@blamejs/blamejs-shop 0.1.33 → 0.1.34

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.1.x
 
+- v0.1.34 (2026-05-26) — **Vendored blamejs refreshed to v0.13.0.** Refreshes the vendored blamejs stack from v0.12.11 to v0.13.0 — the single source of every security, crypto, and primitive the shop composes. No application API changes; the refresh keeps the shop current with upstream fixes and broadens the primitive surface the shop builds on. The vendored tree is verified against the release tag by the vendor-integrity gate, and the in-image smoke gate runs against the refreshed tree before any image ships. **Changed:** *Vendored blamejs v0.12.11 → v0.13.0* — The committed copy under `lib/vendor/blamejs/` is updated to the v0.13.0 release tag via the vendor-refresh entry point. Composed primitives are unchanged at the call sites the shop already uses; the refresh carries upstream maintenance and expands the available primitive surface for future shop features.
+
 - v0.1.33 (2026-05-26) — **Search filters and synonyms — narrow results by facet, and match what shoppers mean, not just what they typed.** Search gains filters and smarter matching. A search result page now shows facet groups — collection, price range, and in-stock — as filter controls; choosing one narrows the results, the counts beside each option reflect the current result set, and choices combine across groups. Active filters show with a one-click clear and carry through pagination rather than dropping on page two. All filtering is server-side from query parameters, so it works with no client JavaScript. Separately, the query is expanded through an operator-curated synonym and typo vocabulary before the catalog is searched, so a search for "tee" matches "t-shirt" and a near-miss spelling still finds the product, with a "Showing results for" note when the query was corrected. Filters and synonym matching work identically whether the page is served from the edge or the container. This release also moves the shipped theme's stylesheets and island scripts to content-fingerprinted filenames so an asset and the page that references it can never fall out of sync. **Added:** *Faceted search filters* — A search result page shows facet groups — collection, price range, and in-stock availability — as server-rendered filter controls. Selecting a facet narrows the results and is reflected in the URL (for example `/search?q=shirt&collection=summer&in_stock=1`), the count beside each option reflects how many results it would yield against the current query, and facets combine across groups. Active filters render as removable chips with a clear-all path, and the active filters carry through result pagination so page two keeps the filter set. All filtering is server-side from the query string — no client JavaScript — and unknown facet keys, out-of-range price values, and garbage filter values are ignored rather than erroring. With filters applied and no matches, the page shows an empty state with a clear-filters link. · *Synonym and typo-tolerant query matching* — Before the catalog is searched, the query is expanded through an operator-curated vocabulary: synonym groups (so "tee" matches "t-shirt"), common typo corrections, and stopword removal. When the query is corrected or expanded, the page shows a "Showing results for" note. A query that still matches nothing falls back to the raw terms so search never silently empties on an unknown word. **Changed:** *Search filters and synonyms render identically at the edge and the container* — The faceting and synonym logic runs in both the edge worker and the container search path, producing the same results and the same filter chrome whichever serves the page. The edge path reads the catalog and the facet/synonym vocabulary directly from the database, missing-table-resilient, so a shop without the optional facet configuration still searches normally. · *Theme stylesheets and scripts use content-fingerprinted filenames* — The shipped default theme's stylesheets and island scripts are now referenced by a content-hashed filename (`main.<hash>.css`) rather than a `?v=` query, emitted identically by the edge and container renderers and served from object storage under the fingerprinted key. Each URL maps to exactly one byte-content, so an asset and the page that references it can never disagree on a Subresource Integrity digest, and previously-served pages keep working across an asset change. The edge stylesheet link now also carries an integrity attribute, matching the container.
 
 - v0.1.32 (2026-05-26) — **Bundles and quantity discounts — sell products together at a set price, and reward buying more.** Two merchandising surfaces go live on the product page and in the cart, both priced authoritatively on the server. A product that belongs to a bundle shows a "Bundle & save" offer with its member products and the bundle price against the sum of the parts; one action adds the whole bundle to the cart at that price, all-or-nothing, and the discount is split across the member lines so the cart subtotal equals the quoted bundle price. Separately, a product with quantity breaks shows its price tiers ("1–2 / 3–5 / 6+") on the page, and the cart applies the right unit price for each line's quantity — recomputed on every cart render and again at checkout, so the line, cart, and order totals all reflect the break. The client never sends a price: it sends a bundle code or a quantity, and the server prices both from the live catalog. A bundle whose member is archived or out of stock is shown unavailable rather than adding a broken line, and a missing offer simply renders nothing. **Added:** *Bundles on the product page* — A product that is part of one or more bundles shows a "Bundle & save" offer listing the bundle's member products, the bundle price, and the saving against buying the parts separately. `POST /cart/bundle` adds the whole bundle to the cart in one action: the bundle price is recomputed from the live catalog and allocated across the member lines (proportional to each member's list price, with the rounding remainder on the last line) so the cart subtotal equals the quoted price. The add is atomic — if any member is archived or out of stock the bundle is shown unavailable and the action adds nothing rather than a partial set. A product in no bundle shows no offer; an unpriceable bundle (a missing member price or a currency mismatch) is shown unavailable, never a server error. The offer renders identically from the edge worker and the container. · *Quantity discounts on the product page and in the cart* — A product with quantity breaks shows its price tiers on the page (for example 1–2, 3–5, 6+ at descending unit prices). In the cart, each line is priced at the unit price for its quantity — applied server-side on every cart render so changing the quantity re-prices the line, and applied again at checkout so the per-line price and the order total written onto the order reflect the break, not the list price. A quantity below the first tier falls back to the base price; a quantity above the top tier takes the top tier. Stacks with the rest of the cart math. The tier table renders identically from the edge worker and the container. **Fixed:** *Themed product template carries the compare control* — The file-backed default product template now includes the Add-to-compare slot, matching the built-in render path so the comparison control appears on the product page whichever template is in use.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.33",
+  "version": "0.1.34",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-rvjL1QySBgNJGEUDusbbMCkL3fsjmzcwUvTp9pljo/0Nn/lErxq2AbY8EYvDF9Ch",

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.1",
-      "tag": "v0.13.1",
+      "version": "0.13.2",
+      "tag": "v0.13.2",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.2 (2026-05-26) — **`b.iabTcf.encode` — write TCF consent strings, and a TC-string timestamp fix.** b.iabTcf gains the encode half of its consent-string codec: b.iabTcf.encode(obj) serialises a parsed object back into an IAB TCF v2 TC string, and b.iabTcf.isValid(tcString) is a total never-throwing validity check. Vendor and purpose collections may be Sets, id arrays, or the parsed sections parseString returns; vendor sections are written with whichever of the bit-field and range forms is smaller, matching the reference CMP encoders, so a parsed string round-trips to an equivalent signal. parseString now fully decodes the Core publisher-restrictions list and the PublisherTC segment's publisher and custom purposes, where it previously reported only the segment's presence. The encoder is verified against the worked-example string in the IAB Tech Lab consent-string specification: it re-encodes that string's Core segment byte-for-byte. This release also fixes a TC-string parsing bug — the bit reader accumulated values with a 32-bit shift, so the 36-bit Created and LastUpdated timestamp fields were silently truncated for any real date; they now decode and round-trip exactly. **Added:** *`b.iabTcf.encode` / `b.iabTcf.isValid`* — `encode(obj)` serialises a TCF object (the shape `parseString` returns) into a TC string — Core plus optional DisclosedVendors, AllowedVendors, and PublisherTC segments — choosing the smaller of the bit-field and range vendor encodings. `isValid(tcString)` returns whether a string parses as a well-formed Core segment without throwing. `parseString` now fully decodes Core publisher restrictions and the PublisherTC purposes that were previously reported only as present. **Fixed:** *TC-string 36-bit timestamps were truncated on parse* — `b.iabTcf.parseString` read multi-bit fields with a 32-bit left-shift accumulation. The 36-bit Created and LastUpdated fields hold deciseconds-since-epoch, which exceeds 2^31 for any date after 1976, so those timestamps were silently corrupted. The reader now accumulates without the 32-bit truncation; timestamps decode correctly and round-trip through `encode`.
+
 - v0.13.1 (2026-05-26) — **`b.worm` — write-once-read-many retention.** Store records that cannot be altered or deleted before a retention period elapses — the immutable-storage discipline regulators require (SEC 17a-4(f), CFTC 1.31, FINRA 4511). b.worm.create(opts) returns a WORM store that enforces, on every mutating call, that a record is not overwritten or deleted while it is within its retainUntil window or under a legal hold. Two modes mirror cloud Object-Lock: compliance (the default — no one, including the operator, can delete before expiry) and governance (a privileged caller may override with an audited reason). Retention can only be extended, never shortened; every record carries a SHA3-512 digest that get verifies, so tampering with the underlying bytes is detected on read; every allow/refuse decision is audited. Storage is pluggable via a synchronous store adapter, so the policy layer sits over a sealed DB table, a filesystem, or any non-S3 backend — the store-agnostic, application-level companion to b.objectStore's S3 Object Lock, with content-integrity verification that native Object Lock does not provide. **Added:** *`b.worm.create` — write-once-read-many retention* — Returns a store with `put` / `get` / `delete` / `extendRetention` / `placeLegalHold` / `releaseLegalHold` / `list`. `put` is write-once (an overwrite of a retained or held record is refused); `delete` is gated by the retention window, legal holds, and the mode (`compliance` refuses any early delete; `governance` allows a privileged override with a required, audited reason); `extendRetention` is extend-only; `get` verifies the stored SHA3-512 digest and throws `worm/tampered` on a mismatch. Storage is a pluggable synchronous adapter (`get` / `set` / `delete` / `has` / `keys`), defaulting to in-memory for tests. Use it for SEC 17a-4 / CFTC / FINRA immutable records on backends without native Object Lock; `b.objectStore` remains the path for S3 Object Lock.
 
 - v0.13.0 (2026-05-26) — **`b.crypto.oprf` — RFC 9497 Oblivious PRFs.** Compute F(serverKey, input) without the server learning the input and without the client learning the key — the Oblivious PRF primitive behind password hardening (the server peppers a password it never sees), private set intersection, and Privacy Pass. b.crypto.oprf.suite(name) returns an RFC 9497 ciphersuite — ristretto255-sha512, p256-sha256, p384-sha384, or p521-sha512 — each exposing the base oprf mode and the verifiable voprf mode (a DLEQ proof lets the client confirm the server used the key committed in its public key). The client blinds its input, the server blind-evaluates with its secret key, and the client finalizes by un-blinding and hashing; because un-blinding cancels the blind, the output depends only on key and input. Validated byte-for-byte against the RFC 9497 Appendix-A test vectors. Group and hash-to-curve operations come from the newly vendored @noble/curves (Paul Miller, MIT) — the same maintainer as the framework's existing vendored @noble/post-quantum and @noble/ciphers, with no added npm runtime dependency. **Added:** *`b.crypto.oprf` — RFC 9497 OPRF / VOPRF* — `suite(name)` returns `{ name, oprf, voprf }` for one of the four RFC 9497 ciphersuites (ristretto255-SHA512 / P-256-SHA256 / P-384-SHA384 / P-521-SHA512). The `oprf` (base) mode provides `deriveKeyPair` / `generateKeyPair` / `blind` / `blindEvaluate` / `finalize` / `evaluate`; `voprf` (verifiable) adds a DLEQ proof so the client can prove the server used the committed key. Use it for password hardening, private set intersection, and OPRF-based tokens. Verified against the RFC 9497 Appendix-A vectors. The partially-oblivious `poprf` mode is not yet exposed (the vendored `@noble/curves` does not implement it) and will follow upstream. · *Vendored `@noble/curves`* — `@noble/curves` 2.2.0 (Paul Miller, MIT) is vendored under `lib/vendor/` (no npm runtime dependency), supplying the ristretto255 / NIST-curve group and hash-to-curve operations behind `b.crypto.oprf`. It joins the existing vendored `@noble/post-quantum` and `@noble/ciphers` from the same maintainer; tracked in the SBOM and the vendor-currency gate.

package/lib/vendor/blamejs/README.md

@@ -207,7 +207,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **Change control + WORM** — m-of-n approver DDL change-control with maintenance-window + ML-DSA-87 signed proposals (`b.ddlChangeControl`); row-level WORM triggers boot-asserted under `sec-17a-4` / `finra-4511` / `fda-21cfr11` (`b.db.declareWorm`); dual-control physical delete + crypto-erase + REINDEX in one transaction (`b.db.declareRequireDualControl`, `b.db.eraseHard`)
 - **Consumer-protection** — FTC click-to-cancel UX-parity attestation (`ftc-2024` / `ca-sb942` / `strict`) (`b.darkPatterns`)
 - **Differential privacy** — float-safe DP for aggregate releases: snapping-mechanism Laplace (Mironov 2012) + discrete Gaussian (Canonne–Kamath–Steinke 2020), CSPRNG noise, per-scope ε/δ budgets with basic + Rényi-DP accounting; defends the floating-point distinguishing attack that breaks naive Laplace samplers (NIST SP 800-226) (`b.ai.dp`)
-- **Privacy / DSR** — GDPR Articles 15–22 / CCPA / CPRA / LGPD / PIPEDA data-subject-rights workflow (`b.dsr`); IAB TCF v2.3 consent-string parser + `disclosedVendors` validator (`b.iabTcf`); IAB MSPA / GPP universal-opt-out (USNAT / USCA / USVA / USCO / USCT / USUT) + GPC mirror (`b.iabMspa`); generic consent capture + withdrawal (`b.consent`)
+- **Privacy / DSR** — GDPR Articles 15–22 / CCPA / CPRA / LGPD / PIPEDA data-subject-rights workflow (`b.dsr`); IAB TCF v2 consent-string parse + encode + `disclosedVendors` validator (`b.iabTcf`); IAB MSPA / GPP universal-opt-out (USNAT / USCA / USVA / USCO / USCT / USUT) + GPC mirror (`b.iabMspa`); generic consent capture + withdrawal (`b.consent`)
 - **Incident reporters** — EU DORA Article 17 ICT-incident workflow per Commission Delegated Regulation 2024/1772 (`b.dora`); EU NIS2 (`b.nis2`); EU Cyber Resilience Act SBOM + secure-software-attestation (`b.cra`); SEC Form 8-K Item 1.05 cybersecurity-incident materiality-disclosure (`b.secCyber`); incident lifecycle coordinator (`b.incident`)
 - **Outbound DLP** — interceptor-installed on httpClient + mail + webhook with built-in detectors for PAN (Luhn), SSN, EIN, IBAN (mod-97), api-key shapes, PEM, SSH private keys, JWTs, AWS access keys, PHI composite; refuse / redact / audit-only verdicts under pci-dss / hipaa / fapi2 / soc2 / gdpr presets (`b.redact.installOutboundDlp`)
 ### Observability

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.1",
-  "createdAt": "2026-05-26T20:56:45.702Z",
+  "frameworkVersion": "0.13.2",
+  "createdAt": "2026-05-26T22:29:54.847Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -36828,6 +36828,14 @@
           "type": "function",
           "arity": 2
         },
+        "encode": {
+          "type": "function",
+          "arity": 1
+        },
+        "isValid": {
+          "type": "function",
+          "arity": 1
+        },
         "parseString": {
           "type": "function",
           "arity": 1

package/lib/vendor/blamejs/lib/iab-tcf.js

@@ -95,6 +95,7 @@
  */
 
 var audit = require("./audit");
+var bCrypto = require("./crypto");
 var { defineClass } = require("./framework-error");
 var IabTcfError = defineClass("IabTcfError", { alwaysPermanent: true });
 
@@ -129,11 +130,15 @@ function _bitReader(buf) {
       throw IabTcfError.factory("BAD_LENGTH",
         "iabTcf: read past end of segment (offset=" + bitOffset + " want=" + n + " total=" + totalBits + ")");
     }
+    // Accumulate with `* 2`, not `<< 1`: the Created / LastUpdated fields are
+    // 36 bits and their deciseconds values exceed 2^31 for any real date, so a
+    // 32-bit shift would silently truncate them. `* 2 + bit` stays exact up to
+    // 2^53, well above the widest TCF field.
     var v = 0;
     for (var i = 0; i < n; i += 1) {
       var byteIdx = (bitOffset + i) >> 3;
       var bitIdx  = 7 - ((bitOffset + i) & 7);                                                  // allow:raw-byte-literal — high-bit-first ordering
-      v = (v << 1) | ((buf[byteIdx] >> bitIdx) & 1);
+      v = (v * 2) + ((buf[byteIdx] >> bitIdx) & 1);
     }
     bitOffset += n;
     return v;
@@ -178,6 +183,7 @@ function _parseCore(buf) {
   // the vendorConsents/LIs bitmaps when present.
   var vendorConsents = _parseVendorSection(r);
   var vendorLIs      = _parseVendorSection(r);
+  var publisherRestrictions = _parsePublisherRestrictions(r);
   return {
     version:               version,
     createdAt:             createdRaw * 100,                                                   // allow:raw-time-literal — TCF spec deciseconds → ms
@@ -197,6 +203,56 @@ function _parseCore(buf) {
     publisherCC:           publisherCC,
     vendorConsents:        vendorConsents,
     vendorLIs:             vendorLIs,
+    publisherRestrictions: publisherRestrictions,
+  };
+}
+
+// Publisher restrictions follow the two core vendor sections:
+// NumPubRestrictions (12 bits) then, per restriction, PurposeId (6) +
+// RestrictionType (2) + a range list of vendor ids. NumPubRestrictions is
+// mandatory even when zero, so a core that ends before it is truncated — the
+// reader's bounds check throws rather than treating the gap as "no
+// restrictions", which would let a malformed string validate.
+function _parsePublisherRestrictions(r) {
+  var out = [];
+  var num = r.read(12);                                                                         // allow:raw-byte-literal — TCF spec field width
+  for (var i = 0; i < num; i += 1) {
+    var purposeId       = r.read(6);                                                            // allow:raw-byte-literal — TCF spec field width
+    var restrictionType = r.read(2);
+    var numEntries      = r.read(12);                                                           // allow:raw-byte-literal — TCF spec field width
+    var vendorIds = [];
+    for (var e = 0; e < numEntries; e += 1) {
+      var isRange       = r.read(1) === 1;
+      var startVendorId = r.read(16);                                                           // allow:raw-byte-literal — TCF spec field width
+      if (isRange) {
+        var endVendorId = r.read(16);                                                           // allow:raw-byte-literal — TCF spec field width
+        for (var v = startVendorId; v <= endVendorId; v += 1) vendorIds.push(v);
+      } else {
+        vendorIds.push(startVendorId);
+      }
+    }
+    out.push({ purposeId: purposeId, restrictionType: restrictionType, vendorIds: vendorIds });
+  }
+  return out;
+}
+
+// PublisherTC segment (type 3): publisher purpose consent + LI bit-fields
+// then a custom-purpose count and its two bit-fields.
+function _parsePublisherTC(buf) {
+  var r = _bitReader(buf);
+  r.read(3);                                                                                    // allow:raw-byte-literal — segment-type prefix
+  var pubPurposesConsent = r.readBitField(24);                                                  // allow:raw-byte-literal — TCF spec field width
+  var pubPurposesLI      = r.readBitField(24);                                                  // allow:raw-byte-literal — TCF spec field width
+  var numCustomPurposes  = r.read(6);                                                           // allow:raw-byte-literal — TCF spec field width
+  var customConsent      = r.readBitField(numCustomPurposes);
+  var customLI           = r.readBitField(numCustomPurposes);
+  return {
+    present:                      true,
+    pubPurposesConsent:           pubPurposesConsent,
+    pubPurposesLITransparency:    pubPurposesLI,
+    numCustomPurposes:            numCustomPurposes,
+    customPurposesConsent:        customConsent,
+    customPurposesLITransparency: customLI,
   };
 }
 
@@ -298,7 +354,7 @@ function parseString(tcString) {
       } else if (segType === SEGMENT_TYPE_ALLOWED_VENDORS) {
         allowedVendors = { present: true, vendorIds: _parseSecondaryVendorSegment(segBuf, SEGMENT_TYPE_ALLOWED_VENDORS).ids };
       } else if (segType === SEGMENT_TYPE_PUBLISHER_TC) {
-        publisherTC = { present: true };
+        publisherTC = _parsePublisherTC(segBuf);
       } else {
         errors.push("segment[" + i + "] unknown type: " + segType);
       }
@@ -451,8 +507,227 @@ function checkVendor(parsed, vendorId) {
   };
 }
 
+// ---- encode ----------------------------------------------------------------
+
+// Accept a Set, an array, or a parsed `{ ids: Set }` / `{ vendorIds: Set }`
+// section as an id collection, and return a sorted unique array of positive
+// integers.
+function _idArray(x) {
+  var src = x;
+  if (x && typeof x === "object" && !Array.isArray(x) && !(x instanceof Set)) {
+    src = x.ids != null ? x.ids : x.vendorIds;
+  }
+  var list = src instanceof Set ? Array.from(src) : (Array.isArray(src) ? src : []);
+  var seen = Object.create(null);
+  var out = [];
+  list.forEach(function (id) {
+    if (typeof id !== "number" || !isFinite(id) || id < 1 || Math.floor(id) !== id) {
+      throw IabTcfError.factory("BAD_VALUE", "iabTcf.encode: vendor/purpose ids must be positive integers, got " + id);
+    }
+    if (!seen[id]) { seen[id] = 1; out.push(id); }
+  });
+  out.sort(function (a, b) { return a - b; });
+  return out;
+}
+
+// Collapse a sorted unique id array into [start, end] runs for range encoding.
+function _idRuns(ids) {
+  var runs = [];
+  for (var i = 0; i < ids.length; i += 1) {
+    var start = ids[i];
+    var end = start;
+    while (i + 1 < ids.length && ids[i + 1] === end + 1) { end = ids[i + 1]; i += 1; }
+    runs.push([start, end]);
+  }
+  return runs;
+}
+
+function _decisec(t) {
+  var ms = t instanceof Date ? t.getTime() : (t == null ? Date.now() : Number(t));
+  if (!isFinite(ms) || ms < 0) throw IabTcfError.factory("BAD_VALUE", "iabTcf.encode: timestamp must be a Date or non-negative epoch-ms");
+  return Math.round(ms / 100);                                                                  // allow:raw-time-literal — ms → TCF deciseconds
+}
+
+// Bit writer mirroring _bitReader: bits are packed high-bit-first, then the
+// stream is right-padded to a whole number of bytes (byte-oriented base64url,
+// matching the reference CMP encoders and this module's own reader).
+function _bitWriter() {
+  var bits = "";
+  function writeInt(v, n) {
+    if (typeof v !== "number" || !isFinite(v) || v < 0 || Math.floor(v) !== v) throw IabTcfError.factory("BAD_VALUE", "iabTcf.encode: expected a non-negative integer, got " + v);
+    if (v >= Math.pow(2, n)) throw IabTcfError.factory("VALUE_OVERFLOW", "iabTcf.encode: " + v + " does not fit in " + n + " bits");
+    bits += v.toString(2).padStart(n, "0");
+  }
+  function writeBool(flag) { bits += flag ? "1" : "0"; }
+  function writeBitField(ids, n) {
+    var set = Object.create(null);
+    _idArray(ids).forEach(function (id) { set[id] = 1; });
+    for (var i = 1; i <= n; i += 1) writeBool(set[i] === 1);
+  }
+  function writeVendorSection(ids) {
+    var clean = _idArray(ids);
+    var maxVendorId = clean.length ? clean[clean.length - 1] : 0;
+    writeInt(maxVendorId, 16);                                                                  // allow:raw-byte-literal — TCF spec field width
+    if (maxVendorId === 0) { writeBool(false); return; }
+    var runs = _idRuns(clean);
+    var rangeBits = 1 + 12;                                                                     // allow:raw-byte-literal — TCF spec field width
+    runs.forEach(function (run) { rangeBits += 1 + 16 + (run[0] === run[1] ? 0 : 16); });       // allow:raw-byte-literal — TCF spec field width
+    var bitfieldBits = 1 + maxVendorId;
+    if (rangeBits < bitfieldBits) {
+      writeBool(true);
+      writeInt(runs.length, 12);                                                                // allow:raw-byte-literal — TCF spec field width
+      runs.forEach(function (run) {
+        if (run[0] === run[1]) { writeBool(false); writeInt(run[0], 16); }                      // allow:raw-byte-literal — TCF spec field width
+        else { writeBool(true); writeInt(run[0], 16); writeInt(run[1], 16); }                   // allow:raw-byte-literal — TCF spec field width
+      });
+    } else {
+      writeBool(false);
+      writeBitField(clean, maxVendorId);
+    }
+  }
+  function toBuffer() {
+    var padded = bits + "0".repeat((8 - (bits.length % 8)) % 8);                                // allow:raw-byte-literal — pad to whole bytes
+    var byteLen = padded.length / 8;                                                            // allow:raw-byte-literal — bits per byte
+    var out = Buffer.alloc(byteLen);
+    for (var i = 0; i < byteLen; i += 1) out[i] = parseInt(padded.slice(i * 8, i * 8 + 8), 2);  // allow:raw-byte-literal — bits per byte
+    return out;
+  }
+  return { writeInt: writeInt, writeBool: writeBool, writeBitField: writeBitField, writeVendorSection: writeVendorSection, toBuffer: toBuffer };
+}
+
+function _b64urlEncode(buf) {
+  return bCrypto.toBase64Url(buf);
+}
+
+function _writeLetters(w, s, label) {
+  var str = String(s).toUpperCase();
+  if (str.length !== 2) throw IabTcfError.factory("BAD_VALUE", "iabTcf.encode: " + label + " must be a 2-letter code, got '" + s + "'");
+  for (var i = 0; i < 2; i += 1) {
+    var v = str.charCodeAt(i) - 0x41;                                                           // allow:raw-byte-literal — ASCII 'A' offset
+    if (v < 0 || v > 25) throw IabTcfError.factory("BAD_VALUE", "iabTcf.encode: '" + str.charAt(i) + "' is not an A-Z letter");
+    w.writeInt(v, 6);                                                                           // allow:raw-byte-literal — TCF spec field width
+  }
+}
+
+function _encodePublisherTC(pub) {
+  var w = _bitWriter();
+  w.writeInt(SEGMENT_TYPE_PUBLISHER_TC, 3);                                                     // allow:raw-byte-literal — segment-type prefix
+  w.writeBitField(pub.pubPurposesConsent || [], 24);                                            // allow:raw-byte-literal — TCF spec field width
+  w.writeBitField(pub.pubPurposesLITransparency || [], 24);                                     // allow:raw-byte-literal — TCF spec field width
+  var custom = _idArray(pub.customPurposesConsent || []);
+  var customLI = _idArray(pub.customPurposesLITransparency || []);
+  var n = pub.numCustomPurposes != null
+    ? pub.numCustomPurposes
+    : Math.max(custom.length ? custom[custom.length - 1] : 0, customLI.length ? customLI[customLI.length - 1] : 0);
+  w.writeInt(n, 6);                                                                             // allow:raw-byte-literal — TCF spec field width
+  w.writeBitField(custom, n);
+  w.writeBitField(customLI, n);
+  return _b64urlEncode(w.toBuffer());
+}
+
+/**
+ * @primitive b.iabTcf.encode
+ * @signature b.iabTcf.encode(obj)
+ * @since     0.13.1
+ * @status    stable
+ * @compliance iab-tcf
+ * @related   b.iabTcf.parseString, b.iabTcf.isValid
+ *
+ * Serialise a TCF object — in the shape `parseString` returns — back into a
+ * TC string. Vendor and purpose collections may be `Set`s, arrays of ids, or
+ * the parsed `{ ids }` / `{ vendorIds }` sections. Vendor sections are written
+ * with whichever of the bit-field and range forms is smaller, matching the
+ * reference CMP encoders, so a parsed string round-trips to an equivalent
+ * signal. Pass `disclosedVendors` / `allowedVendors` / `publisherTC` to append
+ * those segments. Throws `IabTcfError` on a value that does not fit its field.
+ *
+ * @example
+ *   var s = b.iabTcf.encode({
+ *     core: { version: 2, cmpId: 5, vendorListVersion: 100, consentLanguage: "EN",
+ *             purposesConsent: [1, 2, 3], vendorConsents: [1, 28, 100], publisherCC: "DE" },
+ *     disclosedVendors: [1, 28, 100],
+ *   });
+ */
+function encode(obj) {
+  if (!obj || typeof obj !== "object" || !obj.core || typeof obj.core !== "object") {
+    throw IabTcfError.factory("BAD_INPUT", "iabTcf.encode: obj must have a 'core' object");
+  }
+  var c = obj.core;
+  var w = _bitWriter();
+  w.writeInt(c.version != null ? c.version : TCF_V23_CORE_VERSION, 6);                          // allow:raw-byte-literal — TCF spec field width
+  w.writeInt(_decisec(c.createdAt), 36);                                                        // allow:raw-byte-literal — TCF spec field width
+  w.writeInt(_decisec(c.lastUpdatedAt != null ? c.lastUpdatedAt : c.createdAt), 36);            // allow:raw-byte-literal — TCF spec field width
+  w.writeInt(c.cmpId || 0, 12);                                                                 // allow:raw-byte-literal — TCF spec field width
+  w.writeInt(c.cmpVersion || 0, 12);                                                            // allow:raw-byte-literal — TCF spec field width
+  w.writeInt(c.consentScreen || 0, 6);                                                          // allow:raw-byte-literal — TCF spec field width
+  _writeLetters(w, c.consentLanguage || "EN", "consentLanguage");
+  w.writeInt(c.vendorListVersion || 0, 12);                                                     // allow:raw-byte-literal — TCF spec field width
+  w.writeInt(c.policyVersion != null ? c.policyVersion : TCF_V23_POLICY_VERSION, 6);            // allow:raw-byte-literal — TCF spec field width
+  w.writeBool(c.isServiceSpecific !== false);
+  w.writeBool(c.useNonStandardStacks === true);
+  w.writeBitField(c.specialFeatureOptins || [], 12);                                            // allow:raw-byte-literal — TCF spec field width
+  w.writeBitField(c.purposesConsent || [], 24);                                                 // allow:raw-byte-literal — TCF spec field width
+  w.writeBitField(c.purposesLI || [], 24);                                                      // allow:raw-byte-literal — TCF spec field width
+  w.writeBool(c.purposeOneTreatment === true);
+  _writeLetters(w, c.publisherCC || "AA", "publisherCC");
+  w.writeVendorSection(c.vendorConsents || []);
+  w.writeVendorSection(c.vendorLIs || []);
+  var restrictions = c.publisherRestrictions || [];
+  w.writeInt(restrictions.length, 12);                                                          // allow:raw-byte-literal — TCF spec field width
+  restrictions.forEach(function (pr) {
+    w.writeInt(pr.purposeId, 6);                                                                // allow:raw-byte-literal — TCF spec field width
+    w.writeInt(typeof pr.restrictionType === "number" ? pr.restrictionType : 0, 2);
+    var runs = _idRuns(_idArray(pr.vendorIds || []));
+    w.writeInt(runs.length, 12);                                                                // allow:raw-byte-literal — TCF spec field width
+    runs.forEach(function (run) {
+      if (run[0] === run[1]) { w.writeBool(false); w.writeInt(run[0], 16); }                    // allow:raw-byte-literal — TCF spec field width
+      else { w.writeBool(true); w.writeInt(run[0], 16); w.writeInt(run[1], 16); }               // allow:raw-byte-literal — TCF spec field width
+    });
+  });
+  var segs = [_b64urlEncode(w.toBuffer())];
+
+  if (obj.disclosedVendors != null) {
+    var dw = _bitWriter();
+    dw.writeInt(SEGMENT_TYPE_DISCLOSED_VENDORS, 3);                                              // allow:raw-byte-literal — segment-type prefix
+    dw.writeVendorSection(obj.disclosedVendors);
+    segs.push(_b64urlEncode(dw.toBuffer()));
+  }
+  if (obj.allowedVendors != null) {
+    var aw = _bitWriter();
+    aw.writeInt(SEGMENT_TYPE_ALLOWED_VENDORS, 3);                                                // allow:raw-byte-literal — segment-type prefix
+    aw.writeVendorSection(obj.allowedVendors);
+    segs.push(_b64urlEncode(aw.toBuffer()));
+  }
+  if (obj.publisherTC != null && obj.publisherTC.present !== false) {
+    segs.push(_encodePublisherTC(obj.publisherTC));
+  }
+  return segs.join(".");
+}
+
+/**
+ * @primitive b.iabTcf.isValid
+ * @signature b.iabTcf.isValid(tcString)
+ * @since     0.13.1
+ * @status    stable
+ * @compliance iab-tcf
+ * @related   b.iabTcf.parseString
+ *
+ * Return `true` if the string parses as a well-formed TCF Core segment,
+ * `false` otherwise. A total predicate — never throws. Note this checks
+ * structural validity only; use `requireV23Disclosed` for the v2.3 policy gate.
+ *
+ * @example
+ *   b.iabTcf.isValid("CQSbk4AQSbk4ANwAAAENAwCgAAAAAAAAAAYgACPAAAAA");  // → true
+ *   b.iabTcf.isValid("nonsense");                                      // → false
+ */
+function isValid(tcString) {
+  try { parseString(tcString); return true; } catch (_e) { return false; }
+}
+
 module.exports = {
   parseString:           parseString,
+  encode:                encode,
+  isValid:               isValid,
   requireV23Disclosed:   requireV23Disclosed,
   checkVendor:           checkVendor,
   IabTcfError:           IabTcfError,

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.2.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.2",
+  "date": "2026-05-26",
+  "headline": "`b.iabTcf.encode` — write TCF consent strings, and a TC-string timestamp fix",
+  "summary": "b.iabTcf gains the encode half of its consent-string codec: b.iabTcf.encode(obj) serialises a parsed object back into an IAB TCF v2 TC string, and b.iabTcf.isValid(tcString) is a total never-throwing validity check. Vendor and purpose collections may be Sets, id arrays, or the parsed sections parseString returns; vendor sections are written with whichever of the bit-field and range forms is smaller, matching the reference CMP encoders, so a parsed string round-trips to an equivalent signal. parseString now fully decodes the Core publisher-restrictions list and the PublisherTC segment's publisher and custom purposes, where it previously reported only the segment's presence. The encoder is verified against the worked-example string in the IAB Tech Lab consent-string specification: it re-encodes that string's Core segment byte-for-byte. This release also fixes a TC-string parsing bug — the bit reader accumulated values with a 32-bit shift, so the 36-bit Created and LastUpdated timestamp fields were silently truncated for any real date; they now decode and round-trip exactly.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.iabTcf.encode` / `b.iabTcf.isValid`",
+          "body": "`encode(obj)` serialises a TCF object (the shape `parseString` returns) into a TC string — Core plus optional DisclosedVendors, AllowedVendors, and PublisherTC segments — choosing the smaller of the bit-field and range vendor encodings. `isValid(tcString)` returns whether a string parses as a well-formed Core segment without throwing. `parseString` now fully decodes Core publisher restrictions and the PublisherTC purposes that were previously reported only as present."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "TC-string 36-bit timestamps were truncated on parse",
+          "body": "`b.iabTcf.parseString` read multi-bit fields with a 32-bit left-shift accumulation. The 36-bit Created and LastUpdated fields hold deciseconds-since-epoch, which exceeds 2^31 for any date after 1976, so those timestamps were silently corrupted. The reader now accumulates without the 32-bit truncation; timestamps decode correctly and round-trip through `encode`."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/iab-tcf.test.js

@@ -41,7 +41,8 @@ async function run() {
     // bytes with a zero pad.
     var totalBits = 6 + 36 + 36 + 12 + 12 + 6 + 6 + 6 + 12 + 6 + 1 + 1 +
                     12 + 24 + 24 + 1 + 6 + 6 +
-                    16 + 1 + 16 + 1; // two empty vendor sections
+                    16 + 1 + 16 + 1 + // two empty vendor sections
+                    12;               // NumPubRestrictions (mandatory, =0)
     var byteLen = Math.ceil(totalBits / 8);                                                   // allow:raw-byte-literal — bits-per-byte
     var buf = Buffer.alloc(byteLen);
     // Set version field (top 6 bits of byte 0).
@@ -68,6 +69,65 @@ async function run() {
   check("core version=4",             parsed.core.version === 4);
   check("checkVendor handles bare core",
         b.iabTcf.checkVendor(parsed, 755).consented === false);
+
+  // ---- encode + isValid + completed parse --------------------------------
+  check("iabTcf.encode is fn",  typeof b.iabTcf.encode === "function");
+  check("iabTcf.isValid is fn", typeof b.iabTcf.isValid === "function");
+
+  // Independent oracle: the worked-example string from the IAB Tech Lab
+  // "Consent string and vendor list formats v2" specification.
+  var SPEC = "CQSbk4AQSbk4ANwAAAENAwCgAAAAAAAAAAYgACPAAAAA.IDKQA4AAgAKAGQAygAAA.YAAAAAAAAAAA";
+  var SPEC_CORE = "CQSbk4AQSbk4ANwAAAENAwCgAAAAAAAAAAYgACPAAAAA";
+  var sp = b.iabTcf.parseString(SPEC);
+  check("spec core version 2",            sp.core.version === 2);
+  check("spec cmpId 880",                 sp.core.cmpId === 880);
+  check("spec vendorListVersion 48",      sp.core.vendorListVersion === 48);
+  check("spec created 2025-06-03",        new Date(sp.core.createdAt).toISOString() === "2025-06-03T00:00:00.000Z");
+  check("spec vendorConsents [1,2,3,4]",  JSON.stringify(Array.from(sp.core.vendorConsents.ids)) === "[1,2,3,4]");
+  check("spec disclosedVendors decoded",  JSON.stringify(Array.from(sp.disclosedVendors.vendorIds)) === "[1,2,3,4,5,100,404]");
+  check("spec publisherTC fully parsed",  sp.publisherTC && sp.publisherTC.present === true && typeof sp.publisherTC.numCustomPurposes === "number");
+  check("core.publisherRestrictions array", Array.isArray(sp.core.publisherRestrictions));
+  // Strong oracle: re-encoding the parsed core reproduces the spec Core
+  // segment byte-for-byte.
+  check("re-encoded core is byte-identical to the spec", b.iabTcf.encode({ core: sp.core }) === SPEC_CORE);
+  // Disclosed content round-trips (the encoder writes the minimal valid form).
+  var rt = b.iabTcf.parseString(b.iabTcf.encode({ core: sp.core, disclosedVendors: sp.disclosedVendors }));
+  check("disclosed content round-trips", JSON.stringify(Array.from(rt.disclosedVendors.vendorIds)) === "[1,2,3,4,5,100,404]");
+
+  // 36-bit timestamp regression: a real date (deciseconds > 2^31) must survive
+  // parse → encode unchanged. Guards the reader's `* 2` (not `<< 1`)
+  // accumulation, without which Created / LastUpdated truncate at 32 bits.
+  var bigCreated = Date.UTC(2026, 4, 26);
+  var encTs = b.iabTcf.encode({ core: { version: 2, createdAt: bigCreated, lastUpdatedAt: bigCreated, cmpId: 300, vendorListVersion: 100, consentLanguage: "EN", publisherCC: "DE", vendorConsents: [], vendorLIs: [] } });
+  var decTs = b.iabTcf.parseString(encTs);
+  check("36-bit timestamp survives round-trip", decTs.core.createdAt === bigCreated);
+  check("cmpId survives round-trip",            decTs.core.cmpId === 300);
+  check("consentLanguage survives round-trip",  decTs.core.consentLanguage === "EN");
+
+  // Vendor-section round-trip across range-favouring and sparse sets.
+  [[1, 2, 3, 4, 5, 6, 7, 8, 9, 10], [12, 37, 199, 755], [1]].forEach(function (vc, idx) {
+    var s = b.iabTcf.encode({ core: { version: 2, createdAt: bigCreated, lastUpdatedAt: bigCreated, cmpId: 5, vendorListVersion: 10, consentLanguage: "EN", publisherCC: "FR", purposesConsent: [1, 2, 3], vendorConsents: vc, vendorLIs: [] } });
+    var d = b.iabTcf.parseString(s);
+    check("vendorConsents round-trip " + idx,  JSON.stringify(Array.from(d.core.vendorConsents.ids)) === JSON.stringify(vc));
+    check("purposesConsent round-trip " + idx, JSON.stringify(Array.from(d.core.purposesConsent)) === "[1,2,3]");
+  });
+
+  // Publisher restrictions round-trip.
+  var prDec = b.iabTcf.parseString(b.iabTcf.encode({ core: { version: 2, createdAt: bigCreated, lastUpdatedAt: bigCreated, cmpId: 9, vendorListVersion: 1, consentLanguage: "IT", publisherCC: "IT", vendorConsents: [], vendorLIs: [], publisherRestrictions: [{ purposeId: 2, restrictionType: 1, vendorIds: [5, 6, 7, 50] }] } }));
+  check("publisher restriction round-trips",
+        prDec.core.publisherRestrictions.length === 1 &&
+        prDec.core.publisherRestrictions[0].purposeId === 2 &&
+        JSON.stringify(prDec.core.publisherRestrictions[0].vendorIds) === "[5,6,7,50]");
+
+  check("isValid true for the spec vector", b.iabTcf.isValid(SPEC) === true);
+  check("isValid false for garbage",        b.iabTcf.isValid("nonsense!!") === false);
+  // A truncated core (a dropped trailing character cuts into the mandatory
+  // NumPubRestrictions field) must NOT validate — the reader's bounds check
+  // rejects it rather than treating the gap as "no restrictions".
+  check("isValid false for a truncated core", b.iabTcf.isValid(SPEC_CORE.slice(0, -1)) === false);
+  rejects("encode without core throws", function () { b.iabTcf.encode({}); }, "BAD_INPUT");
+  rejects("encode rejects a non-positive id",
+    function () { b.iabTcf.encode({ core: { consentLanguage: "EN", publisherCC: "DE", vendorConsents: [0], vendorLIs: [] } }); }, "BAD_VALUE");
 }
 
 module.exports = { run: run };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.33",
+  "version": "0.1.34",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {