cell\"><span class=\"compare-cell__badge compare-cell__badge--ok\">In stock</span></td>"
+      : "<td class=\"compare-cell\"><span class=\"compare-cell__badge\">Out of stock</span></td>";
+  }
+  var priceRow = "<tr><th scope=\"row\" class=\"compare-row-label\">Price</th>";
+  var availRow = "<tr><th scope=\"row\" class=\"compare-row-label\">Availability</th>";
+  for (var c = 0; c < columns.length; c += 1) {
+    priceRow += _priceCell(columns[c]);
+    availRow += _availCell(columns[c]);
+  }
+  priceRow += "</tr>";
+  availRow += "</tr>";
+
+  // Attribute matrix rows from the primitive. The `price` attribute is
+  // already surfaced as the fixed Price row above, so skip its duplicate
+  // here; every other attribute renders one row, one cell per column.
+  var attrRowsHtml = "";
+  for (var r = 0; r < attrRows.length; r += 1) {
+    var ar = attrRows[r];
+    if (ar.attribute && ar.attribute.slug === "price") continue;
+    var label = (ar.attribute && ar.attribute.label) || "";
+    var fmt = ar.attribute && ar.attribute.format;
+    var cells = "";
+    var vals = ar.values_per_product || [];
+    for (var v = 0; v < columns.length; v += 1) {
+      cells += "<td class=\"compare-cell\">" + _compareCellValue(vals[v], fmt) + "</td>";
+    }
+    attrRowsHtml += "<tr><th scope=\"row\" class=\"compare-row-label\">" + esc(label) + "</th>" + cells + "</tr>";
+  }
+
+  var clearForm =
+    "<form class=\"compare-page__clear\" method=\"post\" action=\"/compare/clear\">" +
+      "<button type=\"submit\" class=\"btn-ghost\">Clear comparison</button>" +
+    "</form>";
+
+  var body =
+    "<section class=\"compare-page\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/\">Shop</a></li>" +
+        "<li aria-current=\"page\">Compare</li>" +
+      "</ol></nav>" +
+      "<header class=\"compare-page__head\">" +
+        "<h1 class=\"compare-page__title\">Compare products (" + columns.length + ")</h1>" +
+        clearForm +
+      "</header>" +
+      notice +
+      "<div class=\"table-scroll\">" +
+        "<table class=\"compare-table\">" +
+          "<thead><tr><th scope=\"col\" class=\"compare-row-label\"><span class=\"sr-only\">Attribute</span></th>" + headerCells + "</tr></thead>" +
+          "<tbody>" + priceRow + availRow + attrRowsHtml + "</tbody>" +
+        "</table>" +
+      "</div>" +
+    "</section>";
+
+  return _wrap({
+    title:      "Compare products",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Account "Saved for later" page. `opts.items` is a resolved list:
 // { save, product, hero_media } for live products, or { save,
 // product: null } when the variant/product behind a saved row was
@@ -2093,6 +2266,27 @@ function _buildWishlist(productId, count) {
          "</div>";
 }
 
+// Product-level "Add to compare" control. Byte-compatible with the
+// edge renderer (`worker/render/product.js`) so both paths emit
+// identical markup. Action-only label — the toggle route resolves
+// add/remove server-side against the sealed session, and a guest who
+// has never compared anything still sees the same neutral control the
+// edge cache serves. The link to the compare table sits beside the
+// toggle so a shopper mid-basket can jump straight to the side-by-side
+// view.
+function _buildCompare(productId) {
+  var esc = b.template.escapeHtml;
+  return "<div class=\"compare\">" +
+           "<form class=\"compare__form\" method=\"post\" action=\"/compare/toggle\">" +
+             "<input type=\"hidden\" name=\"product_id\" value=\"" + esc(productId) + "\">" +
+             "<button type=\"submit\" class=\"btn-secondary compare__btn\">" +
+               "<span class=\"compare__icon\" aria-hidden=\"true\">⇄</span> Add to compare" +
+             "</button>" +
+           "</form>" +
+           "<a class=\"compare__link card-link\" href=\"/compare\">View compare →</a>" +
+         "</div>";
+}
+
 // Schema.org JSON-LD block. JSON.stringify covers the standard escapes;
 // the `</` → `<\/` rewrite neutralises any literal `</script>` in a
 // value. Mirrors the edge renderer's `jsonLdScript`.
@@ -2128,6 +2322,7 @@ function renderProduct(opts) {
       reviews_html:   _buildReviews(opts.review_summary, opts.reviews, opts.review_cta),
       qa_html:        _buildProductQa(opts.qa_questions, opts.qa_cta),
       wishlist_html:  _buildWishlist(opts.product.id, opts.wishlist_count),
+      compare_html:   _buildCompare(opts.product.id),
       asset_css_main: opts.theme.assetUrl("css/main.css"),
     });
   }
@@ -2139,6 +2334,7 @@ function renderProduct(opts) {
   var reviewsHtml = _buildReviews(opts.review_summary, opts.reviews, opts.review_cta);
   var qaHtml = _buildProductQa(opts.qa_questions, opts.qa_cta);
   var wishlistHtml = _buildWishlist(opts.product.id, opts.wishlist_count);
+  var compareHtml = _buildCompare(opts.product.id);
   var body = _render(PRODUCT_PAGE, {
     title:        opts.product.title,
     description:  description,
@@ -2147,6 +2343,7 @@ function renderProduct(opts) {
     .replace("RAW_GALLERY_PLACEHOLDER", galleryHtml)
     .replace("RAW_ROWS_PLACEHOLDER", rows)
     .replace("RAW_WISHLIST_PLACEHOLDER", wishlistHtml)
+    .replace("RAW_COMPARE_PLACEHOLDER", compareHtml)
     .replace("RAW_REVIEWS_PLACEHOLDER", reviewsHtml)
     .replace("RAW_QA_PLACEHOLDER", qaHtml);
   // Product-specific OpenGraph + Twitter Card values so shares
@@ -3589,6 +3786,224 @@ function mount(router, deps) {
     _send(res, 200, html);
   });
 
+  // Product compare — the guest-or-customer side-by-side basket. Mounts
+  // when the productCompare primitive is wired. The basket is keyed on
+  // the same `shop_sid` session cookie the cart uses (a routing key that
+  // grants zero authority — the primitive namespace-hashes it before it
+  // touches the database), so a shopper compares without authenticating;
+  // a logged-in shopper's customer_id rides alongside so the operator's
+  // account widget could resume the basket on another device. All three
+  // routes (toggle / clear / view) are writes-or-session-reads, so they
+  // live in the container — the edge forwards them (and any request
+  // carrying shop_sid skips the edge cache, so the view always reflects
+  // the live basket).
+  if (deps.productCompare) {
+    // Resolve the compare basket's session id. Reads the cart session
+    // cookie; when `mint` is true and none exists, allocates one + sets
+    // the cookie so the basket has a stable key across requests. A
+    // read-only path (the view) passes mint=false and returns null when
+    // there's no session — that renders the empty state without minting
+    // a cookie on a bare GET.
+    function _compareSid(req, res, mint) {
+      var sid = _readSidCookie(req);
+      if (sid) return sid;
+      if (!mint) return null;
+      sid = b.uuid.v7();
+      _setSidCookie(res, sid);
+      return sid;
+    }
+
+    function _compareRedirect(res, dest, notice) {
+      var sep = dest.indexOf("?") === -1 ? "?" : "&";
+      var to = notice ? (dest + sep + "notice=" + encodeURIComponent(notice)) : dest;
+      res.status(303);
+      res.setHeader && res.setHeader("location", to);
+      return res.end ? res.end() : res.send("");
+    }
+
+    // POST /compare/toggle — add the product if it isn't in the basket,
+    // remove it if it is. Idempotent (the primitive collapses a repeat
+    // add / a remove of an absent id). Redirects to `return_to` when it's
+    // a safe same-origin path (the compare page's per-column Remove uses
+    // it), otherwise back to the product PDP (the canonical slug is
+    // resolved from product_id, so a forged slug can't drive an open
+    // redirect). No auth required — guests compare too.
+    router.post("/compare/toggle", async function (req, res) {
+      var productId = (req.body || {}).product_id;
+      var sid = _compareSid(req, res, true);
+      var custEnv = _currentCustomerEnv(req);
+      var customerId = custEnv ? custEnv.customer_id : null;
+
+      // Resolve the safe redirect destination up front so a validation
+      // failure still lands the shopper somewhere sane.
+      var rt = (req.body || {}).return_to;
+      var dest = null;
+      if (typeof rt === "string" && /^\/[^/]/.test(rt)) dest = rt;
+
+      var notice;
+      try {
+        var list = await deps.productCompare.getCompareList({ session_id: sid });
+        var inBasket = list.product_ids.indexOf(productId) !== -1;
+        if (inBasket) {
+          await deps.productCompare.removeFromCompare({ session_id: sid, product_id: productId });
+          notice = "removed";
+        } else {
+          await deps.productCompare.addToCompare({ session_id: sid, product_id: productId, customer_id: customerId });
+          notice = "added";
+          // Best-effort impression telemetry — drop-silent, never block
+          // the toggle on the merchandising ledger write.
+          try {
+            await deps.productCompare.recordImpression({ session_id: sid, product_id: productId, source_kind: "product_page" });
+          } catch (_e) { /* drop-silent — impression telemetry is supplementary */ }
+        }
+      } catch (e) {
+        if (e && e.code === "COMPARE_FULL") {
+          // Cap reached — refuse the add with a notice rather than a
+          // crash. The basket is unchanged; the shopper removes one to
+          // make room.
+          if (!dest) {
+            var capProduct = null;
+            try { capProduct = await deps.catalog.products.get(productId); } catch (_e2) { capProduct = null; }
+            dest = capProduct ? ("/products/" + encodeURIComponent(capProduct.slug)) : "/compare";
+          }
+          return _compareRedirect(res, dest, "full");
+        }
+        // A malformed product id (or session id) is a client error.
+        res.status(e instanceof TypeError ? 400 : 500);
+        return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+      }
+
+      if (!dest) {
+        var product = null;
+        try { product = await deps.catalog.products.get(productId); } catch (_e) { product = null; }
+        dest = product ? ("/products/" + encodeURIComponent(product.slug)) : "/compare";
+      }
+      return _compareRedirect(res, dest, notice);
+    });
+
+    // POST /compare/clear — drop the whole basket. Idempotent (clearing
+    // an empty basket is a no-op). Always redirects back to the compare
+    // page so the shopper sees the emptied state.
+    router.post("/compare/clear", async function (req, res) {
+      var sid = _compareSid(req, res, false);
+      if (sid) {
+        try { await deps.productCompare.clearCompareList({ session_id: sid }); }
+        catch (e) {
+          if (!(e instanceof TypeError)) {
+            res.status(500);
+            return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+          }
+          // A malformed session cookie can't address a basket — treat
+          // the clear as a no-op rather than a 400 (the cookie grants
+          // zero authority; a stale/garbage value just means "no basket").
+        }
+      }
+      return _compareRedirect(res, "/compare", "cleared");
+    });
+
+    // GET /compare — the side-by-side comparison table for the session's
+    // basket. Empty basket → the friendly empty state. Each product id is
+    // resolved through the catalog; a product archived / deleted between
+    // the add and this render resolves out gracefully (the column renders
+    // "no longer available" with a remove control). The attribute matrix
+    // comes from the primitive's compareTable, fed a getProduct adapter
+    // enriched with the product's first variant + current price so the
+    // baked-in price/sku/weight attributes resolve against this catalog's
+    // schema.
+    router.get("/compare", async function (req, res) {
+      var sid = _compareSid(req, res, false);
+      var cartCount = await _cartCountForReq(req);
+      // Read the post-toggle notice key from the query string the same
+      // way the search route reads `?q=` — via the parsed URL, not
+      // `req.query` (which the router only populates when a route
+      // declares a query validator). renderCompare gates the key
+      // against a fixed allowlist, so a forged value renders nothing.
+      var compareUrl = req.url ? new URL(req.url, "http://localhost") : null;
+      var noticeKey = compareUrl ? compareUrl.searchParams.get("notice") : null;
+
+      if (!sid) {
+        return _send(res, 200, renderCompare({
+          columns: [], rows: [], shop_name: shopName, cart_count: cartCount,
+          asset_prefix: _cardAssetPrefix, notice: noticeKey,
+        }));
+      }
+
+      // Per-request product cache so the header-column decoration and the
+      // attribute-matrix adapter don't double-fetch the same product.
+      var enrichedCache = Object.create(null);
+      async function _enrich(pid) {
+        if (Object.prototype.hasOwnProperty.call(enrichedCache, pid)) return enrichedCache[pid];
+        var result = { product: null, variant: null, price: null, hero_media: null, available: false };
+        var product = null;
+        // get() throws a TypeError on a malformed id; a basket can only
+        // hold strict-UUID ids (the primitive sanitises on add), but stay
+        // defensive — a bad id resolves to the gone-state column.
+        try { product = await deps.catalog.products.get(pid); } catch (_e) { product = null; }
+        if (product && product.status === "active") {
+          result.product = product;
+          var variants = await deps.catalog.variants.listForProduct(pid);
+          if (variants.length) {
+            result.variant = variants[0];
+            var pr = await deps.catalog.prices.current(variants[0].id, "USD");
+            if (pr) result.price = pricing.format(pr.amount_minor, pr.currency);
+            // Availability — best-effort inventory read on the first
+            // variant. A product with no inventory row reads as available
+            // (operators who don't track stock still sell), an explicit
+            // zero-on-hand reads as out of stock.
+            try {
+              var inv = await deps.catalog.inventory.get(variants[0].sku);
+              result.available = !inv || (Number(inv.stock_on_hand) - Number(inv.stock_held)) > 0;
+            } catch (_e) { result.available = true; }
+          } else {
+            result.available = false;
+          }
+          var media = await deps.catalog.media.listForProduct(pid);
+          result.hero_media = media.length ? media[0] : null;
+        }
+        enrichedCache[pid] = result;
+        return result;
+      }
+
+      var list = await deps.productCompare.getCompareList({ session_id: sid });
+      var columns = [];
+      for (var i = 0; i < list.product_ids.length; i += 1) {
+        var pid = list.product_ids[i];
+        var e = await _enrich(pid);
+        columns.push({
+          product_id: pid,
+          product:    e.product,
+          hero_media: e.hero_media,
+          price:      e.price,
+          available:  e.available,
+        });
+      }
+
+      // Attribute matrix from the primitive. compareTable walks the
+      // basket's product ids through the `catalog` adapter wired into the
+      // primitive at create time (server.js) — that adapter enriches each
+      // product with a `variants` array (price as `price_minor`, `weight`
+      // from `weight_grams`) so the baked-in variant-sourced attributes
+      // resolve against this catalog's column shape. compareTable refuses
+      // (throws) when no catalog adapter was wired; a resolution failure
+      // degrades to no attribute rows — the fixed Price/Availability rows
+      // still render the side-by-side view.
+      var attrRows = [];
+      try {
+        var table = await deps.productCompare.compareTable({ session_id: sid });
+        attrRows = table.rows || [];
+      } catch (_e) { attrRows = []; }
+
+      _send(res, 200, renderCompare({
+        columns:      columns,
+        rows:         attrRows,
+        shop_name:    shopName,
+        cart_count:   cartCount,
+        asset_prefix: _cardAssetPrefix,
+        notice:       noticeKey,
+      }));
+    });
+  }
+
   // Collections — operator-curated + smart product lists. Public browse
   // pages; mounted when the collections primitive is wired.
   if (deps.collections) {

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.12.66",
-      "tag": "v0.12.66",
+      "version": "0.12.69",
+      "tag": "v0.12.69",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.12.x
 
+- v0.12.69 (2026-05-26) — **`b.middleware.botGuard` no longer blocks browsers that omit Sec-Fetch-Mode.** b.middleware.botGuard treated a missing Sec-Fetch-Mode header as a bot signal and returned 403 Forbidden, which refused legitimate browsers on any origin where the browser does not emit Fetch Metadata: every plain-HTTP non-localhost origin (Umbrel apps, LAN and *.local reverse-proxy deployments) and Safari before 16.4 even over HTTPS. Browsers only send Sec-Fetch-* in a secure context, so its absence is normal there — not a bot. Sec-Fetch-Mode is now advisory only: it never blocks, and it sets req.suspectedBot in mode:"tag" only on a secure-context HTML GET where a modern browser would have sent it. Drive-by bots are still blocked by the missing-Accept-Language and User-Agent heuristics. No configuration change is needed; if you had widened skipPaths or disabled bot-guard to work around this, you can revert that. **Fixed:** *`b.middleware.botGuard` no longer 403s browsers over plain HTTP or older Safari* — A missing `Sec-Fetch-Mode` was a blocking heuristic, but browsers omit Fetch Metadata outside a secure context (every plain-HTTP non-localhost origin — Umbrel, LAN, `*.local` proxies) and Safari < 16.4 omits it even over HTTPS. Those legitimate browsers were refused with `403 Forbidden`. `Sec-Fetch-Mode` is now advisory: it never blocks, and only sets `req.suspectedBot` in `mode: "tag"` on a secure-context HTML GET. The `Accept-Language` and User-Agent heuristics (which catch the same bots) are unchanged. **Detectors:** *reserved-hostname trailing-dot detector recognizes regex strips* — The codebase-patterns gate that requires stripping the RFC 1034 trailing root-zone dot before a reserved-hostname comparison now also recognizes end-anchored regex strips (`.replace(/\.$/, …)`), not only the `charAt` / `while`-loop forms.
+
+- v0.12.68 (2026-05-26) — **`b.jwk` — RFC 7638 JWK thumbprint.** Compute the RFC 7638 thumbprint of a JSON Web Key — the canonical base64url(SHA-256(canonical-JSON)) identifier used to name a key (DPoP jkt bindings, ACME account-key thumbprints, DBSC session pins, kid derivation). b.jwk.thumbprint(jwk) returns the digest; b.jwk.canonicalize(jwk) returns the exact JSON that is hashed — only the key-type's required members, member names in lexicographic order, no whitespace, so the same key always yields the same thumbprint regardless of how its JWK was serialized. The standard key types are supported (EC, RSA, oct, OKP per RFC 8037) plus AKP, the IANA key type Node uses for ML-DSA / SLH-DSA post-quantum public keys; SHA-256 is the default, with hash: "sha384" | "sha512" for RFC 9278 thumbprint-with-hash. Verified against the RFC 7638 §3.1 worked example. b.auth.dpop, b.acme, and b.dbsc now compute their thumbprints through this primitive. **Added:** *`b.jwk.thumbprint` / `b.jwk.canonicalize`* — RFC 7638 JWK thumbprint. `thumbprint(jwk, opts)` returns `base64url(hash(canonical-JSON))` — only the key-type's required members feed the hash, so optional fields (`kid`, `use`, `alg`, …) never change the result. `canonicalize(jwk)` returns the canonical JSON string itself. Supports EC / RSA / oct / OKP and the AKP post-quantum key type; SHA-256 default, `hash` selects SHA-384 / SHA-512. Throws `JwkError` on an invalid key or unknown hash. **Changed:** *DPoP, ACME, and DBSC compose `b.jwk`* — `b.auth.dpop` (the `jkt` proof-key thumbprint), `b.acme` (the RFC 8555 account-key authorization), and `b.dbsc` (the session-pin thumbprint) now compute RFC 7638 thumbprints through `b.jwk` instead of carrying their own implementations. Behavior is unchanged — DPoP still refuses symmetric key types, and each surface keeps its own error codes.
+
 - v0.12.66 (2026-05-26) — **`b.uriTemplate` — RFC 6570 URI Template expansion.** Expand RFC 6570 URI Templates — the {var} syntax that OpenAPI links, HAL _links, and hypermedia API clients use to turn a template plus a set of variables into a concrete URI. The full Level 4 grammar is supported: every operator ({+var} reserved, {#var} fragment, {.var} label, {/var} path, {;var} path-style parameters, {?var} query, {&var} query continuation), the {var:3} prefix modifier, and the {var*} explode modifier for lists and associative arrays. b.uriTemplate.expand(template, vars) returns the expanded string; b.uriTemplate.compile(template) parses once for templates applied to many variable sets. A malformed template (unclosed expression, reserved operator, non-numeric prefix, unmatched brace) throws UriTemplateError. Verified against the official uritemplate-test conformance suite (all 135 spec, extended, and negative cases). **Added:** *`b.uriTemplate.expand` / `b.uriTemplate.compile`* — RFC 6570 URI Template expansion, full Level 4. `expand(template, vars)` substitutes variables into a template and returns the URI; `compile(template)` returns a reusable `{ expand }` for repeated use. Variable values may be strings, numbers, booleans, arrays (lists), or plain objects (associative arrays); undefined, null, and empty list/map variables are omitted. All eight operators, the `:N` prefix modifier, and the `*` explode modifier follow §3.2, including reserved-set encoding for `{+var}` / `{#var}`. Composes naturally with `b.hal`, `b.linkHeader`, and `b.openapi` link objects. A malformed template throws `UriTemplateError`.
 
 - v0.12.65 (2026-05-26) — **`b.base32` — RFC 4648 Base32 encode / decode.** Encode and decode RFC 4648 Base32 — the case-insensitive alphabet behind TOTP / 2FA secrets, DNSSEC NSEC3 hashes, and human-transcribable identifiers. Both RFC 4648 variants are supported: the standard alphabet (the default) and the extended-hex alphabet. b.base32.encode pads to an 8-character boundary by default (pass padding: false for the bare form TOTP key URIs use); b.base32.decode is strict by default but accepts the real-world shapes humans produce — lower-case, embedded spaces and dashes, missing padding — under loose: true. Verified against the RFC 4648 §10 test vectors for both alphabets. The TOTP primitive now composes this codec instead of carrying its own Base32 implementation. **Added:** *`b.base32.encode` / `b.base32.decode`* — RFC 4648 Base32 codec. `encode(buf, opts)` takes a Buffer or Uint8Array and returns a Base32 string, padded to an 8-character boundary unless `padding: false`; `decode(str, opts)` returns a Buffer. The `variant` option selects the standard (`"rfc4648"`, default) or extended-hex (`"rfc4648-hex"`) alphabet. Decoding is strict by default — any character outside the alphabet throws `Base32Error` — and `loose: true` up-cases the input and ignores embedded spaces, dashes, and missing padding, which is how copied TOTP keys and hand-typed codes arrive. **Changed:** *TOTP composes `b.base32`* — `b.auth.totp` now encodes and decodes its secrets through `b.base32` rather than a private Base32 implementation. Behavior is unchanged — secrets are still emitted unpadded and parsed leniently (case-insensitive, ignoring spaces and dashes).

package/lib/vendor/blamejs/README.md

@@ -71,6 +71,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 
 - **Passwords** — Argon2id + policy primitive (`b.auth.password`); NIST 800-63B / PCI-DSS 4.0 / HIPAA-AAL2 profiles; HaveIBeenPwned k-anonymity breach check; length / context / dictionary / complexity rules; rotation + history
 - **Multi-factor + WebAuthn** — passkeys (WebAuthn), TOTP, JWT (PQ-default)
+- **JWK thumbprint** — RFC 7638 `base64url(SHA-256(canonical-JSON))` key identifier (`b.jwk.thumbprint` / `canonicalize`): EC / RSA / oct / OKP + the AKP post-quantum key type, SHA-256/384/512; the canonical key name behind DPoP `jkt`, ACME account keys, and DBSC session pins
 - **OAuth / OIDC RP** — `b.auth.oauth`
   - RP-Initiated / Front-Channel / Back-Channel Logout 1.0 (`parseFrontchannelLogoutRequest` + `verifyBackchannelLogoutToken` with jti-replay defense)
   - RFC 9207 AS Issuer Identifier validation on callbacks (`parseCallback` — refuses iss mismatch + OP `error=` redirect)

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.12.66",
-  "createdAt": "2026-05-26T09:03:41.849Z",
+  "frameworkVersion": "0.12.69",
+  "createdAt": "2026-05-26T14:58:13.295Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -37180,6 +37180,48 @@
         }
       }
     },
+    "jwk": {
+      "type": "object",
+      "members": {
+        "JwkError": {
+          "type": "function",
+          "arity": 4
+        },
+        "REQUIRED": {
+          "type": "object",
+          "members": {
+            "AKP": {
+              "type": "instance",
+              "ctorName": "Array"
+            },
+            "EC": {
+              "type": "instance",
+              "ctorName": "Array"
+            },
+            "OKP": {
+              "type": "instance",
+              "ctorName": "Array"
+            },
+            "RSA": {
+              "type": "instance",
+              "ctorName": "Array"
+            },
+            "oct": {
+              "type": "instance",
+              "ctorName": "Array"
+            }
+          }
+        },
+        "canonicalize": {
+          "type": "function",
+          "arity": 1
+        },
+        "thumbprint": {
+          "type": "function",
+          "arity": 2
+        }
+      }
+    },
     "keychain": {
       "type": "object",
       "members": {

package/lib/vendor/blamejs/index.js

@@ -406,6 +406,7 @@ var jtd = require("./lib/jtd");
 var jsonSchema = require("./lib/json-schema");
 var base32 = require("./lib/base32");
 var uriTemplate = require("./lib/uri-template");
+var jwk = require("./lib/jwk");
 var standardWebhooks = require("./lib/standard-webhooks");
 var lro = require("./lib/lro");
 var jsonApi = require("./lib/jsonapi");
@@ -433,6 +434,7 @@ module.exports = {
   jsonSchema:       jsonSchema,
   base32:           base32,
   uriTemplate:      uriTemplate,
+  jwk:              jwk,
   standardWebhooks: standardWebhooks,
   lro:              lro,
   jsonApi:          jsonApi,

package/lib/vendor/blamejs/lib/acme.js

@@ -45,6 +45,7 @@ var nodeCrypto = require("node:crypto");
 
 var C = require("./constants");
 var asn1 = require("./asn1-der");
+var jwk = require("./jwk");
 var safeUrl = require("./safe-url");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
@@ -114,8 +115,7 @@ function _publicJwkFromKeyObject(keyObject) {
 
 function _jwkThumbprint(publicJwk) {
   // RFC 7638 §3 — base64url(SHA-256(canonical JSON of required members)).
-  var canon = JSON.stringify({ crv: publicJwk.crv, kty: publicJwk.kty, x: publicJwk.x, y: publicJwk.y });
-  return _b64u(nodeCrypto.createHash("sha256").update(canon).digest());
+  return jwk.thumbprint(publicJwk);
 }
 
 function _signJws(privateKey, protectedHeader, payload) {

package/lib/vendor/blamejs/lib/auth/dpop.js

@@ -28,6 +28,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("../crypto");
+var jwk = require("../jwk");
 var safeJson = require("../safe-json");
 var safeUrl = require("../safe-url");
 var validateOpts = require("../validate-opts");
@@ -84,52 +85,21 @@ function _b64urlDecode(s) {
   }
 }
 
-// Canonical JWK per RFC 7638 — keys present in lexicographic order,
-// only the kty-defined "required" members. Used for thumbprint.
-function _canonicalJwk(jwk) {
-  if (!jwk || typeof jwk !== "object") {
-    throw new AuthError("auth-dpop/bad-jwk", "jwk must be an object");
-  }
-  if (typeof jwk.kty !== "string" || jwk.kty.length === 0) {
-    throw new AuthError("auth-dpop/bad-jwk", "jwk.kty is required");
-  }
-  if (jwk.kty === "EC") {
-    if (typeof jwk.crv !== "string" || typeof jwk.x !== "string" || typeof jwk.y !== "string") {
-      throw new AuthError("auth-dpop/bad-jwk", "EC jwk requires crv, x, y");
-    }
-    return JSON.stringify({ crv: jwk.crv, kty: "EC", x: jwk.x, y: jwk.y });
+// Asymmetric key types DPoP accepts (its proof model relies on a
+// signature, so symmetric "oct" keys are refused). AKP is the IANA key
+// type for ML-DSA / SLH-DSA PQC public keys.
+var DPOP_KTY = { EC: 1, OKP: 1, RSA: 1, AKP: 1 };
+
+function thumbprint(key) {
+  if (!key || typeof key !== "object" || typeof key.kty !== "string" || key.kty.length === 0) {
+    throw new AuthError("auth-dpop/bad-jwk", "jwk must be an object with a kty");
   }
-  if (jwk.kty === "OKP") {
-    if (typeof jwk.crv !== "string" || typeof jwk.x !== "string") {
-      throw new AuthError("auth-dpop/bad-jwk", "OKP jwk requires crv, x");
-    }
-    return JSON.stringify({ crv: jwk.crv, kty: "OKP", x: jwk.x });
+  if (!DPOP_KTY[key.kty]) {
+    throw new AuthError("auth-dpop/refused-kty", "jwk.kty='" + key.kty + "' is not allowed (DPoP requires asymmetric kty)");
   }
-  if (jwk.kty === "RSA") {
-    if (typeof jwk.e !== "string" || typeof jwk.n !== "string") {
-      throw new AuthError("auth-dpop/bad-jwk", "RSA jwk requires e, n");
-    }
-    return JSON.stringify({ e: jwk.e, kty: "RSA", n: jwk.n });
-  }
-  if (jwk.kty === "AKP") {
-    // PQC asymmetric key package (draft-ietf-cose-cnsa-pqc / IANA AKP
-    // registry). Node:crypto exports ML-DSA / SLH-DSA public keys with
-    // kty=AKP, alg=<algId>, pub=<base64url public bytes>.
-    if (typeof jwk.alg !== "string" || typeof jwk.pub !== "string") {
-      throw new AuthError("auth-dpop/bad-jwk", "AKP jwk requires alg, pub");
-    }
-    return JSON.stringify({ alg: jwk.alg, kty: "AKP", pub: jwk.pub });
-  }
-  // Symmetric keys (oct) and any other kty are refused outright — DPoP's
-  // proof model requires asymmetric.
-  throw new AuthError("auth-dpop/refused-kty",
-    "jwk.kty='" + jwk.kty + "' is not allowed (DPoP requires asymmetric kty)");
-}
-
-function thumbprint(jwk) {
-  var canonical = _canonicalJwk(jwk);
-  var hash = nodeCrypto.createHash("sha256").update(canonical, "utf8").digest();
-  return _b64urlEncode(hash);
+  // The RFC 7638 thumbprint itself is computed by b.jwk.
+  try { return jwk.thumbprint(key); }
+  catch (e) { throw new AuthError("auth-dpop/bad-jwk", (e && e.message) || "invalid jwk"); }
 }
 
 function _sha256B64Url(input) {

package/lib/vendor/blamejs/lib/dbsc.js

@@ -36,7 +36,7 @@ var nodeCrypto    = require("node:crypto");
 var validateOpts  = require("./validate-opts");
 var safeJson      = require("./safe-json");
 var bCrypto       = require("./crypto");
-var canonicalJson = require("./canonical-json");
+var jwk           = require("./jwk");
 var jwtExternal   = require("./auth/jwt-external");
 var C             = require("./constants");
 var { defineClass } = require("./framework-error");
@@ -272,23 +272,10 @@ function _trimLeadingZeros(buf) {
   return buf.slice(i);
 }
 
-function _jwkThumbprint(jwk) {
-  // RFC 7638 canonical thumbprint: alphabetic key-name ordering + no
-  // whitespace + SHA-256 + base64url. For EC P-256 the required keys
-  // are { crv, kty, x, y }.
-  var members;
-  if (jwk.kty === "EC") {
-    members = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
-  } else if (jwk.kty === "RSA") {
-    members = { e: jwk.e, kty: jwk.kty, n: jwk.n };
-  } else {
-    throw new DbscError("dbsc/bad-jwk-kty",
-      "jwkThumbprint: unsupported kty " + jwk.kty);
-  }
-  var canonical = canonicalJson.stringify(members);
-  return bCrypto.toBase64Url(
-    nodeCrypto.createHash("sha256").update(Buffer.from(canonical, "utf8")).digest()
-  );
+function _jwkThumbprint(key) {
+  // RFC 7638 thumbprint (base64url(SHA-256(canonical JWK))) via b.jwk.
+  try { return jwk.thumbprint(key); }
+  catch (e) { throw new DbscError("dbsc/bad-jwk-kty", "jwkThumbprint: " + ((e && e.message) || "invalid jwk")); }
 }
 
 module.exports = {

package/lib/vendor/blamejs/lib/jwk.js

@@ -0,0 +1,127 @@
+"use strict";
+/**
+ * @module b.jwk
+ * @nav    Identity
+ * @title  JWK Thumbprint
+ *
+ * @intro
+ *   Compute the <a href="https://www.rfc-editor.org/rfc/rfc7638">RFC 7638</a>
+ *   thumbprint of a JSON Web Key — the canonical, hash-based identifier used
+ *   to name a key (DPoP <code>jkt</code> bindings, ACME account-key
+ *   thumbprints per RFC 8555, DBSC session pins, and <code>kid</code>
+ *   derivation). The thumbprint is
+ *   <code>base64url(SHA-256(canonical-JSON))</code>, where the canonical
+ *   JSON contains only the key-type's required members, with member names
+ *   in lexicographic order and no whitespace — so the same key always
+ *   produces the same thumbprint regardless of how its JWK was serialized.
+ *
+ *   <code>thumbprint(jwk)</code> returns the base64url digest;
+ *   <code>canonicalize(jwk)</code> returns the exact JSON string that is
+ *   hashed. The standard key types are supported — EC, RSA, oct, and OKP
+ *   (RFC 8037 Ed25519 / X25519) — plus AKP, the IANA key type Node uses for
+ *   ML-DSA / SLH-DSA post-quantum public keys. SHA-256 is the default;
+ *   <code>hash: "sha384" | "sha512"</code> selects a longer digest
+ *   (RFC 9278 thumbprint-with-hash).
+ *
+ * @card
+ *   RFC 7638 JWK thumbprint — the canonical
+ *   <code>base64url(SHA-256(canonical-JSON))</code> identifier for a JSON
+ *   Web Key (EC / RSA / oct / OKP / AKP), behind DPoP <code>jkt</code>,
+ *   ACME account keys, and DBSC session pins.
+ */
+
+var nodeCrypto = require("node:crypto");
+var canonicalJson = require("./canonical-json");
+var { defineClass } = require("./framework-error");
+
+var JwkError = defineClass("JwkError", { alwaysPermanent: true });
+
+var HASHES = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
+
+// RFC 7638 §3.2 + JWA: the required members per key type, which (and only
+// which) participate in the thumbprint. Listed for documentation; the
+// canonical form is produced with lexicographic ordering regardless.
+var REQUIRED = {
+  EC:  ["crv", "kty", "x", "y"],
+  RSA: ["e", "kty", "n"],
+  oct: ["k", "kty"],
+  OKP: ["crv", "kty", "x"],   // RFC 8037
+  AKP: ["alg", "kty", "pub"], // IANA AKP — ML-DSA / SLH-DSA public keys
+};
+
+function _requiredMembers(jwk) {
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    throw new JwkError("jwk/bad-jwk", "jwk: must be a JWK object");
+  }
+  if (typeof jwk.kty !== "string" || jwk.kty.length === 0) {
+    throw new JwkError("jwk/bad-jwk", "jwk: 'kty' is required");
+  }
+  var names = REQUIRED[jwk.kty];
+  if (!names) throw new JwkError("jwk/unsupported-kty", "jwk: unsupported kty '" + jwk.kty + "'");
+  var out = {};
+  for (var i = 0; i < names.length; i++) {
+    var n = names[i];
+    if (typeof jwk[n] !== "string" || jwk[n].length === 0) {
+      throw new JwkError("jwk/bad-jwk", "jwk: " + jwk.kty + " key requires a string '" + n + "' member");
+    }
+    out[n] = jwk[n];
+  }
+  return out;
+}
+
+/**
+ * @primitive  b.jwk.canonicalize
+ * @signature  b.jwk.canonicalize(jwk)
+ * @since      0.12.68
+ * @status     stable
+ * @related    b.jwk.thumbprint
+ *
+ * Return the RFC 7638 canonical JSON string for a JWK — only the key-type's
+ * required members, member names in lexicographic order, no whitespace.
+ * This is the exact input that <code>thumbprint</code> hashes. Throws
+ * <code>JwkError</code> for a missing <code>kty</code>, an unsupported key
+ * type, or a missing required member.
+ *
+ * @example
+ *   b.jwk.canonicalize({ kty: "EC", crv: "P-256", x: "...", y: "...", use: "sig" });
+ *   // → '{"crv":"P-256","kty":"EC","x":"...","y":"..."}'  (use omitted)
+ */
+function canonicalize(jwk) {
+  return canonicalJson.stringify(_requiredMembers(jwk));
+}
+
+/**
+ * @primitive  b.jwk.thumbprint
+ * @signature  b.jwk.thumbprint(jwk, opts?)
+ * @since      0.12.68
+ * @status     stable
+ * @related    b.jwk.canonicalize
+ *
+ * Compute the RFC 7638 thumbprint of a JWK:
+ * <code>base64url(hash(canonicalJSON))</code>. Only the key-type's required
+ * members feed the hash, so optional fields (<code>kid</code>,
+ * <code>use</code>, <code>alg</code>, …) never change the result. SHA-256
+ * is the default digest; <code>hash</code> selects a longer one. Throws
+ * <code>JwkError</code> on an invalid JWK or unknown hash.
+ *
+ * @opts
+ *   hash:   "sha256" | "sha384" | "sha512",   // default: "sha256"
+ *
+ * @example
+ *   b.jwk.thumbprint({ kty: "RSA", e: "AQAB", n: "0vx7ago...DKgw" });
+ *   // → "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
+ */
+function thumbprint(jwk, opts) {
+  opts = opts || {};
+  var hash = HASHES[opts.hash || "sha256"];
+  if (!hash) throw new JwkError("jwk/bad-hash", "jwk.thumbprint: hash must be sha256, sha384, or sha512");
+  var canon = canonicalize(jwk);
+  return nodeCrypto.createHash(hash).update(canon, "utf8").digest("base64url");
+}
+
+module.exports = {
+  thumbprint:   thumbprint,
+  canonicalize: canonicalize,
+  REQUIRED:     REQUIRED,
+  JwkError:     JwkError,
+};

package/lib/vendor/blamejs/lib/middleware/bot-guard.js

@@ -6,8 +6,12 @@
  *
  * Heuristics (all combined):
  *   - Missing Accept-Language header (real browsers always send one)
- *   - Missing Sec-Fetch-Mode header (modern browsers send these on every
- *     navigation; absence is suspicious for HTML routes but not API)
+ *   - Missing Sec-Fetch-Mode header — ADVISORY ONLY (never blocks). Tagged
+ *     in mode:"tag" on secure-context HTML GETs where a modern browser
+ *     would have sent it. It cannot block because the header is absent for
+ *     entire browser families (Safari < 16.4) and for every plain-HTTP
+ *     non-localhost origin (Umbrel, LAN / *.local proxies) — a 403 on it
+ *     alone would refuse real users.
  *   - User-Agent matches known automation libraries (curl, wget, python-
  *     requests, axios, Go-http-client) — operators can add or remove
  *     entries via config
@@ -86,9 +90,13 @@ function _xffIpFor(trustProxy) {
  * Cheap fingerprint-based detection of obviously-non-browser requests.
  * Constructed via `b.middleware.botGuard(opts)`; the resulting
  * middleware has the `(req, res, next)` shape shown above.
- * Combines three heuristics: missing `Accept-Language`, missing
- * `Sec-Fetch-Mode` (HTML routes), and User-Agent regex match against
- * a default list (curl / wget / python-requests / axios / etc.). Not
+ * Two blocking heuristics — missing `Accept-Language` and a User-Agent
+ * regex match against a default list (curl / wget / python-requests /
+ * axios / etc.) — plus one advisory signal: a missing `Sec-Fetch-Mode`
+ * on a secure-context HTML GET sets `req.suspectedBot` in `mode: "tag"`
+ * but NEVER blocks (the header is absent for Safari < 16.4 and every
+ * plain-HTTP non-localhost origin, so blocking on it refuses real
+ * users). Not
  * a substitute for proper authentication — catches drive-by scrapers
  * and low-effort bots. In `mode: "block"` (default) the request is
  * refused; in `mode: "tag"` `req.suspectedBot = true` is set and the
@@ -152,6 +160,28 @@ function create(opts) {
     return /^\/api\//.test(path);
   }
 
+  // Browsers only emit Fetch Metadata (Sec-Fetch-*) in a *secure context*
+  // (W3C Secure Contexts): an HTTPS origin, or a localhost-family origin
+  // even over plain HTTP. On a plain-HTTP non-localhost origin — an Umbrel
+  // app, a LAN / *.local reverse-proxy deployment — the browser omits
+  // Sec-Fetch-* entirely, so a missing Sec-Fetch-Mode is NORMAL there and
+  // must not be read as a bot signal. The effective scheme honours
+  // X-Forwarded-Proto only under trustProxy (otherwise it is forgeable).
+  function _isSecureContext(req) {
+    if (requestHelpers.requestProtocol(req, { trustProxy: trustProxy }) === "https") return true;
+    var host = (req.headers && req.headers.host) || "";
+    host = String(host).toLowerCase().replace(/:\d+$/, "");   // strip :port
+    if (host.charAt(0) === "[") {                              // [::1] IPv6 literal
+      var end = host.indexOf("]");
+      host = end === -1 ? host.slice(1) : host.slice(1, end);
+    }
+    host = host.replace(/\.$/, "");                            // strip trailing root-zone dot (RFC 1034 §3.1) so "localhost." matches
+    if (host === "localhost" || /\.localhost$/.test(host)) return true;
+    if (host === "::1") return true;
+    if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host)) return true;   // allow:regex-no-length-cap — bounded dotted-quad loopback
+    return false;
+  }
+
   function _checkHeuristics(req) {
     var headers = req.headers || {};
     var ua = headers["user-agent"] || "";
@@ -167,7 +197,14 @@ function create(opts) {
       return null;
     }
     if (!headers["accept-language"]) return "missing-accept-language";
-    if (req.method === "GET" && !headers["sec-fetch-mode"]) return "missing-sec-fetch-mode";
+    // Missing Sec-Fetch-Mode NEVER blocks: the header is absent for entire
+    // browser families (Safari < 16.4 omits Fetch Metadata even over HTTPS)
+    // and for every plain-HTTP non-localhost origin (Umbrel, LAN / *.local
+    // reverse proxies), so a 403 on it alone refuses real users. It survives
+    // only as an advisory TAG in mode:"tag", and even then only in a secure
+    // context where a modern browser would have sent it. Drive-by bots are
+    // still blocked by missing Accept-Language + the User-Agent deny-list.
+    if (mode === "tag" && req.method === "GET" && _isSecureContext(req) && !headers["sec-fetch-mode"]) return "missing-sec-fetch-mode";
     return null;
   }
 

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.12.66",
+  "version": "0.12.69",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.12.68.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.68",
+  "date": "2026-05-26",
+  "headline": "`b.jwk` — RFC 7638 JWK thumbprint",
+  "summary": "Compute the RFC 7638 thumbprint of a JSON Web Key — the canonical base64url(SHA-256(canonical-JSON)) identifier used to name a key (DPoP jkt bindings, ACME account-key thumbprints, DBSC session pins, kid derivation). b.jwk.thumbprint(jwk) returns the digest; b.jwk.canonicalize(jwk) returns the exact JSON that is hashed — only the key-type's required members, member names in lexicographic order, no whitespace, so the same key always yields the same thumbprint regardless of how its JWK was serialized. The standard key types are supported (EC, RSA, oct, OKP per RFC 8037) plus AKP, the IANA key type Node uses for ML-DSA / SLH-DSA post-quantum public keys; SHA-256 is the default, with hash: \"sha384\" | \"sha512\" for RFC 9278 thumbprint-with-hash. Verified against the RFC 7638 §3.1 worked example. b.auth.dpop, b.acme, and b.dbsc now compute their thumbprints through this primitive.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.jwk.thumbprint` / `b.jwk.canonicalize`",
+          "body": "RFC 7638 JWK thumbprint. `thumbprint(jwk, opts)` returns `base64url(hash(canonical-JSON))` — only the key-type's required members feed the hash, so optional fields (`kid`, `use`, `alg`, …) never change the result. `canonicalize(jwk)` returns the canonical JSON string itself. Supports EC / RSA / oct / OKP and the AKP post-quantum key type; SHA-256 default, `hash` selects SHA-384 / SHA-512. Throws `JwkError` on an invalid key or unknown hash."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "DPoP, ACME, and DBSC compose `b.jwk`",
+          "body": "`b.auth.dpop` (the `jkt` proof-key thumbprint), `b.acme` (the RFC 8555 account-key authorization), and `b.dbsc` (the session-pin thumbprint) now compute RFC 7638 thumbprints through `b.jwk` instead of carrying their own implementations. Behavior is unchanged — DPoP still refuses symmetric key types, and each surface keeps its own error codes."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.12.69.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.69",
+  "date": "2026-05-26",
+  "headline": "`b.middleware.botGuard` no longer blocks browsers that omit Sec-Fetch-Mode",
+  "summary": "b.middleware.botGuard treated a missing Sec-Fetch-Mode header as a bot signal and returned 403 Forbidden, which refused legitimate browsers on any origin where the browser does not emit Fetch Metadata: every plain-HTTP non-localhost origin (Umbrel apps, LAN and *.local reverse-proxy deployments) and Safari before 16.4 even over HTTPS. Browsers only send Sec-Fetch-* in a secure context, so its absence is normal there — not a bot. Sec-Fetch-Mode is now advisory only: it never blocks, and it sets req.suspectedBot in mode:\"tag\" only on a secure-context HTML GET where a modern browser would have sent it. Drive-by bots are still blocked by the missing-Accept-Language and User-Agent heuristics. No configuration change is needed; if you had widened skipPaths or disabled bot-guard to work around this, you can revert that.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.middleware.botGuard` no longer 403s browsers over plain HTTP or older Safari",
+          "body": "A missing `Sec-Fetch-Mode` was a blocking heuristic, but browsers omit Fetch Metadata outside a secure context (every plain-HTTP non-localhost origin — Umbrel, LAN, `*.local` proxies) and Safari < 16.4 omits it even over HTTPS. Those legitimate browsers were refused with `403 Forbidden`. `Sec-Fetch-Mode` is now advisory: it never blocks, and only sets `req.suspectedBot` in `mode: \"tag\"` on a secure-context HTML GET. The `Accept-Language` and User-Agent heuristics (which catch the same bots) are unchanged."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "reserved-hostname trailing-dot detector recognizes regex strips",
+          "body": "The codebase-patterns gate that requires stripping the RFC 1034 trailing root-zone dot before a reserved-hostname comparison now also recognizes end-anchored regex strips (`.replace(/\\.$/, …)`), not only the `charAt` / `while`-loop forms."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/bot-guard.test.js

@@ -0,0 +1,102 @@
+"use strict";
+/**
+ * Layer 0 — b.middleware.botGuard.
+ * Focus: the Sec-Fetch-Mode heuristic must never refuse a real browser.
+ * Browsers omit Fetch Metadata (Sec-Fetch-*) on plain-HTTP non-localhost
+ * origins (Umbrel, LAN / *.local reverse proxies) AND in Safari < 16.4
+ * even over HTTPS — so a missing Sec-Fetch-Mode is advisory-only (tags in
+ * mode:"tag", never blocks). Drive-by bots are still blocked by the
+ * missing-Accept-Language and User-Agent heuristics.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+
+var BROWSER_UA = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120 Safari/537.36";
+
+function _run(opts, reqInit) {
+  var mw = b.middleware.botGuard(opts || {});
+  var req = b.testing.mockReq(reqInit);
+  var res = b.testing.mockRes();
+  var nexted = false;
+  mw(req, res, function () { nexted = true; });
+  var cap = res._captured();
+  return { nexted: nexted, blocked: cap.status === 403, status: cap.status, body: cap.body, suspectedBot: req.suspectedBot };
+}
+
+function testSurface() {
+  check("b.middleware.botGuard is a function", typeof b.middleware.botGuard === "function");
+  check("returns a (req,res,next) middleware", b.middleware.botGuard({}).length === 3);
+}
+
+function testSecFetchNeverBlocks() {
+  // The reported defect: a real browser on a plain-HTTP non-localhost
+  // origin (Umbrel app / LAN proxy) sends Accept-Language but no Sec-Fetch-*.
+  var umbrel = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "accept-language": "en-US", "user-agent": BROWSER_UA, host: "umbrel-dev.local:3080" } });
+  check("plain-HTTP browser (Umbrel) is NOT blocked", umbrel.nexted && !umbrel.blocked);
+
+  // Safari < 16.4 omits Sec-Fetch-* even over HTTPS — must not 403 either.
+  var safari = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "accept-language": "en-US", "user-agent": "Mozilla/5.0 (Macintosh) Version/15.6 Safari/605", host: "app.example.com" }, socket: { encrypted: true } });
+  check("Safari-over-HTTPS (no Sec-Fetch) is NOT blocked", safari.nexted && !safari.blocked);
+
+  // localhost over plain HTTP, no Sec-Fetch — also fine.
+  var local = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": BROWSER_UA, host: "localhost:3000" } });
+  check("localhost browser is NOT blocked", local.nexted && !local.blocked);
+
+  // A secure-context browser that DID send Sec-Fetch-Mode passes (sanity).
+  var modern = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": BROWSER_UA, "sec-fetch-mode": "navigate", host: "app.example.com" }, socket: { encrypted: true } });
+  check("modern HTTPS browser passes", modern.nexted && !modern.blocked);
+}
+
+function testBotsStillBlocked() {
+  // Missing Accept-Language remains a hard block.
+  var noLang = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "user-agent": BROWSER_UA, host: "app.example.com" }, socket: { encrypted: true } });
+  check("missing Accept-Language is blocked", noLang.blocked && noLang.status === 403 && noLang.body === "Forbidden");
+
+  // Known automation UA remains a hard block.
+  var curl = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": "curl/8.4.0", host: "app.example.com" } });
+  check("curl UA is blocked", curl.blocked && curl.status === 403);
+
+  var py = _run({ mode: "block" }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": "python-requests/2.31.0", host: "x" } });
+  check("python-requests UA is blocked", py.blocked);
+}
+
+function testTagModeAdvisory() {
+  // mode:"tag" — secure context, no Sec-Fetch-Mode → advisory tag, never blocks.
+  var tagged = _run({ mode: "tag" }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": BROWSER_UA, host: "app.example.com" }, socket: { encrypted: true } });
+  check("tag mode: secure-context Sec-Fetch miss tags but continues", tagged.nexted && !tagged.blocked && tagged.suspectedBot === "missing-sec-fetch-mode");
+
+  // mode:"tag" — plain-HTTP non-localhost → NOT tagged for Sec-Fetch (insecure context).
+  var untagged = _run({ mode: "tag" }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": BROWSER_UA, host: "umbrel.local" } });
+  check("tag mode: plain-HTTP origin is NOT tagged for Sec-Fetch", untagged.nexted && !untagged.suspectedBot);
+}
+
+function testOverridesAndSkips() {
+  // allowedAgents override beats the deny-list.
+  var allowed = _run({ mode: "block", allowedAgents: [/^curl\//i] }, { method: "GET", url: "/", headers: { "accept-language": "en", "user-agent": "curl/8.4.0", host: "x" } });
+  check("allowedAgents override lets curl through", allowed.nexted && !allowed.blocked);
+
+  // API routes skip the browser-fingerprint checks (onlyForHtml default).
+  var api = _run({ mode: "block" }, { method: "GET", url: "/api/data", pathname: "/api/data", headers: { "user-agent": BROWSER_UA, host: "x" } });
+  check("API route skips fingerprint checks", api.nexted && !api.blocked);
+
+  // skipPaths bypass.
+  var skipped = _run({ mode: "block", skipPaths: ["/healthz"] }, { method: "GET", url: "/healthz", pathname: "/healthz", headers: { "user-agent": "curl/8" } });
+  check("skipPaths bypasses bot-guard", skipped.nexted && !skipped.blocked);
+
+  // RegExp patterns are required (string patterns refused at create()).
+  var threw = null;
+  try { b.middleware.botGuard({ blockedAgents: ["badbot"] }); } catch (e) { threw = e.code; }
+  check("string blockedAgents pattern is refused", threw === "bot-guard/bad-pattern");
+}
+
+async function run() {
+  testSurface();
+  testSecFetchNeverBlocks();
+  testBotsStillBlocked();
+  testTagModeAdvisory();
+  testOverridesAndSkips();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[bot-guard] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -7963,7 +7963,10 @@ function testHostnameCompareTrailingDotNormalize() {
     catch (_e) { continue; }
     if (!reservedHostLiteralRe.test(content)) continue;
     var hasStrip = /\.charAt\([^)]*length\s*-\s*1\)\s*===\s*"\."/.test(content) ||
-                   /while[\s\S]{0,80}length\s*>\s*0[\s\S]{0,80}charAt[\s\S]{0,80}===\s*"\."/.test(content);
+                   /while[\s\S]{0,80}length\s*>\s*0[\s\S]{0,80}charAt[\s\S]{0,80}===\s*"\."/.test(content) ||
+                   // end-anchored regex strip of one-or-more trailing dots:
+                   // .replace(/\.$/, ...) / .replace(/\.+$/, ...) / .replace(/\.*$/, ...)
+                   /\.replace\(\s*\/\\\.[+*]?\$\//.test(content);
     if (hasStrip) continue;
     var m = content.match(reservedHostLiteralRe);
     var lineNum = content.slice(0, m.index).split("\n").length;

package/lib/vendor/blamejs/test/layer-0-primitives/jwk.test.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * Layer 0 — b.jwk (RFC 7638 thumbprint).
+ * Oracle: the RFC 7638 §3.1 worked example (an RSA key whose SHA-256
+ * thumbprint is "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"), plus
+ * canonicalization + per-kty + composition (DPoP / DBSC delegate here).
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+// RFC 7638 §3.1 example key (with extra members that must be ignored).
+var RFC_RSA = {
+  kty: "RSA",
+  n: "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtVT86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMstn64tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbISD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw",
+  e: "AQAB", alg: "RS256", kid: "2011-04-29", use: "sig",
+};
+var RFC_THUMB = "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs";
+
+function testSurface() {
+  check("b.jwk.thumbprint is a function", typeof b.jwk.thumbprint === "function");
+  check("b.jwk.canonicalize is a function", typeof b.jwk.canonicalize === "function");
+  check("b.jwk.JwkError is a class", typeof b.jwk.JwkError === "function");
+}
+
+function testRfc7638() {
+  check("RFC 7638 §3.1 thumbprint matches", b.jwk.thumbprint(RFC_RSA) === RFC_THUMB);
+  check("optional members are ignored", b.jwk.thumbprint({ kty: "RSA", n: RFC_RSA.n, e: "AQAB" }) === RFC_THUMB);
+  check("canonical JSON is lexicographic + minimal", b.jwk.canonicalize(RFC_RSA) === '{"e":"AQAB","kty":"RSA","n":"' + RFC_RSA.n + '"}');
+}
+
+function testKtys() {
+  // EC required members are crv, kty, x, y (lexicographic).
+  check("EC canonical", b.jwk.canonicalize({ kty: "EC", crv: "P-256", x: "X", y: "Y", d: "secret" }) === '{"crv":"P-256","kty":"EC","x":"X","y":"Y"}');
+  check("OKP canonical (RFC 8037)", b.jwk.canonicalize({ kty: "OKP", crv: "Ed25519", x: "X" }) === '{"crv":"Ed25519","kty":"OKP","x":"X"}');
+  check("oct canonical", b.jwk.canonicalize({ kty: "oct", k: "GawgguFyGrWKav7AX4VKUg" }) === '{"k":"GawgguFyGrWKav7AX4VKUg","kty":"oct"}');
+  check("AKP canonical (PQC)", b.jwk.canonicalize({ kty: "AKP", alg: "ML-DSA-87", pub: "UFVC" }) === '{"alg":"ML-DSA-87","kty":"AKP","pub":"UFVC"}');
+  check("different keys → different thumbprints", b.jwk.thumbprint({ kty: "oct", k: "AAAA" }) !== b.jwk.thumbprint({ kty: "oct", k: "BBBB" }));
+}
+
+function testHashOption() {
+  check("sha384 differs from sha256", b.jwk.thumbprint(RFC_RSA, { hash: "sha384" }) !== RFC_THUMB);
+  check("sha512 is a string", typeof b.jwk.thumbprint(RFC_RSA, { hash: "sha512" }) === "string");
+  check("bad hash throws", code(function () { b.jwk.thumbprint(RFC_RSA, { hash: "md5" }); }) === "jwk/bad-hash");
+}
+
+function testErrors() {
+  check("missing kty throws", code(function () { b.jwk.thumbprint({ n: "x", e: "y" }); }) === "jwk/bad-jwk");
+  check("unsupported kty throws", code(function () { b.jwk.thumbprint({ kty: "XYZ" }); }) === "jwk/unsupported-kty");
+  check("missing required member throws", code(function () { b.jwk.thumbprint({ kty: "EC", crv: "P-256", x: "X" }); }) === "jwk/bad-jwk");
+  check("non-object throws", code(function () { b.jwk.thumbprint("nope"); }) === "jwk/bad-jwk");
+}
+
+function testComposition() {
+  // DPoP and DBSC compute their thumbprints through b.jwk.
+  var ec = { kty: "EC", crv: "P-256", x: "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU", y: "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0" };
+  check("dpop.thumbprint composes b.jwk", b.auth.dpop.thumbprint(ec) === b.jwk.thumbprint(ec));
+  check("dpop refuses symmetric kty", code(function () { b.auth.dpop.thumbprint({ kty: "oct", k: "x" }); }) === "auth-dpop/refused-kty");
+}
+
+async function run() {
+  testSurface();
+  testRfc7638();
+  testKtys();
+  testHashOption();
+  testErrors();
+  testComposition();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[jwk] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.30",
+  "version": "0.1.31",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {