@blamejs/blamejs-shop 0.2.22 → 0.2.24

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.24 (2026-05-29) — **Scope cart-line edits to your own cart, harden structured data, and redact auth errors.** A set of request-path hardening fixes. Cart line edit and remove are now scoped to your own session cart, so a cart-line id belonging to another shopper can no longer be used to change quantities on or delete their item — a mismatched id is a no-op, not a mutation. The product structured-data (JSON-LD) embedded in page heads now neutralizes every `</script` close-tag variant (with trailing space, slash, or newline), not just the exact `</script>`, closing a markup-injection path from admin-entered product fields. Account sign-in, registration, and passkey error responses now return a generic message plus a request id instead of the raw internal error string, with the full error logged server-side for the operator. And the worker DB/R2 bridge secret is checked at boot: a secret shorter than 32 characters logs a loud warning so a weak secret is visible in the boot log (the documented generator produces 43 characters, so a by-the-docs deploy stays quiet). **Security:** *Cart-line edits are scoped to your cart* — `POST /cart/lines/:id/update` and `/remove` now resolve the requester's session cart and scope the change to it (`WHERE id = ? AND cart_id = ?`), so a cart-line id from another shopper's cart can't be used to alter or delete their line — it resolves to a no-op rather than a cross-cart mutation. Legitimate edits to your own cart are unchanged. · *Structured-data close-tag escaping hardened* — JSON-LD embedded in page heads (edge and origin, byte-identical) now escapes every `</script` sequence the HTML parser treats as a tag-closer — including `</script `, `</script/`, and `</script` followed by a newline — not only the exact `</script>`. This removes a markup-injection vector from admin-entered product fields that flow into structured data. · *Account auth errors no longer leak internals* — The sign-in, registration, and passkey ceremony endpoints now return a generic message and a request id on an unexpected server error instead of the raw error string; the real error is logged server-side, correlated by that request id. Client-shape (400) and other expected responses are unchanged. · *Bridge-secret entropy warning at boot* — The worker DB/R2 bridge secret (`D1_BRIDGE_SECRET`) authorizes the database and object-storage bridge, so a weak value is high-impact. The container now logs a loud boot warning in production when it is shorter than 32 characters. The documented generator produces 43 characters; if you see the warning, regenerate the secret with the command it prints.
+
+- v0.2.23 (2026-05-29) — **Rate limiting and cross-site request isolation on the request lifecycle.** Two request-lifecycle defenses are now composed into every storefront and admin request. A per-client-IP rate limit backs the whole site (a generous global budget that a normal browsing and checkout session never trips) with tighter budgets on the abusable POST/auth endpoints — sign-in, passkey enrolment, checkout, gift-card balance lookup, account registration, newsletter, review/question submit, and survey response — so credential and passkey spraying, gift-card brute-forcing, and checkout flooding are shut down. Separately, a fetch-metadata gate refuses cross-site state-changing requests using the browser's Sec-Fetch headers, adding CSRF defense-in-depth on top of the SameSite session cookies. The client IP is read from the edge-forwarded header (the container sits behind the Worker), so limits apply per real visitor; the payment-webhook and health-probe paths are exempt. No change for normal use. **Added:** *Per-client rate limiting* — A generous global token-bucket limit per client IP backs the whole site, with tight fixed-window budgets on the abusable POST/auth endpoints (login, passkey register/add, checkout, gift-card balance, register, newsletter, review/question, survey). Keyed on the real client IP forwarded from the edge; payment-webhook and health-probe paths are exempt. The single-instance container uses an in-memory backend. · *Cross-site request isolation (fetch-metadata)* — Cross-site state-changing requests (the CSRF vector) are refused using the browser's Sec-Fetch-Site/Mode/Dest headers — same-origin requests and direct navigations pass; payment webhooks are exempt. This restores defense-in-depth alongside the SameSite session cookies.
+
 - v0.2.22 (2026-05-29) — **See your full order history, track shipments, reorder, and request returns.** The customer order surface is now complete end-to-end. A new order-history list shows every order (cursor-paginated), and each order page gains a status timeline, a carrier tracking panel (tracking number + the carrier's public tracking link), a one-click Reorder that rebuilds a cart from the order, and a Request-a-return button for eligible orders — the same Reorder/Return actions also appear per row on the account dashboard and the history list. On the operator side, the admin order screen gets a shipment panel to attach a carrier + tracking number and record shipment events, and the returns console's Refund now issues the payment-provider refund first (then records the RMA) whenever the order has a captured charge, so a return can't be marked refunded while the customer is left un-refunded; manual/guest orders with no charge fall back to an explicit record-only step. **Added:** *Order history + tracking + reorder + returns (customer)* — `/account/orders` lists all your orders with pagination; each order page shows a status timeline and carrier tracking, plus Reorder (`POST /orders/:id/reorder` rebuilds a cart from the order's lines at current prices) and Request-a-return for eligible orders. The dashboard and history rows carry the same actions. · *Shipment + tracking panel (admin)* — The admin order detail screen can attach a shipment (carrier + tracking number) and record shipment events; marking delivered advances the order's lifecycle. Tracking the order surfaces the carrier's public tracking link to the customer. **Changed:** *Return refunds move the money* — The returns console Refund action now issues the payment-provider refund first and records the RMA only on success when the order has a captured charge, so an approved return is never marked refunded without the customer actually being refunded. Orders with no captured charge use an explicit record-only step that points to the order.
 
 - v0.2.21 (2026-05-29) — **Related products ("You may also like") on the product page.** Product pages now show a related-products rail. The picks are the other products in the product's primary collection, ordered deterministically and capped at four, rendered with the same product-card markup the home and search grids use — identical on the edge and origin paths. The rail is hidden when a product has no related items. This surfaces existing catalog relationships to shoppers without any new data or configuration. **Added:** *Related-products rail on the PDP* — A "You may also like" section on each product page lists other active products from the same primary collection (deterministic order, up to four), using the standard product-card markup byte-identically across the edge and origin renders. Hidden when there are no related products.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.2.22",
+  "version": "0.2.24",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/cart.js

@@ -184,28 +184,43 @@ function create(opts) {
       return { id: id, cart_id: cartId, variant_id: input.variant_id, sku: variantRow.sku, qty: input.qty, unit_amount_minor: unitAmount, unit_currency: unitCurrency, added_at: ts, updated_at: ts };
     },
 
-    updateLine: async function (lineId, patch) {
+    // Scope the mutation to (lineId, cartId): a caller who learns
+    // another visitor's cart_lines.id (it's rendered in their own cart
+    // HTML as the update/remove form action) can't mutate it because
+    // the row only matches when it also belongs to the caller's session
+    // cart. A cross-cart id matches zero rows and becomes a no-op
+    // (returns null), never a mutation. cartId is required — every
+    // caller resolves the session cart first.
+    updateLine: async function (lineId, cartId, patch) {
       _uuid(lineId, "line id");
+      _uuid(cartId, "cart_id");
       if (!patch || typeof patch !== "object") throw new TypeError("cart.updateLine: patch object required");
       if (patch.qty == null) throw new TypeError("cart.updateLine: qty is the only updatable field");
       _qty(patch.qty);
       var ts = _now();
       var r = await query(
-        "UPDATE cart_lines SET qty = ?1, updated_at = ?2 WHERE id = ?3",
-        [patch.qty, ts, lineId],
+        "UPDATE cart_lines SET qty = ?1, updated_at = ?2 WHERE id = ?3 AND cart_id = ?4",
+        [patch.qty, ts, lineId, cartId],
       );
       if (r.rowCount === 0) return null;
-      var row = (await query("SELECT * FROM cart_lines WHERE id = ?1", [lineId])).rows[0];
-      await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [ts, row.cart_id]);
+      var row = (await query("SELECT * FROM cart_lines WHERE id = ?1 AND cart_id = ?2", [lineId, cartId])).rows[0];
+      await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [ts, cartId]);
       return row;
     },
 
-    removeLine: async function (lineId) {
+    // Same cart-scoping as updateLine: a row only deletes when it
+    // belongs to the caller's session cart, so a cross-cart id is a
+    // no-op (returns false) rather than deleting another visitor's line.
+    removeLine: async function (lineId, cartId) {
       _uuid(lineId, "line id");
-      var row = (await query("SELECT cart_id FROM cart_lines WHERE id = ?1", [lineId])).rows[0];
+      _uuid(cartId, "cart_id");
+      var row = (await query(
+        "SELECT cart_id FROM cart_lines WHERE id = ?1 AND cart_id = ?2",
+        [lineId, cartId],
+      )).rows[0];
       if (!row) return false;
-      await query("DELETE FROM cart_lines WHERE id = ?1", [lineId]);
-      await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [_now(), row.cart_id]);
+      await query("DELETE FROM cart_lines WHERE id = ?1 AND cart_id = ?2", [lineId, cartId]);
+      await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [_now(), cartId]);
       return true;
     },
 

package/lib/index.js

@@ -40,6 +40,7 @@ try {
 module.exports.framework = framework;
 
 Object.assign(module.exports, {
+  securityMiddleware: require("./security-middleware"),
   externaldbD1: require("./externaldb-d1"),
   r2Bridge:     require("./r2-bridge"),
   catalog:      require("./catalog"),

package/lib/security-middleware.js

@@ -0,0 +1,217 @@
+"use strict";
+/**
+ * Request-lifecycle security wiring — composes the vendored blamejs
+ * middleware that defends the storefront + admin request paths into a
+ * single place both the production entry point (server.js) and the
+ * end-to-end harness (test/e2e/serve.js) wire identically.
+ *
+ * Three layers, all per-client-IP:
+ *
+ *   1. A generous GLOBAL rate limit (token bucket) — the backstop
+ *      against credential / passkey spraying, gift-card balance
+ *      brute-force, checkout hammering, and unauthenticated row-flood
+ *      writes. Sized so a normal browsing + checkout session (page
+ *      navigations + form POSTs + the cart-count island fetch) never
+ *      trips it; only a flood does.
+ *
+ *   2. TIGHT per-route budgets on the abusable POST / auth endpoints
+ *      (login, passkey register, checkout, gift-card balance lookup,
+ *      account register, newsletter, review / question submit, survey
+ *      response). A human does well under five of these a minute, so a
+ *      ~10/min budget is invisible to real use and shuts spray down.
+ *
+ *   3. fetch-metadata (Sec-Fetch-Site / -Mode / -Dest) — refuses
+ *      cross-site state-changing requests WITHOUT needing a per-form
+ *      token, restoring CSRF defense-in-depth on top of the storefront's
+ *      SameSite session cookies. The payment webhook routes are exempt
+ *      (a payment processor's server-to-server POST is cross-site by
+ *      nature and carries its own HMAC signature check).
+ *
+ * THE CLIENT-IP CONSTRAINT. In production the Node container sits BEHIND
+ * the Cloudflare Worker: every container request arrives via the
+ * Worker's forward, so the socket peer is the CF fabric, not the user.
+ * Cloudflare injects the real client address as `cf-connecting-ip`
+ * (with `x-real-ip` as a mirror); the Worker forwards both verbatim.
+ * Every limiter here therefore keys on that header, falling back to the
+ * socket address only for direct (non-proxied) connections such as the
+ * e2e harness and local dev. Keying on the socket would put every
+ * visitor in ONE bucket behind the fabric and let a single global limit
+ * throttle the whole store.
+ *
+ * The container runs as a single instance (max_instances=1), so the
+ * default in-memory rate-limit backend is correct — there is no second
+ * replica to coordinate a shared counter with, and the in-memory token
+ * bucket / fixed window need no SQL hop.
+ */
+
+var b = require("./vendor/blamejs");
+
+var C = b.constants;
+
+// Payment webhooks are server-to-server POSTs from Stripe / PayPal:
+// cross-site by nature, unthrottleable by a per-IP human budget, and
+// already authenticated by an HMAC signature the edge + container both
+// verify. They are exempt from BOTH the rate limiters and fetch-metadata.
+var WEBHOOK_PATHS = ["/api/webhooks/stripe", "/api/webhooks/paypal"];
+
+// Liveness / readiness probe — the container's Docker HEALTHCHECK hits
+// this on a fixed cadence; never rate-limit it or a slow cold start
+// could wedge the health signal.
+var HEALTH_PATH = "/_/health";
+
+// The abusable endpoints — POST / auth surfaces where a human does
+// well under five requests a minute. Each gets its own per-client-IP
+// budget so a spray against one can't borrow another's headroom, and a
+// legitimate burst on one (a shopper re-submitting a slow checkout)
+// never eats the login budget. Entries are matched as path PREFIXES so
+// the dynamic `:slug` / `:token` segments and the begin/finish passkey
+// sub-paths are all covered by a single stem.
+//
+// Prefix coverage notes:
+//   /account/login            -> /account/login, /account/login/google, ...
+//   /account/register         -> /account/register AND /account/register-begin
+//   /account/passkey/         -> register-begin / register-finish / add-* begin+finish
+//   /products/                -> the review + question submit sub-paths (gated to POST below)
+//   /survey/                  -> /survey/:token (GET form + POST submit)
+var TIGHT_PREFIXES = [
+  "/account/login",
+  "/account/register",
+  "/account/passkey/",
+  "/checkout",
+  "/gift-cards/balance",
+  "/gift-cards",
+  "/newsletter",
+  "/products/",
+  "/survey/",
+];
+
+/**
+ * Resolve the real client IP for rate-limit keying. Reads the
+ * Cloudflare-injected `cf-connecting-ip` first (the canonical single
+ * client address behind the fabric), then `x-real-ip` (its mirror),
+ * then falls back to the socket address via `b.requestHelpers.clientIp`
+ * for direct connections (e2e harness, local dev). Always returns a
+ * non-empty string so two un-identifiable clients never collapse into
+ * the same bucket as a real IP — request-shape reader, returns a
+ * default, never throws.
+ */
+function clientKey(req) {
+  var headers = (req && req.headers) || {};
+  var cf = headers["cf-connecting-ip"];
+  if (typeof cf === "string" && cf.length > 0) return cf.trim();
+  var real = headers["x-real-ip"];
+  if (typeof real === "string" && real.length > 0) return real.trim();
+  var sock = b.requestHelpers.clientIp(req);
+  return sock || "unknown";
+}
+
+/**
+ * Build the GLOBAL rate-limit options for createApp's
+ * `middleware.rateLimit`. Token-bucket so a bursty-but-bounded browsing
+ * session is smoothed rather than clipped at a window edge.
+ *
+ *   burst           — the standing buffer a client may spend at once.
+ *   refillPerSecond — the sustained per-second throughput.
+ *
+ * 300 burst + 5/s refill = a 300-request standing buffer that refills
+ * to full over a minute, i.e. a 300/min sustained ceiling per client
+ * IP. A very active human session (rapid navigation, the cart-count
+ * island firing once per page view, form POSTs) lands far under this;
+ * an unauthenticated spray flood blows straight through it. The webhook
+ * + health paths skip the limiter entirely.
+ */
+function globalRateLimitOpts() {
+  return {
+    backend:         "memory",
+    algorithm:       "token-bucket",
+    burst:           300,
+    refillPerSecond: 5,
+    keyFn:           clientKey,
+    skipPaths:       WEBHOOK_PATHS.concat([HEALTH_PATH]),
+  };
+}
+
+function _hasPrefix(pathname, prefixes) {
+  for (var i = 0; i < prefixes.length; i += 1) {
+    if (pathname.indexOf(prefixes[i]) === 0) return true;
+  }
+  return false;
+}
+
+/**
+ * Mount the per-route tight rate limiters + the fetch-metadata gate on
+ * the router inside the operator's `routes(r)` chain. Call AFTER the
+ * webhook raw-body capture + bodyParser are mounted (so the gate reads
+ * a fully-shaped request) and BEFORE the storefront / admin routes.
+ *
+ * @param r  the blamejs Router passed to createApp's routes(r) callback.
+ */
+function mountRouteGuards(r) {
+  // --- fetch-metadata: cross-site state-change isolation -------------
+  //
+  // Refuses cross-site POST / PUT / DELETE / PATCH (the CSRF vector)
+  // using the browser-supplied Sec-Fetch-* headers — same-origin and
+  // same-site requests, plus direct navigations (typed URL / bookmark),
+  // pass through. Legacy / non-browser clients that omit Sec-Fetch-*
+  // are deferred to (allowMissing default) so server-to-server callers
+  // and old browsers aren't broken; the storefront's SameSite session
+  // cookie is the gate for those. The webhook paths are exempt because
+  // a payment processor's callback is legitimately cross-site.
+  var fmGate = b.middleware.fetchMetadata({
+    allowSameSite:   true,
+    allowCrossSite:  false,
+    allowMissing:    true,
+    allowedNavigate: true,
+  });
+  r.use(function fetchMetadataGuard(req, res, next) {
+    var pathname = req.pathname || req.url || "/";
+    if (_hasPrefix(pathname, WEBHOOK_PATHS)) return next();
+    return fmGate(req, res, next);
+  });
+
+  // --- tight per-route rate limiters ---------------------------------
+  //
+  // One fixed-window limiter keyed on (client IP + path) so each
+  // abusable endpoint carries its own per-client budget. Fixed-window
+  // (rather than token-bucket) gives a flat, predictable "N per minute"
+  // ceiling that's easy to reason about for an auth surface. ~10/min is
+  // an order of magnitude above human use of any of these endpoints and
+  // shuts a spray down hard.
+  var tightLimiter = b.middleware.rateLimit({
+    backend:   "memory",
+    algorithm: "fixed-window",
+    max:       10,
+    windowMs:  C.TIME.minutes(1),
+    keyFn:     function (req) {
+      return clientKey(req) + "|" + (req.pathname || req.url || "/");
+    },
+  });
+  r.use(function tightRateGuard(req, res, next) {
+    var pathname = req.pathname || req.url || "/";
+    // Never throttle the webhook or health paths.
+    if (_hasPrefix(pathname, WEBHOOK_PATHS) || pathname === HEALTH_PATH) return next();
+    if (!_hasPrefix(pathname, TIGHT_PREFIXES)) return next();
+    // `/products/` and `/gift-cards` carry GET reads (PDP, balance page
+    // render) that a shopper hits freely — only gate the state-changing
+    // / lookup POSTs there. Login / register / passkey / checkout /
+    // newsletter / survey are gated on every method (their GETs are the
+    // form render, which a spray would hammer just the same to harvest a
+    // fresh token, so the budget covers both).
+    var method = (req.method || "GET").toUpperCase();
+    var gateAllMethods = pathname.indexOf("/products/") !== 0 &&
+                         pathname.indexOf("/gift-cards") !== 0;
+    if (!gateAllMethods && method !== "POST") return next();
+    return tightLimiter(req, res, next);
+  });
+
+  return { fetchMetadata: fmGate, tightLimiter: tightLimiter };
+}
+
+module.exports = {
+  clientKey:            clientKey,
+  globalRateLimitOpts:  globalRateLimitOpts,
+  mountRouteGuards:     mountRouteGuards,
+  WEBHOOK_PATHS:        WEBHOOK_PATHS,
+  HEALTH_PATH:          HEALTH_PATH,
+  TIGHT_PREFIXES:       TIGHT_PREFIXES,
+};

package/lib/storefront.js

@@ -44,6 +44,35 @@ var b = require("./vendor/blamejs");
 // finds no store and falls back to the English baseline.
 var _localeAls = new AsyncLocalStorage();
 
+// Storefront error logger. Routes through the framework's structured
+// log sink (not console) so operators can redirect / quiet / structured-
+// log every emission point, and so the per-request id the createApp
+// requestId middleware allocates is auto-bound to each line. Used by the
+// 5xx auth-route handlers to record the real failure server-side while
+// the client only ever sees a generic message + the correlating id.
+var _log = b.log.create({});
+
+// Generic 500 for an auth/ceremony route: log the real error server-side
+// (correlated by the framework request id) and return a fixed message to
+// the client so no internal error string (stack frame, DB column, vault
+// internals) leaks. The request id — set by the createApp requestId
+// middleware on req.requestId and echoed in the X-Request-Id response
+// header — rides in the body so an operator can grep the logs for a
+// customer's failed ceremony. `where` names the route for the log line
+// only; it is not reflected to the client.
+function _authServerError(req, res, e, where) {
+  var rid = (req && req.requestId) || null;
+  _log.error("storefront auth route failed", {
+    route:      where,
+    request_id: rid,
+    err:        (e && e.message) || String(e),
+  });
+  res.status(500);
+  var ref = rid ? " (ref " + rid + ")" : "";
+  var msg = "Something went wrong. Please try again." + ref;
+  return res.end ? res.end(msg) : res.send(msg);
+}
+
 // Payment-webhook signatures (Stripe's HMAC, PayPal's, …) are computed over
 // the EXACT raw request bytes, but the global JSON body-parser reparses and
 // discards them. This middleware buffers the raw body for the given POST
@@ -3561,10 +3590,16 @@ function _buildCompare(productId) {
 }
 
 // Schema.org JSON-LD block. JSON.stringify covers the standard escapes;
-// the `</` → `<\/` rewrite neutralises any literal `</script>` in a
-// value. Mirrors the edge renderer's `jsonLdScript`.
+// the `</script` → `<\/script` rewrite neutralises any literal closing
+// tag in a value. The HTML tokenizer ends a <script> on `</script`
+// followed by whitespace, `/`, or `>`, so matching only the exact
+// `</script>` byte sequence misses `</script `, `</script\n`,
+// `</script/` — all of which still break out. Matching `</script`
+// (any trailing byte) closes every variant. Mirrors the edge
+// renderer's `jsonLdScript` byte-for-byte (this output is dual-rendered
+// edge + container; the render-parity tests gate on the two agreeing).
 function _jsonLdScript(data) {
-  var serialised = JSON.stringify(data).replace(/<\/(?=script>)/gi, "<\\/");
+  var serialised = JSON.stringify(data).replace(/<\/script/gi, "<\\/script");
   return "<script type=\"application/ld+json\">" + serialised + "</script>";
 }
 
@@ -8067,8 +8102,11 @@ function mount(router, deps) {
         return res.end ? res.end(JSON.stringify(startOpts)) : res.send(JSON.stringify(startOpts));
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "register-begin failed") : res.send((e && e.message) || "register-begin failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "register-begin failed") : res.send((e && e.message) || "register-begin failed");
+        }
+        return _authServerError(req, res, e, "register-begin");
       }
     });
 
@@ -8125,8 +8163,11 @@ function mount(router, deps) {
         return res.end ? res.end("ok") : res.send("ok");
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "register-finish failed") : res.send((e && e.message) || "register-finish failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "register-finish failed") : res.send((e && e.message) || "register-finish failed");
+        }
+        return _authServerError(req, res, e, "register-finish");
       }
     });
 
@@ -8166,8 +8207,11 @@ function mount(router, deps) {
         return res.end ? res.end(JSON.stringify(startOpts)) : res.send(JSON.stringify(startOpts));
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "login-begin failed") : res.send((e && e.message) || "login-begin failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "login-begin failed") : res.send((e && e.message) || "login-begin failed");
+        }
+        return _authServerError(req, res, e, "login-begin");
       }
     });
 
@@ -8230,8 +8274,11 @@ function mount(router, deps) {
         return res.end ? res.end("ok") : res.send("ok");
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "login-finish failed") : res.send((e && e.message) || "login-finish failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "login-finish failed") : res.send((e && e.message) || "login-finish failed");
+        }
+        return _authServerError(req, res, e, "login-finish");
       }
     });
 
@@ -8507,8 +8554,11 @@ function mount(router, deps) {
         return res.end ? res.end(JSON.stringify(startOpts)) : res.send(JSON.stringify(startOpts));
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "add-begin failed") : res.send((e && e.message) || "add-begin failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "add-begin failed") : res.send((e && e.message) || "add-begin failed");
+        }
+        return _authServerError(req, res, e, "add-begin");
       }
     });
 
@@ -8560,8 +8610,11 @@ function mount(router, deps) {
         return res.end ? res.end("ok") : res.send("ok");
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "add-finish failed") : res.send((e && e.message) || "add-finish failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "add-finish failed") : res.send((e && e.message) || "add-finish failed");
+        }
+        return _authServerError(req, res, e, "add-finish");
       }
     });
 
@@ -10161,9 +10214,11 @@ function mount(router, deps) {
 
   // POST /cart/lines — add a line. Reads variant_id + qty from the
   // form body (b.middleware.bodyParser parses it into req.body).
-  // CSRF token validation is the responsibility of the csrfProtect
-  // middleware mounted at the app level (server.js). Redirects to
-  // /cart on success so a refresh doesn't re-submit the form.
+  // Cross-site forgery of this state-changing POST is refused by the
+  // app-level fetch-metadata gate (Sec-Fetch-Site) plus the SameSite
+  // session cookie; both are wired in server.js via
+  // lib/security-middleware. Redirects to /cart on success so a
+  // refresh doesn't re-submit the form.
   router.post("/cart/lines", async function (req, res) {
     var body = req.body || {};
     var variantId = body.variant_id;
@@ -10344,8 +10399,19 @@ function mount(router, deps) {
       res.status(400);
       return res.end ? res.end("Invalid request") : res.send("Invalid request");
     }
+    // Resolve the requester's own session cart and scope the mutation
+    // to it (same pattern as POST /cart/lines/:line_id/save). The line
+    // id is rendered in every visitor's own cart HTML, so without this
+    // a caller who learns another visitor's line id could change its
+    // qty. A line that isn't in the caller's cart returns null → 404.
+    var sid  = _readSidCookie(req);
+    var cart = sid ? await deps.cart.bySession(sid) : null;
+    if (!cart) {
+      res.status(404);
+      return res.end ? res.end("Line not found") : res.send("Line not found");
+    }
     try {
-      var updated = await deps.cart.updateLine(lineId, { qty: qty });
+      var updated = await deps.cart.updateLine(lineId, cart.id, { qty: qty });
       if (!updated) {
         res.status(404);
         return res.end ? res.end("Line not found") : res.send("Line not found");
@@ -10366,8 +10432,19 @@ function mount(router, deps) {
       res.status(400);
       return res.end ? res.end("Invalid request") : res.send("Invalid request");
     }
+    // Scope the delete to the requester's own session cart (same as the
+    // update route) so a known-but-foreign line id can't delete another
+    // visitor's line. No session cart → nothing of the caller's to
+    // remove; redirect to /cart as the no-op success path.
+    var sid  = _readSidCookie(req);
+    var cart = sid ? await deps.cart.bySession(sid) : null;
+    if (!cart) {
+      res.status(303);
+      res.setHeader && res.setHeader("location", "/cart");
+      return res.end ? res.end() : res.send("");
+    }
     try {
-      await deps.cart.removeLine(lineId);
+      await deps.cart.removeLine(lineId, cart.id);
     } catch (e) {
       res.status(e instanceof TypeError ? 400 : 500);
       return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
@@ -10421,8 +10498,10 @@ function mount(router, deps) {
   //
   // The decision is written to a sealed first-party cookie (the gate) AND
   // recorded in the cookie-consent ledger (the audit trail) when the
-  // primitive is wired. CSRF / origin / fetch-metadata defenses are the
-  // framework middleware already on every POST — no per-route re-check.
+  // primitive is wired. Cross-site forgery of this POST is refused by the
+  // app-level fetch-metadata gate (Sec-Fetch-Site) plus the SameSite
+  // session cookie (both wired in server.js via lib/security-middleware)
+  // — no per-route re-check.
 
   // Same-origin path guard for `return_to`. Accepts a single leading slash
   // followed by a non-slash (so `//evil.example` and absolute URLs are

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.42",
-      "tag": "v0.13.42",
+      "version": "0.13.43",
+      "tag": "v0.13.43",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -13,7 +13,7 @@
         "server": "lib/vendor/blamejs/"
       },
       "bundler": "shallow git clone of release tag from github.com/blamejs/blamejs",
-      "bundledAt": "2026-05-29"
+      "bundledAt": "2026-05-30"
     }
   }
 }

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.43 (2026-05-29) — **LTS window stated consistently as 24 months, experimental primitives declared semver-exempt, and stale version references cleaned up.** Documentation and operator-facing string hygiene ahead of the 1.0 stability contract. The LTS support window is now stated as 24 months everywhere (GOVERNANCE.md and the LTS calendar previously disagreed — 24 vs 18). The LTS calendar gains an explicit clause that primitives marked experimental are exempt from the stability/LTS contract, so operators can tell at a glance which surfaces may change between minors. Several error messages and doc blocks that pinned to long-past version numbers ("lands in v0.10.9", "not supported in v0.12.7", "ships in v0.6.45+") are restated version-agnostically with their escape hatch, and the S/MIME module now points operators at the live PGP encrypt/decrypt path for confidentiality today. No API or behavior changes. **Changed:** *LTS support window is consistently 24 months* — `GOVERNANCE.md` promised a 24-month LTS window while `LTS-CALENDAR.md` and `SECURITY.md` stated 18 — a six-month contradiction in the single most load-bearing number of the support contract. All three now state 24 months of security-only patches per major. The calendar table and the supported-versions prose are aligned. · *Experimental primitives are declared exempt from the stability contract* — `LTS-CALENDAR.md` now states explicitly that primitives documented as experimental (shown as "experimental" on their wiki page, and via the `experimental` segment in namespaces like `b.jose.jwe.experimental`) are not covered by the stability contract or the LTS window — they may change signature, behavior, or wire format, or be removed, in any minor without a deprecation cycle. This lets the framework ship primitives that track in-flight standards without freezing an unsettled format, and tells operators precisely which surfaces are not yet frozen. **Fixed:** *Stale version references removed from operator-facing errors and docs* — Error messages and documentation that pinned to long-past versions are restated version-agnostically with the relevant escape hatch: ZIP64 and unsupported-compression errors in archive reading, the CMS AuthEnvelopedData / fielded-decoder notes, the mTLS CRL-engine error, the safe-archive format-detection summary (which also now correctly lists the supported zip / tar / tar.gz set rather than claiming only zip), and the AI-content IPTC-reader note. None changed behavior; they no longer read as broken promises against the published version history. · *S/MIME confidentiality deferral points to the working PGP path* — `b.mail.crypto.smime` ships sign + verify; encrypt/decrypt is deferred. The deferral note previously cited an open-ended internal condition; it now names the escape hatch directly — use `b.mail.crypto.pgp.encrypt` / `decrypt` for mail confidentiality today — and states the concrete trigger that would re-open S/MIME-specific (X.509-recipient) encryption. · *Governance doc no longer references an internal file operators cannot see* — `GOVERNANCE.md` cited a rule number in a contributor-only file that does not ship in the repository. The deprecation-policy statement is now self-contained.
+
 - v0.13.42 (2026-05-29) — **S/MIME trust-chain validation binds the leaf to the key that verified the signature.** When b.mail.crypto.smime.verify is given trust anchors, it validates the supplied certificate chain — but it picked the chain leaf unconditionally (the first cert) and never tied it to signerPublicKey, the key that actually verified the signature. A SignedData blob could therefore carry a validly-chained certificate for one identity while the signature was verified under an unrelated key, and the chain-validated result would imply a cert↔signer binding the code never made. Chain validation now selects the leaf as the certificate whose public key matches signerPublicKey, and refuses (signer-not-in-chain) when no certificate in the chain carries that key — so a chain-validated signature is bound to the cert it claims. **Security:** *Trust-chain leaf is bound to the verified signer key* — `smime.verify({ trustAnchorCertsPem })` validated the supplied chain starting from `chain[0]` without checking that the leaf's public key was the one that verified the signature (the operator-supplied `signerPublicKey`). A crafted `SignedData` could pair a validly-chained certificate for identity A with a signature verified under an unrelated key, and the chain-valid result would assert a binding that didn't hold. The chain walk now selects the leaf as the certificate whose public key equals `signerPublicKey` (matched against the certificate's SPKI, raw key or full-encoding form), and throws `mail-crypto/smime/signer-not-in-chain` when no certificate in `SignedData.certificates` carries that key. A certificate whose key cannot be extracted is treated as a non-match, so validation fails closed rather than trusting an unverifiable binding.
 
 - v0.13.41 (2026-05-29) — **Agent registry reads can be tenant-scoped; compliance-erasure docs clarify actor is an audit field.** The agent orchestrator's registry reads (list and lookup) gated only on the flat agent-registry:read scope, so any holder could enumerate every tenant's agents and resolve a handle to one — even though the event bus already scopes subscribe and delivery by tenant. The orchestrator now mirrors that: with the new tenantScope option enabled, list returns only the actor's own tenant's agents and lookup refuses a cross-tenant name, unless the actor holds the framework cross-tenant-admin scope. Off by default, so single-tenant deployments are unaffected. Separately, the subject-erasure docs now state explicitly that the recorded actor is an audit field, not authentication — the caller must be authorized upstream. **Added:** *Tenant-scoped agent registry reads (opts.tenantScope)* — `b.agent.orchestrator.create({ tenantScope: true })` now scopes `list` and `lookup` to the calling actor's tenant: `list` filters out agents in other tenants and `lookup` returns null for a cross-tenant name, unless the actor holds the cross-tenant-admin scope (`b.agent.tenant.CROSS_TENANT_ADMIN_SCOPE`). This closes a cross-tenant metadata-enumeration and handle-acquisition path — `agent-registry:read` alone no longer exposes other tenants' agents — and mirrors the tenant scoping the event bus enforces on subscribe and delivery. The option defaults off; existing single-tenant orchestrators behave exactly as before. The `tenantId` argument to `list` remains a convenience filter, distinct from this authorization boundary. **Changed:** *Subject-erasure docs clarify the actor is an audit field, not authentication* — `b.subject.erase` and `b.subject.eraseHard` gate the deletion on operator acknowledgements and the legal-hold registry, not on caller identity. Their documentation now states explicitly that the recorded `actor` is an audit-record field, not authentication — the caller MUST be authenticated and authorized by the route before invoking. No behavior change; this removes an implicit assumption that could otherwise be read as the primitive authorizing the call.

package/lib/vendor/blamejs/GOVERNANCE.md

@@ -39,9 +39,8 @@ then, the maintainer is final on technical direction.
 - **Operator-impacting changes.** Pre-1.0 the framework reserves the
   right to break operator-facing surface in any minor version; major
   versions ship deprecation warnings at least one minor before
-  removal (per project rule §6 in `CLAUDE.md`). Post-1.0 the same
-  contract applies across majors with a 24-month LTS window per
-  [LTS-CALENDAR.md](LTS-CALENDAR.md).
+  removal. Post-1.0 the same contract applies across majors with a
+  24-month LTS window per [LTS-CALENDAR.md](LTS-CALENDAR.md).
 - **Releases.** Patch (`0.0.x`) is the default; minor (`0.x.0`)
   requires an explicit decision the maintainer documents in the
   release notes; major (`x.0.0`) requires a deprecation cycle. The

package/lib/vendor/blamejs/LTS-CALENDAR.md

@@ -1,13 +1,13 @@
 # LTS calendar
 
 `@blamejs/core` ships on a published major cadence. Each major receives
-**18 months of security-only patches** starting the day the next major is
+**24 months of security-only patches** starting the day the next major is
 published. Feature backports are not promised.
 
 | Version       | First release | Security patches through    | Node minimum  | KEM                  | Cipher                | KDF      | Sigs                  |
 |---------------|---------------|-----------------------------|---------------|----------------------|-----------------------|----------|-----------------------|
 | `v0.x` (pre-1.0) | 2026-04-25  | until v1.0 ships            | 24            | ML-KEM-1024 + P-384  | XChaCha20-Poly1305    | SHAKE256 | SLH-DSA-SHAKE-256f    |
-| `v1.x`        | TBD           | first release + 18 months   | current LTS   | ML-KEM-1024 + P-384  | XChaCha20-Poly1305    | SHAKE256 | SLH-DSA-SHAKE-256f    |
+| `v1.x`        | TBD           | first release + 24 months   | current LTS   | ML-KEM-1024 + P-384  | XChaCha20-Poly1305    | SHAKE256 | SLH-DSA-SHAKE-256f    |
 
 ## What "security patches" means
 
@@ -27,3 +27,7 @@ The "Node minimum" column is the lowest Node major the framework supports for th
 ## Pre-1.0 caveat
 
 `v0.x` has no LTS commitment. Every release may change something operators depend on; the algorithm posture is intentionally evolving. Read [CHANGELOG.md](CHANGELOG.md) before upgrading across more than a few patches at a time. The LTS calendar takes effect at v1.0.
+
+## Experimental primitives are exempt
+
+Primitives documented `@status experimental` (shown as "experimental" on each wiki page, and via the `experimental` segment in namespaces such as `b.jose.jwe.experimental`) are **not** covered by the stability contract or the LTS window. They may change signature, behavior, or wire format — or be removed — in any minor, without the deprecation cycle that stable primitives get. This applies on the LTS line too. The exemption exists so the framework can ship primitives that track in-flight standards (draft RFCs, pre-IANA codepoints, newly published W3C surfaces) without freezing an unsettled format for a major's full support window. A primitive graduates to stable by dropping the `@status experimental` marker in a release whose notes call out the graduation.

package/lib/vendor/blamejs/SECURITY.md

@@ -178,7 +178,7 @@ We coordinate with the reporter on disclosure — typical embargo is 14 days pos
 
 Pre-1.0, the supported version is the most-recent published patch on the most-recent minor. Older minors do not receive security backports unless the issue is critical AND the operator base on the older minor is non-trivial.
 
-Once 1.0 ships, the LTS calendar takes effect: each major gets 18 months of security-only patches after the next major's release.
+Once 1.0 ships, the LTS calendar takes effect: each major gets 24 months of security-only patches after the next major's release.
 
 | Version range | Security patches |
 |---|---|

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.42",
-  "createdAt": "2026-05-29T18:46:45.251Z",
+  "frameworkVersion": "0.13.43",
+  "createdAt": "2026-05-29T22:10:35.036Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/ai-content-detect.js

@@ -30,9 +30,10 @@
  *   IPTC `digitalSourceType` PhotoMetadata reading is forward-watch —
  *   the framework ships no XMP / EXIF parser yet, so operators that
  *   want IPTC detection pre-parse with their tool of choice and pass
- *   the field via `opts.ipmd`. AB-853 names C2PA as "widely adopted";
- *   IPTC PhotoMetadata reader lands in v0.10.9 once a vendoring
- *   decision is made.
+ *   the field via `opts.ipmd`. AB-853 names C2PA as "widely adopted".
+ *   A built-in IPTC PhotoMetadata reader is deferred pending a vendoring
+ *   decision for an XMP/EXIF parser; the `opts.ipmd` escape hatch covers
+ *   the gap until then.
  *
  * @card
  *   Inbound provenance detector — composes C2PA verify + CAC implicit-label parser + operator-supplied IPTC field, returns a normalized report for AB-853 / EU AI Act Art. 50 / CAC disclosure UIs.

package/lib/vendor/blamejs/lib/archive-read.js

@@ -214,10 +214,11 @@ async function _readCentralDirectory(adapter, eocd) {
       "multi-disk archives are not supported (diskNumber=" + eocd.diskNumber + ")");
   }
   if (eocd.totalEntries === 0xffff || eocd.cdSize === 0xffffffff || eocd.cdOffset === 0xffffffff) {
-    // ZIP64 sentinel — not supported in v0.12.7. Will land in a
-    // follow-up patch when an operator surfaces a need.
+    // ZIP64 sentinel — unsupported. Archives at >4 GiB / >65535 entries
+    // use tar instead (the escape hatch); ZIP64 read support is deferred
+    // until an operator surfaces a need.
     throw new ArchiveReadError("archive-read/zip64-unsupported",
-      "ZIP64 archives are not supported in v0.12.7 (operators at >4 GiB / >65535 entries should switch to tar — lands v0.12.8)");
+      "ZIP64 archives are unsupported (operators at >4 GiB / >65535 entries should switch to tar)");
   }
   if (eocd.cdSize === 0 || eocd.totalEntries === 0) {
     return [];
@@ -256,7 +257,7 @@ async function _readCentralDirectory(adapter, eocd) {
     }
     if (compressedSize === 0xffffffff || uncompressedSize === 0xffffffff || lfhOffset === 0xffffffff) {
       throw new ArchiveReadError("archive-read/zip64-unsupported",
-        "central directory entry " + n + " carries ZIP64 sentinel sizes (not supported in v0.12.7)");
+        "central directory entry " + n + " carries ZIP64 sentinel sizes (unsupported — use tar for >4 GiB / >65535 entries)");
     }
     // ZIP names are CP437 or UTF-8 (per FLAG_UTF8_NAME bit). Decode
     // as UTF-8 unconditionally — Codex P2 territory if operators in
@@ -425,7 +426,7 @@ async function _decompressEntry(adapter, entry, dataStart, bombPolicy) {
   }
   throw new ArchiveReadError("archive-read/unsupported-method",
     "entry " + JSON.stringify(entry.name) + " uses method=" + entry.method +
-    " — only STORE (0) and DEFLATE (8) supported in v0.12.7");
+    " — only STORE (0) and DEFLATE (8) are supported");
 }
 
 // ---- Public read.zip factory ---------------------------------------------
@@ -668,8 +669,10 @@ function zip(adapter, opts) {
         // entry-type policy opts in.
         if (entry.isEncrypted && !extractOpts.allowEncrypted) {
           throw new ArchiveReadError("archive-read/encrypted-entry",
-            "entry " + JSON.stringify(entry.name) + " is encrypted — " +
-            "v0.12.7 does not decrypt; Flavor 1/2/3 land v0.12.10/v0.12.11");
+            "entry " + JSON.stringify(entry.name) + " is encrypted — this " +
+            "low-level reader does not decrypt; use b.safeArchive for " +
+            "encrypted-archive handling, or pass allowEncrypted to extract " +
+            "the raw entry");
         }
         var typeRefusal = _enforceEntryTypePolicy(entry, entryTypePolicy);
         if (typeRefusal) {

package/lib/vendor/blamejs/lib/break-glass.js

@@ -523,7 +523,7 @@ function _validatePolicySet(table, opts) {
         "' not in allowed factors [" + ALLOWED_FACTORS.join(",") + "]");
     }
   }
-  // Model B (cryptographic mode) ships in v0.5.1. When enabled,
+  // Model B (cryptographic mode). When enabled,
   // glass-locked columns must be encrypted with `b.breakGlass.encryptCell`
   // at write time (the framework can't auto-encrypt at write because
   // policy-set may post-date existing data; operators run the migration

package/lib/vendor/blamejs/lib/cms-codec.js

@@ -42,15 +42,16 @@
  *     refuses EnvelopedData and accepts only the §5083 ContentInfo
  *     OID. Cheap escape hatch: operators on such a peer compose
  *     `b.asn1Der` directly to rewrap an EnvelopedData blob into an
- *     AuthEnvelopedData ContentInfo. Lights up in v0.10.14 alongside
- *     `b.mail.smime` sign + verify, where the on-the-wire S/MIME 4.0
- *     content shape calls for it.
+ *     AuthEnvelopedData ContentInfo. A built-in encode path is deferred
+ *     until an interop case requires a peer that refuses EnvelopedData;
+ *     the `b.asn1Der` rewrap covers the gap until then.
  *   - **`b.cms.decode` parse-tree of inner SignedData / EnvelopedData**
- *     beyond the ContentInfo wrapper. v0.10.13 returns the inner
+ *     beyond the ContentInfo wrapper. `b.cms.decode` returns the inner
  *     SEQUENCE bytes as `content` (an asn1-der node); callers that
- *     need fielded access walk it via `b.asn1Der.readSequence`. The
- *     fielded decoders ship alongside S/MIME verify in v0.10.14 where
- *     they're actually consumed.
+ *     need fielded access walk it via `b.asn1Der.readSequence`. Built-in
+ *     fielded decoders are deferred until they're actually consumed by a
+ *     shipping primitive; the `b.asn1Der.readSequence` walk is the escape
+ *     hatch until then.
  *
  *   Refusal posture:
  *
@@ -302,8 +303,8 @@ function encodeEnvelopedData(opts) {
  * string (e.g. `"1.2.840.113549.1.7.2"` for SignedData) and
  * `content` is the inner asn1-der node (SignedData / EnvelopedData /
  * other) — operators walk it via `b.asn1Der.readSequence`. Fielded
- * decoders for SignedData / EnvelopedData ship in v0.10.14 alongside
- * S/MIME sign+verify.
+ * decoders for SignedData / EnvelopedData are deferred; the
+ * `b.asn1Der.readSequence` walk is the escape hatch until then.
  *
  * Refuses input past `opts.maxBytes` (default 64 MiB), top-level
  * non-SEQUENCE shapes, missing OID + [0] EXPLICIT child pair.

package/lib/vendor/blamejs/lib/mail-crypto-smime.js

@@ -9,8 +9,10 @@
  * @card
  *   S/MIME 4.0 sign + verify (PQC-first ML-DSA / SLH-DSA signers) on
  *   the b.cms substrate. RFC 8551 multipart/signed with RFC 5652
- *   SignedData; EFAIL-class encrypt/decrypt deferred until the AAD-
- *   binding posture lands.
+ *   SignedData. Confidentiality (encrypt/decrypt) is deferred — use
+ *   `b.mail.crypto.pgp.encrypt`/`decrypt` today; S/MIME-specific
+ *   (X.509-recipient) encryption re-opens when an operator surfaces a
+ *   peer that requires it, with the EFAIL defenses below applied then.
  *
  * @intro
  *   S/MIME 4.0 (RFC 8551, replacing RFC 5751) `multipart/signed;
@@ -112,10 +114,12 @@ var ALLOWED_HASHES = ["sha256", "sha384", "sha512"];
 var REFUSED_HASHES = ["md5", "sha1"];                                             // allow:raw-byte-literal — SHAttered / RFC 8551 §2.5
 
 // PROFILES + COMPLIANCE_POSTURES — the framework's standard cross-
-// primitive contract. sign() and verify() (live since v0.10.16) read
-// these to determine which hash + RSA-bit floors apply per operator
-// posture; encrypt() / decrypt() (deferred per the @intro EFAIL note)
-// will compose the same set when they land.
+// primitive contract. sign() and verify() read these to determine which
+// hash + RSA-bit floors apply per operator posture. Confidentiality
+// (encrypt/decrypt) is deferred — b.mail.crypto.pgp.encrypt/decrypt is the
+// confidentiality path today; if S/MIME-specific X.509-recipient
+// encryption is added, it composes the same set with the @intro EFAIL
+// defenses applied.
 var PROFILES = ["strict", "balanced", "permissive"];
 var COMPLIANCE_POSTURES = {
   hipaa:     "strict",

package/lib/vendor/blamejs/lib/mtls-ca.js

@@ -517,8 +517,8 @@ function create(opts) {
     opts3 = opts3 || {};
     if (typeof engine.generateCrl !== "function") {
       throw new MtlsCaError("mtls-ca/engine-no-crl",
-        "configured engine does not implement generateCrl(); the bundled " +
-        "engine ships in v0.6.45+");
+        "configured engine does not implement generateCrl(); use the " +
+        "framework's bundled CA engine, which supports it");
     }
     var ca = await initCA();
     var revocations = _loadRevocations().revocations;

package/lib/vendor/blamejs/lib/safe-archive.js

@@ -22,10 +22,11 @@
  *   pipeline manually.
  *
  *   Format auto-detection sniffs the first ~512 bytes for magic
- *   signatures. v0.12.7 ships ZIP detection (LFH magic `0x04034b50`
- *   + EOCD magic `0x06054b50`); tar / gz / ae2 / `b.crypto.encryptPacked`-
- *   wrapped formats are flagged as `safe-archive/format-unsupported`
- *   in this patch — tar lands v0.12.8, gz v0.12.9, encryption v0.12.10/11.
+ *   signatures: ZIP (LFH magic `0x04034b50` + EOCD magic `0x06054b50`),
+ *   tar (`ustar` at offset 257), gzip / tar.gz (RFC 1952 magic), and
+ *   `b.crypto.encryptPacked`-wrapped envelopes (auto-unwrapped before
+ *   format detection). Unrecognized inputs are flagged
+ *   `safe-archive/format-unsupported`.
  *
  *   The orchestrator refuses the WHOLE archive on any single critical
  *   guard issue — no partial extraction. Cleanup is `fs.rm`-recursive
@@ -148,7 +149,7 @@ async function _collectSourceBytes(source) {
  * @opts
  *   source:           b.archive.adapters.* | Buffer | string,
  *   destination:      string (target directory; created if missing),
- *   format:           "auto" | "zip"        (v0.12.7 — tar v0.12.8, gz v0.12.9),
+ *   format:           "auto" | "zip" | "tar" | "tar.gz",
  *   bombPolicy:       b.guardArchive.zipBombPolicy(...) | { ... },
  *   entryTypePolicy:  b.guardArchive.entryTypePolicy(...) | { ... },
  *   guardProfile:     "strict" | "balanced" | "permissive" | "hipaa" | ...,
@@ -275,8 +276,8 @@ async function extract(opts) {
       });
     } else {
       throw new SafeArchiveError("safe-archive/format-unsupported",
-        "extract: format=" + JSON.stringify(format) + " — v0.12.9 ships ZIP + tar + tar.gz; " +
-        "v0.12.10/v0.12.11 added wrap-recipient + wrap-passphrase envelopes (auto-unwrap as of v0.12.15)");
+        "extract: format=" + JSON.stringify(format) + " — supported formats are " +
+        "zip, tar, tar.gz; b.crypto.encryptPacked-wrapped archives are auto-unwrapped first");
     }
     var result = await reader.extract({
       destination:    opts.destination,

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.42",
+  "version": "0.13.43",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.43.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.43",
+  "date": "2026-05-29",
+  "headline": "LTS window stated consistently as 24 months, experimental primitives declared semver-exempt, and stale version references cleaned up",
+  "summary": "Documentation and operator-facing string hygiene ahead of the 1.0 stability contract. The LTS support window is now stated as 24 months everywhere (GOVERNANCE.md and the LTS calendar previously disagreed — 24 vs 18). The LTS calendar gains an explicit clause that primitives marked experimental are exempt from the stability/LTS contract, so operators can tell at a glance which surfaces may change between minors. Several error messages and doc blocks that pinned to long-past version numbers (\"lands in v0.10.9\", \"not supported in v0.12.7\", \"ships in v0.6.45+\") are restated version-agnostically with their escape hatch, and the S/MIME module now points operators at the live PGP encrypt/decrypt path for confidentiality today. No API or behavior changes.",
+  "sections": [
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "LTS support window is consistently 24 months",
+          "body": "`GOVERNANCE.md` promised a 24-month LTS window while `LTS-CALENDAR.md` and `SECURITY.md` stated 18 — a six-month contradiction in the single most load-bearing number of the support contract. All three now state 24 months of security-only patches per major. The calendar table and the supported-versions prose are aligned."
+        },
+        {
+          "title": "Experimental primitives are declared exempt from the stability contract",
+          "body": "`LTS-CALENDAR.md` now states explicitly that primitives documented as experimental (shown as \"experimental\" on their wiki page, and via the `experimental` segment in namespaces like `b.jose.jwe.experimental`) are not covered by the stability contract or the LTS window — they may change signature, behavior, or wire format, or be removed, in any minor without a deprecation cycle. This lets the framework ship primitives that track in-flight standards without freezing an unsettled format, and tells operators precisely which surfaces are not yet frozen."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Stale version references removed from operator-facing errors and docs",
+          "body": "Error messages and documentation that pinned to long-past versions are restated version-agnostically with the relevant escape hatch: ZIP64 and unsupported-compression errors in archive reading, the CMS AuthEnvelopedData / fielded-decoder notes, the mTLS CRL-engine error, the safe-archive format-detection summary (which also now correctly lists the supported zip / tar / tar.gz set rather than claiming only zip), and the AI-content IPTC-reader note. None changed behavior; they no longer read as broken promises against the published version history."
+        },
+        {
+          "title": "S/MIME confidentiality deferral points to the working PGP path",
+          "body": "`b.mail.crypto.smime` ships sign + verify; encrypt/decrypt is deferred. The deferral note previously cited an open-ended internal condition; it now names the escape hatch directly — use `b.mail.crypto.pgp.encrypt` / `decrypt` for mail confidentiality today — and states the concrete trigger that would re-open S/MIME-specific (X.509-recipient) encryption."
+        },
+        {
+          "title": "Governance doc no longer references an internal file operators cannot see",
+          "body": "`GOVERNANCE.md` cited a rule number in a contributor-only file that does not ship in the repository. The deprecation-policy statement is now self-contained."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/ws-client.test.js

@@ -254,7 +254,10 @@ async function run() {
   var c8 = b.wsClient.connect("ws://127.0.0.1:" + port8 + "/foo", {
     reconnect: false, audit: false, allowInternal: true,
   });
-  await _sleep(150);
+  // Poll for handshake completion rather than a fixed-budget sleep — the
+  // 150ms budget flakes under SMOKE_PARALLEL=64 contention (rule §11b).
+  await helpers.waitUntil(function () { return c8.readyState === "open"; },
+    { timeoutMs: 5000, label: "ws-client: c8 handshake completes (readyState open)" });
   check("getter: url",                            c8.url.indexOf("/foo") !== -1);
   check("getter: readyState open after handshake", c8.readyState === "open");
   c8.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.22",
+  "version": "0.2.24",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {