@blamejs/blamejs-shop 0.2.26 → 0.2.28

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.28 (2026-05-29) — **Sales reports and printable receipts in the admin console.** The admin console gains a Reports screen and printable order documents. Reports aggregates a sales and revenue summary over a date range you choose — order count, gross and net revenue, refunds, average order value, an order-status funnel, a by-day revenue table, and top products — with a CSV export of the daily series. Every order detail page now offers a printable receipt and a printable packing slip (print-optimized, carrying your shop name and contact), so you can pull a revenue report or print an order without querying the database directly. **Added:** *Reports screen* — `/admin/reports` aggregates a sales/revenue summary over a selectable date range: order count, gross and net revenue, refunds and refund rate, average order value, an order-status funnel, a by-day revenue table, and top products. The daily series exports to CSV. The screen reads only — it never writes. · *Printable receipts and packing slips* — `GET /admin/orders/:id/receipt` and `GET /admin/orders/:id/packing-slip` render self-contained, print-optimized order documents (lines, totals, ship-to, tracking barcode) with your shop name and contact in the masthead. Both are linked from a Documents panel on the admin order detail screen.
+
+- v0.2.27 (2026-05-29) — **Upload product images directly from the admin console.** The admin product media manager can now take an image file uploaded straight from your device, in addition to attaching one by URL. On the product detail screen, pick a PNG, JPEG, WebP, GIF, AVIF, or SVG and it streams to object storage and attaches to the product (or a specific variant) in one step. Every upload is validated by both its declared content type and its actual magic bytes — a mismatched or disguised file is refused — and capped at 10 MiB. The upload surface is only present when object storage is configured, so a store without it sees no change. **Added:** *Direct image-file upload in the admin product media manager* — A file picker on the admin product detail screen accepts a local image (`multipart/form-data`) alongside the existing attach-by-URL field. The file is content-type- and magic-byte-validated (png/jpeg/webp/gif/avif/svg), size-capped at 10 MiB, streamed to the object-storage bridge, and attached to the product or variant. JSON API: `POST /admin/products/:id/media/upload-file` and `POST /admin/media/upload-file`. The routes mount only when the object-storage bridge is configured.
+
 - v0.2.26 (2026-05-29) — **Update the vendored blamejs runtime to v0.13.44.** The bundled blamejs runtime moves from v0.13.0 to v0.13.44, carrying a run of upstream security and reliability fixes through the crypto, storage, and middleware layers the shop is built on, with no API or configuration changes. Highlights: DNSSEC validation now bounds the work spent on colliding keys and signatures (KeyTrap / NSEC3 resource-exhaustion defense); a sealed database column that fails to unseal now returns null instead of risking forged or cross-row ciphertext; the encrypted database gains a temporary-storage free-space guard and a shutdown watchdog that preserves the final flush on exit; S/MIME chain verification binds the leaf certificate to the verifying signer key; archive extraction refuses Windows reserved and alternate-data-stream path names; and the replay-nonce store is memory-capped and fails closed under flood. **Changed:** *Database reliability under low temporary storage* — The encrypted database now refuses growth-writes with a clear error when its temporary storage drops below a safety headroom (rather than risking corruption), and a shutdown watchdog preserves the final database flush if a shutdown phase hangs. Both harden the container restart path. **Security:** *Bundled blamejs runtime updated to v0.13.44* — Pulls in the upstream security fixes accumulated since v0.13.0: DNSSEC KeyTrap / NSEC3 work caps, sealed-column null-on-unseal-failure (no forged or cross-row ciphertext), S/MIME leaf-to-signer binding, archive-extraction rejection of Windows reserved / alternate-data-stream names, static-file sibling-prefix path containment, and a memory-capped, fail-closed replay-nonce store. No API or configuration changes are required.
 
 - v0.2.25 (2026-05-29) — **Harden session and admin cookies with __Host- / __Secure- name prefixes.** The session, login, and admin cookies now carry the browser-enforced `__Host-` / `__Secure-` name prefixes when served over HTTPS. These prefixes bind a cookie to a secure, same-origin context — a browser only accepts a `__Host-` cookie that was set with `Secure`, `Path=/`, and no `Domain` attribute — which closes off cookie-injection and session-fixation paths from a related origin or a non-secure context. The secure-versus-plain decision follows the forwarded request protocol, so a deployment behind a TLS-terminating proxy (the production setup) gets the hardened prefixes while local development and tests over HTTP keep the bare names and keep working. Returning visitors are not signed out by the upgrade: the cookie reader resolves both the prefixed and the legacy name during the transition. **Security:** *`__Host-` on the session and login cookies* — Over HTTPS the storefront session and login cookies are issued as `__Host-shop_sid` and `__Host-shop_auth` with `Secure`, `Path=/`, and no `Domain` — the attribute set a browser requires before it will store a `__Host-` cookie, so the session cookie can no longer be planted or overwritten by a related origin or a non-secure context. · *`__Secure-` on the admin cookie* — The admin session cookie is scoped to `Path=/admin`, so it takes the `__Secure-` prefix (which requires `Secure`) rather than `__Host-` (which mandates `Path=/`). The edge cache-skip check and the audience bucketing were updated to recognize the prefixed names so a signed-in response is never served from the shared edge cache.

package/lib/admin.js

@@ -90,6 +90,28 @@ function _extFromContentType(ct) {
   return _CT_TO_EXT[ct.toLowerCase()] || "";
 }
 
+// Image content-types the direct-file upload path accepts — a strict
+// subset of _CT_TO_EXT. The file picker is for product imagery, so
+// video / pdf are not offered here (the attach-by-key + upload-from-URL
+// routes still reach the wider _CT_TO_EXT set for those). svg stays on
+// the list to match the upload-from-URL flow, but it can't be
+// magic-byte sniffed (it's text), so the mismatch cross-check skips it.
+var _UPLOAD_IMAGE_CT = {
+  "image/png":     "png",
+  "image/jpeg":    "jpg",
+  "image/jpg":     "jpg",
+  "image/webp":    "webp",
+  "image/gif":     "gif",
+  "image/avif":    "avif",
+  "image/svg+xml": "svg",
+};
+// Per-file cap on a direct upload, sized for product photography. The
+// body-parser multipart sub-parser enforces its own global fileSize cap
+// upstream; this is the route-level cap so the limit is explicit at the
+// media surface and the rejection names the media budget rather than a
+// generic 413.
+var _UPLOAD_MAX_BYTES = b.constants.BYTES.mib(10);
+
 // ---- shared helpers -----------------------------------------------------
 
 function _parseEpochMs(str, label) {
@@ -349,10 +371,16 @@ function mount(router, deps) {
   var returns       = deps.returns       || null;   // RMA moderation endpoints disabled when absent
   var customers     = deps.customers     || null;   // read-only customers console disabled when absent
   var orderTracking = deps.orderTracking || null;   // shipment/tracking panel disabled when absent
+  var salesReports  = deps.salesReports  || null;   // /admin/reports degrades to an unconfigured notice when absent
+  var printReceipts = deps.printReceipts || null;   // order receipt document disabled when absent
+  var packingSlips  = deps.packingSlips  || null;   // order packing-slip document disabled when absent
 
   // Which optional console sections are wired — gates their nav links so a
   // signed-in admin is never sent to a route that wasn't mounted. Passed
   // into every authed render call as `nav_available`.
+  // `reports` is always present in the nav (read-only sales summary needs no
+  // extra dep); its route mounts unconditionally and renders an unconfigured
+  // notice when the salesReports primitive isn't wired.
   var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
@@ -1007,14 +1035,24 @@ function mount(router, deps) {
       if (buf.length === 0) {
         return { status: 422, code: "source-empty", detail: "source_url returned an empty body" };
       }
-      // Generate the R2 key. The extension is inferred from the
-      // declared content-type so the operator can preview the asset
-      // without a content-disposition round-trip.
+      return await _storeAndAttach(buf, body.content_type, body);
+    }
+
+    // Store bytes to R2 and attach the media row — the tail shared by the
+    // upload-from-URL flow and the direct-file upload flow. Generates the
+    // R2 key (extension inferred from the declared content-type so the
+    // operator can preview without a content-disposition round-trip),
+    // pushes through the same r2_bridge put path, then records the catalog
+    // row. Returns `{ status, code, detail }` on an operational failure or
+    // `{ rec }` on success. Never throws on an R2 / attach failure — the
+    // caller renders the problem.
+    async function _storeAndAttach(buf, contentType, body) {
+      var declared = String(contentType).split(";")[0].trim().toLowerCase();
       var ext = _extFromContentType(declared);
       var id  = b.uuid.v7();
       var key = "media/" + id + (ext ? "." + ext : "");
       try {
-        await r2.put(key, buf, body.content_type);
+        await r2.put(key, buf, contentType);
       } catch (e) {
         return { status: 502, code: "r2-upload-failed", detail: (e && e.message) || String(e) };
       }
@@ -1024,7 +1062,7 @@ function mount(router, deps) {
           product_id:   body.product_id || undefined,
           variant_id:   body.variant_id || undefined,
           r2_key:       key,
-          content_type: body.content_type,
+          content_type: contentType,
           width:        body.width    || 0,
           height:       body.height   || 0,
           position:     body.position || 0,
@@ -1042,6 +1080,91 @@ function mount(router, deps) {
       return { rec: Object.assign({}, m, { asset_url: assetPrefix + key }) };
     }
 
+    // Direct-file upload: validate + store an image picked from the
+    // operator's device. The framework's multipart body-parser has already
+    // streamed the part to a tmp file (req.files[N] = { field, filename,
+    // mimeType, path, size, hash }); this reads it back, checks the
+    // declared MIME against the image allowlist, enforces the media-budget
+    // size cap, cross-checks the magic bytes against the declared type
+    // (defense against an image/png label on a non-image body), then hands
+    // off to _storeAndAttach. Request-shape reader: returns `{ status,
+    // code, detail }` for any bad/oversized/disallowed file rather than
+    // throwing — the upload must never crash the request that carries it.
+    async function _performFileUpload(file, body) {
+      body = body || {};
+      if (!body.product_id && !body.variant_id) {
+        return { status: 400, code: "missing-target", detail: "one of product_id / variant_id required" };
+      }
+      if (!file || typeof file.path !== "string" || !file.path.length) {
+        return { status: 400, code: "no-file", detail: "no file part received (expected a multipart `file` field)" };
+      }
+      var declaredCT = String(file.mimeType || "").split(";")[0].trim().toLowerCase();
+      if (!_UPLOAD_IMAGE_CT[declaredCT]) {
+        return { status: 415, code: "unsupported-type",
+          detail: "`" + (declaredCT || "(none)") + "` is not an accepted image type " +
+                  "(png, jpeg, webp, gif, avif, svg)" };
+      }
+      // The multipart parser caps file size globally, but the media route
+      // pins its own budget so the limit is explicit here and the message
+      // names the media cap. file.size is the streamed byte count.
+      if (typeof file.size === "number" && file.size > _UPLOAD_MAX_BYTES) {
+        return { status: 413, code: "file-too-large",
+          detail: "file is " + file.size + " bytes, exceeds the " + _UPLOAD_MAX_BYTES + "-byte media upload cap" };
+      }
+      // Read the streamed tmp file back through the framework's atomic
+      // reader with the media cap as maxBytes — this re-checks the on-disk
+      // byte count against the budget (the parser's own cap is global) and
+      // catches a size header that under-reported the streamed bytes,
+      // throwing `atomic-file/too-large` rather than buffering past the cap.
+      var buf;
+      try {
+        buf = b.atomicFile.readSync(file.path, { maxBytes: _UPLOAD_MAX_BYTES });
+      } catch (e) {
+        if (e && e.code === "atomic-file/too-large") {
+          return { status: 413, code: "file-too-large",
+            detail: "file exceeds the " + _UPLOAD_MAX_BYTES + "-byte media upload cap" };
+        }
+        return { status: 500, code: "tmp-read-failed", detail: (e && e.message) || String(e) };
+      }
+      if (buf.length === 0) {
+        return { status: 422, code: "file-empty", detail: "uploaded file is empty (0 bytes)" };
+      }
+      // Magic-byte cross-check: refuse a body whose sniffed type doesn't
+      // match the declared image type. svg is text (no magic bytes) so
+      // b.fileType.detect returns null — skip the cross-check for it and
+      // trust the declared type, same as the upload-from-URL flow.
+      if (declaredCT !== "image/svg+xml") {
+        var sniffed = b.fileType.detect(buf);
+        var sniffedMime = sniffed && sniffed.mime;
+        // jpg/jpeg are synonyms; normalize both sides to one token.
+        var declNorm  = declaredCT === "image/jpg" ? "image/jpeg" : declaredCT;
+        var sniffNorm = sniffedMime === "image/jpg" ? "image/jpeg" : sniffedMime;
+        if (!sniffNorm) {
+          return { status: 422, code: "unrecognized-bytes",
+            detail: "could not classify the file's bytes as a known image format" };
+        }
+        if (sniffNorm !== declNorm) {
+          return { status: 422, code: "content-type-mismatch",
+            detail: "file bytes sniff as `" + sniffNorm + "` but the part declared `" + declaredCT + "`" };
+        }
+      }
+      return await _storeAndAttach(buf, declaredCT, body);
+    }
+
+    // Pull the first uploaded file out of req.files. The multipart parser
+    // exposes every accepted file part as req.files[] = { field, filename,
+    // mimeType, path, size, hash }; the media form names its part `file`,
+    // but accept any single file part so an API caller using a different
+    // field name still works.
+    function _firstUploadFile(req) {
+      var files = (req && Array.isArray(req.files)) ? req.files : [];
+      if (!files.length) return null;
+      for (var i = 0; i < files.length; i++) {
+        if (files[i] && files[i].field === "file") return files[i];
+      }
+      return files[0];
+    }
+
     router.post("/admin/media/upload", W("media.upload", async function (req, res) {
       var out = await _performMediaUpload(req.body || {});
       if (out.rec) { _json(res, 201, out.rec); return out.rec; }
@@ -1070,6 +1193,33 @@ function mount(router, deps) {
         _redirect(res, "/admin/products/" + enc + "?saved=1");
       },
     ));
+
+    // Direct-file upload (multipart/form-data). The JSON API route takes
+    // product_id / variant_id from the form fields; the browser alias
+    // scopes it to the product in the path and PRGs back to the detail.
+    router.post("/admin/media/upload-file", W("media.upload", async function (req, res) {
+      var out = await _performFileUpload(_firstUploadFile(req), req.body || {});
+      if (out.rec) { _json(res, 201, out.rec); return out.rec; }
+      return _problem(res, out.status, out.code, out.detail);
+    }));
+
+    router.post("/admin/products/:id/media/upload-file", _pageOrApi(false,
+      W("media.upload", async function (req, res) {
+        var body = Object.assign({}, req.body || {}, { product_id: req.params.id });
+        var out = await _performFileUpload(_firstUploadFile(req), body);
+        if (out.rec) { _json(res, 201, out.rec); return out.rec; }
+        return _problem(res, out.status, out.code, out.detail);
+      }),
+      async function (req, res) {
+        var id  = req.params.id;
+        var enc = encodeURIComponent(id);
+        var body = Object.assign({}, req.body || {}, { product_id: id });
+        var out = await _performFileUpload(_firstUploadFile(req), body);
+        if (!out.rec) return _redirect(res, "/admin/products/" + enc + "?err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".media.upload", outcome: "success", metadata: { id: id } });
+        _redirect(res, "/admin/products/" + enc + "?saved=1");
+      },
+    ));
   }
 
   router.delete("/admin/media/:id", W("media.delete", async function (req, res) {
@@ -1235,6 +1385,10 @@ function mount(router, deps) {
         // Shipment/tracking panel only renders when the tracking primitive
         // is wired; the carrier + status enums drive its form selects.
         can_track:   !!orderTracking,
+        // Printable-document links — shown only when the render primitive is
+        // wired (its route is mounted only then).
+        can_receipt:      !!printReceipts,
+        can_packing_slip: !!packingSlips,
         shipments:   shipments,
         carriers:    orderTracking ? orderTracking.CARRIERS : null,
         statuses:    orderTracking ? orderTracking.STATUSES : null,
@@ -3016,6 +3170,288 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- reporting ------------------------------------------------------
+  //
+  // A sales/revenue report over a selectable date range: order count,
+  // gross/net revenue, refunds, AOV, top products, broken down by day and
+  // by status. Aggregated from the salesReports primitive (pure read-only
+  // SQL over orders/order_lines). The route mounts unconditionally so the
+  // always-present "Reports" nav link never points at a missing route; when
+  // the salesReports primitive isn't wired it renders an unconfigured
+  // notice. CSV export of the by-day series is exposed via `?format=csv`.
+  //
+  // Date range: `from`/`to` are epoch-ms query params (defaults to the last
+  // 30 days). A malformed range re-renders the page with a 400 + the
+  // validator's message rather than crashing — the report is config/entry
+  // tier, so a bad operator-typed range surfaces as a correction, not a 500.
+
+  // Parse a "YYYY-MM-DD" calendar-date param to the epoch-ms at UTC
+  // midnight. Returns null when the param is absent; throws TypeError on a
+  // malformed value so the config/entry-tier 400 path catches it. The
+  // browser date <input> submits this shape; the JSON API can use either
+  // this or the raw epoch-ms `from`/`to`.
+  function _parseDateParam(str, label) {
+    if (str == null || str === "") return null;
+    if (typeof str !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(str)) {
+      throw new TypeError("admin: " + label + " must be a YYYY-MM-DD date");
+    }
+    var ms = Date.parse(str + "T00:00:00Z");
+    if (!isFinite(ms)) throw new TypeError("admin: " + label + " is not a valid date");
+    return ms;
+  }
+
+  // Resolve the report window from the query string. Returns
+  // `{ from, to }` (epoch-ms) or throws TypeError on a malformed value.
+  // Accepts either the raw epoch-ms `from`/`to` pair (machine clients) or
+  // the calendar-date `from-date`/`to-date` pair (the browser date inputs);
+  // the epoch-ms form wins when both are present. Defaults: to = now,
+  // from = now - 30d. The salesReports primitive re-validates (from < to,
+  // span ≤ 1y), so this only coerces the shape.
+  function _reportWindow(url) {
+    var from = _parseEpochMs(url && url.searchParams.get("from"), "from");
+    var to   = _parseEpochMs(url && url.searchParams.get("to"),   "to");
+    if (from == null) from = _parseDateParam(url && url.searchParams.get("from-date"), "from");
+    // `to-date` is the inclusive end day — advance to the next UTC midnight
+    // so the window covers the whole selected day (salesReports treats `to`
+    // as exclusive: `updated_at < to`).
+    if (to == null) {
+      var toDate = _parseDateParam(url && url.searchParams.get("to-date"), "to");
+      if (toDate != null) to = toDate + b.constants.TIME.days(1);
+    }
+    var now  = Date.now();
+    return {
+      to:   to   == null ? now : to,
+      from: from == null ? (now - b.constants.TIME.days(30)) : from,
+    };
+  }
+
+  // Aggregate the report payload from the salesReports primitive. Composes
+  // the by-day revenue series, AOV, refund rate, the status funnel, and the
+  // top products into one object the HTML + CSV + JSON surfaces all read.
+  async function _buildReport(win) {
+    var byDay  = await salesReports.revenueByDay({ from: win.from, to: win.to });
+    var aov    = await salesReports.aov({ from: win.from, to: win.to });
+    var refund = await salesReports.refundRate({ from: win.from, to: win.to });
+    var funnel = await salesReports.funnel({ from: win.from, to: win.to });
+    var top    = await salesReports.topProducts({ from: win.from, to: win.to, limit: 10 });
+
+    // Headline totals from the by-day series — gross/net/refunds summed
+    // across every currency bucket in the window. The per-currency split
+    // stays on the by-day rows for the operator who needs it; the headline
+    // is the single-number summary a dashboard leads with.
+    var orderCount = 0, gross = 0, net = 0, refunds = 0;
+    var currency = (aov && aov.currency) || "USD";
+    for (var i = 0; i < byDay.length; i += 1) {
+      var row = byDay[i];
+      orderCount += row.order_count;
+      gross      += row.gross_revenue_minor;
+      net        += row.net_revenue_minor;
+      refunds    += row.refund_total_minor;
+    }
+    return {
+      from:                win.from,
+      to:                  win.to,
+      currency:            currency,
+      order_count:         orderCount,
+      gross_revenue_minor: gross,
+      net_revenue_minor:   net,
+      refund_total_minor:  refunds,
+      aov_minor:           (aov && aov.aov_minor) || 0,
+      refund_rate_bps:     (refund && refund.refund_rate_bps) || 0,
+      by_day:              byDay,
+      by_status:           funnel,
+      top_products:        (top && top.rows) || [],
+    };
+  }
+
+  // CSV body for the by-day revenue series. Composes `b.csv.stringify`
+  // (RFC 4180) — the cell values are integer aggregates + ISO date buckets
+  // + 3-letter currency codes, all framework-internal (never raw
+  // operator/customer prose), so the RFC-4180 quoting is sufficient here;
+  // there is no untrusted free-text column that would require b.guardCsv's
+  // formula-injection defenses.
+  function _reportCsv(report) {
+    var rows = report.by_day.map(function (r) {
+      return {
+        date:                r.bucket_start,
+        currency:            r.currency,
+        order_count:         r.order_count,
+        gross_revenue_minor: r.gross_revenue_minor,
+        net_revenue_minor:   r.net_revenue_minor,
+        refund_total_minor:  r.refund_total_minor,
+      };
+    });
+    return b.csv.stringify(rows, {
+      columns: ["date", "currency", "order_count", "gross_revenue_minor", "net_revenue_minor", "refund_total_minor"],
+      header:  true,
+      eol:     "\n",
+    });
+  }
+
+  router.get("/admin/reports", _pageOrApi(true,
+    R(async function (req, res) {
+      if (!salesReports) return _problem(res, 503, "reporting-unconfigured", "the salesReports primitive is not wired");
+      var url = req.url ? new URL(req.url, "http://localhost") : null;
+      // A malformed from/to surfaces as a 400 problem (config/entry tier).
+      var win;
+      try { win = _reportWindow(url); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      var report;
+      try { report = await _buildReport(win); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (url && url.searchParams.get("format") === "csv") {
+        res.status(200);
+        if (res.setHeader) {
+          res.setHeader("content-type", "text/csv; charset=utf-8");
+          res.setHeader("content-disposition", "attachment; filename=\"sales-report.csv\"");
+        }
+        var csv = _reportCsv(report);
+        if (res.end) res.end(csv); else res.send(csv);
+        return;
+      }
+      _json(res, 200, report);
+    }),
+    async function (req, res) {
+      var url = req.url ? new URL(req.url, "http://localhost") : null;
+      if (!salesReports) {
+        return _sendHtml(res, 200, renderAdminReports({
+          shop_name: deps.shop_name, nav_available: navAvailable, report: null,
+          notice: "Reporting isn't configured on this deployment.",
+        }));
+      }
+      var win, notice = null;
+      try { win = _reportWindow(url); }
+      catch (e) {
+        if (!(e instanceof TypeError)) throw e;
+        // Bad range → re-render with the default window + a correction
+        // notice (config/entry tier: the operator fixes the typo).
+        win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
+        notice = e.message.replace(/^admin:\s*/, "");
+      }
+      // CSV download from the browser surface too (a link, not a fetch).
+      if (url && url.searchParams.get("format") === "csv") {
+        var report0;
+        try { report0 = await _buildReport(win); }
+        catch (e2) { if (!(e2 instanceof TypeError)) throw e2; report0 = null; }
+        if (report0) {
+          res.status(200);
+          if (res.setHeader) {
+            res.setHeader("content-type", "text/csv; charset=utf-8");
+            res.setHeader("content-disposition", "attachment; filename=\"sales-report.csv\"");
+          }
+          var csv0 = _reportCsv(report0);
+          if (res.end) res.end(csv0); else res.send(csv0);
+          return;
+        }
+      }
+      var report;
+      try { report = await _buildReport(win); }
+      catch (e3) {
+        if (!(e3 instanceof TypeError)) throw e3;
+        win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
+        notice = e3.message.replace(/^salesReports:\s*/, "");
+        report = await _buildReport(win);
+      }
+      _sendHtml(res, 200, renderAdminReports({
+        shop_name: deps.shop_name, nav_available: navAvailable, report: report, notice: notice,
+      }));
+    },
+  ));
+
+  // ---- printable order documents --------------------------------------
+  //
+  // Operator-facing receipt + packing slip for an order. These are the
+  // warehouse/fulfilment paper trail (the customer's own order page is a
+  // separate storefront surface — untouched here). Each renders clean,
+  // self-contained, print-optimized HTML the operator prints or pipes to a
+  // PDF. Mounted only when the corresponding render primitive is wired.
+  //
+  // Failure modes: a malformed order id (TypeError from the primitive's id
+  // reader) → 404; a missing order → 404. Only TypeError is swallowed to a
+  // 404 — any other error propagates to the 500 path.
+
+  // The receipt + packing-slip render primitives emit a self-contained
+  // document driven purely by the order; the shop's own name + contact live
+  // in shop_config, so we read them here and inject a small masthead at the
+  // top of the document `<body>`. Both renderers emit a literal "<body>\n"
+  // marker; the header slots in right after it. When config is unwired or
+  // the keys are unset, the document renders without a masthead (the order
+  // data alone is still a complete, valid document).
+  async function _shopMastheadHtml() {
+    if (!deps.config) return "";
+    var name = null, contact = null;
+    try {
+      name = await deps.config.get("shop.name", deps.shop_name || null);
+      // The setup wizard persists the operator's contact under
+      // "shop.contact_email"; fall back to the conventional
+      // "shop.support_email" key the config module documents.
+      contact = await deps.config.get("shop.contact_email", null);
+      if (contact == null) contact = await deps.config.get("shop.support_email", null);
+    } catch (_e) {
+      // Config read failure must not break the print document — degrade to
+      // no masthead rather than 500-ing the operator's print job.
+      return "";
+    }
+    if (!name && !contact) return "";
+    var parts = "";
+    if (name)    parts += "<strong>" + _htmlEscape(String(name)) + "</strong>";
+    if (contact) parts += (name ? "<br>" : "") + _htmlEscape(String(contact));
+    // Inline style is acceptable here: this document is served standalone
+    // (not under the admin console's strict style-src CSP) and is built for
+    // printing, where an external stylesheet round-trip is undesirable.
+    return "<div style=\"margin-bottom:8mm;font-size:11pt;\">" + parts + "</div>\n";
+  }
+
+  function _injectMasthead(html, masthead) {
+    if (!masthead) return html;
+    var marker = "<body>\n";
+    var at = html.indexOf(marker);
+    if (at === -1) return html;                                  // renderer changed shape — emit the doc unaltered
+    return html.slice(0, at + marker.length) + masthead + html.slice(at + marker.length);
+  }
+
+  if (printReceipts) {
+    router.get("/admin/orders/:id/receipt", async function (req, res) {
+      if (!_htmlAuthed(req, expectedToken)) {
+        if (req.method === "GET" || !req.method) return _sendHtml(res, 200, renderAdminLogin({ shop_name: deps.shop_name }));
+        return _problem(res, 401, "unauthorized");
+      }
+      var html;
+      try {
+        html = await printReceipts.htmlPdf({ order_id: req.params.id });
+      } catch (e) {
+        if (e instanceof TypeError) {
+          return _sendHtml(res, 404, renderAdminOrders({
+            shop_name: deps.shop_name, nav_available: navAvailable, orders: [], notice: "Order not found.",
+          }));
+        }
+        return _problem(res, 500, "internal-error", (e && e.message) || String(e));
+      }
+      _sendHtml(res, 200, _injectMasthead(html, await _shopMastheadHtml()));
+    });
+  }
+
+  if (packingSlips) {
+    router.get("/admin/orders/:id/packing-slip", async function (req, res) {
+      if (!_htmlAuthed(req, expectedToken)) {
+        if (req.method === "GET" || !req.method) return _sendHtml(res, 200, renderAdminLogin({ shop_name: deps.shop_name }));
+        return _problem(res, 401, "unauthorized");
+      }
+      var html;
+      try {
+        html = await packingSlips.renderHtml({ order_id: req.params.id });
+      } catch (e) {
+        if (e instanceof TypeError) {
+          return _sendHtml(res, 404, renderAdminOrders({
+            shop_name: deps.shop_name, nav_available: navAvailable, orders: [], notice: "Order not found.",
+          }));
+        }
+        return _problem(res, 500, "internal-error", (e && e.message) || String(e));
+      }
+      _sendHtml(res, 200, _injectMasthead(html, await _shopMastheadHtml()));
+    });
+  }
+
   // ---- analytics ------------------------------------------------------
 
   var analytics = deps.analytics || null;
@@ -4361,6 +4797,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "products",     href: "/admin/products",     label: "Products" },
   { key: "inventory",    href: "/admin/inventory",    label: "Inventory" },
   { key: "orders",       href: "/admin/orders",       label: "Orders" },
+  { key: "reports",      href: "/admin/reports",      label: "Reports" },
   { key: "customers",    href: "/admin/customers",    label: "Customers",    requires: "customers" },
   { key: "returns",      href: "/admin/returns",      label: "Returns",      requires: "returns" },
   { key: "reviews",      href: "/admin/reviews",      label: "Reviews",      requires: "reviews" },
@@ -4649,6 +5086,123 @@ function renderAdminOrders(opts) {
   return _renderAdminShell(opts.shop_name, "Orders", body, "orders", opts.nav_available);
 }
 
+// epoch-ms → "YYYY-MM-DD" for a date <input>'s value. Mirrors `_fmtDate`'s
+// guard so a bad value never throws inside the template.
+function _dateInputValue(v) {
+  var n = typeof v === "number" ? v : Date.parse(v);
+  if (!isFinite(n)) return "";
+  return new Date(n).toISOString().slice(0, 10);
+}
+
+// Sales/revenue report screen. Renders the headline totals (orders,
+// gross/net revenue, refunds, AOV, refund rate), the order-status funnel,
+// a by-day revenue table, and the top products — all for the selected
+// date range. A date-range form lets the operator retune the window; a CSV
+// link exports the by-day series. `opts.report` is null when reporting
+// isn't configured (renders the notice only).
+function renderAdminReports(opts) {
+  opts = opts || {};
+  var report = opts.report;
+  var notice = opts.notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  if (!report) {
+    var emptyBody = "<section><h2>Reports</h2>" + notice +
+      "<p class=\"empty\">No sales report available.</p></section>";
+    return _renderAdminShell(opts.shop_name, "Reports", emptyBody, "reports", opts.nav_available);
+  }
+
+  var fromVal = _dateInputValue(report.from);
+  // The window's `to` is exclusive (next UTC midnight after the operator's
+  // chosen end day); render the inclusive end day back into the date input
+  // by stepping one day back.
+  var toVal   = _dateInputValue(report.to - b.constants.TIME.days(1));
+
+  // Date-range form (GET so the window lives in the URL — bookmarkable +
+  // shareable). The browser submits calendar-date params; the CSV link
+  // carries the same window as raw epoch-ms.
+  var csvHref = "/admin/reports?format=csv" +
+    "&from=" + encodeURIComponent(String(report.from)) +
+    "&to="   + encodeURIComponent(String(report.to));
+  var rangeForm =
+    "<form method=\"get\" action=\"/admin/reports\" class=\"order-filters\">" +
+      "<label class=\"form-field\"><span>From</span><input type=\"date\" name=\"from-date\" value=\"" + _htmlEscape(fromVal) + "\"></label>" +
+      "<label class=\"form-field\"><span>To</span><input type=\"date\" name=\"to-date\" value=\"" + _htmlEscape(toVal) + "\"></label>" +
+      "<button class=\"btn\" type=\"submit\">Apply</button>" +
+      "<a class=\"btn btn--ghost\" href=\"" + _htmlEscape(csvHref) + "\">Export CSV</a>" +
+    "</form>";
+
+  // Headline stat cards. Money formats through the same pricing helper the
+  // dashboard + order pages use, in the report's headline currency.
+  var cur = report.currency;
+  var statsBlock =
+    "<section><h2>Summary</h2><div class=\"stat-grid\">" +
+      _statCard("Orders", String(report.order_count)) +
+      _statCard("Gross revenue", pricing.format(report.gross_revenue_minor, cur)) +
+      _statCard("Net revenue", pricing.format(report.net_revenue_minor, cur)) +
+      _statCard("Refunds", pricing.format(report.refund_total_minor, cur)) +
+      _statCard("Avg order value", pricing.format(report.aov_minor, cur)) +
+      _statCard("Refund rate", (report.refund_rate_bps / 100).toFixed(2) + "%") +
+    "</div></section>";
+
+  // Order-status funnel — each milestone counts orders that reached at
+  // least that stage within the window.
+  var f = report.by_status || {};
+  var funnelRows = [
+    ["Checkout started", f.checkout_started],
+    ["Payment intent created", f.payment_intent_created],
+    ["Paid", f.paid],
+    ["Fulfilled", f.fulfilled],
+    ["Refunded", f.refunded],
+  ].map(function (pair) {
+    return "<tr><td>" + _htmlEscape(pair[0]) + "</td><td class=\"num\">" + _htmlEscape(String(pair[1] == null ? 0 : pair[1])) + "</td></tr>";
+  }).join("");
+  var funnelBlock =
+    "<section><h2>Order status</h2><div class=\"panel\">" +
+      "<table><thead><tr><th scope=\"col\">Stage</th><th scope=\"col\" class=\"num\">Orders</th></tr></thead><tbody>" + funnelRows + "</tbody></table>" +
+    "</div></section>";
+
+  // Top products by gross revenue across the window.
+  var top = report.top_products || [];
+  var topRows = top.length
+    ? top.map(function (r) {
+        return "<tr><td>" + _htmlEscape(r.sku) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(String(r.units_sold)) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(pricing.format(r.gross_revenue_minor, r.currency)) + "</td></tr>";
+      }).join("")
+    : "<tr><td colspan=\"3\" class=\"empty\">No sales in this window.</td></tr>";
+  var topBlock =
+    "<section><h2>Top products</h2><div class=\"panel\">" +
+      "<table><thead><tr><th scope=\"col\">SKU</th><th scope=\"col\" class=\"num\">Units</th><th scope=\"col\" class=\"num\">Revenue</th></tr></thead><tbody>" + topRows + "</tbody></table>" +
+    "</div></section>";
+
+  // By-day revenue series — one row per (day, currency) bucket.
+  var byDay = report.by_day || [];
+  var dayRows = byDay.length
+    ? byDay.map(function (r) {
+        return "<tr>" +
+          "<td>" + _htmlEscape(r.bucket_start) + "</td>" +
+          "<td>" + _htmlEscape(r.currency) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(String(r.order_count)) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(pricing.format(r.gross_revenue_minor, r.currency)) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(pricing.format(r.net_revenue_minor, r.currency)) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(pricing.format(r.refund_total_minor, r.currency)) + "</td>" +
+          "</tr>";
+      }).join("")
+    : "<tr><td colspan=\"6\" class=\"empty\">No sales in this window.</td></tr>";
+  var dayBlock =
+    "<section><h2>By day</h2><div class=\"panel\">" +
+      "<table><thead><tr><th scope=\"col\">Date</th><th scope=\"col\">Currency</th><th scope=\"col\" class=\"num\">Orders</th><th scope=\"col\" class=\"num\">Gross</th><th scope=\"col\" class=\"num\">Net</th><th scope=\"col\" class=\"num\">Refunds</th></tr></thead><tbody>" + dayRows + "</tbody></table>" +
+    "</div></section>";
+
+  var body =
+    "<section><h2>Reports</h2>" + notice +
+      "<p class=\"meta\">Window: " + _htmlEscape(_fmtDate(report.from)) + " → " + _htmlEscape(_fmtDate(report.to)) + "</p>" +
+      rangeForm +
+    "</section>" +
+    statsBlock + funnelBlock + topBlock + dayBlock;
+  return _renderAdminShell(opts.shop_name, "Reports", body, "reports", opts.nav_available);
+}
+
 function renderAdminOrder(opts) {
   opts = opts || {};
   var o = opts.order;
@@ -4710,6 +5264,22 @@ function renderAdminOrder(opts) {
   }).filter(Boolean).join(" ");
   var actions = actionForms || "<span class=\"meta\">This order is in a final state — no further changes.</span>";
 
+  // Printable operator documents — a receipt + a packing slip, each opening
+  // the print-optimized HTML in a new tab. Rendered only when the matching
+  // render primitive is wired (the routes mount only then).
+  var docLinks = [];
+  if (opts.can_receipt) {
+    docLinks.push("<a class=\"btn btn--ghost\" href=\"/admin/orders/" + _htmlEscape(o.id) + "/receipt\" target=\"_blank\" rel=\"noopener\">Print receipt</a>");
+  }
+  if (opts.can_packing_slip) {
+    docLinks.push("<a class=\"btn btn--ghost\" href=\"/admin/orders/" + _htmlEscape(o.id) + "/packing-slip\" target=\"_blank\" rel=\"noopener\">Print packing slip</a>");
+  }
+  var documentsPanel = docLinks.length
+    ? "<div class=\"panel mt\"><h3 class=\"subhead\">Documents</h3>" +
+        "<div class=\"order-actions\">" + docLinks.join(" ") + "</div>" +
+      "</div>"
+    : "";
+
   // Shipment + tracking panel. Renders only when the tracking primitive is
   // wired (`can_track`). For each existing shipment: the carrier, status,
   // tracking number (linked to the carrier's public URL when known), and
@@ -4794,6 +5364,7 @@ function renderAdminOrder(opts) {
       "<div class=\"panel mt\"><h3 class=\"subhead\">Actions</h3>" +
         "<div class=\"order-actions\">" + actions + "</div>" +
       "</div>" +
+      documentsPanel +
       trackingPanel +
     "</section>";
   return _renderAdminShell(opts.shop_name, "Order " + o.id.slice(0, 8), body, "orders", opts.nav_available);
@@ -6573,6 +7144,21 @@ function renderAdminProduct(opts) {
       "</form>" +
     "</div>";
 
+  var fileUploadForm = uploadWired
+    ? "<div class=\"panel mt-1 mw-40\">" +
+        "<h3 class=\"subhead\">Upload an image from your device</h3>" +
+        "<p class=\"meta\">Pick a file (PNG, JPEG, WebP, GIF, AVIF, or SVG). It's stored in your bucket and attached to this product in one step.</p>" +
+        "<form method=\"post\" enctype=\"multipart/form-data\" action=\"/admin/products/" + pid + "/media/upload-file\">" +
+          "<label class=\"form-field\"><span>Image file</span>" +
+            "<input type=\"file\" name=\"file\" accept=\"image/png,image/jpeg,image/webp,image/gif,image/avif,image/svg+xml\" required>" +
+            "<small>Up to 10 MB. The file's bytes are checked against its type.</small>" +
+          "</label>" +
+          _setupField("Alt text", "alt_text", "", "text", "Describes the image for screen readers + SEO.", " maxlength=\"500\"") +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Upload + attach</button></div>" +
+        "</form>" +
+      "</div>"
+    : "";
+
   var uploadForm = uploadWired
     ? "<div class=\"panel mt-1 mw-40\">" +
         "<h3 class=\"subhead\">Upload media from a URL</h3>" +
@@ -6586,7 +7172,7 @@ function renderAdminProduct(opts) {
       "</div>"
     : "";
 
-  var mediaSection = "<section class=\"mt\"><h3 class=\"fs-105\">Media</h3>" + mediaGrid + attachForm + uploadForm + "</section>";
+  var mediaSection = "<section class=\"mt\"><h3 class=\"fs-105\">Media</h3>" + mediaGrid + fileUploadForm + attachForm + uploadForm + "</section>";
 
   // ---- head + assembly -------------------------------------------------
   var statusCls = p.status === "active" ? "paid" : (p.status === "archived" ? "refunded" : "pending");

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.2.26",
+  "version": "0.2.28",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.44",
-      "tag": "v0.13.44",
+      "version": "0.13.45",
+      "tag": "v0.13.45",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.45 (2026-05-29) — **`b.cert` now fetches and staples a validated OCSP response per certificate, and validates declared compliance postures at create().** Two capabilities that b.cert documented but did not act on are now wired through. OCSP stapling: the cert manager fetches the leaf's OCSP response from the responder named in its Authority Information Access extension, validates it against the issuer (status, nonce, serial) via b.network.tls.ocsp, caches the DER, and exposes it on getContext().ocspResponse so a TLS server's OCSPRequest handler can staple it. The fetch runs in the background on a refresh timer and never blocks cert.start() — a slow or unreachable responder produces an audited per-certificate failure, not a stalled boot. Compliance postures: opts.compliance names are now validated against b.compliance.KNOWN_POSTURES at create() (an unknown name throws cert/unknown-compliance-posture instead of being silently recorded) and are surfaced on getContext().compliance for an auditor. Storage-confidentiality postures hold by construction because cert keys and certificates are always sealed at rest. The supporting composition primitive b.network.tls.ocsp.fetch (build request, POST to the responder through b.httpClient, validate the response) is now part of the public OCSP surface. **Added:** *b.network.tls.ocsp.fetch — fetch and validate an OCSP response* — The OCSP helper set previously built requests and evaluated responses but had no way to actually retrieve one. b.network.tls.ocsp.fetch({ leafPem, issuerPem, nonce?, timeoutMs? }) reads the responder URL from the leaf certificate's Authority Information Access extension, builds the request, POSTs it through b.httpClient (so the SSRF guard and pinned DNS apply), and validates the response against the issuer — returning the validated DER plus the parsed evaluation. It rejects when the leaf carries no OCSP responder URL or the response fails validation. · *b.cert staples a validated OCSP response per certificate* — With ocsp.stapling enabled (the default), the cert manager refreshes each certificate's OCSP response on a timer (ocsp.refreshMs, default 12h) and caches the validated DER. getContext(serverName).ocspResponse returns that DER for a TLS server to hand back from its OCSPRequest handler. The refresh runs in the background and is never on the path of cert.start(): an unreachable or slow responder is recorded as an audited cert.ocsp.refresh failure for that certificate and leaves the rest of the manager running. **Changed:** *opts.compliance posture names are validated at create()* — b.cert.create now checks each name in opts.compliance against b.compliance.KNOWN_POSTURES and throws cert/unknown-compliance-posture on an unrecognized name, so a typo is caught at construction rather than being silently recorded. The declared postures are surfaced on getContext().compliance. Cert keys and certificates are always sealed at rest, so storage-confidentiality postures are satisfied by construction.
+
 - v0.13.44 (2026-05-29) — **Error codes on the consent, compliance, and protocol namespaces now follow the namespace/kebab-case contract.** The framework's error contract is `err.code = "namespace/kebab-case"`, and the vast majority of namespaces already followed it. This release normalizes the holdouts: fifteen namespaces that threw bare UPPER_SNAKE codes with no namespace, and nine that used a camelCase namespace prefix. After this release every error these namespaces throw carries a `namespace/kebab-case` code, so an operator switching on `err.code` no longer has to special-case them. This is a breaking change for code that matches the old strings — pre-1.0, there is no compatibility shim, so update any `err.code` comparisons against the listed namespaces. A codebase check now enforces the convention so it cannot regress. A small set of older codes (the cluster, scheduler, circuit-breaker, object-store, and upload subsystems) is intentionally left for the 1.0 release, where it will carry a deprecation cycle. **Changed:** *Bare UPPER_SNAKE error codes are now namespaced (breaking)* — Fifteen namespaces threw bare UPPER_SNAKE error codes with no namespace prefix (for example `mcp` threw `BAD_JSON`, `BAD_ENVELOPE`, `BAD_METHOD`). Their `err.code` values are now `namespace/kebab-case` — `mcp/bad-json`, `mcp/bad-envelope`, and so on. The affected namespaces are `b.a2a`, `b.aiInput`, `b.aiPref`, `b.budr`, `b.contentCredentials`, `b.darkPatterns`, `b.fapi2`, `b.fdx`, `b.graphqlFederation`, `b.iabTcf`, `b.iabMspa`, `b.mcp`, `b.secCyber`, `b.sse`, and `b.tcpa10dlc`. Operators matching the old bare codes on `err.code` must update those comparisons; the error message text is unchanged. · *camelCase error-code namespaces are now kebab-case (breaking)* — Nine namespaces emitted error codes whose namespace segment was camelCase (for example `aiDp/bad-bound`, `argParser/flag-duplicate`). The namespace segment is now kebab-case to match every other code: `ai-dp/`, `ai-capability/`, `ai-quota/`, `arg-parser/`, `audit-sign/`, `auth-step-up/`, `ddl-change-control/`, `dr-runbook/`, `tenant-quota/`, and `boot-gates/`. The `b.*` API namespace keys themselves are unchanged (those remain camelCase, e.g. `b.argParser`); only the `err.code` string changed. Operators matching these `err.code` strings must update them. **Detectors:** *Error-code shape is enforced* — A codebase check now flags any error code constructed via `new XError(...)` or the per-class `factory(...)` whose value is a bare UPPER_SNAKE string or carries a camelCase namespace segment, so the `namespace/kebab-case` contract cannot silently regress. It correctly ignores native error constructors (whose first argument is the message, not a code).
 
 - v0.13.43 (2026-05-29) — **LTS window stated consistently as 24 months, experimental primitives declared semver-exempt, and stale version references cleaned up.** Documentation and operator-facing string hygiene ahead of the 1.0 stability contract. The LTS support window is now stated as 24 months everywhere (GOVERNANCE.md and the LTS calendar previously disagreed — 24 vs 18). The LTS calendar gains an explicit clause that primitives marked experimental are exempt from the stability/LTS contract, so operators can tell at a glance which surfaces may change between minors. Several error messages and doc blocks that pinned to long-past version numbers ("lands in v0.10.9", "not supported in v0.12.7", "ships in v0.6.45+") are restated version-agnostically with their escape hatch, and the S/MIME module now points operators at the live PGP encrypt/decrypt path for confidentiality today. No API or behavior changes. **Changed:** *LTS support window is consistently 24 months* — `GOVERNANCE.md` promised a 24-month LTS window while `LTS-CALENDAR.md` and `SECURITY.md` stated 18 — a six-month contradiction in the single most load-bearing number of the support contract. All three now state 24 months of security-only patches per major. The calendar table and the supported-versions prose are aligned. · *Experimental primitives are declared exempt from the stability contract* — `LTS-CALENDAR.md` now states explicitly that primitives documented as experimental (shown as "experimental" on their wiki page, and via the `experimental` segment in namespaces like `b.jose.jwe.experimental`) are not covered by the stability contract or the LTS window — they may change signature, behavior, or wire format, or be removed, in any minor without a deprecation cycle. This lets the framework ship primitives that track in-flight standards without freezing an unsettled format, and tells operators precisely which surfaces are not yet frozen. **Fixed:** *Stale version references removed from operator-facing errors and docs* — Error messages and documentation that pinned to long-past versions are restated version-agnostically with the relevant escape hatch: ZIP64 and unsupported-compression errors in archive reading, the CMS AuthEnvelopedData / fielded-decoder notes, the mTLS CRL-engine error, the safe-archive format-detection summary (which also now correctly lists the supported zip / tar / tar.gz set rather than claiming only zip), and the AI-content IPTC-reader note. None changed behavior; they no longer read as broken promises against the published version history. · *S/MIME confidentiality deferral points to the working PGP path* — `b.mail.crypto.smime` ships sign + verify; encrypt/decrypt is deferred. The deferral note previously cited an open-ended internal condition; it now names the escape hatch directly — use `b.mail.crypto.pgp.encrypt` / `decrypt` for mail confidentiality today — and states the concrete trigger that would re-open S/MIME-specific (X.509-recipient) encryption. · *Governance doc no longer references an internal file operators cannot see* — `GOVERNANCE.md` cited a rule number in a contributor-only file that does not ship in the repository. The deprecation-policy statement is now self-contained.

package/lib/vendor/blamejs/README.md

@@ -114,7 +114,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **CMS codec** — RFC 5652 Cryptographic Message Syntax encoder + decoder with PQC signers (ML-DSA-65 / ML-DSA-87 / SLH-DSA-SHAKE-256f; RFC 9909 + 9881) and KEMRecipientInfo recipients (ML-KEM-1024; RFC 9629 + 9936); ChaCha20-Poly1305 content encryption (RFC 8103) so Efail-class malleability cannot apply (`b.cms`)
 - **Stream throttle** — shared token-bucket bandwidth limiter (RFC 2697 srTCM shape); N concurrent `node:stream` pipelines draw from one operator-configured `bytesPerSec` budget (`b.streamThrottle`)
 - **TLS-RPT receiver** — RFC 8460 inbound aggregate-report ingest; HTTPS POST handler + §4.4 schema parser with gzip-bomb / ratio-bomb / depth-bomb defenses (`b.mail.deploy.parseTlsRptReport` / `b.mail.deploy.tlsRptIngestHttp`)
-- **TLS / channel binding** — RFC 9266 TLS-Exporter token-to-session pinning (`b.tlsExporter`); RFC 9162 CT v2 inclusion-proof verification (`b.network.tls.ct.verifyInclusion`); RFC 8555 ACME + RFC 9773 ARI for 47-day certs with `{ jitter: true }` fleet-scheduling (`b.acme.renewIfDue`); draft-aaron-acme-profiles (`acme.listProfiles()` + `newOrder({ profile })`); draft-ietf-acme-dns-account-label (`acme.dnsAccount01ChallengeRecord(token, { identifier })`); RFC 8470 0-RTT inbound posture refuse / replay-cache (`b.router.create({tls0Rtt})`); RFC 9794 SecP256r1MLKEM768 in preferred-group order (`b.network.tls.preferredGroups`)
+- **TLS / channel binding** — RFC 9266 TLS-Exporter token-to-session pinning (`b.tlsExporter`); RFC 9162 CT v2 inclusion-proof verification (`b.network.tls.ct.verifyInclusion`); RFC 8555 ACME + RFC 9773 ARI for 47-day certs with `{ jitter: true }` fleet-scheduling (`b.acme.renewIfDue`); draft-aaron-acme-profiles (`acme.listProfiles()` + `newOrder({ profile })`); draft-ietf-acme-dns-account-label (`acme.dnsAccount01ChallengeRecord(token, { identifier })`); RFC 8470 0-RTT inbound posture refuse / replay-cache (`b.router.create({tls0Rtt})`); RFC 9794 SecP256r1MLKEM768 in preferred-group order (`b.network.tls.preferredGroups`); RFC 6960 OCSP stapling — the cert manager (`b.cert`) fetches + validates each managed certificate's OCSP response (`b.network.tls.ocsp.fetch`) on a refresh cadence and exposes it on the served context for a TLS server's `OCSPRequest` handler to staple
 - **mTLS CA** — pure-JS, issues clientAuth / serverAuth / dual-EKU certs with SAN; auto-detects highest-PQC signature alg (today ECDSA-P384-SHA384; self-upgrades to SLH-DSA / ML-DSA when X.509 ecosystem catches up); PQC TLS gates inbound + outbound (`b.mtlsCa`, `b.pqcGate`, `b.pqcAgent`)
 ### HTTP
 

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.44",
-  "createdAt": "2026-05-30T00:31:59.364Z",
+  "frameworkVersion": "0.13.45",
+  "createdAt": "2026-05-30T01:07:50.513Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -42813,6 +42813,10 @@
                   "type": "function",
                   "arity": 2
                 },
+                "fetch": {
+                  "type": "function",
+                  "arity": 1
+                },
                 "inspectMustStaple": {
                   "type": "function",
                   "arity": 1

package/lib/vendor/blamejs/lib/cert.js

@@ -22,9 +22,9 @@
  *     - `b.acme.create`         → ACME orders, JWS, ARI fetch
  *     - `b.vault.seal`          → sealed-disk persistence of certs + keys + account material
  *     - `b.safeAsync.repeating` → renewal scheduler with drop-silent error path
- *     - `b.network.tls.ocsp`    → server-side stapling helpers
+ *     - `b.network.tls.ocsp`    → fetches + caches a validated OCSP response per cert for server-side stapling
  *     - `b.audit`               → cert.* lifecycle audit chain
- *     - `b.compliance`          → posture refusals (e.g. plaintext storage refused under HIPAA / PCI)
+ *     - `b.compliance`          → validates the declared posture names; storage-confidentiality postures hold because keys/certs are always sealed at rest
  *
  *   Does NOT ship the challenge-solver implementations (HTTP-01 server,
  *   DNS provider integrations, TLS-ALPN-01 socket). Those are operator-
@@ -60,6 +60,7 @@ var acme          = lazyRequire(function () { return require("./acme"); });
 var vault         = lazyRequire(function () { return require("./vault"); });
 var audit         = lazyRequire(function () { return require("./audit"); });
 var networkTls    = lazyRequire(function () { return require("./network-tls"); });
+var compliance    = lazyRequire(function () { return require("./compliance"); });
 var bCrypto       = lazyRequire(function () { return require("./crypto"); });
 
 var CertError = defineClass("CertError");
@@ -222,7 +223,7 @@ function _createSealedDiskStorage(opts) {
  *     refreshMs:  number,             // default 12h — OCSP-response cache lifetime
  *   },
  *   audit:    boolean | object,       // default true — emit cert.* lifecycle events via b.audit.safeEmit
- *   compliance: Array<string>,         // optional — posture refusals (e.g. ["hipaa"]); refuses plaintext storage etc.
+ *   compliance: Array<string>,         // optional — posture names (e.g. ["hipaa"]); validated against b.compliance.KNOWN_POSTURES (throws on an unknown name) + surfaced on getContext().compliance. Cert keys/certs are always sealed at rest, so storage-confidentiality postures hold by construction.
  *
  * @example
  *   var mgr = b.cert.create({
@@ -383,13 +384,31 @@ function create(opts) {
 
   // ---- Audit + compliance ----
   var auditEnabled = opts.audit !== false;
-  var compliance = Array.isArray(opts.compliance) ? opts.compliance.slice() : [];
+  var compliancePostures = Array.isArray(opts.compliance) ? opts.compliance.slice() : [];
+  // Validate posture names against the framework catalog so a typo is
+  // caught at create() rather than silently ignored. The cert manager
+  // satisfies the storage-confidentiality postures (HIPAA / PCI-DSS /
+  // GDPR …) by construction — keys + certs are always sealed at rest
+  // (storage.type is enforced to "sealed-disk"), so there is no plaintext-
+  // storage state for a posture to fail to. The postures are recorded +
+  // surfaced on the served context for an auditor.
+  if (compliancePostures.length > 0) {
+    var knownPostures = compliance().KNOWN_POSTURES;
+    compliancePostures.forEach(function (p) {
+      if (knownPostures.indexOf(p) === -1) {
+        throw new CertError("cert/unknown-compliance-posture",
+          "cert.create: opts.compliance posture '" + p + "' is not a known posture; " +
+          "see b.compliance.KNOWN_POSTURES");
+      }
+    });
+  }
 
   // ---- Internal state ----
   var emitter = new EventEmitter();
-  var loadedContexts = Object.create(null);   // name → { cert, key, ca, expiresAt, fingerprintSha256, sniNames }
+  var loadedContexts = Object.create(null);   // name → { cert, key, ca, expiresAt, fingerprintSha256, sniNames, ocspResponse }
   var acmeClient = null;
   var scheduler = null;
+  var ocspTimer = null;
   var stopped = false;
 
   function _emitAudit(action, outcome, metadata) {
@@ -689,6 +708,39 @@ function create(opts) {
     }
   }
 
+  // Split a PEM chain into individual certificate blocks (leaf first).
+  function _splitPemChain(pem) {
+    return pem.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) || [];
+  }
+
+  // Fetch + cache a validated OCSP response for one managed cert, for
+  // server-side stapling. Fail-soft: a responder error, or no issuer in the
+  // served chain, leaves any prior staple in place and never throws — an
+  // absent staple degrades gracefully (clients fall back to their own
+  // revocation checking). The validated DER is exposed on
+  // getContext().ocspResponse for the operator's TLS server to staple via
+  // its 'OCSPRequest' handler.
+  async function _refreshOcspFor(name) {
+    var ctx = loadedContexts[name];
+    if (!ctx || !ocspStapling) return;
+    var chain = _splitPemChain(ctx.cert);
+    if (chain.length < 2) return;   // no issuer in the served chain
+    try {
+      // allow:raw-outbound-http — b.network.tls.ocsp.fetch composes b.httpClient internally (SSRF guard + pinned DNS); not a raw outbound call
+      var rv = await networkTls().ocsp.fetch({ leafPem: chain[0], issuerPem: chain[1] });
+      ctx.ocspResponse = rv.ocspDer;
+      _emitAudit("cert.ocsp.refreshed", "success", { name: name });
+    } catch (e) {
+      _emitAudit("cert.ocsp.refresh-failed", "failure",
+        { name: name, error: (e && e.message) || String(e) });
+    }
+  }
+
+  async function _refreshAllOcsp() {
+    var keys = Object.keys(loadedContexts);
+    for (var i = 0; i < keys.length; i += 1) { await _refreshOcspFor(keys[i]); }
+  }
+
   async function start() {
     if (stopped) {
       throw new CertError("cert/already-stopped",
@@ -706,12 +758,21 @@ function create(opts) {
         await _renewCheckOne(certsByName[keys[ki]]);
       }
     }, renewIntervalMs, { name: "cert-renew" });
+    // 3. OCSP stapling. The initial fetch runs in the background so a slow
+    //    responder never delays start(); the staple becomes available
+    //    shortly after, and the timer refreshes on the configured cadence.
+    if (ocspStapling) {
+      _refreshAllOcsp().catch(function () { /* per-cert errors already audited */ });
+      ocspTimer = safeAsync.repeating(_refreshAllOcsp, ocspRefreshMs, { name: "cert-ocsp" });
+    }
   }
 
   async function stop() {
     stopped = true;
     if (scheduler && typeof scheduler.stop === "function") scheduler.stop();
     scheduler = null;
+    if (ocspTimer && typeof ocspTimer.stop === "function") ocspTimer.stop();
+    ocspTimer = null;
   }
 
   function getContext(name) {
@@ -729,6 +790,11 @@ function create(opts) {
       key:                ctx.key,
       expiresAt:          ctx.expiresAt,
       fingerprintSha256:  ctx.fingerprintSha256,
+      // The cached, validated OCSP response (DER Buffer) when ocsp.stapling
+      // is on and a response has been fetched; null otherwise. Staple it
+      // from the TLS server's 'OCSPRequest' handler: cb(null, ocspResponse).
+      ocspResponse:       ctx.ocspResponse || null,
+      compliance:         compliancePostures.slice(),
     };
   }
 
@@ -798,10 +864,6 @@ function create(opts) {
   function off(event, handler)  { emitter.off(event, handler);   return this; }
   function once(event, handler) { emitter.once(event, handler);  return this; }
 
-  // Suppress unused-warnings for ocsp + compliance until those branches
-  // wire up in v0.11.23+ follow-up.
-  void ocspStapling; void ocspRefreshMs; void compliance; void networkTls;
-
   return {
     start:        start,
     stop:         stop,

package/lib/vendor/blamejs/lib/network-tls.js

@@ -20,6 +20,7 @@ var NetworkTlsError = defineClass("NetworkTlsError", { alwaysPermanent: true });
 var observability = lazyRequire(function () { return require("./observability"); });
 var audit = lazyRequire(function () { return require("./audit"); });
 var networkDns = lazyRequire(function () { return require("./network-dns"); });
+var httpClient = lazyRequire(function () { return require("./http-client"); });
 var asn1 = require("./asn1-der");
 
 // STATE.tlsKeyShares is initialized to the default PQC group list at
@@ -1194,9 +1195,10 @@ function evaluateOcspResponse(ocspDer, opts) {
 //
 // Constructs a DER-encoded OCSPRequest for a single (leafCertDer,
 // issuerCertDer) pair, optionally with an RFC 8954 nonce extension.
-// Operators send the returned `requestDer` to the OCSP responder URL
-// (e.g. via b.httpClient with `Content-Type: application/ocsp-request`)
-// and pass `nonce` to `ocsp.evaluate(responseDer, { expectedNonce })`
+// `ocsp.fetch` composes this with `b.httpClient` to POST the request to
+// the cert's responder and return a validated response; operators who
+// need the raw request (custom transport, batched requests) call this
+// directly and pass `nonce` to `ocsp.evaluate(responseDer, { expectedNonce })`
 // to defend against replay attacks.
 //
 // Nonce DEFAULT ON — defense in depth. RFC 6960 §4.4.1 marks nonce
@@ -1291,8 +1293,10 @@ function buildOcspRequest(opts) {
   // framework that touches SHA-1" need a signal. Emit an audit row
   // on every OCSP request build so the algorithm choice is visible
   // in the chain.
-  var nameHash = nodeCrypto.createHash("sha1").update(iss.issuerNameDer).digest();
-  var keyHash  = nodeCrypto.createHash("sha1").update(iss.issuerKey).digest();
+  // lgtm[js/weak-cryptographic-algorithm] — RFC 6960 §4.1.1 CertID lookup hash over the PUBLIC issuer name; a name/key lookup, not an integrity or secrecy operation. SHA-256 CertIDs are §4.3-optional and rejected by most responders.
+  var nameHash = nodeCrypto.createHash("sha1").update(iss.issuerNameDer).digest(); // lgtm[js/weak-cryptographic-algorithm]
+  // lgtm[js/weak-cryptographic-algorithm] — RFC 6960 §4.1.1 CertID lookup hash over the PUBLIC issuer key; a name/key lookup, not an integrity or secrecy operation.
+  var keyHash  = nodeCrypto.createHash("sha1").update(iss.issuerKey).digest(); // lgtm[js/weak-cryptographic-algorithm]
   setImmediate(function () {
     try {
       var auditMod = require("./audit");                                            // allow:inline-require — circular-load defense (audit imports network-tls)
@@ -1339,6 +1343,77 @@ function buildOcspRequest(opts) {
   return { requestDer: requestDer, nonce: nonceBytes };
 }
 
+// _ocspResponderUrl — pull the OCSP responder URL out of a cert's
+// Authority Information Access extension. node:crypto exposes it as a
+// multi-line string ("OCSP - URI:http://...\nCA Issuers - URI:...\n").
+function _ocspResponderUrl(x509) {
+  var ia = x509 && x509.infoAccess;
+  if (typeof ia !== "string") return null;
+  var m = ia.match(/OCSP\s*-\s*URI:(\S+)/i);
+  return m ? m[1].trim() : null;
+}
+
+// fetch — POST a freshly-built OCSPRequest to the cert's responder and
+// return the validated, known-good response bytes. Composes buildRequest +
+// b.httpClient + evaluate, completing the server-side-stapling fetch path
+// (the response is what a TLS server staples via its 'OCSPRequest' handler).
+// The responder URL is taken from the leaf cert's AIA extension unless
+// opts.responderUrl overrides it. Throws TlsTrustError on any failure
+// (no responder, transport error, non-good certStatus, signature mismatch);
+// callers that staple should treat a throw as "no staple this cycle".
+async function fetchOcspResponse(opts) {
+  opts = opts || {};
+  if (typeof opts.leafPem !== "string" || typeof opts.issuerPem !== "string") {
+    throw new TlsTrustError("tls/ocsp-bad-input",
+      "ocsp.fetch: opts.leafPem and opts.issuerPem (PEM strings) are required");
+  }
+  var leafX, issuerX;
+  try {
+    leafX = new nodeCrypto.X509Certificate(opts.leafPem);
+    issuerX = new nodeCrypto.X509Certificate(opts.issuerPem);
+  } catch (e) {
+    throw new TlsTrustError("tls/ocsp-bad-cert",
+      "ocsp.fetch: could not parse leaf/issuer PEM: " + ((e && e.message) || String(e)));
+  }
+  var responderUrl = opts.responderUrl || _ocspResponderUrl(leafX);
+  if (!responderUrl) {
+    throw new TlsTrustError("tls/ocsp-no-responder",
+      "ocsp.fetch: cert has no AIA OCSP responder URL; pass opts.responderUrl");
+  }
+  var built = buildOcspRequest({
+    leafCertDer: leafX.raw, issuerCertDer: issuerX.raw,
+    nonce: opts.nonce, nonceLen: opts.nonceLen,
+  });
+  var res;
+  try {
+    res = await httpClient().request({
+      url:          responderUrl,
+      method:       "POST",
+      headers:      { "content-type": "application/ocsp-request", "accept": "application/ocsp-response" },
+      body:         built.requestDer,
+      responseMode: "buffer",
+      timeoutMs:    opts.timeoutMs || C.TIME.seconds(10),
+    });
+  } catch (e) {
+    throw new TlsTrustError("tls/ocsp-fetch-failed",
+      "ocsp.fetch: responder request to " + responderUrl + " failed: " + ((e && e.message) || String(e)));
+  }
+  if (res.status !== 200 || !Buffer.isBuffer(res.body) || res.body.length === 0) {
+    throw new TlsTrustError("tls/ocsp-fetch-bad-status",
+      "ocsp.fetch: responder returned status " + res.status + " with an empty/non-buffer body");
+  }
+  var evald = evaluateOcspResponse(res.body, {
+    issuerPem:     opts.issuerPem,
+    serialHex:     opts.serialHex || null,
+    expectedNonce: opts.nonce === false ? null : built.nonce,
+  });
+  if (!evald.ok) {
+    throw new TlsTrustError("tls/ocsp-not-good",
+      "ocsp.fetch: response is not good: " + (evald.errors || []).join("; "));
+  }
+  return { ocspDer: res.body, evaluation: evald, responderUrl: responderUrl };
+}
+
 var ocsp = Object.freeze({
   // Connect with OCSP requested. Returns { authorized, ocspBytes,
   // peerCert }. requireStapled: true makes empty / not-stapled responses
@@ -1379,6 +1454,7 @@ var ocsp = Object.freeze({
   },
   parseResponse:        parseOcspResponse,
   evaluate:             evaluateOcspResponse,
+  fetch:                fetchOcspResponse,
   // buildRequest — construct a DER-encoded OCSPRequest for a single
   // (leafCertDer, issuerCertDer) pair. RFC 8954 nonce extension is ON
   // by default (16 random bytes; opts.nonceLen overrides within RFC

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.44",
+  "version": "0.13.45",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.45.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.45",
+  "date": "2026-05-29",
+  "headline": "`b.cert` now fetches and staples a validated OCSP response per certificate, and validates declared compliance postures at create()",
+  "summary": "Two capabilities that b.cert documented but did not act on are now wired through. OCSP stapling: the cert manager fetches the leaf's OCSP response from the responder named in its Authority Information Access extension, validates it against the issuer (status, nonce, serial) via b.network.tls.ocsp, caches the DER, and exposes it on getContext().ocspResponse so a TLS server's OCSPRequest handler can staple it. The fetch runs in the background on a refresh timer and never blocks cert.start() — a slow or unreachable responder produces an audited per-certificate failure, not a stalled boot. Compliance postures: opts.compliance names are now validated against b.compliance.KNOWN_POSTURES at create() (an unknown name throws cert/unknown-compliance-posture instead of being silently recorded) and are surfaced on getContext().compliance for an auditor. Storage-confidentiality postures hold by construction because cert keys and certificates are always sealed at rest. The supporting composition primitive b.network.tls.ocsp.fetch (build request, POST to the responder through b.httpClient, validate the response) is now part of the public OCSP surface.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.network.tls.ocsp.fetch — fetch and validate an OCSP response",
+          "body": "The OCSP helper set previously built requests and evaluated responses but had no way to actually retrieve one. b.network.tls.ocsp.fetch({ leafPem, issuerPem, nonce?, timeoutMs? }) reads the responder URL from the leaf certificate's Authority Information Access extension, builds the request, POSTs it through b.httpClient (so the SSRF guard and pinned DNS apply), and validates the response against the issuer — returning the validated DER plus the parsed evaluation. It rejects when the leaf carries no OCSP responder URL or the response fails validation."
+        },
+        {
+          "title": "b.cert staples a validated OCSP response per certificate",
+          "body": "With ocsp.stapling enabled (the default), the cert manager refreshes each certificate's OCSP response on a timer (ocsp.refreshMs, default 12h) and caches the validated DER. getContext(serverName).ocspResponse returns that DER for a TLS server to hand back from its OCSPRequest handler. The refresh runs in the background and is never on the path of cert.start(): an unreachable or slow responder is recorded as an audited cert.ocsp.refresh failure for that certificate and leaves the rest of the manager running."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "opts.compliance posture names are validated at create()",
+          "body": "b.cert.create now checks each name in opts.compliance against b.compliance.KNOWN_POSTURES and throws cert/unknown-compliance-posture on an unrecognized name, so a typo is caught at construction rather than being silently recorded. The declared postures are surfaced on getContext().compliance. Cert keys and certificates are always sealed at rest, so storage-confidentiality postures are satisfied by construction."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/cert.test.js

@@ -245,6 +245,49 @@ function testFactoryRefusesBadOpts() {
     });
     check("cert name '" + JSON.stringify(badName) + "' refused as path-segment", e && e.code === "cert/bad-cert-name");
   });
+
+  // ---- compliance posture validation ----
+  // opts.compliance names are validated against b.compliance.KNOWN_POSTURES
+  // at create() so a typo is caught at boot rather than silently recorded.
+  var goodChallenge = { type: "http-01", provision: function () {}, cleanup: function () {} };
+  var eBadPosture = threw(function () {
+    b.cert.create({
+      storage:    { type: "sealed-disk", rootDir: _tmpDir(), vault: _ephemeralVault() },
+      acme:       { directory: "https://example/", accountKey: "auto" },
+      certs:      [{ name: "m", domains: ["a.com"], challenge: goodChallenge }],
+      compliance: ["not-a-real-posture"],
+      audit:      false,
+    });
+  });
+  check("unknown compliance posture → cert/unknown-compliance-posture",
+    eBadPosture && eBadPosture.code === "cert/unknown-compliance-posture");
+
+  var eGoodPosture = threw(function () {
+    b.cert.create({
+      storage:    { type: "sealed-disk", rootDir: _tmpDir(), vault: _ephemeralVault() },
+      acme:       { directory: "https://example/", accountKey: "auto" },
+      certs:      [{ name: "m", domains: ["a.com"], challenge: goodChallenge }],
+      compliance: ["hipaa", "pci-dss"],
+      audit:      false,
+    });
+  });
+  check("known compliance postures accepted", !eGoodPosture);
+
+  // ---- b.network.tls.ocsp.fetch composition surface ----
+  check("b.network.tls.ocsp.fetch is a function",
+    typeof b.network.tls.ocsp.fetch === "function");
+}
+
+// b.network.tls.ocsp.fetch rejects on missing leafPem/issuerPem rather than
+// issuing an outbound request with undefined inputs.
+async function testOcspFetchRejectsBadInput() {
+  var rejected = false;
+  try {
+    await b.network.tls.ocsp.fetch({});
+  } catch (_e) {
+    rejected = true;
+  }
+  check("ocsp.fetch({}) rejects (no leafPem/issuerPem)", rejected);
 }
 
 // ---- Sealed-disk storage roundtrip ----
@@ -699,6 +742,7 @@ async function testCorruptAccountKeyClearError() {
 async function run() {
   testSurface();
   testFactoryRefusesBadOpts();
+  await testOcspFetchRejectsBadInput();
   await testStorageRoundtrip();
   await testSniCallback();
   await testSniWildcardSingleLabel();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.26",
+  "version": "0.2.28",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {