@blamejs/blamejs-shop 0.2.23 → 0.2.25

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.25 (2026-05-29) — **Harden session and admin cookies with __Host- / __Secure- name prefixes.** The session, login, and admin cookies now carry the browser-enforced `__Host-` / `__Secure-` name prefixes when served over HTTPS. These prefixes bind a cookie to a secure, same-origin context — a browser only accepts a `__Host-` cookie that was set with `Secure`, `Path=/`, and no `Domain` attribute — which closes off cookie-injection and session-fixation paths from a related origin or a non-secure context. The secure-versus-plain decision follows the forwarded request protocol, so a deployment behind a TLS-terminating proxy (the production setup) gets the hardened prefixes while local development and tests over HTTP keep the bare names and keep working. Returning visitors are not signed out by the upgrade: the cookie reader resolves both the prefixed and the legacy name during the transition. **Security:** *`__Host-` on the session and login cookies* — Over HTTPS the storefront session and login cookies are issued as `__Host-shop_sid` and `__Host-shop_auth` with `Secure`, `Path=/`, and no `Domain` — the attribute set a browser requires before it will store a `__Host-` cookie, so the session cookie can no longer be planted or overwritten by a related origin or a non-secure context. · *`__Secure-` on the admin cookie* — The admin session cookie is scoped to `Path=/admin`, so it takes the `__Secure-` prefix (which requires `Secure`) rather than `__Host-` (which mandates `Path=/`). The edge cache-skip check and the audience bucketing were updated to recognize the prefixed names so a signed-in response is never served from the shared edge cache.
+
+- v0.2.24 (2026-05-29) — **Scope cart-line edits to your own cart, harden structured data, and redact auth errors.** A set of request-path hardening fixes. Cart line edit and remove are now scoped to your own session cart, so a cart-line id belonging to another shopper can no longer be used to change quantities on or delete their item — a mismatched id is a no-op, not a mutation. The product structured-data (JSON-LD) embedded in page heads now neutralizes every `</script` close-tag variant (with trailing space, slash, or newline), not just the exact `</script>`, closing a markup-injection path from admin-entered product fields. Account sign-in, registration, and passkey error responses now return a generic message plus a request id instead of the raw internal error string, with the full error logged server-side for the operator. And the worker DB/R2 bridge secret is checked at boot: a secret shorter than 32 characters logs a loud warning so a weak secret is visible in the boot log (the documented generator produces 43 characters, so a by-the-docs deploy stays quiet). **Security:** *Cart-line edits are scoped to your cart* — `POST /cart/lines/:id/update` and `/remove` now resolve the requester's session cart and scope the change to it (`WHERE id = ? AND cart_id = ?`), so a cart-line id from another shopper's cart can't be used to alter or delete their line — it resolves to a no-op rather than a cross-cart mutation. Legitimate edits to your own cart are unchanged. · *Structured-data close-tag escaping hardened* — JSON-LD embedded in page heads (edge and origin, byte-identical) now escapes every `</script` sequence the HTML parser treats as a tag-closer — including `</script `, `</script/`, and `</script` followed by a newline — not only the exact `</script>`. This removes a markup-injection vector from admin-entered product fields that flow into structured data. · *Account auth errors no longer leak internals* — The sign-in, registration, and passkey ceremony endpoints now return a generic message and a request id on an unexpected server error instead of the raw error string; the real error is logged server-side, correlated by that request id. Client-shape (400) and other expected responses are unchanged. · *Bridge-secret entropy warning at boot* — The worker DB/R2 bridge secret (`D1_BRIDGE_SECRET`) authorizes the database and object-storage bridge, so a weak value is high-impact. The container now logs a loud boot warning in production when it is shorter than 32 characters. The documented generator produces 43 characters; if you see the warning, regenerate the secret with the command it prints.
+
 - v0.2.23 (2026-05-29) — **Rate limiting and cross-site request isolation on the request lifecycle.** Two request-lifecycle defenses are now composed into every storefront and admin request. A per-client-IP rate limit backs the whole site (a generous global budget that a normal browsing and checkout session never trips) with tighter budgets on the abusable POST/auth endpoints — sign-in, passkey enrolment, checkout, gift-card balance lookup, account registration, newsletter, review/question submit, and survey response — so credential and passkey spraying, gift-card brute-forcing, and checkout flooding are shut down. Separately, a fetch-metadata gate refuses cross-site state-changing requests using the browser's Sec-Fetch headers, adding CSRF defense-in-depth on top of the SameSite session cookies. The client IP is read from the edge-forwarded header (the container sits behind the Worker), so limits apply per real visitor; the payment-webhook and health-probe paths are exempt. No change for normal use. **Added:** *Per-client rate limiting* — A generous global token-bucket limit per client IP backs the whole site, with tight fixed-window budgets on the abusable POST/auth endpoints (login, passkey register/add, checkout, gift-card balance, register, newsletter, review/question, survey). Keyed on the real client IP forwarded from the edge; payment-webhook and health-probe paths are exempt. The single-instance container uses an in-memory backend. · *Cross-site request isolation (fetch-metadata)* — Cross-site state-changing requests (the CSRF vector) are refused using the browser's Sec-Fetch-Site/Mode/Dest headers — same-origin requests and direct navigations pass; payment webhooks are exempt. This restores defense-in-depth alongside the SameSite session cookies.
 
 - v0.2.22 (2026-05-29) — **See your full order history, track shipments, reorder, and request returns.** The customer order surface is now complete end-to-end. A new order-history list shows every order (cursor-paginated), and each order page gains a status timeline, a carrier tracking panel (tracking number + the carrier's public tracking link), a one-click Reorder that rebuilds a cart from the order, and a Request-a-return button for eligible orders — the same Reorder/Return actions also appear per row on the account dashboard and the history list. On the operator side, the admin order screen gets a shipment panel to attach a carrier + tracking number and record shipment events, and the returns console's Refund now issues the payment-provider refund first (then records the RMA) whenever the order has a captured charge, so a return can't be marked refunded while the customer is left un-refunded; manual/guest orders with no charge fall back to an explicit record-only step. **Added:** *Order history + tracking + reorder + returns (customer)* — `/account/orders` lists all your orders with pagination; each order page shows a status timeline and carrier tracking, plus Reorder (`POST /orders/:id/reorder` rebuilds a cart from the order's lines at current prices) and Request-a-return for eligible orders. The dashboard and history rows carry the same actions. · *Shipment + tracking panel (admin)* — The admin order detail screen can attach a shipment (carrier + tracking number) and record shipment events; marking delivered advances the order's lifecycle. Tracking the order surfaces the carrier's public tracking link to the customer. **Changed:** *Return refunds move the money* — The returns console Refund action now issues the payment-provider refund first and records the RMA only on success when the order has a captured charge, so an approved return is never marked refunded without the customer actually being refunded. Orders with no captured charge use an explicit record-only step that points to the order.

package/lib/admin.js

@@ -183,6 +183,17 @@ function _authOk(token, expected) {
 // read/write) — scoped to /admin, SameSite=Strict, HttpOnly + Secure.
 var ADMIN_COOKIE_NAME = "shop_admin";
 
+// Cookie-prefix-hardened name. The admin session cookie is Path=/admin, so
+// it CANNOT carry `__Host-` (which mandates Path=/); the correct prefix is
+// `__Secure-`, which requires only the Secure attribute (RFC 6265bis
+// §4.1.3.1). As with the storefront session cookies, the prefix moves in
+// lockstep with Secure: a `__Secure-` cookie without Secure is invalid
+// (silently dropped), and Secure cookies don't store over plain http. So
+// https admin sessions carry `__Secure-shop_admin`; http dev/e2e sessions
+// carry the bare `shop_admin`. The validity check resolves the prefixed
+// name first and the bare name second.
+var ADMIN_COOKIE_NAME_SECURE = "__Secure-" + ADMIN_COOKIE_NAME;
+
 var _adminJarMemo = null;
 function _adminJar() {
   if (!_adminJarMemo) {
@@ -194,14 +205,33 @@ function _adminJar() {
   return _adminJarMemo;
 }
 
-function _setAdminCookie(res) {
-  _adminJar().writeSealed(res, ADMIN_COOKIE_NAME, JSON.stringify({
+// Whether THIS request's PUBLIC connection is https — drives both the
+// Secure attribute and the prefix choice for the admin session cookie.
+// Same rule as the storefront: trust the Worker-set `x-forwarded-proto`
+// (the container socket may be plain http behind the TLS-terminating
+// Worker), and treat a direct dev/e2e connection (no forwarded header,
+// non-encrypted socket) as http so the bare-named, non-Secure cookie is
+// emitted and a real browser stores it.
+function _secureForReq(req) {
+  return b.requestHelpers.requestProtocol(req, { trustProxy: true }) === "https";
+}
+function _adminCookieName(secure) { return secure ? ADMIN_COOKIE_NAME_SECURE : ADMIN_COOKIE_NAME; }
+
+function _setAdminCookie(req, res) {
+  var secure = _secureForReq(req);
+  _adminJar().writeSealed(res, _adminCookieName(secure), JSON.stringify({
     admin: true,
     exp:   Date.now() + b.constants.TIME.hours(12),
-  }), { expires: new Date(Date.now() + b.constants.TIME.hours(12)) });
+  }), { expires: new Date(Date.now() + b.constants.TIME.hours(12)), secure: secure });
 }
-function _clearAdminCookie(res) {
-  _adminJar().clear(res, ADMIN_COOKIE_NAME);
+function _clearAdminCookie(req, res) {
+  // Expire-now must match the live request's protocol so the cleared
+  // cookie's attributes satisfy the `__Secure-` invariant: over https
+  // clear the prefixed name with Secure; over http clear the bare name. A
+  // request never carries both at once (the write side emits one per
+  // protocol), so clearing the protocol-matched name signs the operator out.
+  var secure = _secureForReq(req);
+  _adminJar().clear(res, _adminCookieName(secure), { secure: secure });
 }
 
 // One-time gift-card code reveal. The issue POST stashes the freshly-issued
@@ -224,7 +254,10 @@ function _takeGiftCardReveal(req, res, id) {
   return (env && env.id === id && typeof env.code === "string") ? env.code : null;
 }
 function _adminCookieValid(req) {
-  var raw = _adminJar().readSealed(req, ADMIN_COOKIE_NAME);
+  // Resolve the prefixed name first and the bare name second so an admin
+  // session set in either environment (or mid-rollout) is recognised.
+  var raw = _adminJar().readSealed(req, ADMIN_COOKIE_NAME_SECURE);
+  if (raw === null) raw = _adminJar().readSealed(req, ADMIN_COOKIE_NAME);
   if (raw === null) return false;
   var env;
   try { env = JSON.parse(raw); } catch (_e) { return false; }
@@ -4048,7 +4081,7 @@ function mount(router, deps) {
     if (!_authOk(token, expectedToken)) {
       return _sendHtml(res, 401, renderAdminLogin({ shop_name: deps.shop_name, error: true }));
     }
-    try { _setAdminCookie(res); }
+    try { _setAdminCookie(req, res); }
     catch (e) {
       // Sealed cookies need an initialized vault — surface 503 rather
       // than 500 so the operator knows to configure VAULT_PASSPHRASE.
@@ -4060,8 +4093,8 @@ function mount(router, deps) {
     _redirect(res, (await _setupComplete()) ? "/admin" : "/admin/setup");
   });
 
-  router.post("/admin/logout", async function (_req, res) {
-    _clearAdminCookie(res);
+  router.post("/admin/logout", async function (req, res) {
+    _clearAdminCookie(req, res);
     _redirect(res, "/admin");
   });
 

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.2.23",
+  "version": "0.2.25",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/cart.js

@@ -184,28 +184,43 @@ function create(opts) {
       return { id: id, cart_id: cartId, variant_id: input.variant_id, sku: variantRow.sku, qty: input.qty, unit_amount_minor: unitAmount, unit_currency: unitCurrency, added_at: ts, updated_at: ts };
     },
 
-    updateLine: async function (lineId, patch) {
+    // Scope the mutation to (lineId, cartId): a caller who learns
+    // another visitor's cart_lines.id (it's rendered in their own cart
+    // HTML as the update/remove form action) can't mutate it because
+    // the row only matches when it also belongs to the caller's session
+    // cart. A cross-cart id matches zero rows and becomes a no-op
+    // (returns null), never a mutation. cartId is required — every
+    // caller resolves the session cart first.
+    updateLine: async function (lineId, cartId, patch) {
       _uuid(lineId, "line id");
+      _uuid(cartId, "cart_id");
       if (!patch || typeof patch !== "object") throw new TypeError("cart.updateLine: patch object required");
       if (patch.qty == null) throw new TypeError("cart.updateLine: qty is the only updatable field");
       _qty(patch.qty);
       var ts = _now();
       var r = await query(
-        "UPDATE cart_lines SET qty = ?1, updated_at = ?2 WHERE id = ?3",
-        [patch.qty, ts, lineId],
+        "UPDATE cart_lines SET qty = ?1, updated_at = ?2 WHERE id = ?3 AND cart_id = ?4",
+        [patch.qty, ts, lineId, cartId],
       );
       if (r.rowCount === 0) return null;
-      var row = (await query("SELECT * FROM cart_lines WHERE id = ?1", [lineId])).rows[0];
-      await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [ts, row.cart_id]);
+      var row = (await query("SELECT * FROM cart_lines WHERE id = ?1 AND cart_id = ?2", [lineId, cartId])).rows[0];
+      await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [ts, cartId]);
       return row;
     },
 
-    removeLine: async function (lineId) {
+    // Same cart-scoping as updateLine: a row only deletes when it
+    // belongs to the caller's session cart, so a cross-cart id is a
+    // no-op (returns false) rather than deleting another visitor's line.
+    removeLine: async function (lineId, cartId) {
       _uuid(lineId, "line id");
-      var row = (await query("SELECT cart_id FROM cart_lines WHERE id = ?1", [lineId])).rows[0];
+      _uuid(cartId, "cart_id");
+      var row = (await query(
+        "SELECT cart_id FROM cart_lines WHERE id = ?1 AND cart_id = ?2",
+        [lineId, cartId],
+      )).rows[0];
       if (!row) return false;
-      await query("DELETE FROM cart_lines WHERE id = ?1", [lineId]);
-      await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [_now(), row.cart_id]);
+      await query("DELETE FROM cart_lines WHERE id = ?1 AND cart_id = ?2", [lineId, cartId]);
+      await query("UPDATE carts SET updated_at = ?1 WHERE id = ?2", [_now(), cartId]);
       return true;
     },
 

package/lib/storefront.js

@@ -44,6 +44,35 @@ var b = require("./vendor/blamejs");
 // finds no store and falls back to the English baseline.
 var _localeAls = new AsyncLocalStorage();
 
+// Storefront error logger. Routes through the framework's structured
+// log sink (not console) so operators can redirect / quiet / structured-
+// log every emission point, and so the per-request id the createApp
+// requestId middleware allocates is auto-bound to each line. Used by the
+// 5xx auth-route handlers to record the real failure server-side while
+// the client only ever sees a generic message + the correlating id.
+var _log = b.log.create({});
+
+// Generic 500 for an auth/ceremony route: log the real error server-side
+// (correlated by the framework request id) and return a fixed message to
+// the client so no internal error string (stack frame, DB column, vault
+// internals) leaks. The request id — set by the createApp requestId
+// middleware on req.requestId and echoed in the X-Request-Id response
+// header — rides in the body so an operator can grep the logs for a
+// customer's failed ceremony. `where` names the route for the log line
+// only; it is not reflected to the client.
+function _authServerError(req, res, e, where) {
+  var rid = (req && req.requestId) || null;
+  _log.error("storefront auth route failed", {
+    route:      where,
+    request_id: rid,
+    err:        (e && e.message) || String(e),
+  });
+  res.status(500);
+  var ref = rid ? " (ref " + rid + ")" : "";
+  var msg = "Something went wrong. Please try again." + ref;
+  return res.end ? res.end(msg) : res.send(msg);
+}
+
 // Payment-webhook signatures (Stripe's HMAC, PayPal's, …) are computed over
 // the EXACT raw request bytes, but the global JSON body-parser reparses and
 // discards them. This middleware buffers the raw body for the given POST
@@ -3561,10 +3590,16 @@ function _buildCompare(productId) {
 }
 
 // Schema.org JSON-LD block. JSON.stringify covers the standard escapes;
-// the `</` → `<\/` rewrite neutralises any literal `</script>` in a
-// value. Mirrors the edge renderer's `jsonLdScript`.
+// the `</script` → `<\/script` rewrite neutralises any literal closing
+// tag in a value. The HTML tokenizer ends a <script> on `</script`
+// followed by whitespace, `/`, or `>`, so matching only the exact
+// `</script>` byte sequence misses `</script `, `</script\n`,
+// `</script/` — all of which still break out. Matching `</script`
+// (any trailing byte) closes every variant. Mirrors the edge
+// renderer's `jsonLdScript` byte-for-byte (this output is dual-rendered
+// edge + container; the render-parity tests gate on the two agreeing).
 function _jsonLdScript(data) {
-  var serialised = JSON.stringify(data).replace(/<\/(?=script>)/gi, "<\\/");
+  var serialised = JSON.stringify(data).replace(/<\/script/gi, "<\\/script");
   return "<script type=\"application/ld+json\">" + serialised + "</script>";
 }
 
@@ -4921,6 +4956,27 @@ var SESSION_COOKIE_NAME = "shop_sid";
 // initiated logout-everywhere).
 var AUTH_COOKIE_NAME    = "shop_auth";
 
+// Cookie-prefix-hardened names for the two Path=/ session cookies. The
+// `__Host-` prefix is a browser-enforced integrity marker (RFC 6265bis
+// §4.1.3.2): a `__Host-`-named cookie is only stored when it was set
+// Secure, Path=/, and with NO Domain — pinning it to the exact host over
+// HTTPS, immune to subdomain / related-domain cookie injection + session
+// fixation. Both cookies are already Path=/ with no Domain, so `__Host-`
+// is the correct (strongest) prefix.
+//
+// The prefix moves in lockstep with the Secure attribute: a `__Host-`
+// cookie is INVALID (silently dropped by the browser) without Secure, and
+// Secure cookies are silently dropped over plain http. Local dev + the
+// e2e harness run over http, so the cookie there must carry the BARE name
+// (Secure off) or it would never store and every session would break. The
+// public protocol — https in production where the Cloudflare Worker
+// terminates TLS and forwards `x-forwarded-proto: https` to the container
+// — drives the choice via `_secureForReq` below. Read sites resolve the
+// prefixed name first and fall back to the bare name, so a request in
+// either environment (or mid-rollout) still resolves its session.
+var SESSION_COOKIE_NAME_SECURE = "__Host-" + SESSION_COOKIE_NAME;
+var AUTH_COOKIE_NAME_SECURE    = "__Host-" + AUTH_COOKIE_NAME;
+
 // WebAuthn ceremony state cookie — short-lived envelope holding the
 // random challenge + the ceremony-scoped metadata so register-finish /
 // login-finish can verify the same challenge the browser was sent.
@@ -4978,6 +5034,41 @@ function _readCookie(req, name) {
   return _cookieJar().read(req, name);
 }
 
+// Whether THIS request's PUBLIC connection is https — the single source
+// of truth for both the Secure attribute and the cookie-prefix choice.
+// The container socket behind the Cloudflare Worker may be plain http even
+// when the visitor's connection is https, so the decision rides on the
+// forwarded protocol the Worker sets (`x-forwarded-proto`); `trustProxy`
+// opts that header in (the framework refuses the attacker-forgeable header
+// otherwise). Direct dev / e2e connections have no forwarded header and a
+// non-encrypted socket, so this returns false there and the bare-named,
+// non-Secure cookie is emitted (a real browser drops a Secure cookie over
+// http, so the bare name is what keeps dev/e2e sessions working).
+function _secureForReq(req) {
+  return b.requestHelpers.requestProtocol(req, { trustProxy: true }) === "https";
+}
+
+// Resolve the on-wire name for one of the prefix-hardened cookies. Secure
+// requests (https) carry the `__Host-`-prefixed name; non-Secure requests
+// (http dev/e2e) carry the bare name so the browser actually stores it.
+function _sidCookieName(secure)  { return secure ? SESSION_COOKIE_NAME_SECURE : SESSION_COOKIE_NAME; }
+function _authCookieName(secure) { return secure ? AUTH_COOKIE_NAME_SECURE    : AUTH_COOKIE_NAME; }
+
+// Read a prefix-hardened cookie value resolving the prefixed name first
+// and the bare name second, so a request resolves its session regardless
+// of which environment wrote the cookie (or a mid-rollout request that
+// still carries the old bare-named cookie). Returns the raw string or null.
+function _readPrefixedCookie(req, secureName, bareName) {
+  var v = _cookieJar().read(req, secureName);
+  if (v !== null && v !== undefined) return v;
+  return _cookieJar().read(req, bareName);
+}
+function _readPrefixedSealed(req, secureName, bareName) {
+  var v = _cookieJar().readSealed(req, secureName);
+  if (v !== null) return v;
+  return _cookieJar().readSealed(req, bareName);
+}
+
 function _readSidCookie(req) {
   // A cookie carrying anything but a well-shaped session id (a stale
   // value from an old deploy, a tampered cookie, garbage) reads as "no
@@ -4985,27 +5076,45 @@ function _readSidCookie(req) {
   // malformed id and would turn every page that renders the cart count
   // into a 500. The cookie grants zero authority, so dropping a
   // malformed one silently is safe.
-  var v = _cookieJar().read(req, SESSION_COOKIE_NAME);
+  var v = _readPrefixedCookie(req, SESSION_COOKIE_NAME_SECURE, SESSION_COOKIE_NAME);
   return v && SID_SHAPE_RE.test(v) ? v : null;
 }
 
-function _setSidCookie(res, sid) {
+function _setSidCookie(req, res, sid) {
   var T = b.constants.TIME;
-  _cookieJar().write(res, SESSION_COOKIE_NAME, sid, { expires: new Date(Date.now() + T.days(30)) });
+  var secure = _secureForReq(req);
+  // The jar defaults Path=/ and no Domain — exactly the `__Host-`
+  // invariant. The explicit `secure` here moves the Secure attribute and
+  // the prefixed name together: an https request gets `__Host-shop_sid`
+  // with Secure; an http dev/e2e request gets `shop_sid` without Secure.
+  _cookieJar().write(res, _sidCookieName(secure), sid, {
+    expires: new Date(Date.now() + T.days(30)),
+    secure:  secure,
+  });
 }
 
 // Auth + WebAuthn-challenge cookies carry a vault-sealed JSON envelope.
 // writeSealed/readSealed handle the seal + the on-wire prefix; the
 // caller works in plain objects.
-function _setAuthCookie(res, env) {
+function _setAuthCookie(req, res, env) {
   var T = b.constants.TIME;
-  _cookieJar().writeSealed(res, AUTH_COOKIE_NAME, JSON.stringify(env), { expires: new Date(Date.now() + T.days(14)) });
+  var secure = _secureForReq(req);
+  _cookieJar().writeSealed(res, _authCookieName(secure), JSON.stringify(env), {
+    expires: new Date(Date.now() + T.days(14)),
+    secure:  secure,
+  });
 }
-function _clearAuthCookie(res) {
-  _cookieJar().clear(res, AUTH_COOKIE_NAME);
+function _clearAuthCookie(req, res) {
+  // Expire-now must match the live request's protocol so the attributes
+  // satisfy the prefix invariant: over https clear the `__Host-` name with
+  // Secure+Path=/; over http clear the bare name. A request never carries
+  // both names at once (the write side emits exactly one per protocol), so
+  // clearing the protocol-matched name signs the visitor out.
+  var secure = _secureForReq(req);
+  _cookieJar().clear(res, _authCookieName(secure), { secure: secure });
 }
 function _readAuthEnv(req) {
-  var raw = _cookieJar().readSealed(req, AUTH_COOKIE_NAME);
+  var raw = _readPrefixedSealed(req, AUTH_COOKIE_NAME_SECURE, AUTH_COOKIE_NAME);
   if (raw === null) return null;
   try { return JSON.parse(raw); } catch (_e) { return null; }
 }
@@ -6209,7 +6318,10 @@ function mount(router, deps) {
     router.use(function announcementMiddleware(req, _res, next) {
       try {
         _refreshAnnouncementCache(deps.announcementBar);
-        var viewerKind = _cookieJar().read(req, AUTH_COOKIE_NAME) ? "logged_in" : "guest";
+        // Coarse logged-in/guest bucket from auth-cookie PRESENCE — resolve
+        // the prefixed (`__Host-`, https/production) and bare (http/dev)
+        // names so an https visitor isn't mis-bucketed as a guest.
+        var viewerKind = _readPrefixedCookie(req, AUTH_COOKIE_NAME_SECURE, AUTH_COOKIE_NAME) ? "logged_in" : "guest";
         var row = _resolveActiveAnnouncement(viewerKind);
         var cur = _localeAls.getStore() || {};
         _localeAls.enterWith(Object.assign({}, cur, { announcement: row }));
@@ -6514,7 +6626,7 @@ function mount(router, deps) {
     var sid = _readSidCookie(req);
     if (!sid) {
       sid = b.uuid.v7();
-      _setSidCookie(res, sid);
+      _setSidCookie(req, res, sid);
     }
     var existing = await deps.cart.bySession(sid);
     if (existing) return { sid: sid, cart: existing };
@@ -7063,7 +7175,7 @@ function mount(router, deps) {
       if (sid) return sid;
       if (!mint) return null;
       sid = b.uuid.v7();
-      _setSidCookie(res, sid);
+      _setSidCookie(req, res, sid);
       return sid;
     }
 
@@ -8067,8 +8179,11 @@ function mount(router, deps) {
         return res.end ? res.end(JSON.stringify(startOpts)) : res.send(JSON.stringify(startOpts));
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "register-begin failed") : res.send((e && e.message) || "register-begin failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "register-begin failed") : res.send((e && e.message) || "register-begin failed");
+        }
+        return _authServerError(req, res, e, "register-begin");
       }
     });
 
@@ -8105,7 +8220,7 @@ function mount(router, deps) {
           transports:    transports,
         });
         _clearChallengeCookie(res);
-        _setAuthCookie(res, {
+        _setAuthCookie(req, res, {
           customer_id: env.customer_id,
           exp:         Date.now() + b.constants.TIME.days(14),
         });
@@ -8125,8 +8240,11 @@ function mount(router, deps) {
         return res.end ? res.end("ok") : res.send("ok");
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "register-finish failed") : res.send((e && e.message) || "register-finish failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "register-finish failed") : res.send((e && e.message) || "register-finish failed");
+        }
+        return _authServerError(req, res, e, "register-finish");
       }
     });
 
@@ -8166,8 +8284,11 @@ function mount(router, deps) {
         return res.end ? res.end(JSON.stringify(startOpts)) : res.send(JSON.stringify(startOpts));
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "login-begin failed") : res.send((e && e.message) || "login-begin failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "login-begin failed") : res.send((e && e.message) || "login-begin failed");
+        }
+        return _authServerError(req, res, e, "login-begin");
       }
     });
 
@@ -8222,7 +8343,7 @@ function mount(router, deps) {
           } catch (_e) { /* best-effort merge; sign-in itself succeeds */ }
         }
         _clearChallengeCookie(res);
-        _setAuthCookie(res, {
+        _setAuthCookie(req, res, {
           customer_id: customer.id,
           exp:         Date.now() + b.constants.TIME.days(14),
         });
@@ -8230,8 +8351,11 @@ function mount(router, deps) {
         return res.end ? res.end("ok") : res.send("ok");
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "login-finish failed") : res.send((e && e.message) || "login-finish failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "login-finish failed") : res.send((e && e.message) || "login-finish failed");
+        }
+        return _authServerError(req, res, e, "login-finish");
       }
     });
 
@@ -8248,7 +8372,7 @@ function mount(router, deps) {
       }
       var customer = await deps.customers.get(auth.customer_id);
       if (!customer) {
-        _clearAuthCookie(res);
+        _clearAuthCookie(req, res);
         res.status(303); res.setHeader && res.setHeader("location", "/account/login");
         return res.end ? res.end() : res.send("");
       }
@@ -8348,8 +8472,8 @@ function mount(router, deps) {
       });
     }
 
-    router.post("/account/logout", function (_req, res) {
-      _clearAuthCookie(res);
+    router.post("/account/logout", function (req, res) {
+      _clearAuthCookie(req, res);
       res.status(303); res.setHeader && res.setHeader("location", "/");
       return res.end ? res.end() : res.send("");
     });
@@ -8507,8 +8631,11 @@ function mount(router, deps) {
         return res.end ? res.end(JSON.stringify(startOpts)) : res.send(JSON.stringify(startOpts));
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "add-begin failed") : res.send((e && e.message) || "add-begin failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "add-begin failed") : res.send((e && e.message) || "add-begin failed");
+        }
+        return _authServerError(req, res, e, "add-begin");
       }
     });
 
@@ -8560,8 +8687,11 @@ function mount(router, deps) {
         return res.end ? res.end("ok") : res.send("ok");
       } catch (e) {
         if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
-        res.status(e instanceof TypeError ? 400 : 500);
-        return res.end ? res.end((e && e.message) || "add-finish failed") : res.send((e && e.message) || "add-finish failed");
+        if (e instanceof TypeError) {
+          res.status(400);
+          return res.end ? res.end((e && e.message) || "add-finish failed") : res.send((e && e.message) || "add-finish failed");
+        }
+        return _authServerError(req, res, e, "add-finish");
       }
     });
 
@@ -8586,7 +8716,7 @@ function mount(router, deps) {
       var auth = _accountAuth(req, res); if (!auth) return;
       var customer = await deps.customers.get(auth.customer_id);
       if (!customer) {
-        _clearAuthCookie(res);
+        _clearAuthCookie(req, res);
         res.status(303); res.setHeader && res.setHeader("location", "/account/login");
         return res.end ? res.end() : res.send("");
       }
@@ -8597,7 +8727,7 @@ function mount(router, deps) {
       var auth = _accountAuth(req, res); if (!auth) return;
       var customer = await deps.customers.get(auth.customer_id);
       if (!customer) {
-        _clearAuthCookie(res);
+        _clearAuthCookie(req, res);
         res.status(303); res.setHeader && res.setHeader("location", "/account/login");
         return res.end ? res.end() : res.send("");
       }
@@ -8707,7 +8837,7 @@ function mount(router, deps) {
         } else {
           try { _clearReferralCookie(res); } catch (_e) { /* best-effort */ }
         }
-        _setAuthCookie(res, { customer_id: rv.customer.id, exp: Date.now() + b.constants.TIME.days(14) });
+        _setAuthCookie(req, res, { customer_id: rv.customer.id, exp: Date.now() + b.constants.TIME.days(14) });
         res.status(303); res.setHeader && res.setHeader("location", "/account");
         return res.end ? res.end() : res.send("");
       });
@@ -8820,7 +8950,7 @@ function mount(router, deps) {
         } else {
           try { _clearReferralCookie(res); } catch (_e) { /* best-effort */ }
         }
-        _setAuthCookie(res, { customer_id: rv.customer.id, exp: Date.now() + b.constants.TIME.days(14) });
+        _setAuthCookie(req, res, { customer_id: rv.customer.id, exp: Date.now() + b.constants.TIME.days(14) });
         res.status(303); res.setHeader && res.setHeader("location", "/account");
         return res.end ? res.end() : res.send("");
       });
@@ -10346,8 +10476,19 @@ function mount(router, deps) {
       res.status(400);
       return res.end ? res.end("Invalid request") : res.send("Invalid request");
     }
+    // Resolve the requester's own session cart and scope the mutation
+    // to it (same pattern as POST /cart/lines/:line_id/save). The line
+    // id is rendered in every visitor's own cart HTML, so without this
+    // a caller who learns another visitor's line id could change its
+    // qty. A line that isn't in the caller's cart returns null → 404.
+    var sid  = _readSidCookie(req);
+    var cart = sid ? await deps.cart.bySession(sid) : null;
+    if (!cart) {
+      res.status(404);
+      return res.end ? res.end("Line not found") : res.send("Line not found");
+    }
     try {
-      var updated = await deps.cart.updateLine(lineId, { qty: qty });
+      var updated = await deps.cart.updateLine(lineId, cart.id, { qty: qty });
       if (!updated) {
         res.status(404);
         return res.end ? res.end("Line not found") : res.send("Line not found");
@@ -10368,8 +10509,19 @@ function mount(router, deps) {
       res.status(400);
       return res.end ? res.end("Invalid request") : res.send("Invalid request");
     }
+    // Scope the delete to the requester's own session cart (same as the
+    // update route) so a known-but-foreign line id can't delete another
+    // visitor's line. No session cart → nothing of the caller's to
+    // remove; redirect to /cart as the no-op success path.
+    var sid  = _readSidCookie(req);
+    var cart = sid ? await deps.cart.bySession(sid) : null;
+    if (!cart) {
+      res.status(303);
+      res.setHeader && res.setHeader("location", "/cart");
+      return res.end ? res.end() : res.send("");
+    }
     try {
-      await deps.cart.removeLine(lineId);
+      await deps.cart.removeLine(lineId, cart.id);
     } catch (e) {
       res.status(e instanceof TypeError ? 400 : 500);
       return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
@@ -10471,7 +10623,7 @@ function mount(router, deps) {
     var sid = _readSidCookie(req);
     if (!sid) {
       sid = b.uuid.v7();
-      _setSidCookie(res, sid);
+      _setSidCookie(req, res, sid);
     }
     return sid;
   }

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.42",
-      "tag": "v0.13.42",
+      "version": "0.13.44",
+      "tag": "v0.13.44",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -13,7 +13,7 @@
         "server": "lib/vendor/blamejs/"
       },
       "bundler": "shallow git clone of release tag from github.com/blamejs/blamejs",
-      "bundledAt": "2026-05-29"
+      "bundledAt": "2026-05-30"
     }
   }
 }

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.44 (2026-05-29) — **Error codes on the consent, compliance, and protocol namespaces now follow the namespace/kebab-case contract.** The framework's error contract is `err.code = "namespace/kebab-case"`, and the vast majority of namespaces already followed it. This release normalizes the holdouts: fifteen namespaces that threw bare UPPER_SNAKE codes with no namespace, and nine that used a camelCase namespace prefix. After this release every error these namespaces throw carries a `namespace/kebab-case` code, so an operator switching on `err.code` no longer has to special-case them. This is a breaking change for code that matches the old strings — pre-1.0, there is no compatibility shim, so update any `err.code` comparisons against the listed namespaces. A codebase check now enforces the convention so it cannot regress. A small set of older codes (the cluster, scheduler, circuit-breaker, object-store, and upload subsystems) is intentionally left for the 1.0 release, where it will carry a deprecation cycle. **Changed:** *Bare UPPER_SNAKE error codes are now namespaced (breaking)* — Fifteen namespaces threw bare UPPER_SNAKE error codes with no namespace prefix (for example `mcp` threw `BAD_JSON`, `BAD_ENVELOPE`, `BAD_METHOD`). Their `err.code` values are now `namespace/kebab-case` — `mcp/bad-json`, `mcp/bad-envelope`, and so on. The affected namespaces are `b.a2a`, `b.aiInput`, `b.aiPref`, `b.budr`, `b.contentCredentials`, `b.darkPatterns`, `b.fapi2`, `b.fdx`, `b.graphqlFederation`, `b.iabTcf`, `b.iabMspa`, `b.mcp`, `b.secCyber`, `b.sse`, and `b.tcpa10dlc`. Operators matching the old bare codes on `err.code` must update those comparisons; the error message text is unchanged. · *camelCase error-code namespaces are now kebab-case (breaking)* — Nine namespaces emitted error codes whose namespace segment was camelCase (for example `aiDp/bad-bound`, `argParser/flag-duplicate`). The namespace segment is now kebab-case to match every other code: `ai-dp/`, `ai-capability/`, `ai-quota/`, `arg-parser/`, `audit-sign/`, `auth-step-up/`, `ddl-change-control/`, `dr-runbook/`, `tenant-quota/`, and `boot-gates/`. The `b.*` API namespace keys themselves are unchanged (those remain camelCase, e.g. `b.argParser`); only the `err.code` string changed. Operators matching these `err.code` strings must update them. **Detectors:** *Error-code shape is enforced* — A codebase check now flags any error code constructed via `new XError(...)` or the per-class `factory(...)` whose value is a bare UPPER_SNAKE string or carries a camelCase namespace segment, so the `namespace/kebab-case` contract cannot silently regress. It correctly ignores native error constructors (whose first argument is the message, not a code).
+
+- v0.13.43 (2026-05-29) — **LTS window stated consistently as 24 months, experimental primitives declared semver-exempt, and stale version references cleaned up.** Documentation and operator-facing string hygiene ahead of the 1.0 stability contract. The LTS support window is now stated as 24 months everywhere (GOVERNANCE.md and the LTS calendar previously disagreed — 24 vs 18). The LTS calendar gains an explicit clause that primitives marked experimental are exempt from the stability/LTS contract, so operators can tell at a glance which surfaces may change between minors. Several error messages and doc blocks that pinned to long-past version numbers ("lands in v0.10.9", "not supported in v0.12.7", "ships in v0.6.45+") are restated version-agnostically with their escape hatch, and the S/MIME module now points operators at the live PGP encrypt/decrypt path for confidentiality today. No API or behavior changes. **Changed:** *LTS support window is consistently 24 months* — `GOVERNANCE.md` promised a 24-month LTS window while `LTS-CALENDAR.md` and `SECURITY.md` stated 18 — a six-month contradiction in the single most load-bearing number of the support contract. All three now state 24 months of security-only patches per major. The calendar table and the supported-versions prose are aligned. · *Experimental primitives are declared exempt from the stability contract* — `LTS-CALENDAR.md` now states explicitly that primitives documented as experimental (shown as "experimental" on their wiki page, and via the `experimental` segment in namespaces like `b.jose.jwe.experimental`) are not covered by the stability contract or the LTS window — they may change signature, behavior, or wire format, or be removed, in any minor without a deprecation cycle. This lets the framework ship primitives that track in-flight standards without freezing an unsettled format, and tells operators precisely which surfaces are not yet frozen. **Fixed:** *Stale version references removed from operator-facing errors and docs* — Error messages and documentation that pinned to long-past versions are restated version-agnostically with the relevant escape hatch: ZIP64 and unsupported-compression errors in archive reading, the CMS AuthEnvelopedData / fielded-decoder notes, the mTLS CRL-engine error, the safe-archive format-detection summary (which also now correctly lists the supported zip / tar / tar.gz set rather than claiming only zip), and the AI-content IPTC-reader note. None changed behavior; they no longer read as broken promises against the published version history. · *S/MIME confidentiality deferral points to the working PGP path* — `b.mail.crypto.smime` ships sign + verify; encrypt/decrypt is deferred. The deferral note previously cited an open-ended internal condition; it now names the escape hatch directly — use `b.mail.crypto.pgp.encrypt` / `decrypt` for mail confidentiality today — and states the concrete trigger that would re-open S/MIME-specific (X.509-recipient) encryption. · *Governance doc no longer references an internal file operators cannot see* — `GOVERNANCE.md` cited a rule number in a contributor-only file that does not ship in the repository. The deprecation-policy statement is now self-contained.
+
 - v0.13.42 (2026-05-29) — **S/MIME trust-chain validation binds the leaf to the key that verified the signature.** When b.mail.crypto.smime.verify is given trust anchors, it validates the supplied certificate chain — but it picked the chain leaf unconditionally (the first cert) and never tied it to signerPublicKey, the key that actually verified the signature. A SignedData blob could therefore carry a validly-chained certificate for one identity while the signature was verified under an unrelated key, and the chain-validated result would imply a cert↔signer binding the code never made. Chain validation now selects the leaf as the certificate whose public key matches signerPublicKey, and refuses (signer-not-in-chain) when no certificate in the chain carries that key — so a chain-validated signature is bound to the cert it claims. **Security:** *Trust-chain leaf is bound to the verified signer key* — `smime.verify({ trustAnchorCertsPem })` validated the supplied chain starting from `chain[0]` without checking that the leaf's public key was the one that verified the signature (the operator-supplied `signerPublicKey`). A crafted `SignedData` could pair a validly-chained certificate for identity A with a signature verified under an unrelated key, and the chain-valid result would assert a binding that didn't hold. The chain walk now selects the leaf as the certificate whose public key equals `signerPublicKey` (matched against the certificate's SPKI, raw key or full-encoding form), and throws `mail-crypto/smime/signer-not-in-chain` when no certificate in `SignedData.certificates` carries that key. A certificate whose key cannot be extracted is treated as a non-match, so validation fails closed rather than trusting an unverifiable binding.
 
 - v0.13.41 (2026-05-29) — **Agent registry reads can be tenant-scoped; compliance-erasure docs clarify actor is an audit field.** The agent orchestrator's registry reads (list and lookup) gated only on the flat agent-registry:read scope, so any holder could enumerate every tenant's agents and resolve a handle to one — even though the event bus already scopes subscribe and delivery by tenant. The orchestrator now mirrors that: with the new tenantScope option enabled, list returns only the actor's own tenant's agents and lookup refuses a cross-tenant name, unless the actor holds the framework cross-tenant-admin scope. Off by default, so single-tenant deployments are unaffected. Separately, the subject-erasure docs now state explicitly that the recorded actor is an audit field, not authentication — the caller must be authorized upstream. **Added:** *Tenant-scoped agent registry reads (opts.tenantScope)* — `b.agent.orchestrator.create({ tenantScope: true })` now scopes `list` and `lookup` to the calling actor's tenant: `list` filters out agents in other tenants and `lookup` returns null for a cross-tenant name, unless the actor holds the cross-tenant-admin scope (`b.agent.tenant.CROSS_TENANT_ADMIN_SCOPE`). This closes a cross-tenant metadata-enumeration and handle-acquisition path — `agent-registry:read` alone no longer exposes other tenants' agents — and mirrors the tenant scoping the event bus enforces on subscribe and delivery. The option defaults off; existing single-tenant orchestrators behave exactly as before. The `tenantId` argument to `list` remains a convenience filter, distinct from this authorization boundary. **Changed:** *Subject-erasure docs clarify the actor is an audit field, not authentication* — `b.subject.erase` and `b.subject.eraseHard` gate the deletion on operator acknowledgements and the legal-hold registry, not on caller identity. Their documentation now states explicitly that the recorded `actor` is an audit-record field, not authentication — the caller MUST be authenticated and authorized by the route before invoking. No behavior change; this removes an implicit assumption that could otherwise be read as the primitive authorizing the call.