@blamejs/blamejs-shop 0.2.23 → 0.2.24

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.24 (2026-05-29) — **Scope cart-line edits to your own cart, harden structured data, and redact auth errors.** A set of request-path hardening fixes. Cart line edit and remove are now scoped to your own session cart, so a cart-line id belonging to another shopper can no longer be used to change quantities on or delete their item — a mismatched id is a no-op, not a mutation. The product structured-data (JSON-LD) embedded in page heads now neutralizes every `</script` close-tag variant (with trailing space, slash, or newline), not just the exact `</script>`, closing a markup-injection path from admin-entered product fields. Account sign-in, registration, and passkey error responses now return a generic message plus a request id instead of the raw internal error string, with the full error logged server-side for the operator. And the worker DB/R2 bridge secret is checked at boot: a secret shorter than 32 characters logs a loud warning so a weak secret is visible in the boot log (the documented generator produces 43 characters, so a by-the-docs deploy stays quiet). **Security:** *Cart-line edits are scoped to your cart* — `POST /cart/lines/:id/update` and `/remove` now resolve the requester's session cart and scope the change to it (`WHERE id = ? AND cart_id = ?`), so a cart-line id from another shopper's cart can't be used to alter or delete their line — it resolves to a no-op rather than a cross-cart mutation. Legitimate edits to your own cart are unchanged. · *Structured-data close-tag escaping hardened* — JSON-LD embedded in page heads (edge and origin, byte-identical) now escapes every `</script` sequence the HTML parser treats as a tag-closer — including `</script `, `</script/`, and `</script` followed by a newline — not only the exact `</script>`. This removes a markup-injection vector from admin-entered product fields that flow into structured data. · *Account auth errors no longer leak internals* — The sign-in, registration, and passkey ceremony endpoints now return a generic message and a request id on an unexpected server error instead of the raw error string; the real error is logged server-side, correlated by that request id. Client-shape (400) and other expected responses are unchanged. · *Bridge-secret entropy warning at boot* — The worker DB/R2 bridge secret (`D1_BRIDGE_SECRET`) authorizes the database and object-storage bridge, so a weak value is high-impact. The container now logs a loud boot warning in production when it is shorter than 32 characters. The documented generator produces 43 characters; if you see the warning, regenerate the secret with the command it prints.
+
 - v0.2.23 (2026-05-29) — **Rate limiting and cross-site request isolation on the request lifecycle.** Two request-lifecycle defenses are now composed into every storefront and admin request. A per-client-IP rate limit backs the whole site (a generous global budget that a normal browsing and checkout session never trips) with tighter budgets on the abusable POST/auth endpoints — sign-in, passkey enrolment, checkout, gift-card balance lookup, account registration, newsletter, review/question submit, and survey response — so credential and passkey spraying, gift-card brute-forcing, and checkout flooding are shut down. Separately, a fetch-metadata gate refuses cross-site state-changing requests using the browser's Sec-Fetch headers, adding CSRF defense-in-depth on top of the SameSite session cookies. The client IP is read from the edge-forwarded header (the container sits behind the Worker), so limits apply per real visitor; the payment-webhook and health-probe paths are exempt. No change for normal use. **Added:** *Per-client rate limiting* — A generous global token-bucket limit per client IP backs the whole site, with tight fixed-window budgets on the abusable POST/auth endpoints (login, passkey register/add, checkout, gift-card balance, register, newsletter, review/question, survey). Keyed on the real client IP forwarded from the edge; payment-webhook and health-probe paths are exempt. The single-instance container uses an in-memory backend. · *Cross-site request isolation (fetch-metadata)* — Cross-site state-changing requests (the CSRF vector) are refused using the browser's Sec-Fetch-Site/Mode/Dest headers — same-origin requests and direct navigations pass; payment webhooks are exempt. This restores defense-in-depth alongside the SameSite session cookies.
 
 - v0.2.22 (2026-05-29) — **See your full order history, track shipments, reorder, and request returns.** The customer order surface is now complete end-to-end. A new order-history list shows every order (cursor-paginated), and each order page gains a status timeline, a carrier tracking panel (tracking number + the carrier's public tracking link), a one-click Reorder that rebuilds a cart from the order, and a Request-a-return button for eligible orders — the same Reorder/Return actions also appear per row on the account dashboard and the history list. On the operator side, the admin order screen gets a shipment panel to attach a carrier + tracking number and record shipment events, and the returns console's Refund now issues the payment-provider refund first (then records the RMA) whenever the order has a captured charge, so a return can't be marked refunded while the customer is left un-refunded; manual/guest orders with no charge fall back to an explicit record-only step. **Added:** *Order history + tracking + reorder + returns (customer)* — `/account/orders` lists all your orders with pagination; each order page shows a status timeline and carrier tracking, plus Reorder (`POST /orders/:id/reorder` rebuilds a cart from the order's lines at current prices) and Request-a-return for eligible orders. The dashboard and history rows carry the same actions. · *Shipment + tracking panel (admin)* — The admin order detail screen can attach a shipment (carrier + tracking number) and record shipment events; marking delivered advances the order's lifecycle. Tracking the order surfaces the carrier's public tracking link to the customer. **Changed:** *Return refunds move the money* — The returns console Refund action now issues the payment-provider refund first and records the RMA only on success when the order has a captured charge, so an approved return is never marked refunded without the customer actually being refunded. Orders with no captured charge use an explicit record-only step that points to the order.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.2.23",
+  "version": "0.2.24",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/cart.js

@@ -184,28 +184,43 @@ function create(opts) {
       return { id: id, cart_id: cartId, variant_id: input.variant_id, sku: variantRow.sku, qty: input.qty, unit_amount_minor: unitAmount, unit_currency: unitCurrency, added_at: ts, updated_at: ts };
     },
 
-    updateLine: async function (lineId, patch) {
+    // Scope the mutation to (lineId, cartId): a caller who learns
+    // another visitor's cart_lines.id (it's rendered in their own cart
+    // HTML as the update/remove form action) can't mutate it because
+    // the row only matches when it also belongs to the caller's session
+    // cart. A cross-cart id matches zero rows and becomes a no-op
+    // (returns null), never a mutation. cartId is required — every
+    // caller resolves the session cart first.
+    updateLine: async function (lineId, cartId, patch) {
       _uuid(lineId, "line id");
+      _uuid(cartId, "cart_id");
       if (!patch || typeof patch !== "object") throw new TypeError("cart.updateLine: patch object required");
       if (patch.qty == null) throw new TypeError("cart.updateLine: qty is the only updatable field");
       _qty(patch.qty);
       var ts = _now();
       var r = await query(
-        "UPDATE cart_lines SET qty = ?1, updated_at = ?2 WHERE id = ?3",
-        [patch.qty, ts, lineId],
+        "UPDATE cart_lines SET qty = ?1, updated_at = ?2 WHERE id = ?3 AND cart_id = ?4",
+        [patch.qty, ts, lineId, cartId],
       );
       if (r.rowCount === 0) return null;
-      var row = (await query("SELECT * FROM cart_lines WHERE id = ?1", [lineId])).rows[0];
-      await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [ts, row.cart_id]);
+      var row = (await query("SELECT * FROM cart_lines WHERE id = ?1 AND cart_id = ?2", [lineId, cartId])).rows[0];
+      await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [ts, cartId]);
       return row;
     },
 
-    removeLine: async function (lineId) {
+    // Same cart-scoping as updateLine: a row only deletes when it
+    // belongs to the caller's session cart, so a cross-cart id is a
+    // no-op (returns false) rather than deleting another visitor's line.
+    removeLine: async function (lineId, cartId) {
       _uuid(lineId, "line id");
-      var row = (await query("SELECT cart_id FROM cart_lines WHERE id = ?1", [lineId])).rows[0];
+      _uuid(cartId, "cart_id");
+      var row = (await query(
+        "SELECT cart_id FROM cart_lines WHERE id = ?1 AND cart_id = ?2",
+        [lineId, cartId],
+      )).rows[0];
       if (!row) return false;
-      await query("DELETE FROM cart_lines WHERE id = ?1", [lineId]);
-      await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [_now(), row.cart_id]);
+      await query("DELETE FROM cart_lines WHERE id = ?1 AND cart_id = ?2", [lineId, cartId]);
+      await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [_now(), cartId]);
       return true;
     },
 

package/lib/storefront.js

@@ -44,6 +44,35 @@ var b = require("./vendor/blamejs");
 // finds no store and falls back to the English baseline.
 var _localeAls = new AsyncLocalStorage();
 
+// Storefront error logger. Routes through the framework's structured
+// log sink (not console) so operators can redirect / quiet / structured-
+// log every emission point, and so the per-request id the createApp
+// requestId middleware allocates is auto-bound to each line. Used by the
+// 5xx auth-route handlers to record the real failure server-side while
+// the client only ever sees a generic message + the correlating id.
+var _log = b.log.create({});
+
+// Generic 500 for an auth/ceremony route: log the real error server-side
+// (correlated by the framework request id) and return a fixed message to
+// the client so no internal error string (stack frame, DB column, vault
+// internals) leaks. The request id — set by the createApp requestId
+// middleware on req.requestId and echoed in the X-Request-Id response
+// header — rides in the body so an operator can grep the logs for a
+// customer's failed ceremony. `where` names the route for the log line
+// only; it is not reflected to the client.
+function _authServerError(req, res, e, where) {
+  var rid = (req && req.requestId) || null;
+  _log.error("storefront auth route failed", {
+    route:      where,
+    request_id: rid,
+    err:        (e && e.message) || String(e),
+  });
+  res.status(500);
+  var ref = rid ? " (ref " + rid + ")" : "";
+  var msg = "Something went wrong. Please try again." + ref;
+  return res.end ? res.end(msg) : res.send(msg);
+}
+
 // Payment-webhook signatures (Stripe's HMAC, PayPal's, …) are computed over
 // the EXACT raw request bytes, but the global JSON body-parser reparses and
 // discards them. This middleware buffers the raw body for the given POST
@@ -3561,10 +3590,16 @@ function _buildCompare(productId) {
 }
 
 // Schema.org JSON-LD block. JSON.stringify covers the standard escapes;
-// the `</` → `<\/` rewrite neutralises any literal `</script>` in a
-// value. Mirrors the edge renderer's `jsonLdScript`.
+// the `</script` → `<\/script` rewrite neutralises any literal closing
+// tag in a value. The HTML tokenizer ends a <script> on `</script`
+// followed by whitespace, `/`, or `>`, so matching only the exact
+// `</script>` byte sequence misses `</script `, `</script\n`,
+// `</script/` — all of which still break out. Matching `</script`
+// (any trailing byte) closes every variant. Mirrors the edge
+// renderer's `jsonLdScript` byte-for-byte (this output is dual-rendered
+// edge + container; the render-parity tests gate on the two agreeing).
 function _jsonLdScript(data) {
-  var serialised = JSON.stringify(data).replace(/<\/(?=script>)/gi, "<\\/");
+  var serialised = JSON.stringify(data).replace(/<\/script/gi, "<\\/script");
   return "<script type=\"application/ld+json\">" + serialised + "</script>";
 }
 
@@ -8067,8 +8102,11 @@ function mount(router, deps) {
         return res.end ? res.end(JSON.stringify(startOpts)) : res.send(JSON.stringify(startOpts));
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "register-begin failed") : res.send((e && e.message) || "register-begin failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "register-begin failed") : res.send((e && e.message) || "register-begin failed");
+        }
+        return _authServerError(req, res, e, "register-begin");
       }
     });
 
@@ -8125,8 +8163,11 @@ function mount(router, deps) {
         return res.end ? res.end("ok") : res.send("ok");
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "register-finish failed") : res.send((e && e.message) || "register-finish failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "register-finish failed") : res.send((e && e.message) || "register-finish failed");
+        }
+        return _authServerError(req, res, e, "register-finish");
       }
     });
 
@@ -8166,8 +8207,11 @@ function mount(router, deps) {
         return res.end ? res.end(JSON.stringify(startOpts)) : res.send(JSON.stringify(startOpts));
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "login-begin failed") : res.send((e && e.message) || "login-begin failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "login-begin failed") : res.send((e && e.message) || "login-begin failed");
+        }
+        return _authServerError(req, res, e, "login-begin");
       }
     });
 
@@ -8230,8 +8274,11 @@ function mount(router, deps) {
         return res.end ? res.end("ok") : res.send("ok");
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "login-finish failed") : res.send((e && e.message) || "login-finish failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "login-finish failed") : res.send((e && e.message) || "login-finish failed");
+        }
+        return _authServerError(req, res, e, "login-finish");
       }
     });
 
@@ -8507,8 +8554,11 @@ function mount(router, deps) {
         return res.end ? res.end(JSON.stringify(startOpts)) : res.send(JSON.stringify(startOpts));
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "add-begin failed") : res.send((e && e.message) || "add-begin failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "add-begin failed") : res.send((e && e.message) || "add-begin failed");
+        }
+        return _authServerError(req, res, e, "add-begin");
       }
     });
 
@@ -8560,8 +8610,11 @@ function mount(router, deps) {
         return res.end ? res.end("ok") : res.send("ok");
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "add-finish failed") : res.send((e && e.message) || "add-finish failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "add-finish failed") : res.send((e && e.message) || "add-finish failed");
+        }
+        return _authServerError(req, res, e, "add-finish");
       }
     });
 
@@ -10346,8 +10399,19 @@ function mount(router, deps) {
       res.status(400);
       return res.end ? res.end("Invalid request") : res.send("Invalid request");
     }
+    // Resolve the requester's own session cart and scope the mutation
+    // to it (same pattern as POST /cart/lines/:line_id/save). The line
+    // id is rendered in every visitor's own cart HTML, so without this
+    // a caller who learns another visitor's line id could change its
+    // qty. A line that isn't in the caller's cart returns null → 404.
+    var sid  = _readSidCookie(req);
+    var cart = sid ? await deps.cart.bySession(sid) : null;
+    if (!cart) {
+      res.status(404);
+      return res.end ? res.end("Line not found") : res.send("Line not found");
+    }
     try {
-      var updated = await deps.cart.updateLine(lineId, { qty: qty });
+      var updated = await deps.cart.updateLine(lineId, cart.id, { qty: qty });
       if (!updated) {
         res.status(404);
         return res.end ? res.end("Line not found") : res.send("Line not found");
@@ -10368,8 +10432,19 @@ function mount(router, deps) {
       res.status(400);
       return res.end ? res.end("Invalid request") : res.send("Invalid request");
     }
+    // Scope the delete to the requester's own session cart (same as the
+    // update route) so a known-but-foreign line id can't delete another
+    // visitor's line. No session cart → nothing of the caller's to
+    // remove; redirect to /cart as the no-op success path.
+    var sid  = _readSidCookie(req);
+    var cart = sid ? await deps.cart.bySession(sid) : null;
+    if (!cart) {
+      res.status(303);
+      res.setHeader && res.setHeader("location", "/cart");
+      return res.end ? res.end() : res.send("");
+    }
     try {
-      await deps.cart.removeLine(lineId);
+      await deps.cart.removeLine(lineId, cart.id);
     } catch (e) {
       res.status(e instanceof TypeError ? 400 : 500);
       return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.42",
-      "tag": "v0.13.42",
+      "version": "0.13.43",
+      "tag": "v0.13.43",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -13,7 +13,7 @@
         "server": "lib/vendor/blamejs/"
       },
       "bundler": "shallow git clone of release tag from github.com/blamejs/blamejs",
-      "bundledAt": "2026-05-29"
+      "bundledAt": "2026-05-30"
     }
   }
 }

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.43 (2026-05-29) — **LTS window stated consistently as 24 months, experimental primitives declared semver-exempt, and stale version references cleaned up.** Documentation and operator-facing string hygiene ahead of the 1.0 stability contract. The LTS support window is now stated as 24 months everywhere (GOVERNANCE.md and the LTS calendar previously disagreed — 24 vs 18). The LTS calendar gains an explicit clause that primitives marked experimental are exempt from the stability/LTS contract, so operators can tell at a glance which surfaces may change between minors. Several error messages and doc blocks that pinned to long-past version numbers ("lands in v0.10.9", "not supported in v0.12.7", "ships in v0.6.45+") are restated version-agnostically with their escape hatch, and the S/MIME module now points operators at the live PGP encrypt/decrypt path for confidentiality today. No API or behavior changes. **Changed:** *LTS support window is consistently 24 months* — `GOVERNANCE.md` promised a 24-month LTS window while `LTS-CALENDAR.md` and `SECURITY.md` stated 18 — a six-month contradiction in the single most load-bearing number of the support contract. All three now state 24 months of security-only patches per major. The calendar table and the supported-versions prose are aligned. · *Experimental primitives are declared exempt from the stability contract* — `LTS-CALENDAR.md` now states explicitly that primitives documented as experimental (shown as "experimental" on their wiki page, and via the `experimental` segment in namespaces like `b.jose.jwe.experimental`) are not covered by the stability contract or the LTS window — they may change signature, behavior, or wire format, or be removed, in any minor without a deprecation cycle. This lets the framework ship primitives that track in-flight standards without freezing an unsettled format, and tells operators precisely which surfaces are not yet frozen. **Fixed:** *Stale version references removed from operator-facing errors and docs* — Error messages and documentation that pinned to long-past versions are restated version-agnostically with the relevant escape hatch: ZIP64 and unsupported-compression errors in archive reading, the CMS AuthEnvelopedData / fielded-decoder notes, the mTLS CRL-engine error, the safe-archive format-detection summary (which also now correctly lists the supported zip / tar / tar.gz set rather than claiming only zip), and the AI-content IPTC-reader note. None changed behavior; they no longer read as broken promises against the published version history. · *S/MIME confidentiality deferral points to the working PGP path* — `b.mail.crypto.smime` ships sign + verify; encrypt/decrypt is deferred. The deferral note previously cited an open-ended internal condition; it now names the escape hatch directly — use `b.mail.crypto.pgp.encrypt` / `decrypt` for mail confidentiality today — and states the concrete trigger that would re-open S/MIME-specific (X.509-recipient) encryption. · *Governance doc no longer references an internal file operators cannot see* — `GOVERNANCE.md` cited a rule number in a contributor-only file that does not ship in the repository. The deprecation-policy statement is now self-contained.
+
 - v0.13.42 (2026-05-29) — **S/MIME trust-chain validation binds the leaf to the key that verified the signature.** When b.mail.crypto.smime.verify is given trust anchors, it validates the supplied certificate chain — but it picked the chain leaf unconditionally (the first cert) and never tied it to signerPublicKey, the key that actually verified the signature. A SignedData blob could therefore carry a validly-chained certificate for one identity while the signature was verified under an unrelated key, and the chain-validated result would imply a cert↔signer binding the code never made. Chain validation now selects the leaf as the certificate whose public key matches signerPublicKey, and refuses (signer-not-in-chain) when no certificate in the chain carries that key — so a chain-validated signature is bound to the cert it claims. **Security:** *Trust-chain leaf is bound to the verified signer key* — `smime.verify({ trustAnchorCertsPem })` validated the supplied chain starting from `chain[0]` without checking that the leaf's public key was the one that verified the signature (the operator-supplied `signerPublicKey`). A crafted `SignedData` could pair a validly-chained certificate for identity A with a signature verified under an unrelated key, and the chain-valid result would assert a binding that didn't hold. The chain walk now selects the leaf as the certificate whose public key equals `signerPublicKey` (matched against the certificate's SPKI, raw key or full-encoding form), and throws `mail-crypto/smime/signer-not-in-chain` when no certificate in `SignedData.certificates` carries that key. A certificate whose key cannot be extracted is treated as a non-match, so validation fails closed rather than trusting an unverifiable binding.
 
 - v0.13.41 (2026-05-29) — **Agent registry reads can be tenant-scoped; compliance-erasure docs clarify actor is an audit field.** The agent orchestrator's registry reads (list and lookup) gated only on the flat agent-registry:read scope, so any holder could enumerate every tenant's agents and resolve a handle to one — even though the event bus already scopes subscribe and delivery by tenant. The orchestrator now mirrors that: with the new tenantScope option enabled, list returns only the actor's own tenant's agents and lookup refuses a cross-tenant name, unless the actor holds the framework cross-tenant-admin scope. Off by default, so single-tenant deployments are unaffected. Separately, the subject-erasure docs now state explicitly that the recorded actor is an audit field, not authentication — the caller must be authorized upstream. **Added:** *Tenant-scoped agent registry reads (opts.tenantScope)* — `b.agent.orchestrator.create({ tenantScope: true })` now scopes `list` and `lookup` to the calling actor's tenant: `list` filters out agents in other tenants and `lookup` returns null for a cross-tenant name, unless the actor holds the cross-tenant-admin scope (`b.agent.tenant.CROSS_TENANT_ADMIN_SCOPE`). This closes a cross-tenant metadata-enumeration and handle-acquisition path — `agent-registry:read` alone no longer exposes other tenants' agents — and mirrors the tenant scoping the event bus enforces on subscribe and delivery. The option defaults off; existing single-tenant orchestrators behave exactly as before. The `tenantId` argument to `list` remains a convenience filter, distinct from this authorization boundary. **Changed:** *Subject-erasure docs clarify the actor is an audit field, not authentication* — `b.subject.erase` and `b.subject.eraseHard` gate the deletion on operator acknowledgements and the legal-hold registry, not on caller identity. Their documentation now states explicitly that the recorded `actor` is an audit-record field, not authentication — the caller MUST be authenticated and authorized by the route before invoking. No behavior change; this removes an implicit assumption that could otherwise be read as the primitive authorizing the call.

package/lib/vendor/blamejs/GOVERNANCE.md

@@ -39,9 +39,8 @@ then, the maintainer is final on technical direction.
 - **Operator-impacting changes.** Pre-1.0 the framework reserves the
   right to break operator-facing surface in any minor version; major
   versions ship deprecation warnings at least one minor before
-  removal (per project rule §6 in `CLAUDE.md`). Post-1.0 the same
-  contract applies across majors with a 24-month LTS window per
-  [LTS-CALENDAR.md](LTS-CALENDAR.md).
+  removal. Post-1.0 the same contract applies across majors with a
+  24-month LTS window per [LTS-CALENDAR.md](LTS-CALENDAR.md).
 - **Releases.** Patch (`0.0.x`) is the default; minor (`0.x.0`)
   requires an explicit decision the maintainer documents in the
   release notes; major (`x.0.0`) requires a deprecation cycle. The

package/lib/vendor/blamejs/LTS-CALENDAR.md

@@ -1,13 +1,13 @@
 # LTS calendar
 
 `@blamejs/core` ships on a published major cadence. Each major receives
-**18 months of security-only patches** starting the day the next major is
+**24 months of security-only patches** starting the day the next major is
 published. Feature backports are not promised.
 
 | Version       | First release | Security patches through    | Node minimum  | KEM                  | Cipher                | KDF      | Sigs                  |
 |---------------|---------------|-----------------------------|---------------|----------------------|-----------------------|----------|-----------------------|
 | `v0.x` (pre-1.0) | 2026-04-25  | until v1.0 ships            | 24            | ML-KEM-1024 + P-384  | XChaCha20-Poly1305    | SHAKE256 | SLH-DSA-SHAKE-256f    |
-| `v1.x`        | TBD           | first release + 18 months   | current LTS   | ML-KEM-1024 + P-384  | XChaCha20-Poly1305    | SHAKE256 | SLH-DSA-SHAKE-256f    |
+| `v1.x`        | TBD           | first release + 24 months   | current LTS   | ML-KEM-1024 + P-384  | XChaCha20-Poly1305    | SHAKE256 | SLH-DSA-SHAKE-256f    |
 
 ## What "security patches" means
 
@@ -27,3 +27,7 @@ The "Node minimum" column is the lowest Node major the framework supports for th
 ## Pre-1.0 caveat
 
 `v0.x` has no LTS commitment. Every release may change something operators depend on; the algorithm posture is intentionally evolving. Read [CHANGELOG.md](CHANGELOG.md) before upgrading across more than a few patches at a time. The LTS calendar takes effect at v1.0.
+
+## Experimental primitives are exempt
+
+Primitives documented `@status experimental` (shown as "experimental" on each wiki page, and via the `experimental` segment in namespaces such as `b.jose.jwe.experimental`) are **not** covered by the stability contract or the LTS window. They may change signature, behavior, or wire format — or be removed — in any minor, without the deprecation cycle that stable primitives get. This applies on the LTS line too. The exemption exists so the framework can ship primitives that track in-flight standards (draft RFCs, pre-IANA codepoints, newly published W3C surfaces) without freezing an unsettled format for a major's full support window. A primitive graduates to stable by dropping the `@status experimental` marker in a release whose notes call out the graduation.

package/lib/vendor/blamejs/SECURITY.md

@@ -178,7 +178,7 @@ We coordinate with the reporter on disclosure — typical embargo is 14 days pos
 
 Pre-1.0, the supported version is the most-recent published patch on the most-recent minor. Older minors do not receive security backports unless the issue is critical AND the operator base on the older minor is non-trivial.
 
-Once 1.0 ships, the LTS calendar takes effect: each major gets 18 months of security-only patches after the next major's release.
+Once 1.0 ships, the LTS calendar takes effect: each major gets 24 months of security-only patches after the next major's release.
 
 | Version range | Security patches |
 |---|---|

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.42",
-  "createdAt": "2026-05-29T18:46:45.251Z",
+  "frameworkVersion": "0.13.43",
+  "createdAt": "2026-05-29T22:10:35.036Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/ai-content-detect.js

@@ -30,9 +30,10 @@
  *   IPTC `digitalSourceType` PhotoMetadata reading is forward-watch —
  *   the framework ships no XMP / EXIF parser yet, so operators that
  *   want IPTC detection pre-parse with their tool of choice and pass
- *   the field via `opts.ipmd`. AB-853 names C2PA as "widely adopted";
- *   IPTC PhotoMetadata reader lands in v0.10.9 once a vendoring
- *   decision is made.
+ *   the field via `opts.ipmd`. AB-853 names C2PA as "widely adopted".
+ *   A built-in IPTC PhotoMetadata reader is deferred pending a vendoring
+ *   decision for an XMP/EXIF parser; the `opts.ipmd` escape hatch covers
+ *   the gap until then.
  *
  * @card
  *   Inbound provenance detector — composes C2PA verify + CAC implicit-label parser + operator-supplied IPTC field, returns a normalized report for AB-853 / EU AI Act Art. 50 / CAC disclosure UIs.

package/lib/vendor/blamejs/lib/archive-read.js

@@ -214,10 +214,11 @@ async function _readCentralDirectory(adapter, eocd) {
       "multi-disk archives are not supported (diskNumber=" + eocd.diskNumber + ")");
   }
   if (eocd.totalEntries === 0xffff || eocd.cdSize === 0xffffffff || eocd.cdOffset === 0xffffffff) {
-    // ZIP64 sentinel — not supported in v0.12.7. Will land in a
-    // follow-up patch when an operator surfaces a need.
+    // ZIP64 sentinel — unsupported. Archives at >4 GiB / >65535 entries
+    // use tar instead (the escape hatch); ZIP64 read support is deferred
+    // until an operator surfaces a need.
     throw new ArchiveReadError("archive-read/zip64-unsupported",
-      "ZIP64 archives are not supported in v0.12.7 (operators at >4 GiB / >65535 entries should switch to tar — lands v0.12.8)");
+      "ZIP64 archives are unsupported (operators at >4 GiB / >65535 entries should switch to tar)");
   }
   if (eocd.cdSize === 0 || eocd.totalEntries === 0) {
     return [];
@@ -256,7 +257,7 @@ async function _readCentralDirectory(adapter, eocd) {
     }
     if (compressedSize === 0xffffffff || uncompressedSize === 0xffffffff || lfhOffset === 0xffffffff) {
       throw new ArchiveReadError("archive-read/zip64-unsupported",
-        "central directory entry " + n + " carries ZIP64 sentinel sizes (not supported in v0.12.7)");
+        "central directory entry " + n + " carries ZIP64 sentinel sizes (unsupported — use tar for >4 GiB / >65535 entries)");
     }
     // ZIP names are CP437 or UTF-8 (per FLAG_UTF8_NAME bit). Decode
     // as UTF-8 unconditionally — Codex P2 territory if operators in
@@ -425,7 +426,7 @@ async function _decompressEntry(adapter, entry, dataStart, bombPolicy) {
   }
   throw new ArchiveReadError("archive-read/unsupported-method",
     "entry " + JSON.stringify(entry.name) + " uses method=" + entry.method +
-    " — only STORE (0) and DEFLATE (8) supported in v0.12.7");
+    " — only STORE (0) and DEFLATE (8) are supported");
 }
 
 // ---- Public read.zip factory ---------------------------------------------
@@ -668,8 +669,10 @@ function zip(adapter, opts) {
         // entry-type policy opts in.
         if (entry.isEncrypted && !extractOpts.allowEncrypted) {
           throw new ArchiveReadError("archive-read/encrypted-entry",
-            "entry " + JSON.stringify(entry.name) + " is encrypted — " +
-            "v0.12.7 does not decrypt; Flavor 1/2/3 land v0.12.10/v0.12.11");
+            "entry " + JSON.stringify(entry.name) + " is encrypted — this " +
+            "low-level reader does not decrypt; use b.safeArchive for " +
+            "encrypted-archive handling, or pass allowEncrypted to extract " +
+            "the raw entry");
         }
         var typeRefusal = _enforceEntryTypePolicy(entry, entryTypePolicy);
         if (typeRefusal) {

package/lib/vendor/blamejs/lib/break-glass.js

@@ -523,7 +523,7 @@ function _validatePolicySet(table, opts) {
         "' not in allowed factors [" + ALLOWED_FACTORS.join(",") + "]");
     }
   }
-  // Model B (cryptographic mode) ships in v0.5.1. When enabled,
+  // Model B (cryptographic mode). When enabled,
   // glass-locked columns must be encrypted with `b.breakGlass.encryptCell`
   // at write time (the framework can't auto-encrypt at write because
   // policy-set may post-date existing data; operators run the migration

package/lib/vendor/blamejs/lib/cms-codec.js

@@ -42,15 +42,16 @@
  *     refuses EnvelopedData and accepts only the §5083 ContentInfo
  *     OID. Cheap escape hatch: operators on such a peer compose
  *     `b.asn1Der` directly to rewrap an EnvelopedData blob into an
- *     AuthEnvelopedData ContentInfo. Lights up in v0.10.14 alongside
- *     `b.mail.smime` sign + verify, where the on-the-wire S/MIME 4.0
- *     content shape calls for it.
+ *     AuthEnvelopedData ContentInfo. A built-in encode path is deferred
+ *     until an interop case requires a peer that refuses EnvelopedData;
+ *     the `b.asn1Der` rewrap covers the gap until then.
  *   - **`b.cms.decode` parse-tree of inner SignedData / EnvelopedData**
- *     beyond the ContentInfo wrapper. v0.10.13 returns the inner
+ *     beyond the ContentInfo wrapper. `b.cms.decode` returns the inner
  *     SEQUENCE bytes as `content` (an asn1-der node); callers that
- *     need fielded access walk it via `b.asn1Der.readSequence`. The
- *     fielded decoders ship alongside S/MIME verify in v0.10.14 where
- *     they're actually consumed.
+ *     need fielded access walk it via `b.asn1Der.readSequence`. Built-in
+ *     fielded decoders are deferred until they're actually consumed by a
+ *     shipping primitive; the `b.asn1Der.readSequence` walk is the escape
+ *     hatch until then.
  *
  *   Refusal posture:
  *
@@ -302,8 +303,8 @@ function encodeEnvelopedData(opts) {
  * string (e.g. `"1.2.840.113549.1.7.2"` for SignedData) and
  * `content` is the inner asn1-der node (SignedData / EnvelopedData /
  * other) — operators walk it via `b.asn1Der.readSequence`. Fielded
- * decoders for SignedData / EnvelopedData ship in v0.10.14 alongside
- * S/MIME sign+verify.
+ * decoders for SignedData / EnvelopedData are deferred; the
+ * `b.asn1Der.readSequence` walk is the escape hatch until then.
  *
  * Refuses input past `opts.maxBytes` (default 64 MiB), top-level
  * non-SEQUENCE shapes, missing OID + [0] EXPLICIT child pair.

package/lib/vendor/blamejs/lib/mail-crypto-smime.js

@@ -9,8 +9,10 @@
  * @card
  *   S/MIME 4.0 sign + verify (PQC-first ML-DSA / SLH-DSA signers) on
  *   the b.cms substrate. RFC 8551 multipart/signed with RFC 5652
- *   SignedData; EFAIL-class encrypt/decrypt deferred until the AAD-
- *   binding posture lands.
+ *   SignedData. Confidentiality (encrypt/decrypt) is deferred — use
+ *   `b.mail.crypto.pgp.encrypt`/`decrypt` today; S/MIME-specific
+ *   (X.509-recipient) encryption re-opens when an operator surfaces a
+ *   peer that requires it, with the EFAIL defenses below applied then.
  *
  * @intro
  *   S/MIME 4.0 (RFC 8551, replacing RFC 5751) `multipart/signed;
@@ -112,10 +114,12 @@ var ALLOWED_HASHES = ["sha256", "sha384", "sha512"];
 var REFUSED_HASHES = ["md5", "sha1"];                                             // allow:raw-byte-literal — SHAttered / RFC 8551 §2.5
 
 // PROFILES + COMPLIANCE_POSTURES — the framework's standard cross-
-// primitive contract. sign() and verify() (live since v0.10.16) read
-// these to determine which hash + RSA-bit floors apply per operator
-// posture; encrypt() / decrypt() (deferred per the @intro EFAIL note)
-// will compose the same set when they land.
+// primitive contract. sign() and verify() read these to determine which
+// hash + RSA-bit floors apply per operator posture. Confidentiality
+// (encrypt/decrypt) is deferred — b.mail.crypto.pgp.encrypt/decrypt is the
+// confidentiality path today; if S/MIME-specific X.509-recipient
+// encryption is added, it composes the same set with the @intro EFAIL
+// defenses applied.
 var PROFILES = ["strict", "balanced", "permissive"];
 var COMPLIANCE_POSTURES = {
   hipaa:     "strict",

package/lib/vendor/blamejs/lib/mtls-ca.js

@@ -517,8 +517,8 @@ function create(opts) {
     opts3 = opts3 || {};
     if (typeof engine.generateCrl !== "function") {
       throw new MtlsCaError("mtls-ca/engine-no-crl",
-        "configured engine does not implement generateCrl(); the bundled " +
-        "engine ships in v0.6.45+");
+        "configured engine does not implement generateCrl(); use the " +
+        "framework's bundled CA engine, which supports it");
     }
     var ca = await initCA();
     var revocations = _loadRevocations().revocations;

package/lib/vendor/blamejs/lib/safe-archive.js

@@ -22,10 +22,11 @@
  *   pipeline manually.
  *
  *   Format auto-detection sniffs the first ~512 bytes for magic
- *   signatures. v0.12.7 ships ZIP detection (LFH magic `0x04034b50`
- *   + EOCD magic `0x06054b50`); tar / gz / ae2 / `b.crypto.encryptPacked`-
- *   wrapped formats are flagged as `safe-archive/format-unsupported`
- *   in this patch — tar lands v0.12.8, gz v0.12.9, encryption v0.12.10/11.
+ *   signatures: ZIP (LFH magic `0x04034b50` + EOCD magic `0x06054b50`),
+ *   tar (`ustar` at offset 257), gzip / tar.gz (RFC 1952 magic), and
+ *   `b.crypto.encryptPacked`-wrapped envelopes (auto-unwrapped before
+ *   format detection). Unrecognized inputs are flagged
+ *   `safe-archive/format-unsupported`.
  *
  *   The orchestrator refuses the WHOLE archive on any single critical
  *   guard issue — no partial extraction. Cleanup is `fs.rm`-recursive
@@ -148,7 +149,7 @@ async function _collectSourceBytes(source) {
  * @opts
  *   source:           b.archive.adapters.* | Buffer | string,
  *   destination:      string (target directory; created if missing),
- *   format:           "auto" | "zip"        (v0.12.7 — tar v0.12.8, gz v0.12.9),
+ *   format:           "auto" | "zip" | "tar" | "tar.gz",
  *   bombPolicy:       b.guardArchive.zipBombPolicy(...) | { ... },
  *   entryTypePolicy:  b.guardArchive.entryTypePolicy(...) | { ... },
  *   guardProfile:     "strict" | "balanced" | "permissive" | "hipaa" | ...,
@@ -275,8 +276,8 @@ async function extract(opts) {
       });
     } else {
       throw new SafeArchiveError("safe-archive/format-unsupported",
-        "extract: format=" + JSON.stringify(format) + " — v0.12.9 ships ZIP + tar + tar.gz; " +
-        "v0.12.10/v0.12.11 added wrap-recipient + wrap-passphrase envelopes (auto-unwrap as of v0.12.15)");
+        "extract: format=" + JSON.stringify(format) + " — supported formats are " +
+        "zip, tar, tar.gz; b.crypto.encryptPacked-wrapped archives are auto-unwrapped first");
     }
     var result = await reader.extract({
       destination:    opts.destination,

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.42",
+  "version": "0.13.43",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.43.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.43",
+  "date": "2026-05-29",
+  "headline": "LTS window stated consistently as 24 months, experimental primitives declared semver-exempt, and stale version references cleaned up",
+  "summary": "Documentation and operator-facing string hygiene ahead of the 1.0 stability contract. The LTS support window is now stated as 24 months everywhere (GOVERNANCE.md and the LTS calendar previously disagreed — 24 vs 18). The LTS calendar gains an explicit clause that primitives marked experimental are exempt from the stability/LTS contract, so operators can tell at a glance which surfaces may change between minors. Several error messages and doc blocks that pinned to long-past version numbers (\"lands in v0.10.9\", \"not supported in v0.12.7\", \"ships in v0.6.45+\") are restated version-agnostically with their escape hatch, and the S/MIME module now points operators at the live PGP encrypt/decrypt path for confidentiality today. No API or behavior changes.",
+  "sections": [
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "LTS support window is consistently 24 months",
+          "body": "`GOVERNANCE.md` promised a 24-month LTS window while `LTS-CALENDAR.md` and `SECURITY.md` stated 18 — a six-month contradiction in the single most load-bearing number of the support contract. All three now state 24 months of security-only patches per major. The calendar table and the supported-versions prose are aligned."
+        },
+        {
+          "title": "Experimental primitives are declared exempt from the stability contract",
+          "body": "`LTS-CALENDAR.md` now states explicitly that primitives documented as experimental (shown as \"experimental\" on their wiki page, and via the `experimental` segment in namespaces like `b.jose.jwe.experimental`) are not covered by the stability contract or the LTS window — they may change signature, behavior, or wire format, or be removed, in any minor without a deprecation cycle. This lets the framework ship primitives that track in-flight standards without freezing an unsettled format, and tells operators precisely which surfaces are not yet frozen."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Stale version references removed from operator-facing errors and docs",
+          "body": "Error messages and documentation that pinned to long-past versions are restated version-agnostically with the relevant escape hatch: ZIP64 and unsupported-compression errors in archive reading, the CMS AuthEnvelopedData / fielded-decoder notes, the mTLS CRL-engine error, the safe-archive format-detection summary (which also now correctly lists the supported zip / tar / tar.gz set rather than claiming only zip), and the AI-content IPTC-reader note. None changed behavior; they no longer read as broken promises against the published version history."
+        },
+        {
+          "title": "S/MIME confidentiality deferral points to the working PGP path",
+          "body": "`b.mail.crypto.smime` ships sign + verify; encrypt/decrypt is deferred. The deferral note previously cited an open-ended internal condition; it now names the escape hatch directly — use `b.mail.crypto.pgp.encrypt` / `decrypt` for mail confidentiality today — and states the concrete trigger that would re-open S/MIME-specific (X.509-recipient) encryption."
+        },
+        {
+          "title": "Governance doc no longer references an internal file operators cannot see",
+          "body": "`GOVERNANCE.md` cited a rule number in a contributor-only file that does not ship in the repository. The deprecation-policy statement is now self-contained."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/ws-client.test.js

@@ -254,7 +254,10 @@ async function run() {
   var c8 = b.wsClient.connect("ws://127.0.0.1:" + port8 + "/foo", {
     reconnect: false, audit: false, allowInternal: true,
   });
-  await _sleep(150);
+  // Poll for handshake completion rather than a fixed-budget sleep — the
+  // 150ms budget flakes under SMOKE_PARALLEL=64 contention (rule §11b).
+  await helpers.waitUntil(function () { return c8.readyState === "open"; },
+    { timeoutMs: 5000, label: "ws-client: c8 handshake completes (readyState open)" });
   check("getter: url",                            c8.url.indexOf("/foo") !== -1);
   check("getter: readyState open after handshake", c8.readyState === "open");
   c8.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.23",
+  "version": "0.2.24",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {