@blamejs/blamejs-shop 0.2.24 → 0.2.25

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.25 (2026-05-29) — **Harden session and admin cookies with __Host- / __Secure- name prefixes.** The session, login, and admin cookies now carry the browser-enforced `__Host-` / `__Secure-` name prefixes when served over HTTPS. These prefixes bind a cookie to a secure, same-origin context — a browser only accepts a `__Host-` cookie that was set with `Secure`, `Path=/`, and no `Domain` attribute — which closes off cookie-injection and session-fixation paths from a related origin or a non-secure context. The secure-versus-plain decision follows the forwarded request protocol, so a deployment behind a TLS-terminating proxy (the production setup) gets the hardened prefixes while local development and tests over HTTP keep the bare names and keep working. Returning visitors are not signed out by the upgrade: the cookie reader resolves both the prefixed and the legacy name during the transition. **Security:** *`__Host-` on the session and login cookies* — Over HTTPS the storefront session and login cookies are issued as `__Host-shop_sid` and `__Host-shop_auth` with `Secure`, `Path=/`, and no `Domain` — the attribute set a browser requires before it will store a `__Host-` cookie, so the session cookie can no longer be planted or overwritten by a related origin or a non-secure context. · *`__Secure-` on the admin cookie* — The admin session cookie is scoped to `Path=/admin`, so it takes the `__Secure-` prefix (which requires `Secure`) rather than `__Host-` (which mandates `Path=/`). The edge cache-skip check and the audience bucketing were updated to recognize the prefixed names so a signed-in response is never served from the shared edge cache.
+
 - v0.2.24 (2026-05-29) — **Scope cart-line edits to your own cart, harden structured data, and redact auth errors.** A set of request-path hardening fixes. Cart line edit and remove are now scoped to your own session cart, so a cart-line id belonging to another shopper can no longer be used to change quantities on or delete their item — a mismatched id is a no-op, not a mutation. The product structured-data (JSON-LD) embedded in page heads now neutralizes every `</script` close-tag variant (with trailing space, slash, or newline), not just the exact `</script>`, closing a markup-injection path from admin-entered product fields. Account sign-in, registration, and passkey error responses now return a generic message plus a request id instead of the raw internal error string, with the full error logged server-side for the operator. And the worker DB/R2 bridge secret is checked at boot: a secret shorter than 32 characters logs a loud warning so a weak secret is visible in the boot log (the documented generator produces 43 characters, so a by-the-docs deploy stays quiet). **Security:** *Cart-line edits are scoped to your cart* — `POST /cart/lines/:id/update` and `/remove` now resolve the requester's session cart and scope the change to it (`WHERE id = ? AND cart_id = ?`), so a cart-line id from another shopper's cart can't be used to alter or delete their line — it resolves to a no-op rather than a cross-cart mutation. Legitimate edits to your own cart are unchanged. · *Structured-data close-tag escaping hardened* — JSON-LD embedded in page heads (edge and origin, byte-identical) now escapes every `</script` sequence the HTML parser treats as a tag-closer — including `</script `, `</script/`, and `</script` followed by a newline — not only the exact `</script>`. This removes a markup-injection vector from admin-entered product fields that flow into structured data. · *Account auth errors no longer leak internals* — The sign-in, registration, and passkey ceremony endpoints now return a generic message and a request id on an unexpected server error instead of the raw error string; the real error is logged server-side, correlated by that request id. Client-shape (400) and other expected responses are unchanged. · *Bridge-secret entropy warning at boot* — The worker DB/R2 bridge secret (`D1_BRIDGE_SECRET`) authorizes the database and object-storage bridge, so a weak value is high-impact. The container now logs a loud boot warning in production when it is shorter than 32 characters. The documented generator produces 43 characters; if you see the warning, regenerate the secret with the command it prints.
 
 - v0.2.23 (2026-05-29) — **Rate limiting and cross-site request isolation on the request lifecycle.** Two request-lifecycle defenses are now composed into every storefront and admin request. A per-client-IP rate limit backs the whole site (a generous global budget that a normal browsing and checkout session never trips) with tighter budgets on the abusable POST/auth endpoints — sign-in, passkey enrolment, checkout, gift-card balance lookup, account registration, newsletter, review/question submit, and survey response — so credential and passkey spraying, gift-card brute-forcing, and checkout flooding are shut down. Separately, a fetch-metadata gate refuses cross-site state-changing requests using the browser's Sec-Fetch headers, adding CSRF defense-in-depth on top of the SameSite session cookies. The client IP is read from the edge-forwarded header (the container sits behind the Worker), so limits apply per real visitor; the payment-webhook and health-probe paths are exempt. No change for normal use. **Added:** *Per-client rate limiting* — A generous global token-bucket limit per client IP backs the whole site, with tight fixed-window budgets on the abusable POST/auth endpoints (login, passkey register/add, checkout, gift-card balance, register, newsletter, review/question, survey). Keyed on the real client IP forwarded from the edge; payment-webhook and health-probe paths are exempt. The single-instance container uses an in-memory backend. · *Cross-site request isolation (fetch-metadata)* — Cross-site state-changing requests (the CSRF vector) are refused using the browser's Sec-Fetch-Site/Mode/Dest headers — same-origin requests and direct navigations pass; payment webhooks are exempt. This restores defense-in-depth alongside the SameSite session cookies.

package/lib/admin.js

@@ -183,6 +183,17 @@ function _authOk(token, expected) {
 // read/write) — scoped to /admin, SameSite=Strict, HttpOnly + Secure.
 var ADMIN_COOKIE_NAME = "shop_admin";
 
+// Cookie-prefix-hardened name. The admin session cookie is Path=/admin, so
+// it CANNOT carry `__Host-` (which mandates Path=/); the correct prefix is
+// `__Secure-`, which requires only the Secure attribute (RFC 6265bis
+// §4.1.3.1). As with the storefront session cookies, the prefix moves in
+// lockstep with Secure: a `__Secure-` cookie without Secure is invalid
+// (silently dropped), and Secure cookies don't store over plain http. So
+// https admin sessions carry `__Secure-shop_admin`; http dev/e2e sessions
+// carry the bare `shop_admin`. The validity check resolves the prefixed
+// name first and the bare name second.
+var ADMIN_COOKIE_NAME_SECURE = "__Secure-" + ADMIN_COOKIE_NAME;
+
 var _adminJarMemo = null;
 function _adminJar() {
   if (!_adminJarMemo) {
@@ -194,14 +205,33 @@ function _adminJar() {
   return _adminJarMemo;
 }
 
-function _setAdminCookie(res) {
-  _adminJar().writeSealed(res, ADMIN_COOKIE_NAME, JSON.stringify({
+// Whether THIS request's PUBLIC connection is https — drives both the
+// Secure attribute and the prefix choice for the admin session cookie.
+// Same rule as the storefront: trust the Worker-set `x-forwarded-proto`
+// (the container socket may be plain http behind the TLS-terminating
+// Worker), and treat a direct dev/e2e connection (no forwarded header,
+// non-encrypted socket) as http so the bare-named, non-Secure cookie is
+// emitted and a real browser stores it.
+function _secureForReq(req) {
+  return b.requestHelpers.requestProtocol(req, { trustProxy: true }) === "https";
+}
+function _adminCookieName(secure) { return secure ? ADMIN_COOKIE_NAME_SECURE : ADMIN_COOKIE_NAME; }
+
+function _setAdminCookie(req, res) {
+  var secure = _secureForReq(req);
+  _adminJar().writeSealed(res, _adminCookieName(secure), JSON.stringify({
     admin: true,
     exp:   Date.now() + b.constants.TIME.hours(12),
-  }), { expires: new Date(Date.now() + b.constants.TIME.hours(12)) });
+  }), { expires: new Date(Date.now() + b.constants.TIME.hours(12)), secure: secure });
 }
-function _clearAdminCookie(res) {
-  _adminJar().clear(res, ADMIN_COOKIE_NAME);
+function _clearAdminCookie(req, res) {
+  // Expire-now must match the live request's protocol so the cleared
+  // cookie's attributes satisfy the `__Secure-` invariant: over https
+  // clear the prefixed name with Secure; over http clear the bare name. A
+  // request never carries both at once (the write side emits one per
+  // protocol), so clearing the protocol-matched name signs the operator out.
+  var secure = _secureForReq(req);
+  _adminJar().clear(res, _adminCookieName(secure), { secure: secure });
 }
 
 // One-time gift-card code reveal. The issue POST stashes the freshly-issued
@@ -224,7 +254,10 @@ function _takeGiftCardReveal(req, res, id) {
   return (env && env.id === id && typeof env.code === "string") ? env.code : null;
 }
 function _adminCookieValid(req) {
-  var raw = _adminJar().readSealed(req, ADMIN_COOKIE_NAME);
+  // Resolve the prefixed name first and the bare name second so an admin
+  // session set in either environment (or mid-rollout) is recognised.
+  var raw = _adminJar().readSealed(req, ADMIN_COOKIE_NAME_SECURE);
+  if (raw === null) raw = _adminJar().readSealed(req, ADMIN_COOKIE_NAME);
   if (raw === null) return false;
   var env;
   try { env = JSON.parse(raw); } catch (_e) { return false; }
@@ -4048,7 +4081,7 @@ function mount(router, deps) {
     if (!_authOk(token, expectedToken)) {
       return _sendHtml(res, 401, renderAdminLogin({ shop_name: deps.shop_name, error: true }));
     }
-    try { _setAdminCookie(res); }
+    try { _setAdminCookie(req, res); }
     catch (e) {
       // Sealed cookies need an initialized vault — surface 503 rather
       // than 500 so the operator knows to configure VAULT_PASSPHRASE.
@@ -4060,8 +4093,8 @@ function mount(router, deps) {
     _redirect(res, (await _setupComplete()) ? "/admin" : "/admin/setup");
   });
 
-  router.post("/admin/logout", async function (_req, res) {
-    _clearAdminCookie(res);
+  router.post("/admin/logout", async function (req, res) {
+    _clearAdminCookie(req, res);
     _redirect(res, "/admin");
   });
 

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.2.24",
+  "version": "0.2.25",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/storefront.js

@@ -4956,6 +4956,27 @@ var SESSION_COOKIE_NAME = "shop_sid";
 // initiated logout-everywhere).
 var AUTH_COOKIE_NAME    = "shop_auth";
 
+// Cookie-prefix-hardened names for the two Path=/ session cookies. The
+// `__Host-` prefix is a browser-enforced integrity marker (RFC 6265bis
+// §4.1.3.2): a `__Host-`-named cookie is only stored when it was set
+// Secure, Path=/, and with NO Domain — pinning it to the exact host over
+// HTTPS, immune to subdomain / related-domain cookie injection + session
+// fixation. Both cookies are already Path=/ with no Domain, so `__Host-`
+// is the correct (strongest) prefix.
+//
+// The prefix moves in lockstep with the Secure attribute: a `__Host-`
+// cookie is INVALID (silently dropped by the browser) without Secure, and
+// Secure cookies are silently dropped over plain http. Local dev + the
+// e2e harness run over http, so the cookie there must carry the BARE name
+// (Secure off) or it would never store and every session would break. The
+// public protocol — https in production where the Cloudflare Worker
+// terminates TLS and forwards `x-forwarded-proto: https` to the container
+// — drives the choice via `_secureForReq` below. Read sites resolve the
+// prefixed name first and fall back to the bare name, so a request in
+// either environment (or mid-rollout) still resolves its session.
+var SESSION_COOKIE_NAME_SECURE = "__Host-" + SESSION_COOKIE_NAME;
+var AUTH_COOKIE_NAME_SECURE    = "__Host-" + AUTH_COOKIE_NAME;
+
 // WebAuthn ceremony state cookie — short-lived envelope holding the
 // random challenge + the ceremony-scoped metadata so register-finish /
 // login-finish can verify the same challenge the browser was sent.
@@ -5013,6 +5034,41 @@ function _readCookie(req, name) {
   return _cookieJar().read(req, name);
 }
 
+// Whether THIS request's PUBLIC connection is https — the single source
+// of truth for both the Secure attribute and the cookie-prefix choice.
+// The container socket behind the Cloudflare Worker may be plain http even
+// when the visitor's connection is https, so the decision rides on the
+// forwarded protocol the Worker sets (`x-forwarded-proto`); `trustProxy`
+// opts that header in (the framework refuses the attacker-forgeable header
+// otherwise). Direct dev / e2e connections have no forwarded header and a
+// non-encrypted socket, so this returns false there and the bare-named,
+// non-Secure cookie is emitted (a real browser drops a Secure cookie over
+// http, so the bare name is what keeps dev/e2e sessions working).
+function _secureForReq(req) {
+  return b.requestHelpers.requestProtocol(req, { trustProxy: true }) === "https";
+}
+
+// Resolve the on-wire name for one of the prefix-hardened cookies. Secure
+// requests (https) carry the `__Host-`-prefixed name; non-Secure requests
+// (http dev/e2e) carry the bare name so the browser actually stores it.
+function _sidCookieName(secure)  { return secure ? SESSION_COOKIE_NAME_SECURE : SESSION_COOKIE_NAME; }
+function _authCookieName(secure) { return secure ? AUTH_COOKIE_NAME_SECURE    : AUTH_COOKIE_NAME; }
+
+// Read a prefix-hardened cookie value resolving the prefixed name first
+// and the bare name second, so a request resolves its session regardless
+// of which environment wrote the cookie (or a mid-rollout request that
+// still carries the old bare-named cookie). Returns the raw string or null.
+function _readPrefixedCookie(req, secureName, bareName) {
+  var v = _cookieJar().read(req, secureName);
+  if (v !== null && v !== undefined) return v;
+  return _cookieJar().read(req, bareName);
+}
+function _readPrefixedSealed(req, secureName, bareName) {
+  var v = _cookieJar().readSealed(req, secureName);
+  if (v !== null) return v;
+  return _cookieJar().readSealed(req, bareName);
+}
+
 function _readSidCookie(req) {
   // A cookie carrying anything but a well-shaped session id (a stale
   // value from an old deploy, a tampered cookie, garbage) reads as "no
@@ -5020,27 +5076,45 @@ function _readSidCookie(req) {
   // malformed id and would turn every page that renders the cart count
   // into a 500. The cookie grants zero authority, so dropping a
   // malformed one silently is safe.
-  var v = _cookieJar().read(req, SESSION_COOKIE_NAME);
+  var v = _readPrefixedCookie(req, SESSION_COOKIE_NAME_SECURE, SESSION_COOKIE_NAME);
   return v && SID_SHAPE_RE.test(v) ? v : null;
 }
 
-function _setSidCookie(res, sid) {
+function _setSidCookie(req, res, sid) {
   var T = b.constants.TIME;
-  _cookieJar().write(res, SESSION_COOKIE_NAME, sid, { expires: new Date(Date.now() + T.days(30)) });
+  var secure = _secureForReq(req);
+  // The jar defaults Path=/ and no Domain — exactly the `__Host-`
+  // invariant. The explicit `secure` here moves the Secure attribute and
+  // the prefixed name together: an https request gets `__Host-shop_sid`
+  // with Secure; an http dev/e2e request gets `shop_sid` without Secure.
+  _cookieJar().write(res, _sidCookieName(secure), sid, {
+    expires: new Date(Date.now() + T.days(30)),
+    secure:  secure,
+  });
 }
 
 // Auth + WebAuthn-challenge cookies carry a vault-sealed JSON envelope.
 // writeSealed/readSealed handle the seal + the on-wire prefix; the
 // caller works in plain objects.
-function _setAuthCookie(res, env) {
+function _setAuthCookie(req, res, env) {
   var T = b.constants.TIME;
-  _cookieJar().writeSealed(res, AUTH_COOKIE_NAME, JSON.stringify(env), { expires: new Date(Date.now() + T.days(14)) });
+  var secure = _secureForReq(req);
+  _cookieJar().writeSealed(res, _authCookieName(secure), JSON.stringify(env), {
+    expires: new Date(Date.now() + T.days(14)),
+    secure:  secure,
+  });
 }
-function _clearAuthCookie(res) {
-  _cookieJar().clear(res, AUTH_COOKIE_NAME);
+function _clearAuthCookie(req, res) {
+  // Expire-now must match the live request's protocol so the attributes
+  // satisfy the prefix invariant: over https clear the `__Host-` name with
+  // Secure+Path=/; over http clear the bare name. A request never carries
+  // both names at once (the write side emits exactly one per protocol), so
+  // clearing the protocol-matched name signs the visitor out.
+  var secure = _secureForReq(req);
+  _cookieJar().clear(res, _authCookieName(secure), { secure: secure });
 }
 function _readAuthEnv(req) {
-  var raw = _cookieJar().readSealed(req, AUTH_COOKIE_NAME);
+  var raw = _readPrefixedSealed(req, AUTH_COOKIE_NAME_SECURE, AUTH_COOKIE_NAME);
   if (raw === null) return null;
   try { return JSON.parse(raw); } catch (_e) { return null; }
 }
@@ -6244,7 +6318,10 @@ function mount(router, deps) {
     router.use(function announcementMiddleware(req, _res, next) {
       try {
         _refreshAnnouncementCache(deps.announcementBar);
-        var viewerKind = _cookieJar().read(req, AUTH_COOKIE_NAME) ? "logged_in" : "guest";
+        // Coarse logged-in/guest bucket from auth-cookie PRESENCE — resolve
+        // the prefixed (`__Host-`, https/production) and bare (http/dev)
+        // names so an https visitor isn't mis-bucketed as a guest.
+        var viewerKind = _readPrefixedCookie(req, AUTH_COOKIE_NAME_SECURE, AUTH_COOKIE_NAME) ? "logged_in" : "guest";
         var row = _resolveActiveAnnouncement(viewerKind);
         var cur = _localeAls.getStore() || {};
         _localeAls.enterWith(Object.assign({}, cur, { announcement: row }));
@@ -6549,7 +6626,7 @@ function mount(router, deps) {
     var sid = _readSidCookie(req);
     if (!sid) {
       sid = b.uuid.v7();
-      _setSidCookie(res, sid);
+      _setSidCookie(req, res, sid);
     }
     var existing = await deps.cart.bySession(sid);
     if (existing) return { sid: sid, cart: existing };
@@ -7098,7 +7175,7 @@ function mount(router, deps) {
       if (sid) return sid;
       if (!mint) return null;
       sid = b.uuid.v7();
-      _setSidCookie(res, sid);
+      _setSidCookie(req, res, sid);
       return sid;
     }
 
@@ -8143,7 +8220,7 @@ function mount(router, deps) {
           transports:    transports,
         });
         _clearChallengeCookie(res);
-        _setAuthCookie(res, {
+        _setAuthCookie(req, res, {
           customer_id: env.customer_id,
           exp:         Date.now() + b.constants.TIME.days(14),
         });
@@ -8266,7 +8343,7 @@ function mount(router, deps) {
           } catch (_e) { /* best-effort merge; sign-in itself succeeds */ }
         }
         _clearChallengeCookie(res);
-        _setAuthCookie(res, {
+        _setAuthCookie(req, res, {
           customer_id: customer.id,
           exp:         Date.now() + b.constants.TIME.days(14),
         });
@@ -8295,7 +8372,7 @@ function mount(router, deps) {
       }
       var customer = await deps.customers.get(auth.customer_id);
       if (!customer) {
-        _clearAuthCookie(res);
+        _clearAuthCookie(req, res);
         res.status(303); res.setHeader && res.setHeader("location", "/account/login");
         return res.end ? res.end() : res.send("");
       }
@@ -8395,8 +8472,8 @@ function mount(router, deps) {
       });
     }
 
-    router.post("/account/logout", function (_req, res) {
-      _clearAuthCookie(res);
+    router.post("/account/logout", function (req, res) {
+      _clearAuthCookie(req, res);
       res.status(303); res.setHeader && res.setHeader("location", "/");
       return res.end ? res.end() : res.send("");
     });
@@ -8639,7 +8716,7 @@ function mount(router, deps) {
       var auth = _accountAuth(req, res); if (!auth) return;
       var customer = await deps.customers.get(auth.customer_id);
       if (!customer) {
-        _clearAuthCookie(res);
+        _clearAuthCookie(req, res);
         res.status(303); res.setHeader && res.setHeader("location", "/account/login");
         return res.end ? res.end() : res.send("");
       }
@@ -8650,7 +8727,7 @@ function mount(router, deps) {
       var auth = _accountAuth(req, res); if (!auth) return;
       var customer = await deps.customers.get(auth.customer_id);
       if (!customer) {
-        _clearAuthCookie(res);
+        _clearAuthCookie(req, res);
         res.status(303); res.setHeader && res.setHeader("location", "/account/login");
         return res.end ? res.end() : res.send("");
       }
@@ -8760,7 +8837,7 @@ function mount(router, deps) {
         } else {
           try { _clearReferralCookie(res); } catch (_e) { /* best-effort */ }
         }
-        _setAuthCookie(res, { customer_id: rv.customer.id, exp: Date.now() + b.constants.TIME.days(14) });
+        _setAuthCookie(req, res, { customer_id: rv.customer.id, exp: Date.now() + b.constants.TIME.days(14) });
         res.status(303); res.setHeader && res.setHeader("location", "/account");
         return res.end ? res.end() : res.send("");
       });
@@ -8873,7 +8950,7 @@ function mount(router, deps) {
         } else {
           try { _clearReferralCookie(res); } catch (_e) { /* best-effort */ }
         }
-        _setAuthCookie(res, { customer_id: rv.customer.id, exp: Date.now() + b.constants.TIME.days(14) });
+        _setAuthCookie(req, res, { customer_id: rv.customer.id, exp: Date.now() + b.constants.TIME.days(14) });
         res.status(303); res.setHeader && res.setHeader("location", "/account");
         return res.end ? res.end() : res.send("");
       });
@@ -10546,7 +10623,7 @@ function mount(router, deps) {
     var sid = _readSidCookie(req);
     if (!sid) {
       sid = b.uuid.v7();
-      _setSidCookie(res, sid);
+      _setSidCookie(req, res, sid);
     }
     return sid;
   }

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.43",
-      "tag": "v0.13.43",
+      "version": "0.13.44",
+      "tag": "v0.13.44",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.44 (2026-05-29) — **Error codes on the consent, compliance, and protocol namespaces now follow the namespace/kebab-case contract.** The framework's error contract is `err.code = "namespace/kebab-case"`, and the vast majority of namespaces already followed it. This release normalizes the holdouts: fifteen namespaces that threw bare UPPER_SNAKE codes with no namespace, and nine that used a camelCase namespace prefix. After this release every error these namespaces throw carries a `namespace/kebab-case` code, so an operator switching on `err.code` no longer has to special-case them. This is a breaking change for code that matches the old strings — pre-1.0, there is no compatibility shim, so update any `err.code` comparisons against the listed namespaces. A codebase check now enforces the convention so it cannot regress. A small set of older codes (the cluster, scheduler, circuit-breaker, object-store, and upload subsystems) is intentionally left for the 1.0 release, where it will carry a deprecation cycle. **Changed:** *Bare UPPER_SNAKE error codes are now namespaced (breaking)* — Fifteen namespaces threw bare UPPER_SNAKE error codes with no namespace prefix (for example `mcp` threw `BAD_JSON`, `BAD_ENVELOPE`, `BAD_METHOD`). Their `err.code` values are now `namespace/kebab-case` — `mcp/bad-json`, `mcp/bad-envelope`, and so on. The affected namespaces are `b.a2a`, `b.aiInput`, `b.aiPref`, `b.budr`, `b.contentCredentials`, `b.darkPatterns`, `b.fapi2`, `b.fdx`, `b.graphqlFederation`, `b.iabTcf`, `b.iabMspa`, `b.mcp`, `b.secCyber`, `b.sse`, and `b.tcpa10dlc`. Operators matching the old bare codes on `err.code` must update those comparisons; the error message text is unchanged. · *camelCase error-code namespaces are now kebab-case (breaking)* — Nine namespaces emitted error codes whose namespace segment was camelCase (for example `aiDp/bad-bound`, `argParser/flag-duplicate`). The namespace segment is now kebab-case to match every other code: `ai-dp/`, `ai-capability/`, `ai-quota/`, `arg-parser/`, `audit-sign/`, `auth-step-up/`, `ddl-change-control/`, `dr-runbook/`, `tenant-quota/`, and `boot-gates/`. The `b.*` API namespace keys themselves are unchanged (those remain camelCase, e.g. `b.argParser`); only the `err.code` string changed. Operators matching these `err.code` strings must update them. **Detectors:** *Error-code shape is enforced* — A codebase check now flags any error code constructed via `new XError(...)` or the per-class `factory(...)` whose value is a bare UPPER_SNAKE string or carries a camelCase namespace segment, so the `namespace/kebab-case` contract cannot silently regress. It correctly ignores native error constructors (whose first argument is the message, not a code).
+
 - v0.13.43 (2026-05-29) — **LTS window stated consistently as 24 months, experimental primitives declared semver-exempt, and stale version references cleaned up.** Documentation and operator-facing string hygiene ahead of the 1.0 stability contract. The LTS support window is now stated as 24 months everywhere (GOVERNANCE.md and the LTS calendar previously disagreed — 24 vs 18). The LTS calendar gains an explicit clause that primitives marked experimental are exempt from the stability/LTS contract, so operators can tell at a glance which surfaces may change between minors. Several error messages and doc blocks that pinned to long-past version numbers ("lands in v0.10.9", "not supported in v0.12.7", "ships in v0.6.45+") are restated version-agnostically with their escape hatch, and the S/MIME module now points operators at the live PGP encrypt/decrypt path for confidentiality today. No API or behavior changes. **Changed:** *LTS support window is consistently 24 months* — `GOVERNANCE.md` promised a 24-month LTS window while `LTS-CALENDAR.md` and `SECURITY.md` stated 18 — a six-month contradiction in the single most load-bearing number of the support contract. All three now state 24 months of security-only patches per major. The calendar table and the supported-versions prose are aligned. · *Experimental primitives are declared exempt from the stability contract* — `LTS-CALENDAR.md` now states explicitly that primitives documented as experimental (shown as "experimental" on their wiki page, and via the `experimental` segment in namespaces like `b.jose.jwe.experimental`) are not covered by the stability contract or the LTS window — they may change signature, behavior, or wire format, or be removed, in any minor without a deprecation cycle. This lets the framework ship primitives that track in-flight standards without freezing an unsettled format, and tells operators precisely which surfaces are not yet frozen. **Fixed:** *Stale version references removed from operator-facing errors and docs* — Error messages and documentation that pinned to long-past versions are restated version-agnostically with the relevant escape hatch: ZIP64 and unsupported-compression errors in archive reading, the CMS AuthEnvelopedData / fielded-decoder notes, the mTLS CRL-engine error, the safe-archive format-detection summary (which also now correctly lists the supported zip / tar / tar.gz set rather than claiming only zip), and the AI-content IPTC-reader note. None changed behavior; they no longer read as broken promises against the published version history. · *S/MIME confidentiality deferral points to the working PGP path* — `b.mail.crypto.smime` ships sign + verify; encrypt/decrypt is deferred. The deferral note previously cited an open-ended internal condition; it now names the escape hatch directly — use `b.mail.crypto.pgp.encrypt` / `decrypt` for mail confidentiality today — and states the concrete trigger that would re-open S/MIME-specific (X.509-recipient) encryption. · *Governance doc no longer references an internal file operators cannot see* — `GOVERNANCE.md` cited a rule number in a contributor-only file that does not ship in the repository. The deprecation-policy statement is now self-contained.
 
 - v0.13.42 (2026-05-29) — **S/MIME trust-chain validation binds the leaf to the key that verified the signature.** When b.mail.crypto.smime.verify is given trust anchors, it validates the supplied certificate chain — but it picked the chain leaf unconditionally (the first cert) and never tied it to signerPublicKey, the key that actually verified the signature. A SignedData blob could therefore carry a validly-chained certificate for one identity while the signature was verified under an unrelated key, and the chain-validated result would imply a cert↔signer binding the code never made. Chain validation now selects the leaf as the certificate whose public key matches signerPublicKey, and refuses (signer-not-in-chain) when no certificate in the chain carries that key — so a chain-validated signature is bound to the cert it claims. **Security:** *Trust-chain leaf is bound to the verified signer key* — `smime.verify({ trustAnchorCertsPem })` validated the supplied chain starting from `chain[0]` without checking that the leaf's public key was the one that verified the signature (the operator-supplied `signerPublicKey`). A crafted `SignedData` could pair a validly-chained certificate for identity A with a signature verified under an unrelated key, and the chain-valid result would assert a binding that didn't hold. The chain walk now selects the leaf as the certificate whose public key equals `signerPublicKey` (matched against the certificate's SPKI, raw key or full-encoding form), and throws `mail-crypto/smime/signer-not-in-chain` when no certificate in `SignedData.certificates` carries that key. A certificate whose key cannot be extracted is treated as a non-match, so validation fails closed rather than trusting an unverifiable binding.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.43",
-  "createdAt": "2026-05-29T22:10:35.036Z",
+  "frameworkVersion": "0.13.44",
+  "createdAt": "2026-05-30T00:31:59.364Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/a2a.js

@@ -48,52 +48,52 @@ var SEMVER_RE = /^[0-9]+\.[0-9]+(?:\.[0-9]+)?(?:-[A-Za-z0-9.-]+)?$/;
 
 function _validateCardShape(card, errorClass) {
   if (!card || typeof card !== "object" || Array.isArray(card)) {
-    throw errorClass.factory("BAD_CARD",
+    throw errorClass.factory("a2a/bad-card",
       "a2a: card must be an object");
   }
   for (var i = 0; i < REQUIRED_CARD_FIELDS.length; i += 1) {
     var f = REQUIRED_CARD_FIELDS[i];
     if (typeof card[f] === "undefined" || card[f] === null) {
-      throw errorClass.factory("MISSING_FIELD",
+      throw errorClass.factory("a2a/missing-field",
         "a2a: card." + f + " is required");
     }
   }
   if (typeof card.issuer !== "string" || card.issuer.length > ID_MAX || !ID_RE.test(card.issuer)) {
-    throw errorClass.factory("BAD_FIELD",
+    throw errorClass.factory("a2a/bad-field",
       "a2a: card.issuer shape (must match " + ID_RE + ")");
   }
   if (typeof card.agentId !== "string" || card.agentId.length > ID_MAX || !ID_RE.test(card.agentId)) {
-    throw errorClass.factory("BAD_FIELD",
+    throw errorClass.factory("a2a/bad-field",
       "a2a: card.agentId shape");
   }
   if (typeof card.version !== "string" || card.version.length > SEMVER_MAX || !SEMVER_RE.test(card.version)) {
-    throw errorClass.factory("BAD_FIELD",
+    throw errorClass.factory("a2a/bad-field",
       "a2a: card.version must be semver");
   }
   if (!Array.isArray(card.capabilities)) {
-    throw errorClass.factory("BAD_FIELD",
+    throw errorClass.factory("a2a/bad-field",
       "a2a: card.capabilities must be an array");
   }
   for (var c = 0; c < card.capabilities.length; c += 1) {
     var cap = card.capabilities[c];
     if (typeof cap !== "string" || cap.length === 0 || cap.length > CAP_NAME_MAX) {
-      throw errorClass.factory("BAD_FIELD",
+      throw errorClass.factory("a2a/bad-field",
         "a2a: card.capabilities[" + c + "] must be 1-128 char string");
     }
   }
   if (card.endpoints !== undefined) {
     if (!Array.isArray(card.endpoints)) {
-      throw errorClass.factory("BAD_FIELD",
+      throw errorClass.factory("a2a/bad-field",
         "a2a: card.endpoints must be an array");
     }
     for (var e = 0; e < card.endpoints.length; e += 1) {
       var ep = card.endpoints[e];
       if (!ep || typeof ep !== "object" || typeof ep.url !== "string") {
-        throw errorClass.factory("BAD_FIELD",
+        throw errorClass.factory("a2a/bad-field",
           "a2a: card.endpoints[" + e + "] must have a string url");
       }
       if (!/^https:\/\//.test(ep.url) && !/^http:\/\/(localhost|127\.0\.0\.1|\[::1\])/.test(ep.url)) {
-        throw errorClass.factory("INSECURE_ENDPOINT",
+        throw errorClass.factory("a2a/insecure-endpoint",
           "a2a: card.endpoints[" + e + "].url must be HTTPS (or localhost)");
       }
     }
@@ -226,7 +226,7 @@ function signCard(card, privateKeyPem, opts) {
   _validateCardShape(card, errorClass);
 
   if (typeof privateKeyPem !== "string" || privateKeyPem.length === 0) {
-    throw errorClass.factory("BAD_KEY",
+    throw errorClass.factory("a2a/bad-key",
       "a2a.signCard: privateKeyPem required");
   }
 

package/lib/vendor/blamejs/lib/agent-snapshot.js

@@ -170,7 +170,7 @@ function _resolveSigner(ctx) {
   var as;
   try { as = auditSign(); } catch (_e) { as = null; }
   if (as && typeof as.sign === "function" && typeof as.verify === "function") {
-    // b.auditSign.sign throws "auditSign/not-initialized" when called
+    // b.auditSign.sign throws "audit-sign/not-initialized" when called
     // pre-init — surface that here as the snapshot's signer-not-wired
     // error so the caller's message is consistent regardless of which
     // dependency landed unwired.

package/lib/vendor/blamejs/lib/ai-capability.js

@@ -108,31 +108,31 @@ function _isStringArray(a) {
 // surfaces at config time rather than as a silent mis-route.
 function _normalizeDescriptor(modelId, d) {
   if (!d || typeof d !== "object" || Array.isArray(d)) {
-    throw new AiCapabilityError("aiCapability/bad-descriptor",
+    throw new AiCapabilityError("ai-capability/bad-descriptor",
       "ai.capability: descriptor for '" + modelId + "' must be a plain object");
   }
   validateOpts(d, DESCRIPTOR_KEYS, "ai.capability descriptor['" + modelId + "']");
 
   if (!_isPositiveInt(d.maxContextTokens)) {
-    throw new AiCapabilityError("aiCapability/bad-descriptor",
+    throw new AiCapabilityError("ai-capability/bad-descriptor",
       "ai.capability: '" + modelId + "'.maxContextTokens must be a positive integer");
   }
   var maxOut = (d.maxOutputTokens == null) ? d.maxContextTokens : d.maxOutputTokens;
   if (!_isPositiveInt(maxOut)) {
-    throw new AiCapabilityError("aiCapability/bad-descriptor",
+    throw new AiCapabilityError("ai-capability/bad-descriptor",
       "ai.capability: '" + modelId + "'.maxOutputTokens must be a positive integer");
   }
 
   var modIn = (d.modalitiesIn == null) ? ["text"] : d.modalitiesIn;
   var modOut = (d.modalitiesOut == null) ? ["text"] : d.modalitiesOut;
   if (!_isStringArray(modIn) || !_isStringArray(modOut)) {
-    throw new AiCapabilityError("aiCapability/bad-descriptor",
+    throw new AiCapabilityError("ai-capability/bad-descriptor",
       "ai.capability: '" + modelId + "'.modalitiesIn / modalitiesOut must be arrays of non-empty strings");
   }
 
   var tier = (d.reasoningTier == null) ? "standard" : d.reasoningTier;
   if (REASONING_TIERS.indexOf(tier) === -1) {
-    throw new AiCapabilityError("aiCapability/bad-descriptor",
+    throw new AiCapabilityError("ai-capability/bad-descriptor",
       "ai.capability: '" + modelId + "'.reasoningTier must be one of " + REASONING_TIERS.join(" / "));
   }
 
@@ -140,7 +140,7 @@ function _normalizeDescriptor(modelId, d) {
   var costIn = (d.costPer1kInputTokens == null) ? 0 : d.costPer1kInputTokens;
   var costOut = (d.costPer1kOutputTokens == null) ? 0 : d.costPer1kOutputTokens;
   if (!_isNonNegFinite(cachingMax) || !_isNonNegFinite(costIn) || !_isNonNegFinite(costOut)) {
-    throw new AiCapabilityError("aiCapability/bad-descriptor",
+    throw new AiCapabilityError("ai-capability/bad-descriptor",
       "ai.capability: '" + modelId + "'.promptCachingMaxTokens / costPer1kInputTokens / " +
       "costPer1kOutputTokens must be non-negative finite numbers");
   }
@@ -224,12 +224,12 @@ function create(opts) {
   validateOpts(opts, ["models", "audit"], "ai.capability.create");
 
   if (!opts.models || typeof opts.models !== "object" || Array.isArray(opts.models)) {
-    throw new AiCapabilityError("aiCapability/bad-models",
+    throw new AiCapabilityError("ai-capability/bad-models",
       "ai.capability.create: models must be a plain object { modelId: descriptor }");
   }
   var ids = Object.keys(opts.models);
   if (ids.length === 0) {
-    throw new AiCapabilityError("aiCapability/bad-models",
+    throw new AiCapabilityError("ai-capability/bad-models",
       "ai.capability.create: models must declare at least one model");
   }
 
@@ -249,7 +249,7 @@ function create(opts) {
   function describe(modelId) {
     var d = registry.get(modelId);
     if (!d) {
-      throw new AiCapabilityError("aiCapability/unknown-model",
+      throw new AiCapabilityError("ai-capability/unknown-model",
         "ai.capability.describe: unknown model '" + modelId + "'");
     }
     return d;
@@ -261,7 +261,7 @@ function create(opts) {
 
   function register(modelId, descriptor) {
     validateOpts.requireNonEmptyString(modelId,
-      "ai.capability.register: modelId", AiCapabilityError, "aiCapability/bad-model");
+      "ai.capability.register: modelId", AiCapabilityError, "ai-capability/bad-model");
     registry.set(modelId, _normalizeDescriptor(modelId, descriptor));
     return registry.get(modelId);
   }
@@ -323,21 +323,21 @@ function create(opts) {
   function _validateRequirements(requirements) {
     if (requirements == null) return {};
     if (typeof requirements !== "object" || Array.isArray(requirements)) {
-      throw new AiCapabilityError("aiCapability/bad-requirements",
+      throw new AiCapabilityError("ai-capability/bad-requirements",
         "ai.capability: requirements must be a plain object");
     }
     validateOpts(requirements, REQUIREMENT_KEYS, "ai.capability requirements");
     if (requirements.minReasoningTier != null &&
         REASONING_TIERS.indexOf(requirements.minReasoningTier) === -1) {
-      throw new AiCapabilityError("aiCapability/bad-requirements",
+      throw new AiCapabilityError("ai-capability/bad-requirements",
         "ai.capability: minReasoningTier must be one of " + REASONING_TIERS.join(" / "));
     }
     if (requirements.modalitiesIn != null && !_isStringArray(requirements.modalitiesIn)) {
-      throw new AiCapabilityError("aiCapability/bad-requirements",
+      throw new AiCapabilityError("ai-capability/bad-requirements",
         "ai.capability: requirements.modalitiesIn must be an array of non-empty strings");
     }
     if (requirements.modalitiesOut != null && !_isStringArray(requirements.modalitiesOut)) {
-      throw new AiCapabilityError("aiCapability/bad-requirements",
+      throw new AiCapabilityError("ai-capability/bad-requirements",
         "ai.capability: requirements.modalitiesOut must be an array of non-empty strings");
     }
     // Numeric minimums are compared with `<` against the descriptor; a
@@ -349,7 +349,7 @@ function create(opts) {
     for (var ni = 0; ni < numericMins.length; ni++) {
       var nk = numericMins[ni];
       if (requirements[nk] != null && !_isNonNegFinite(requirements[nk])) {
-        throw new AiCapabilityError("aiCapability/bad-requirements",
+        throw new AiCapabilityError("ai-capability/bad-requirements",
           "ai.capability: requirements." + nk + " must be a non-negative finite number");
       }
     }
@@ -360,7 +360,7 @@ function create(opts) {
     for (var bi = 0; bi < booleanReqs.length; bi++) {
       var bk = booleanReqs[bi];
       if (requirements[bk] != null && typeof requirements[bk] !== "boolean") {
-        throw new AiCapabilityError("aiCapability/bad-requirements",
+        throw new AiCapabilityError("ai-capability/bad-requirements",
           "ai.capability: requirements." + bk + " must be a boolean");
       }
     }
@@ -392,7 +392,7 @@ function create(opts) {
     var costBasis = null;
     if (routeOpts.costBasis != null) {
       if (typeof routeOpts.costBasis !== "object" || Array.isArray(routeOpts.costBasis)) {
-        throw new AiCapabilityError("aiCapability/bad-requirements",
+        throw new AiCapabilityError("ai-capability/bad-requirements",
           "ai.capability.route: costBasis must be a plain object { inputTokens, outputTokens }");
       }
       validateOpts(routeOpts.costBasis, ["inputTokens", "outputTokens"],
@@ -405,7 +405,7 @@ function create(opts) {
       for (var ci = 0; ci < cbFields.length; ci++) {
         var ck = cbFields[ci];
         if (routeOpts.costBasis[ck] != null && !_isNonNegFinite(routeOpts.costBasis[ck])) {
-          throw new AiCapabilityError("aiCapability/bad-requirements",
+          throw new AiCapabilityError("ai-capability/bad-requirements",
             "ai.capability.route: costBasis." + ck + " must be a non-negative finite number");
         }
       }
@@ -446,7 +446,7 @@ function create(opts) {
     if (routeOpts.fallback != null) {
       var fb = registry.get(routeOpts.fallback);
       if (!fb) {
-        throw new AiCapabilityError("aiCapability/unknown-model",
+        throw new AiCapabilityError("ai-capability/unknown-model",
           "ai.capability.route: fallback '" + routeOpts.fallback + "' is not a registered model");
       }
       _emitAudit("ai/capability-fallback", "allowed", {
@@ -461,7 +461,7 @@ function create(opts) {
     }
 
     _emitAudit("ai/capability-no-candidate", "denied", { requirements: requirements });
-    throw new AiCapabilityError("aiCapability/no-candidate",
+    throw new AiCapabilityError("ai-capability/no-candidate",
       "ai.capability.route: no registered model satisfies the requirements " +
       "and no fallback was supplied");
   }