@blamejs/blamejs-shop 0.2.2 → 0.2.4

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.13",
-  "createdAt": "2026-05-27T11:10:37.499Z",
+  "frameworkVersion": "0.13.16",
+  "createdAt": "2026-05-27T16:55:42.429Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -37552,54 +37552,17 @@
         "agent": {
           "type": "object",
           "members": {
-            "HEAVY_METHODS": {
-              "type": "object",
-              "members": {
-                "export": {
-                  "type": "primitive",
-                  "valueType": "boolean"
-                },
-                "search": {
-                  "type": "primitive",
-                  "valueType": "boolean"
-                }
-              }
-            },
-            "MailAgentError": {
-              "type": "function",
-              "arity": 4
-            },
-            "SCOPE_FOR_METHOD": {
+            "COMPOSE_HINT": {
               "type": "object",
               "members": {
                 "compose": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "delete": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
                 "export": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "expunge": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
-                "fetch": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
-                "flag": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
-                "folders": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
                 "forward": {
                   "type": "primitive",
                   "valueType": "string"
@@ -37628,56 +37591,73 @@
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "move": {
+                "reply": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "quota": {
+                "send": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "reply": {
+                "sieve.activate": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "search": {
+                "sieve.list": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "send": {
+                "vacation.set": {
                   "type": "primitive",
                   "valueType": "string"
+                }
+              }
+            },
+            "HEAVY_METHODS": {
+              "type": "object",
+              "members": {
+                "export": {
+                  "type": "primitive",
+                  "valueType": "boolean"
                 },
-                "sieve.activate": {
+                "search": {
+                  "type": "primitive",
+                  "valueType": "boolean"
+                }
+              }
+            },
+            "MailAgentError": {
+              "type": "function",
+              "arity": 4
+            },
+            "SCOPE_FOR_METHOD": {
+              "type": "object",
+              "members": {
+                "compose": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "sieve.list": {
+                "delete": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "sieve.put": {
+                "export": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "thread": {
+                "expunge": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "vacation.set": {
+                "fetch": {
                   "type": "primitive",
                   "valueType": "string"
-                }
-              }
-            },
-            "WIRED_AT": {
-              "type": "object",
-              "members": {
-                "compose": {
+                },
+                "flag": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "export": {
+                "folders": {
                   "type": "primitive",
                   "valueType": "string"
                 },
@@ -37709,10 +37689,22 @@
                   "type": "primitive",
                   "valueType": "string"
                 },
+                "move": {
+                  "type": "primitive",
+                  "valueType": "string"
+                },
+                "quota": {
+                  "type": "primitive",
+                  "valueType": "string"
+                },
                 "reply": {
                   "type": "primitive",
                   "valueType": "string"
                 },
+                "search": {
+                  "type": "primitive",
+                  "valueType": "string"
+                },
                 "send": {
                   "type": "primitive",
                   "valueType": "string"
@@ -37729,6 +37721,10 @@
                   "type": "primitive",
                   "valueType": "string"
                 },
+                "thread": {
+                  "type": "primitive",
+                  "valueType": "string"
+                },
                 "vacation.set": {
                   "type": "primitive",
                   "valueType": "string"

package/lib/vendor/blamejs/lib/acme.js

@@ -1079,14 +1079,17 @@ function create(opts) {
    * the DER-encoded cert (base64url-encoded automatically) plus an
    * optional `reason` code per RFC 5280 §5.3.1 (0=unspecified,
    * 1=keyCompromise, 3=affiliationChanged, 4=superseded, 5=cessationOfOperation).
-   * Signs with the account key by default; pass `useCertKey:true`
-   * + the cert's private key to authorize via the cert's own key
-   * when the account key is unavailable.
+   * Signs with the account key — the only supported path today, and
+   * sufficient for mainstream CAs. (The cert-key-signed variant —
+   * `useCertKey` / `certPrivateKey` — is reserved and not yet
+   * implemented; passing `useCertKey:true` throws.)
    *
    * @opts
    *   reason:          number,    // RFC 5280 §5.3.1 reason code; default 0 (unspecified)
-   *   useCertKey:      boolean,   // sign with the cert's own key instead of account key
-   *   certPrivateKey:  KeyObject, // required when useCertKey:true
+   *   useCertKey:      boolean,   // RESERVED — cert-key-signed revocation is not yet
+   *                               //   implemented; account-key signing (the default)
+   *                               //   covers mainstream CAs. Passing true throws.
+   *   certPrivateKey:  KeyObject, // RESERVED — consumed only by the cert-key path above
    *
    * @example
    *   await acme.revokeCert(certDerBuffer, { reason: 4 });   // 4 = superseded

package/lib/vendor/blamejs/lib/archive-read.js

@@ -772,7 +772,7 @@ function zip(adapter, opts) {
  * @primitive b.archive.read.zip.fromTrustedStream
  * @signature b.archive.read.zip.fromTrustedStream(adapter, opts?)
  * @since     0.12.7
- * @status    stable
+ * @status    experimental
  * @related   b.archive.read.zip, b.archive.adapters.trustedStream
  *
  * Forward-scan-only ZIP reader for trusted Readable sources. No
@@ -781,20 +781,23 @@ function zip(adapter, opts) {
  * `b.archive.zip().toStream()` output back into a reader for round-trip
  * verification).
  *
- * Adversarial input MUST use the random-access entry point with an
- * `fs` / `buffer` / `objectStore` / `http` adapter.
+ * NOT YET IMPLEMENTED: the streaming LFH walker is not built —
+ * `inspect()` / `entries()` / `extract()` throw
+ * `archive-read/trusted-stream-*-deferred`, and `bombPolicy` / `audit`
+ * are accepted but not yet honored. Re-opens when a streaming
+ * consumer needs it. Until then, collect the stream into a buffer and
+ * use the random-access reader, which is the supported path for both
+ * trusted round-trip verification and adversarial input.
  *
  * @opts
- *   bombPolicy:       { maxEntries, maxEntryDecompressedBytes,
- *                       maxTotalDecompressedBytes, maxExpansionRatio },
- *   audit:            b.audit,
+ *   bombPolicy:       { ... },   // reserved — not yet honored
+ *   audit:            b.audit,   // reserved — not yet honored
  *
  * @example
- *   var produced = fs.createReadStream("./own-export.zip");
- *   var reader   = b.archive.read.zip.fromTrustedStream(
- *     b.archive.adapters.trustedStream(produced)
- *   );
- *   for await (var e of reader.entries()) console.log(e.name, e.size);
+ *   // Supported path: buffer the stream, then read random-access.
+ *   var bytes  = await someStreamToBuffer(producedZipStream);
+ *   var reader = b.archive.read.zip(b.archive.adapters.buffer(bytes));
+ *   var entries = await reader.inspect();
  */
 function fromTrustedStream(adapter, opts) {
   if (!adapter || adapter.kind !== "trusted-sequential") {
@@ -805,25 +808,26 @@ function fromTrustedStream(adapter, opts) {
   var bombPolicy = _normalizeBombPolicy(opts.bombPolicy);
   void bombPolicy;
 
-  // Trusted stream walks LFH-by-LFH. v0.12.7 ships the API surface +
-  // a basic LFH walker for round-trip verification of the framework's
-  // own emitted archives. The full feature parity (extraction via
-  // streaming inflate, data-descriptor scanning) is intentionally
-  // deferred to v0.12.8 alongside the tar reader's sequential mode.
+  // The streaming LFH walker is not built — only the API surface +
+  // adapter validation exist. Extraction via streaming inflate +
+  // data-descriptor scanning re-opens when a streaming consumer needs
+  // it; until then the supported path is to buffer the stream and use
+  // the random-access reader (which handles both trusted round-trip
+  // verification and adversarial input).
   async function inspect() {
     throw new ArchiveReadError("archive-read/trusted-stream-inspect-deferred",
-      "fromTrustedStream.inspect() is deferred to v0.12.8 — use the random-access entry " +
-      "point with b.archive.adapters.buffer(await collect(readable)) for v0.12.7");
+      "fromTrustedStream.inspect() is not implemented — collect the stream into a buffer and " +
+      "use b.archive.read.zip(b.archive.adapters.buffer(bytes))");
   }
 
   async function* entries() {
     throw new ArchiveReadError("archive-read/trusted-stream-entries-deferred",
-      "fromTrustedStream.entries() is deferred to v0.12.8 — collect into buffer for v0.12.7");
+      "fromTrustedStream.entries() is not implemented — collect into a buffer and use the random-access reader");
   }
 
   async function extract() {
     throw new ArchiveReadError("archive-read/trusted-stream-extract-deferred",
-      "fromTrustedStream.extract() is deferred to v0.12.8 — collect into buffer for v0.12.7");
+      "fromTrustedStream.extract() is not implemented — collect into a buffer and use the random-access reader");
   }
 
   return {

package/lib/vendor/blamejs/lib/break-glass.js

@@ -130,9 +130,9 @@ function _ensureFactorLockout() {
 // keys + encryption-context binding (cross-cell tampering / accidental
 // row-swap fails closed). It does NOT defend against vault-key
 // compromise alone — the DEK is still vault-recoverable. True
-// second-factor cryptographic gating ships in v0.5.2 with passkey
-// integration (the passkey private key lives on the YubiKey, not in
-// the framework, so a vault leak alone can't unwrap).
+// second-factor cryptographic gating uses passkey integration (the
+// passkey private key lives on the YubiKey, not in the framework, so a
+// vault leak alone can't unwrap).
 
 // In-memory DEK cache. Keyed by table name. Cleared on _resetForTest.
 var dekCache = new Map();
@@ -520,8 +520,7 @@ function _validatePolicySet(table, opts) {
     if (ALLOWED_FACTORS.indexOf(opts.factors[j]) === -1) {
       throw new BreakGlassError("breakglass/bad-policy",
         "policy.set: factors[" + j + "] '" + opts.factors[j] +
-        "' not in v0.5.0 allowed factors [" + ALLOWED_FACTORS.join(",") + "]" +
-        " (passkey lands in v0.5.2)");
+        "' not in allowed factors [" + ALLOWED_FACTORS.join(",") + "]");
     }
   }
   // Model B (cryptographic mode) ships in v0.5.1. When enabled,

package/lib/vendor/blamejs/lib/crypto.js

@@ -789,10 +789,12 @@ function toBase64Url(buf) {
  *
  * Strict mode (default) refuses non-canonical input — chars outside
  * the RFC 4648 §5 alphabet, length-mod-4-of-1, mixed `+/` from
- * standard base64, trailing garbage. Defends a CVE-2022-0235 class
- * footgun where Node's permissive decoder silently tolerated
- * tampered JWT signatures. Operators with a documented lossy legacy
- * payload opt out per call via `{ strict: false }`.
+ * standard base64, trailing garbage. Defends the CWE-347 /
+ * CWE-1286 signature-canonicalization footgun where a permissive
+ * base64url decoder silently tolerates a tampered JWS / JWT signature
+ * (non-canonical bytes decoding to the same buffer). Operators with a
+ * documented lossy legacy payload opt out per call via
+ * `{ strict: false }`.
  *
  * @opts
  *   strict: boolean   // default: true — refuse non-canonical input
@@ -817,7 +819,8 @@ function fromBase64Url(s, opts) {
   // OAuth `state` round-tripping) MUST reject non-canonical / malformed
   // input. The Node base64url decoder silently tolerates trailing
   // garbage, mixed `+/` from standard base64, missing padding errors,
-  // and length-mod-4 shapes — CVE-2022-0235 class footgun. Strict mode
+  // and length-mod-4 shapes — the CWE-347 / CWE-1286 signature-
+  // canonicalization footgun. Strict mode
   // (the default) refuses anything outside the RFC 4648 §5 alphabet +
   // length rules. Operators with a known-lossy legacy payload pass
   // `{ strict: false }` to opt out per call.

package/lib/vendor/blamejs/lib/guard-dsn.js

@@ -84,8 +84,9 @@
  *     generating a DSN (the existing `b.mail.bounce` primitive does
  *     this); this guard parses INBOUND DSNs and gates the parse
  *     surface bounds, not the bounce-generation policy.
- *   - **DSN header-injection class** (CVE-2026-32178 .NET
- *     System.Net.Mail at outbound; the inbound parse path here)
+ *   - **DSN header-injection class** (CVE-2026-32178 — .NET CWE-138
+ *     special-element / header-injection spoofing, the System.Net.Mail
+ *     vector per MSRC, at outbound; the inbound parse path here)
  *     — refuses CR/LF/NUL/C0 in header lines.
  *   - **CSAF / iSchedule prose tampering** — operator inspecting
  *     the prose part for the original recipient runs into the

package/lib/vendor/blamejs/lib/guard-list-id.js

@@ -37,8 +37,9 @@
  *     octets. Total header value capped at 998 bytes per RFC 5322
  *     §2.1.1 line cap.
  *   - **CRLF + control-char refusal** — header-injection defense
- *     (CVE-2026-32178 .NET System.Net.Mail class on the wire-protocol
- *     surface; this primitive's job is the SEMANTIC shape).
+ *     (CVE-2026-32178 — .NET CWE-138 header-injection spoofing, the
+ *     System.Net.Mail vector per MSRC, on the wire-protocol surface;
+ *     this primitive's job is the SEMANTIC shape).
  *   - **Phrase-injection refusal** — Operator-supplied display
  *     phrase mustn't carry CRLF / `<` / `>` outside the angle
  *     brackets (a separate Bcc/Cc header smuggled into the phrase

package/lib/vendor/blamejs/lib/guard-regex.js

@@ -248,14 +248,14 @@ function _detectIssues(input, opts) {
 }
 
 // Consecutive-star wildcard cap (CVE-2026-26996). Operator-supplied
-// glob fragments compile to picomatch / RegExp; a long run of `*`
-// against a non-matching literal walks O(4^N). Three-or-more
+// glob fragments compile to minimatch / picomatch / RegExp; a long run
+// of `*` against a non-matching literal walks O(4^N). Three-or-more
 // consecutive `*` is the canonical bad shape; `**` (recursive glob)
 // stays permitted, gated by the profile's `maxConsecutiveStars`.
 function _detectConsecutiveStar(input, opts, issues) {
   if (opts.consecutiveStarPolicy === "allow") return;
-  // CVE-2026-26996 is a picomatch / glob-shape backtracking class —
-  // `***+literal` walks O(4^N) when picomatch translates the run to a
+  // CVE-2026-26996 is a minimatch glob-shape backtracking class —
+  // `***+literal` walks O(4^N) when minimatch translates the run to a
   // backtracking-heavy regex. Native ECMAScript regex syntax cannot
   // produce three consecutive `*` quantifiers (it's a SyntaxError),
   // so applying this detector to `inputKind: "regex"` strings only

package/lib/vendor/blamejs/lib/guard-smtp-command.js

@@ -15,8 +15,7 @@
  *   ## Smuggling defense — bare-CR / bare-LF refusal
  *
  *   The SMTP smuggling class (`CVE-2023-51764` Postfix, `CVE-2023-51765`
- *   Sendmail, `CVE-2023-51766` Exim, `CVE-2026-32178` .NET
- *   `System.Net.Mail`) exploits implementations that accept the
+ *   Sendmail, `CVE-2023-51766` Exim) exploits implementations that accept the
  *   non-standard end-of-data sequence `<LF>.<LF>` or `<LF>.<CR><LF>`
  *   instead of the standard `<CR><LF>.<CR><LF>`. The introduced break-
  *   out lets a malicious peer inject a second message past SPF / DMARC

package/lib/vendor/blamejs/lib/mail-agent.js

@@ -7,19 +7,26 @@
  * @featured   true
  *
  * @intro
- *   The standardization contract for every mail protocol blamejs ships.
- *   JMAP (v0.9.27), IMAP (v0.9.28), POP3 (v0.9.29), ManageSieve (v0.9.30),
- *   the inbound MX listener (v0.9.24), and the submission listener
- *   (v0.9.25) all translate their protocol calls into `agent.X(args)`.
- *   The agent owns RBAC, posture enforcement, audit emission,
- *   dispatch, and worker isolation; every protocol on top is a thin
- *   shell.
+ *   A mailbox-access facade that owns RBAC, posture enforcement, audit
+ *   emission, dispatch (local / worker-pool / queue), and worker
+ *   isolation around a mail store, so a protocol server built on top
+ *   can stay a thin shell. It is designed to be the shared dispatch
+ *   layer mail-protocol servers route through; today the read surface
+ *   and the mailbox-mutation + Sieve-upload methods are wired, while the
+ *   compose/send and identity/vacation/MDN/export verbs are not yet
+ *   wired into the facade (see below).
  *
- *   `agent.create()` returns the facade. Methods backed by v0.9.19's
- *   `b.mailStore` run immediately; methods that depend on later slices
- *   throw `mail-agent/not-implemented` with a `wiredAt` tag naming the
- *   version that lights them up (defer-with-condition — operator can
- *   match against the tag to scope their integration).
+ *   `agent.create()` returns the facade. Methods backed by
+ *   `b.mailStore` (folders / fetch / search / move / flag / delete /
+ *   expunge, plus `sieve.put`) run immediately. The remaining verbs —
+ *   compose / send / reply / forward, sieve.list / sieve.activate,
+ *   identity / vacation / mdn.*, export / job / import — throw
+ *   `mail-agent/not-implemented`: they are not yet routed through the
+ *   agent. Until they are, compose the underlying primitive directly
+ *   (`b.mail.send.deliver` for outbound, `b.mail.sieve` for Sieve,
+ *   `b.mailMdn` for MDN, etc.) — which is what the framework's own JMAP
+ *   `emailSubmissionSet` handler does. They wire into the facade when a
+ *   protocol server adopts the agent as its dispatch layer.
  *
  *   ```js
  *   var agent = b.mail.agent.create({
@@ -58,9 +65,11 @@
  *   on every entrypoint.
  *
  * @card
- *   The standardization contract for every mail protocol — JMAP / IMAP /
- *   POP3 all translate into `agent.X(args)`. RBAC + posture + audit +
- *   dispatch owned here; protocols on top are thin shells.
+ *   Mailbox-access facade — RBAC + posture + audit + dispatch around a
+ *   mail store, so a protocol server on top stays a thin shell. Read +
+ *   mailbox-mutation + Sieve-upload methods are wired; compose/send and
+ *   identity/vacation/MDN/export verbs compose the underlying primitive
+ *   directly until a protocol server routes them through the agent.
  */
 
 var lazyRequire        = require("./lazy-require");
@@ -118,25 +127,25 @@ var SCOPE_FOR_METHOD = Object.freeze({
   import:           "mail:import",
 });
 
-// Methods deferred behind a `wiredAt` version. Operator gets a clear
-// error pointing at the slice that lights them up — defer-with-
-// condition per the v1-defensible-scope rule.
-var WIRED_AT = Object.freeze({
-  compose:          "v0.9.25",
-  send:             "v0.9.25",
-  reply:            "v0.9.25",
-  forward:          "v0.9.25",
-  "sieve.list":     "v0.9.26",
-  "sieve.put":      "v0.9.26",
-  "sieve.activate": "v0.9.26",
-  "identity.set":   "v0.9.25",
-  "vacation.set":   "v0.9.25",
-  "mdn.send":       "v0.9.25",
-  "mdn.parse":      "v0.9.25",
-  "mdn.allowList":  "v0.9.25",
-  export:           "v0.9.34a",
-  job:              "v0.9.34a",
-  import:           "v0.9.34",
+// Verbs not yet routed through the agent facade. The error points the
+// operator at the underlying primitive to compose directly (the
+// escape hatch) — defer-with-condition: these wire into the agent when
+// a protocol server adopts it as its dispatch layer.
+var COMPOSE_HINT = Object.freeze({
+  compose:          "b.mail.send.deliver",
+  send:             "b.mail.send.deliver",
+  reply:            "b.mail.send.deliver",
+  forward:          "b.mail.send.deliver",
+  "sieve.list":     "b.mail.sieve",
+  "sieve.activate": "b.mail.sieve",
+  "identity.set":   "your identity store + b.mail.sieve",
+  "vacation.set":   "b.mail.sieve (vacation extension)",
+  "mdn.send":       "b.mailMdn",
+  "mdn.parse":      "b.mailMdn",
+  "mdn.allowList":  "b.mailMdn",
+  export:           "b.mailStore / b.auditTools",
+  job:              "the dispatch queue directly",
+  import:           "b.mailStore",
 });
 
 /**
@@ -653,9 +662,10 @@ function _notImplemented(ctx, method, args) {
   // the slice lights up.
   if (ctx.posture) guardMailQuery.validateActor(args && args.actor, ctx.posture);
   _checkPermission(ctx, method, args);
-  ctx.auditEmit("mail.agent.not_implemented", args && args.actor, { method: method, wiredAt: WIRED_AT[method] });
+  ctx.auditEmit("mail.agent.not_implemented", args && args.actor, { method: method, composeDirectly: COMPOSE_HINT[method] });
   return Promise.reject(new MailAgentError("mail-agent/not-implemented",
-    "agent." + method + ": wired at " + WIRED_AT[method] + " (defer-with-condition)"));
+    "agent." + method + " is not yet routed through the agent facade — compose " +
+    COMPOSE_HINT[method] + " directly"));
 }
 
 // ---- Internals ------------------------------------------------------------
@@ -771,7 +781,7 @@ module.exports = {
   consumer:         consumer,
   MailAgentError:   MailAgentError,
   SCOPE_FOR_METHOD: SCOPE_FOR_METHOD,
-  WIRED_AT:         WIRED_AT,
+  COMPOSE_HINT:     COMPOSE_HINT,
   HEAVY_METHODS:    HEAVY_METHODS,
   // Re-export the guard family so callers can introspect without
   // separate requires.