@blamejs/blamejs-shop 0.2.11 → 0.2.13

package/lib/vendor/blamejs/.github/workflows/actions-lint.yml

@@ -50,6 +50,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install pinact (release binary + sha256 verify)
         # Install pinact directly from the upstream release binary
@@ -106,32 +108,43 @@ jobs:
     name: zizmor — workflow security audit
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    permissions:
-      contents: read
-      security-events: write   # required for SARIF upload to Code Scanning
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
-      - name: Install uv (zizmor distribution)
-        uses: astral-sh/setup-uv@69d3e2780fa0ea7da961bfbb898be32a9b1d10b1  # v7.0.0
+      - name: Install zizmor (release binary + sha256 verify)
+        # Direct release-binary install instead of astral-sh/setup-uv + uvx.
+        # setup-uv (a third-party action) startup_failures the whole
+        # workflow on the current runner — the same class of failure as the
+        # raven-actions/actionlint composite that took down the actionlint
+        # job (no jobs, no logs). A run: step cannot startup_failure.
+        # zizmor publishes no checksums file, so the expected sha256 is
+        # pinned inline; a mismatch fails closed.
+        env:
+          ZIZMOR_VERSION: v1.18.0
+          ZIZMOR_SHA256:  8e7901319ab7b71c38d6d388a48e02ff65791e5971b2ee6577c9b5c3ab44c65f
+        run: |
+          set -euo pipefail
+          curl -fsSLo /tmp/zizmor.tar.gz "https://github.com/zizmorcore/zizmor/releases/download/${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz"
+          ACTUAL=$(sha256sum /tmp/zizmor.tar.gz | awk '{print $1}')
+          if [ "$ACTUAL" != "$ZIZMOR_SHA256" ]; then
+            echo "::error::zizmor tarball sha256 ${ACTUAL} does not match pinned ${ZIZMOR_SHA256}"
+            exit 1
+          fi
+          mkdir -p /tmp/zizmor-bin
+          tar -xzf /tmp/zizmor.tar.gz -C /tmp/zizmor-bin ./zizmor
+          sudo install -m 0755 /tmp/zizmor-bin/zizmor /usr/local/bin/zizmor
+          zizmor --version
 
       - name: Run zizmor (fail on level=low across every rule class)
-        # `--min-severity low` flags every documented class. Suppression
-        # requires an inline `# zizmor: ignore[<rule>] — <reason>` per
-        # the spec.
+        # Pure run-gate: zizmor exits non-zero on any finding, failing the
+        # job. Inline `# zizmor: ignore[<rule>] — <reason>` is the
+        # suppression mechanism for reviewed exceptions.
         run: |
           set -euo pipefail
-          uvx zizmor@1.18.0 --min-severity low --format sarif . > zizmor.sarif || EXIT=$?
-          uvx zizmor@1.18.0 --min-severity low . || true   # human-readable output for the step log
-          if [ "${EXIT:-0}" != "0" ]; then exit "$EXIT"; fi
-
-      - name: Upload SARIF to Code Scanning
-        if: always()
-        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba  # v4.35.5
-        with:
-          sarif_file: zizmor.sarif
-          category: zizmor
+          zizmor --min-severity low --no-progress .github/workflows/
 
   actionlint:
     name: actionlint — YAML + expression + shellcheck on `run:` blocks
@@ -140,9 +153,44 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-
-      - name: Run actionlint
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8  # v2.1.2
         with:
-          fail_on_error: true
-          shellcheck: true
+          persist-credentials: false
+
+      - name: Install actionlint (release binary + sha256 verify)
+        # Direct release-binary install instead of the
+        # raven-actions/actionlint composite action. That composite (v2.1.2,
+        # the latest release) startup_failures on the current runner, taking
+        # the whole workflow down before any job runs — which is why this
+        # gate never ran from v0.11.21 onward. The binary path also drops the
+        # composite's transitive github-script / cache action surface, which
+        # fits the gate whose entire purpose is pinning discipline. Mirrors
+        # the pinact install step above.
+        env:
+          ACTIONLINT_VERSION: v1.7.12
+        run: |
+          set -euo pipefail
+          V="${ACTIONLINT_VERSION#v}"
+          curl -fsSLo /tmp/actionlint.tar.gz "https://github.com/rhysd/actionlint/releases/download/${ACTIONLINT_VERSION}/actionlint_${V}_linux_amd64.tar.gz"
+          curl -fsSLo /tmp/actionlint-checksums.txt "https://github.com/rhysd/actionlint/releases/download/${ACTIONLINT_VERSION}/actionlint_${V}_checksums.txt"
+          ACTUAL=$(sha256sum /tmp/actionlint.tar.gz | awk '{print $1}')
+          EXPECTED=$(grep "actionlint_${V}_linux_amd64.tar.gz\$" /tmp/actionlint-checksums.txt | awk '{print $1}')
+          if [ -z "$EXPECTED" ]; then
+            echo "::error::could not find actionlint_${V}_linux_amd64.tar.gz line in upstream checksums"
+            exit 1
+          fi
+          if [ "$ACTUAL" != "$EXPECTED" ]; then
+            echo "::error::actionlint tarball sha256 ${ACTUAL} does not match upstream-published ${EXPECTED}"
+            exit 1
+          fi
+          mkdir -p /tmp/actionlint-bin
+          tar -xzf /tmp/actionlint.tar.gz -C /tmp/actionlint-bin actionlint
+          sudo install -m 0755 /tmp/actionlint-bin/actionlint /usr/local/bin/actionlint
+          actionlint --version
+
+      - name: Run actionlint (+ shellcheck on every run block)
+        # shellcheck ships preinstalled on ubuntu-latest; actionlint invokes
+        # it automatically on each `run:` block. Non-zero exit on any finding
+        # keeps this a hard gate (the raven composite's fail_on_error: true).
+        run: |
+          set -euo pipefail
+          actionlint -color

package/lib/vendor/blamejs/.github/workflows/cflite_batch.yml

@@ -69,6 +69,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0

package/lib/vendor/blamejs/.github/workflows/cflite_pr.yml

@@ -80,6 +80,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0

package/lib/vendor/blamejs/.github/workflows/ci.yml

@@ -52,6 +52,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -106,6 +108,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -126,6 +130,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -149,6 +155,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
@@ -168,6 +176,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
+          persist-credentials: false
           # gitleaks scans full history on a non-shallow checkout, so an
           # accidentally-committed secret in any prior commit on the
           # branch is caught even if a later commit reverts it. The
@@ -225,6 +234,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -254,6 +265,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -294,6 +307,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Run Hadolint (strict, all severities)
         # `--no-fail` is OFF; any error or warning fails the job.
@@ -336,6 +351,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Detect shell scripts
         id: sh

package/lib/vendor/blamejs/.github/workflows/npm-publish.yml

@@ -94,6 +94,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
@@ -102,11 +104,14 @@ jobs:
 
       - name: Compute version + is_tag flag
         id: version
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REF: ${{ github.ref }}
         run: |
           set -euo pipefail
           PKG_VERSION=$(node -e "console.log(require('./package.json').version)")
           echo "version=$PKG_VERSION" >> "$GITHUB_OUTPUT"
-          if [ "${{ github.event_name }}" = "push" ] && [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+          if [ "$EVENT_NAME" = "push" ] && [[ "$REF" == refs/tags/v* ]]; then
             TAG_VERSION="${GITHUB_REF#refs/tags/v}"
             echo "is_tag=true" >> "$GITHUB_OUTPUT"
             if [ "$PKG_VERSION" != "$TAG_VERSION" ]; then
@@ -132,7 +137,7 @@ jobs:
 
       - name: ShellCheck
         if: steps.shells.outputs.found == 'true'
-        uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca  # v2.0.0
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38  # 2.0.0
         with:
           severity: error
 
@@ -229,7 +234,7 @@ jobs:
         id: subjects
         run: |
           set -euo pipefail
-          TARBALL=$(basename "$(ls dist/*.tgz | head -1)")
+          TARBALL=$(basename "$(find dist -maxdepth 1 -name '*.tgz' | head -1)")
           HASHES=$(
             (cd dist && sha256sum "$TARBALL") && \
             sha256sum sbom.cdx.json sbom.vendored.cdx.json
@@ -292,7 +297,9 @@ jobs:
     # repo specifically so the SLSA tag-pin call is permitted. The
     # `slsa-action-not-pinned` codebase-patterns detector allowlists
     # this specific callsite (see test/layer-0-primitives/codebase-patterns.test.js).
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0  # allow:slsa-framework-action-not-sha-pinned — SLSA's internal builder-fetch refuses non-tag refs; mitigated by slsa-framework's upstream tag-protection + immutable-release rules
+    # SLSA's reusable builder workflow refuses non-tag refs (cannot be
+    # SHA-pinned); upstream tag-protection + immutable releases mitigate.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0  # zizmor: ignore[unpinned-uses] allow:slsa-framework-action-not-sha-pinned — SLSA's internal builder-fetch refuses non-tag refs; mitigated by slsa-framework's upstream tag-protection + immutable-release rules
     with:
       base64-subjects:    "${{ needs.validate.outputs.hashes }}"
       upload-assets:      false
@@ -410,6 +417,7 @@ jobs:
         # and failed immediately on the first PQC release run.
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
+          persist-credentials: false
           path: src
 
       - name: Release-digest sidecars (SHA-256 + SHA3-512)
@@ -424,7 +432,7 @@ jobs:
         # Both written in `<sha>  <filename>` sha-sum-compatible format.
         run: |
           set -euo pipefail
-          TARBALL=$(ls dist/*.tgz | head -1)
+          TARBALL=$(find dist -maxdepth 1 -name '*.tgz' | head -1)
           node src/scripts/sha3-digest.js "$TARBALL"
 
       - name: PQC sidecar — ML-DSA-65 signature of the tarball
@@ -463,7 +471,7 @@ jobs:
             echo "available=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          TARBALL=$(ls dist/*.tgz | head -1)
+          TARBALL=$(find dist -maxdepth 1 -name '*.tgz' | head -1)
           # The signer expects keys/release-pqc-pub.json at the
           # framework root for the self-verify cross-check. Symlink
           # the checked-out src/keys/ into the working directory so
@@ -514,11 +522,11 @@ jobs:
           set -euo pipefail
           if gh release view "$TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
             echo "::error::Release $TAG already exists. The workflow is authoritative for release creation as of v0.11.7."
-            echo "::error::Manual `gh release create` was removed from the release workflow in v0.11.7."
-            echo "::error::Either delete the existing release (`gh release delete $TAG`) and re-run this workflow, OR push a new tag."
+            echo "::error::Manual 'gh release create' was removed from the release workflow in v0.11.7."
+            echo "::error::Either delete the existing release with 'gh release delete $TAG' and re-run this workflow, OR push a new tag."
             exit 1
           fi
-          TARBALL=$(ls dist/*.tgz | head -1)
+          TARBALL=$(find dist -maxdepth 1 -name '*.tgz' | head -1)
           # Title comes from the structured release-notes JSON's
           # `headline` field — single source of truth. Format:
           # `vX.Y.Z — <headline>`.
@@ -594,7 +602,7 @@ jobs:
         # mis-classifies a relative path containing `/` as a git
         # spec.
         run: |
-          TARBALL=$(ls dist/*.tgz | head -1)
+          TARBALL=$(find dist -maxdepth 1 -name '*.tgz' | head -1)
           echo "Publishing: $TARBALL"
           npm publish "./${TARBALL}" --provenance --access public
         env:

package/lib/vendor/blamejs/.github/workflows/release-container.yml

@@ -57,6 +57,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Node 24.14.1 LTS
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
@@ -73,6 +75,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Run Hadolint (strict, all severities)
         uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5  # v3.3.0
         with:
@@ -88,6 +92,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
       - name: Detect shell scripts
         id: sh
         run: |
@@ -97,7 +103,7 @@ jobs:
           echo "found=$count" >> "$GITHUB_OUTPUT"
       - name: Run ShellCheck
         if: steps.sh.outputs.found != '0'
-        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38  # v2.0.0
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38  # 2.0.0
         with:
           severity: style
           format:   tty
@@ -118,16 +124,18 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up QEMU (for ARM64 cross-build)
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4.0.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0
 
       - name: Log in to GHCR
         if: ${{ !inputs.dry_run }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -162,7 +170,7 @@ jobs:
       # Note: load: true forces single-arch (amd64). The multi-arch
       # build happens on the post-scan push step below.
       - name: Build (local-only, for Trivy)
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: .
           file: examples/wiki/Dockerfile
@@ -210,7 +218,7 @@ jobs:
       - name: Push (multi-arch, after Trivy gate)
         id: push
         if: ${{ !inputs.dry_run && steps.tags.outputs.is_tag == 'true' }}
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: .
           file: examples/wiki/Dockerfile
@@ -236,7 +244,7 @@ jobs:
         if: ${{ !inputs.dry_run && steps.tags.outputs.is_tag == 'true' && steps.push.outputs.digest }}
         env:
           DIGEST: ${{ steps.push.outputs.digest }}
-        run: cosign sign --yes "${{ env.IMAGE }}@${DIGEST}"
+        run: cosign sign --yes "${IMAGE}@${DIGEST}"
 
       - name: Generate SHA3-512 digest
         if: ${{ !inputs.dry_run && steps.tags.outputs.is_tag == 'true' && steps.push.outputs.digest }}
@@ -245,8 +253,8 @@ jobs:
           DIGEST: ${{ steps.push.outputs.digest }}
         run: |
           set -euo pipefail
-          docker pull "${{ env.IMAGE }}@${DIGEST}"
-          HASH=$(docker save "${{ env.IMAGE }}@${DIGEST}" | openssl dgst -sha3-512 | awk '{print $NF}')
+          docker pull "${IMAGE}@${DIGEST}"
+          HASH=$(docker save "${IMAGE}@${DIGEST}" | openssl dgst -sha3-512 | awk '{print $NF}')
           echo "SHA3-512: $HASH"
           echo "sha3=$HASH" >> "$GITHUB_OUTPUT"
           {
@@ -275,8 +283,8 @@ jobs:
             echo "|---|---|"
             echo "| **Version**   | ${VERSION} |"
             echo "| **Platforms** | linux/amd64, linux/arm64 |"
-            echo "| **Registry**  | ${{ env.IMAGE }} |"
-            echo "| **Commit**    | ${{ github.sha }} |"
+            echo "| **Registry**  | ${IMAGE} |"
+            echo "| **Commit**    | ${GITHUB_SHA} |"
             echo "| **Dry run**   | ${DRY_RUN} |"
             echo "| **Tag push**  | ${IS_TAG} |"
             echo ""
@@ -297,6 +305,11 @@ jobs:
     if: ${{ !inputs.dry_run && needs.publish.outputs.digest != '' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    env:
+      # Hoisted so run: blocks reference $DIGEST instead of inlining the
+      # ${{ needs.publish.outputs.digest }} expression (template-injection
+      # hardening — keeps GitHub-context values out of shell-parsed text).
+      DIGEST: ${{ needs.publish.outputs.digest }}
     steps:
       # Smoke-test runs on a fresh runner — it doesn't inherit the
       # publish job's GHCR auth. Log in first so `docker pull` works
@@ -304,19 +317,19 @@ jobs:
       # against a public package, so this is the right shape regardless
       # of visibility.
       - name: Log in to GHCR
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Pull published image
-        run: docker pull "${{ env.IMAGE }}@${{ needs.publish.outputs.digest }}"
+        run: docker pull "${IMAGE}@${DIGEST}"
 
       - name: Verify OCI labels
         run: |
           set -euo pipefail
-          LABELS=$(docker inspect "${{ env.IMAGE }}@${{ needs.publish.outputs.digest }}" --format '{{json .Config.Labels}}')
+          LABELS=$(docker inspect "${IMAGE}@${DIGEST}" --format '{{json .Config.Labels}}')
           echo "$LABELS" | python3 -m json.tool
           echo "$LABELS" | python3 -c "
           import sys, json
@@ -342,7 +355,7 @@ jobs:
             --security-opt no-new-privileges:true \
             --cap-drop ALL \
             -p 3008:3008 \
-            "${{ env.IMAGE }}@${{ needs.publish.outputs.digest }}"
+            "${IMAGE}@${DIGEST}"
 
           echo "Waiting for /healthz..."
           for i in $(seq 1 30); do
@@ -396,7 +409,7 @@ jobs:
           {
             echo "### Post-publish smoke ❌"
             echo ""
-            echo "Smoke test failed for ${{ env.IMAGE }}@${{ needs.publish.outputs.digest }}."
+            echo "Smoke test failed for ${IMAGE}@${DIGEST}."
             echo "See the 'Capture container diagnostics on failure' step above for"
             echo "docker ps / inspect / logs output."
           } >> "$GITHUB_STEP_SUMMARY"

package/lib/vendor/blamejs/.github/workflows/sha-to-tag-verify.yml

@@ -39,6 +39,7 @@ jobs:
       - name: Checkout (full history needed for first-parent walk)
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
+          persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
 
@@ -53,10 +54,15 @@ jobs:
       - name: Resolve tag + verify chain
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          EVENT_NAME: ${{ github.event_name }}
+          # Hoisted: a workflow_dispatch input is operator-supplied text;
+          # inlining ${{ github.event.inputs.tag }} into the shell is the
+          # template-injection vector. Reference $INPUT_TAG instead.
+          INPUT_TAG: ${{ github.event.inputs.tag }}
         run: |
           set -euo pipefail
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            TAG="${{ github.event.inputs.tag }}"
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            TAG="$INPUT_TAG"
           else
             TAG="${GITHUB_REF#refs/tags/}"
           fi
@@ -77,7 +83,20 @@ jobs:
           #    pass that test. The strict first-parent invariant is
           #    what the project's squash-merge policy actually
           #    produces; check it directly.
-          if ! git rev-list --first-parent origin/main | grep -qx "$SHA"; then
+          #
+          #    Capture rev-list output first, then grep against a
+          #    here-string. The obvious-looking
+          #      `git rev-list --first-parent origin/main | grep -qx "$SHA"`
+          #    is a `set -o pipefail` + `grep -q` trap: when grep -q
+          #    finds the match it exits early and closes its stdin,
+          #    rev-list gets SIGPIPE and exits 141, and pipefail then
+          #    propagates 141 as the pipeline's exit. The outer
+          #    `if !` negates 141 → enters the false-fail branch
+          #    every time on a long first-parent chain. (False-failed
+          #    every release v0.13.18-.22.) The here-string consumes
+          #    rev-list to completion first; no pipe, no SIGPIPE.
+          FIRST_PARENT=$(git rev-list --first-parent origin/main)
+          if ! grep -qFx "$SHA" <<<"$FIRST_PARENT"; then
             echo "::error::tag $TAG points at $SHA which is NOT on main's first-parent history"
             echo "::error::this means the tag was created from a side-branch commit that never merged via the project's squash-merge flow"
             echo "::error::the publish workflow refuses to proceed; investigate before re-tagging"

package/lib/vendor/blamejs/.github/zizmor.yml

@@ -0,0 +1,29 @@
+# zizmor configuration (auto-discovered at .github/zizmor.yml).
+#
+# Suppressions live here rather than as inline `# zizmor: ignore[...]`
+# comments because the affected lines are `uses:` references that
+# already carry a pinact version comment (`# vX.Y.Z`). zizmor only
+# honors an ignore pragma when `zizmor:` is the first token of the
+# YAML comment; a `# vX.Y.Z  # zizmor: ignore[...]` line reads as the
+# comment text "vX.Y.Z  # zizmor: ..." and the pragma is never seen.
+# A config-file ignore is the only placement that does not collide
+# with the SHA-pin version comment that pinact requires.
+
+rules:
+  cache-poisoning:
+    # actions/setup-node carries an optional `cache:` input that, when
+    # set, restores a dependency cache. zizmor flags the *capability*
+    # whenever the workflow also has a release-class trigger
+    # (`push: tags: ["v*"]`), because a poisoned cache restored during a
+    # publishing run is high-impact. None of these workflows set a
+    # `cache:` input — no dependency cache is created or restored, so
+    # there is nothing to poison. The finding is capability-driven, not
+    # an observed cache.
+    #
+    # Invariant for future edits: if any step in one of these files adds
+    # a `cache:` input to a setup-* action, remove that file from this
+    # list and review the cache-poisoning exposure for real.
+    ignore:
+      - ci.yml
+      - npm-publish.yml
+      - release-container.yml

package/lib/vendor/blamejs/.pinact.yaml

@@ -1,17 +1,33 @@
 # pinact configuration — refuses any tag-shaped `uses:` reference EXCEPT
-# the documented exception below.
+# the documented exceptions below.
 #
-# The single exception is the SLSA reusable workflow. SLSA's internal
-# builder-fetch step refuses non-tag `BUILDER_REF` values ("Invalid ref:
-# <40-hex>. Expected ref of the form refs/tags/vX.Y.Z"), so the call
-# MUST be tag-pinned. Mitigated by slsa-framework's upstream tag-
-# protection + immutable-release rules. Same suppression also appears
-# as a per-line `# allow:slsa-framework-action-not-sha-pinned` marker in
-# `.github/workflows/npm-publish.yml` for the codebase-patterns gate.
+# 1. The SLSA reusable workflow. SLSA's internal builder-fetch step
+#    refuses non-tag `BUILDER_REF` values ("Invalid ref: <40-hex>.
+#    Expected ref of the form refs/tags/vX.Y.Z"), so the call MUST be
+#    tag-pinned. Mitigated by slsa-framework's upstream tag-protection +
+#    immutable-release rules. Same suppression also appears as a per-line
+#    `# allow:slsa-framework-action-not-sha-pinned` marker in
+#    `.github/workflows/npm-publish.yml` for the codebase-patterns gate.
+#
+# 2. aquasecurity/trivy-action. The aquasecurity org enables a GitHub
+#    org-level IP allow-list that returns 403 to GitHub Actions runner
+#    IPs on the commits API, so `pinact run --verify`'s online tag
+#    re-resolution cannot complete from CI (it succeeds from
+#    unrestricted IPs). The action stays SHA-pinned in the workflow
+#    (auditable inline); this entry only exempts it from the online
+#    re-verification that the upstream org makes impossible from a
+#    runner.
 #
 # See npm-publish.yml comment block + memory/specs/release-v0.10.19-plan.md.
 
 version: 3
 
 ignore_actions:
+  # pinact v3 treats both `name` and `ref` as regular expressions, and
+  # both are required (a name-only entry fails config load with
+  # "initialize ignore_action: ref is required"). `ref: .*` matches the
+  # tag-pinned ref this single exception carries (currently v2.1.0).
   - name: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml
+    ref: .*
+  - name: aquasecurity/trivy-action
+    ref: .*

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.24 (2026-05-28) — **`b.guard*` docs corrected: the compliance-posture opt key, the gate API, and validate return shapes.** Documentation corrections across the b.guard* family. The most consequential: the posture-selection option was documented as `compliance:` in many guards' @opts, but the working key is `compliancePosture:` — passing the documented `{ compliance: "hipaa" }` was silently ignored, so a compliance posture (e.g. HIPAA PII redaction) never activated. If you select a posture via the gate/validate/sanitize options, use `compliancePosture:`; `compliance:` had no effect. The guard docs now name the correct key uniformly. Also corrected: gate examples and prose that invoked the gate as a callable or via `.run` / `.inspect` (the gate is an object whose method is `.check(ctx)`), and validate() return shapes that listed `severities` / `summary` / `refusal` fields the function never returned (it returns `{ ok, issues }`). **Fixed:** *guard posture option is `compliancePosture:`, not `compliance:`* — Many `b.guard*` primitives documented the compliance-posture selector as `compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2"` in their `@opts`, but the family resolver reads `compliancePosture:`. Passing `{ compliance: "hipaa" }` was accepted and silently ignored — the posture overlay (e.g. CSV `piiPolicy: "redact"` under HIPAA) never applied, leaving the default policy in force. The docs across the guard family now name `compliancePosture:` consistently (the key the resolver and `b.guardX.compliancePosture(name)` already used). Action: if you selected a posture with `compliance:`, switch to `compliancePosture:` — the posture was not taking effect before. · *guard gate is an object with `.check(ctx)`, not a callable* — Several guards' gate `@example`s and prose invoked the gate as a function (`g({...})`), via `.run(...)`, or via `.inspect(...)`, and a few described it as "an async function". `b.guardX.gate(opts)` returns an object whose async method is `.check(ctx)`; the examples and prose now use `.check`, so they run as written. · *guard validate() returns `{ ok, issues }`* — Several guards documented `validate()` as returning `{ ok, issues, severities }`, `{ ok, issues, summary }`, or `{ ok, issues, refusal? }`. The function returns `{ ok, issues }` (each issue carries its own `severity` / `kind`); the documented extra top-level fields were never present. The docs now state the actual shape.
+
+- v0.13.23 (2026-05-28) — **Documentation corrected to match actual behavior across several primitives.** A set of JSDoc / doc-comment corrections where the documented contract had drifted from what the code does. No behavior changes — the implementations already behaved as now documented; only the docs were wrong. The most operator-relevant is the JWT signer doc: an expiring token signed without an explicit jti receives an auto-minted 128-bit jti (so the replay-defense path has the jti it needs), which the sign-opts doc previously denied. Also corrected: did.resolve's unsupported-method error now names did:jwk (always supported); b.cose.verify is marked stable to match its stable sign sibling and the CWT / EAT / SCITT / mdoc verifiers built on it; b.linkHeader.serialize's doc now states every parameter value is double-quoted; b.auth.saml verifyResponse's documented return shape now lists inResponseTo and issuer (both always returned); and the rate-limit custom-backend contract drops a gc member the middleware never invoked. **Fixed:** *JWT signer doc now describes the auto-minted jti on expiring tokens* — `b.auth.jwt.sign`'s opts doc claimed that omitting `jti` adds no jti. In fact, when a token carries an `exp` and no operator-supplied `jti`, the signer auto-mints a random 128-bit `jti` so a replay-protected token always carries the identifier `verify`'s replay store requires. The doc now describes this; pass an explicit `jti` for a deterministic value. Behavior is unchanged. · *`b.did.resolve` unsupported-method error now names did:jwk* — The thrown error for an unsupported DID method listed only `did:key` and `did:web`, omitting `did:jwk`, which `resolve` fully supports. The message now reads `(did:key, did:jwk, and did:web only)`. · *`b.cose.verify` marked stable* — `b.cose.verify` carried `@status experimental` while its `b.cose.sign` sibling is stable and the CWT / EAT / SCITT / mdoc verifiers that depend on it are stable and shipped. The verifier is the same maturity as the rest of the COSE_Sign1 round-trip; its status now reflects that. · *`b.linkHeader.serialize` doc matches its quoting behavior* — The doc said parameters are token-encoded when they fit RFC 7230 token grammar and double-quoted otherwise. The serializer always double-quotes every value (valid under RFC 8288, and required for space-separated multi-rel and media-type values). The doc now states that. · *`b.auth.saml` verifyResponse documented return shape lists all fields* — The prose and the example each omitted a different field that `verifyResponse` always returns. The documented shape now lists all of `nameId`, `nameIdFormat`, `sessionIndex`, `attributes`, `audience`, `inResponseTo`, and `issuer`. · *rate-limit custom-backend contract is `{ take, reset }`* — The custom-backend opts doc listed a `gc` member that the middleware never reads or invokes (the runtime contract is `take` / `reset` / `close`, and the error message already said `{ take, reset }`). The documented shape now matches; an operator-supplied `gc` was always silently ignored. · *`b.mail.agent.create` doc no longer lists consumer as a method* — The created agent's method list named `consumer`, which is not a method on the returned object — the queue consumer is the sibling export `b.mail.agent.consumer`. The doc now says so.
+
 - v0.13.22 (2026-05-27) — **`b.archive.read.zip.fromTrustedStream` reads a ZIP from a Readable — no longer an experimental stub.** fromTrustedStream was an experimental stub whose inspect / entries / extract methods threw, forcing callers to buffer the stream themselves and use the random-access reader. It now works, with the same shape as the tar trusted-stream reader: pass b.archive.adapters.trustedStream(readable) and the bytes are collected into a size-capped buffer (1 GiB hard ceiling) and read through the same bomb-cap, path-traversal, and entry-type decode as the random-access reader — so bombPolicy, guardProfile, entryTypePolicy, and audit all apply, and inspect / entries / extract / extractEntries all return data. This is a bounded-memory reader (the archive is held in memory under the ceiling), not zero-buffer streaming; a future forward-inflate walker shared with the tar reader would lift the ceiling. **Added:** *`b.archive.read.zip.fromTrustedStream` now reads — `inspect` / `entries` / `extract` / `extractEntries`* — The ZIP trusted-stream reader is implemented (was an experimental stub that threw). Pass `b.archive.adapters.trustedStream(readable)` to read a ZIP straight from a Node Readable without buffering it yourself. The stream is collected into a size-capped buffer (1 GiB ceiling, matching `b.archive.read.tar`'s trusted-stream reader) and decoded through the same adversarial-safe path as the random-access reader, so `bombPolicy` / `guardProfile` / `entryTypePolicy` / `audit` are honored on decode. Adversarial archives remain fully bomb-capped; "trusted" refers only to the source-size bound. A non-trusted-stream adapter is refused with `archive-read/bad-adapter`.
 
 - v0.13.21 (2026-05-27) — **`b.cose.exportKey` — serialize a public key as a COSE_Key, the inverse of `b.cose.importKey`.** b.cose could import a COSE_Key (RFC 9052 §7) into a node:crypto key for verification, but had no way to produce one — so a key used with b.cose.sign could not be shipped to a verifier in COSE form without hand-building the CBOR map. b.cose.exportKey(keyObject, opts?) closes the round-trip: it serializes an EC2 (P-256 / P-384 / P-521) or OKP (Ed25519) public key as the CBOR-encoded COSE_Key map, with optional alg and kid common parameters. A private key has its public half exported; unsupported curves / key types are refused rather than emitting a COSE_Key no verifier here would accept. The bytes round-trip through b.cose.importKey, and feed the mdoc MSO / COSE_Key header / SCITT / C2PA verification-key paths. **Added:** *`b.cose.exportKey(keyObject, { alg?, kid? })` — KeyObject → COSE_Key (RFC 9052 §7)* — Serialize a `node:crypto` public key as the CBOR-encoded COSE_Key map — the inverse of `b.cose.importKey`. Supports EC2 (P-256 / P-384 / P-521) and OKP (Ed25519), the same key types `b.cose.verify` accepts; `opts.alg` (e.g. `"ES256"`) and `opts.kid` populate the COSE_Key alg (label 3) and kid (label 2) common parameters. A private key exports its public half; unsupported curves / key types throw rather than producing a COSE_Key no verifier would accept. `b.cose.importKey(b.cbor.decode(exportKey(k)))` round-trips, so a key signed with `b.cose.sign` can be shipped to a verifier as bytes — the mdoc MSO / COSE_Key header / SCITT / C2PA verification-key paths.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.22",
-  "createdAt": "2026-05-27T23:32:55.833Z",
+  "frameworkVersion": "0.13.24",
+  "createdAt": "2026-05-28T08:46:52.303Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/archive-wrap.js

@@ -370,7 +370,7 @@ function sniffEnvelope(bytes) {
  * @signature b.archive.wrapWithPassphrase(bytes, opts)
  * @since     0.12.11
  * @status    stable
- * @related   b.archive.unwrapWithPassphrase, b.archive.wrap, b.backupCrypto
+ * @related   b.archive.unwrapWithPassphrase, b.archive.wrap
  *
  * Wrap archive bytes in a passphrase-derived envelope. The envelope
  * wire format is the framework's standard Argon2id (RFC 9106) +