@blamejs/blamejs-shop 0.2.3 → 0.2.4

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.4 (2026-05-27) — **Announcement bar — publish a sitewide promo or notice strip from the admin console.** Operators can now publish a sitewide announcement bar — a strip at the very top of every storefront page for a sale, a shipping notice, or an urgent alert. Manage it from a new Announcements screen in the admin console: set the message, an optional call-to-action link, a theme (urgency, promo, info, or success), the audience (everyone, signed-out visitors, or signed-in customers), an optional start/expiry schedule, and whether visitors can dismiss it. The highest-priority active announcement shows automatically (urgency outranks promo outranks info outranks success). The bar renders on both the edge and container paths so it appears on every page including the cached ones, and a dismissed bar stays hidden across navigation. Until an announcement is published, nothing changes. **Added:** *Sitewide announcement bar* — A page-top strip rendered on every storefront page (home, search, product, cart, blog, and the storefront chrome) in one of four themes. The single highest-priority active announcement for the viewer is shown, chosen by theme rank (urgency > promo > info > success). Audience targeting covers everyone, signed-out visitors, and signed-in customers, with an optional scheduled start and expiry. An optional call-to-action link is included; its URL is restricted to https:// or a site-relative path. · *Admin console: Announcements* — A new Announcements screen (and matching JSON API) to create announcements, filter the list to those active right now, and archive ones that are done. The screen appears in the console only when the announcement primitive is wired. · *Dismiss without a round-trip* — Dismissible announcements carry a close control. With JavaScript it's hidden in place and remembered in a local cookie so it doesn't reappear as you browse; with JavaScript off, a form submission records the dismissal and returns you to the page. The bar is always server-rendered identically for everyone, so a dismissed bar never leaks back in from a cached page — it's hidden per-visitor on the client.
+
 - v0.2.3 (2026-05-27) — **Admin console adopts the dark violet brand — the operator dashboard now matches the storefront.** The admin console has been restyled from its previous light theme and orange accent onto the same dark violet identity as the storefront: a neutral near-black canvas with violet reserved for accents, the self-hosted Hanken Grotesk and Space Mono typefaces in place of Inter, and Space Mono carrying the terminal-style chrome (header mark, navigation, micro-labels, figures, SKUs, order ids, and code). Stat cards, tables, status pills, forms, buttons, banners, nav cards, and the sign-in card are all recoloured for the dark surface with contrast preserved — order statuses keep their meaning (green for paid/shipped, amber for pending, violet for refunded, muted for cancelled), form inputs read clearly on the dark wells, and the revenue sparkline is drawn in the brand violet. Operators on the default theme get the new console on upgrade; no admin functionality, routes, or data change. **Changed:** *Dark violet admin theme* — The admin stylesheet is rebuilt on the storefront's palette — near-black surfaces, neutral hairline borders, and violet reserved for accents (active nav, primary buttons, the `/ admin` mark, focus states, and the revenue sparkline) rather than the former light paper and orange. Self-hosted Hanken Grotesk (display/body) and Space Mono (chrome/mono) replace Inter, loaded under the strict `font-src 'self'` policy. · *Components recoloured for the dark surface* — Stat cards, the orders table, status pills, filter chips, forms, buttons (primary/ghost/danger), banners, nav cards, the gift-card detail grid, and the sign-in card are all restyled for dark with contrast maintained. Order-status pills keep their semantics — green for paid/shipped/fulfilling/delivered, amber for pending, violet for refunded, muted for cancelled. Form inputs sit on recessed dark wells with light text and a violet focus ring.
 
 - v0.2.2 (2026-05-27) — **Bespoke line-art illustrations across the storefront — category tiles, image placeholders, and every empty state.** The storefront's stand-in graphics are now a single, cohesive set of hand-drawn line illustrations in the brand violet, replacing the previous mix of gradient-only tiles, single-letter image marks, and emoji. The six featured-collection tiles carry a matching icon (apparel, hardware, digital, subscriptions, bundles, gift cards). Products without an image — in the grid and on the product page — show a bespoke "no image yet" placeholder instead of a letter glyph. Every empty state has its own illustration: cart, search, wishlist, saved-for-later, addresses, returns, and orders. The artwork is inline SVG (no extra files fetched, consistent with the strict asset policy) and adapts to the surface — the fine detail strokes follow the text colour, so the same set reads correctly on a dark or a light background. **Changed:** *Category tiles carry line-art icons* — Each of the six featured-collection tiles now shows a violet line icon for its category, centered over the existing tile gradient. The tile links and labels are unchanged. · *Bespoke image placeholder replaces the letter mark* — When a product has no image, the grid card and the product-page gallery render a line-art "no image yet" placeholder — an isometric package on a faint grid (the product page adds a shield motif and a terminal-prompt accent) — instead of the previous single uppercase letter. The no-image grid card now uses the same media-card layout as image-bearing cards for a consistent grid. · *Every empty state has matching artwork* — The empty cart, no-search-results, empty wishlist, saved-for-later, addresses, returns, and orders states now show a bespoke line illustration in place of the previous emoji or unicode glyphs, so the storefront and account sections share one visual language. · *Inline, theme-adaptive SVG* — All of the new artwork is inline SVG with presentation attributes only — nothing is fetched from a CDN and no inline styles are used, consistent with the strict content-security and asset policies. The detail strokes use currentColor, so the set adapts to the background it sits on. The edge and container renderers emit identical markup.

package/lib/admin.js

@@ -300,7 +300,7 @@ function mount(router, deps) {
   // Which optional console sections are wired — gates their nav links so a
   // signed-in admin is never sent to a route that wasn't mounted. Passed
   // into every authed render call as `nav_available`.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -2098,6 +2098,79 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- announcements --------------------------------------------------
+  // Sitewide promo/notice strip. Content-negotiated like the other console
+  // screens: bearer → the JSON contract; signed-in browser → the HTML
+  // table + create form. The console exposes the all / guest / logged_in
+  // audiences; the primitive's segment audience needs an isMember handle
+  // that isn't wired (see server.js), so it isn't offered here.
+  if (deps.announcementBar) {
+    var announcements = deps.announcementBar;
+
+    router.get("/admin/announcements", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var activeS = url && url.searchParams.get("active");
+        var rows = await announcements.listAnnouncements(activeS === "1" ? { active_only: true } : {});
+        _json(res, 200, { rows: rows });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var activeS = url && url.searchParams.get("active");
+        var rows = await announcements.listAnnouncements(activeS === "1" ? { active_only: true } : {});
+        _sendHtml(res, 200, renderAdminAnnouncements({
+          shop_name: deps.shop_name, nav_available: navAvailable, announcements: rows,
+          active_filter: activeS,
+          created:  url && url.searchParams.get("created"),
+          archived: url && url.searchParams.get("archived"),
+          notice:   (url && url.searchParams.get("err")) ? "That action couldn't be completed for the announcement." : null,
+        }));
+      },
+    ));
+
+    router.post("/admin/announcements", _pageOrApi(false,
+      W("announcement.define", async function (req, res) {
+        var row = await announcements.defineAnnouncement(req.body || {});
+        _json(res, 201, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        try {
+          await announcements.defineAnnouncement(_announcementFromForm(req.body || {}));
+        } catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          var rows = await announcements.listAnnouncements({});
+          return _sendHtml(res, 400, renderAdminAnnouncements({
+            shop_name: deps.shop_name, nav_available: navAvailable, announcements: rows,
+            notice: (e && e.message || "Couldn't save that announcement.").replace(/^announcementBar[.:]\s*/, ""),
+          }));
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".announcement.define", outcome: "success" });
+        _redirect(res, "/admin/announcements?created=1");
+      },
+    ));
+
+    router.post("/admin/announcements/:slug/archive", _pageOrApi(false,
+      W("announcement.archive", async function (req, res) {
+        var row;
+        try { row = await announcements.archiveAnnouncement(req.params.slug); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!row) return _problem(res, 404, "announcement-not-found");
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var row = null;
+        try { row = await announcements.archiveAnnouncement(slug); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; }
+        if (!row) return _redirect(res, "/admin/announcements?err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".announcement.archive", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/announcements?archived=1");
+      },
+    ));
+  }
+
   // ---- analytics ------------------------------------------------------
 
   var analytics = deps.analytics || null;
@@ -2772,6 +2845,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "questions",    href: "/admin/questions",    label: "Q&A",          requires: "productQa" },
   { key: "subscriptions", href: "/admin/subscription-plans", label: "Subscriptions", requires: "subscriptions" },
   { key: "collections",  href: "/admin/collections",  label: "Collections",  requires: "collections" },
+  { key: "announcements", href: "/admin/announcements", label: "Announcements", requires: "announcementBar" },
   { key: "giftcards",    href: "/admin/gift-cards",    label: "Gift cards",   requires: "giftcards" },
   { key: "webhooks",     href: "/admin/webhooks",     label: "Webhooks",     requires: "webhooks" },
   { key: "integrations", href: "/admin/integrations", label: "Integrations" },
@@ -3910,6 +3984,98 @@ function renderAdminCollections(opts) {
   return _renderAdminShell(opts.shop_name, "Collections", bodyHtml, "collections", opts.nav_available);
 }
 
+// A <datetime-local> form value → epoch ms (integer) for the lib's
+// starts_at/expires_at, or null when blank/unparseable (open-ended). The
+// announcement primitive validates the result; a blank schedule field just
+// omits the bound.
+function _epochFromForm(v) {
+  if (typeof v !== "string" || !v.trim()) return null;
+  var t = Date.parse(v.trim());
+  return Number.isFinite(t) ? t : null;
+}
+
+// Coerce the create form into the shape announcementBar.defineAnnouncement
+// expects: trimmed slug, strict boolean `dismissible`, integer epoch
+// schedule bounds, and link_url/link_label as a both-or-neither pair.
+function _announcementFromForm(body) {
+  body = body || {};
+  var out = {
+    slug:        typeof body.slug === "string" ? body.slug.trim() : body.slug,
+    message:     body.message,
+    theme:       body.theme,
+    audience:    body.audience,
+    dismissible: body.dismissible === "on" || body.dismissible === "1" || body.dismissible === true,
+  };
+  var lu = typeof body.link_url === "string" ? body.link_url.trim() : "";
+  var ll = typeof body.link_label === "string" ? body.link_label.trim() : "";
+  if (lu || ll) { out.link_url = lu; out.link_label = ll; }
+  var sa = _epochFromForm(body.starts_at);  if (sa != null) out.starts_at = sa;
+  var ea = _epochFromForm(body.expires_at); if (ea != null) out.expires_at = ea;
+  return out;
+}
+
+function renderAdminAnnouncements(opts) {
+  opts = opts || {};
+  var rows = opts.announcements || [];
+  var created  = opts.created  ? "<div class=\"banner banner--ok\">Announcement saved.</div>" : "";
+  var archived = opts.archived ? "<div class=\"banner banner--ok\">Announcement archived.</div>" : "";
+  var notice   = opts.notice   ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var af = opts.active_filter;
+  var chips = "<div class=\"order-filters\">" +
+    "<a class=\"chip" + (af == null ? " chip--on" : "") + "\" href=\"/admin/announcements\">All</a>" +
+    "<a class=\"chip" + (af === "1" ? " chip--on" : "") + "\" href=\"/admin/announcements?active=1\">Active now</a>" +
+    "</div>";
+
+  var bodyRows = rows.map(function (a) {
+    var isArchived = a.archived_at != null;
+    return "<tr>" +
+      "<td><code class=\"order-id\">" + _htmlEscape(a.slug) + "</code></td>" +
+      "<td>" + _htmlEscape(a.message) + "</td>" +
+      "<td><span class=\"status-pill\">" + _htmlEscape(a.theme) + "</span></td>" +
+      "<td>" + _htmlEscape(a.audience) + "</td>" +
+      "<td><span class=\"status-pill " + (isArchived ? "cancelled" : "paid") + "\">" + (isArchived ? "archived" : "active") + "</span></td>" +
+      "<td><div class=\"actions-row\">" +
+        (isArchived ? "" :
+          "<form method=\"post\" action=\"/admin/announcements/" + _htmlEscape(encodeURIComponent(a.slug)) + "/archive\" class=\"form-inline\">" +
+            "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>") +
+      "</div></td>" +
+    "</tr>";
+  }).join("");
+
+  var table = rows.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Slug</th><th scope=\"col\">Message</th><th scope=\"col\">Theme</th><th scope=\"col\">Audience</th><th scope=\"col\">Status</th><th scope=\"col\">Actions</th></tr></thead><tbody>" + bodyRows + "</tbody></table></div>"
+    : "<p class=\"empty\">No announcements" + (af === "1" ? " active right now" : " yet") + ".</p>";
+
+  var themeOpts = ["urgency", "promo", "info", "success"].map(function (t) {
+    return "<option value=\"" + t + "\"" + (t === "info" ? " selected" : "") + ">" + t + "</option>";
+  }).join("");
+  var audienceOpts = ["all", "guest", "logged_in"].map(function (au) {
+    return "<option value=\"" + au + "\">" + au + "</option>";
+  }).join("");
+
+  var createForm =
+    "<div class=\"panel mt mw-40\">" +
+      "<h3 class=\"subhead\">Create an announcement</h3>" +
+      "<p class=\"meta\">The highest-priority active announcement shows at the top of every page (urgency &gt; promo &gt; info &gt; success). Leave the schedule blank for an open-ended notice.</p>" +
+      "<form method=\"post\" action=\"/admin/announcements\">" +
+        _setupField("Slug", "slug", "", "text", "Lowercase, hyphenated — a stable id.", " maxlength=\"64\" required") +
+        "<label class=\"form-field\"><span>Message</span><textarea name=\"message\" maxlength=\"500\" required></textarea></label>" +
+        _setupField("Link URL (optional)", "link_url", "", "text", "https:// or a /-rooted path.", " maxlength=\"2048\"") +
+        _setupField("Link label (optional)", "link_label", "", "text", "", " maxlength=\"120\"") +
+        "<label class=\"form-field\"><span>Theme</span><select name=\"theme\">" + themeOpts + "</select></label>" +
+        "<label class=\"form-field\"><span>Audience</span><select name=\"audience\">" + audienceOpts + "</select></label>" +
+        "<label class=\"form-field\"><span>Starts at (optional)</span><input type=\"datetime-local\" name=\"starts_at\"></label>" +
+        "<label class=\"form-field\"><span>Expires at (optional)</span><input type=\"datetime-local\" name=\"expires_at\"></label>" +
+        "<label class=\"kv\"><input type=\"checkbox\" name=\"dismissible\" value=\"on\" checked> Visitors can dismiss this</label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Create announcement</button></div>" +
+      "</form>" +
+    "</div>";
+
+  var bodyHtml = "<section><h2>Announcements</h2>" + created + archived + notice + chips + table + createForm + "</section>";
+  return _renderAdminShell(opts.shop_name, "Announcements", bodyHtml, "announcements", opts.nav_available);
+}
+
 function renderAdminCollection(opts) {
   opts = opts || {};
   var col = opts.collection;

package/lib/asset-manifest.json

@@ -1,13 +1,17 @@
 {
-  "version": "0.2.3",
+  "version": "0.2.4",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-FgqvXcZygYkJjjOtXAeu9xi6AtYqkchPnJKcS0OeHm8lynhd9r4RfdpoT7P7j7/l",
       "fingerprinted": "css/admin.afd7b964c1f6fe1b.css"
     },
     "css/main.css": {
-      "integrity": "sha384-iKbkn3AR4k733EgN+1Ju51qbKfz9yVmDk8lE2l99asnRGbSo4BJu4Lo+OTxcBME4",
-      "fingerprinted": "css/main.5678b2596038b019.css"
+      "integrity": "sha384-fMfWbfkIZ29Z4RjHyn3ol0SOf/VodnKqDjkrU7OCQLvzm6hFHRL3kcwMGNnXzdai",
+      "fingerprinted": "css/main.73ee71264ed8de75.css"
+    },
+    "js/announcement.js": {
+      "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",
+      "fingerprinted": "js/announcement.59eab4872d2f3b4c.js"
     },
     "js/consent.js": {
       "integrity": "sha384-KKMQ0og8HPOykRRPpUyxX7dMhTvKySfVtpGX/jGWzZwNaN/c4OykvRvXpqBHcQST",

package/lib/storefront.js

@@ -160,6 +160,7 @@ var LAYOUT =
   "</head>\n" +
   "<body>\n" +
   "  <a class=\"skip-link\" href=\"#main\">{{skip_to_content}}</a>\n" +
+  "RAW_ANNOUNCEMENT_BAR" +
   "\n" +
   "  <div class=\"utility-bar\" role=\"complementary\">\n" +
   "    <div class=\"utility-bar__inner\">\n" +
@@ -262,6 +263,7 @@ var LAYOUT =
   "  </footer>\n" +
   CONSENT_BANNER +
   "RAW_CONSENT_SCRIPT" +
+  "RAW_ANNOUNCEMENT_SCRIPT" +
   "</body>\n" +
   "</html>\n";
 
@@ -331,6 +333,128 @@ function _islandScript(name, opts) {
     (sri ? " integrity=\"" + sri + "\"" : "") + " defer" + policyAttr + "></script>";
 }
 
+// ---- announcement bar --------------------------------------------------
+//
+// Sitewide operator promo/notice strip rendered at the top of every page
+// (this container render + the worker/render/*.js LAYOUT mirror it). The
+// active row is resolved per request from a short-TTL in-memory cache of
+// the active announcements — NOT a per-request DB read — because the bar
+// is page-top chrome on every route and the active set changes rarely
+// (operator-managed). The cache is refreshed out-of-band (fire-and-forget)
+// so a request never blocks on it; resolution is synchronous, which is why
+// it can run in the same sync middleware that seeds the locale context
+// (an async middleware's `enterWith` would not reach the handler).
+//
+// Dismissal mirrors the consent banner: the bar is always server-rendered;
+// the `announcement.js` island hides any bar whose slug is listed in the
+// plain `shop_ann_dismissed` cookie and sets that cookie on dismiss. A
+// no-JS POST /announcements/:slug/dismiss records the durable dismissal +
+// sets the same cookie. The cookie-driven hide is what keeps a dismissed
+// bar from reappearing on an edge-cached page (the slug is in the markup;
+// the island removes it client-side per the visitor's cookie).
+var ANNOUNCEMENT_DISMISS_COOKIE = "shop_ann_dismissed";
+var _BAR_THEME_RANK = { urgency: 3, promo: 2, info: 1, success: 0 };
+var _BAR_TTL_MS = 30000;
+var _annCache = { rows: [], at: 0, inflight: false };
+
+// Refresh the active-announcement cache if it's older than the TTL. Async
+// + fire-and-forget: the caller never awaits it, so a slow D1 read can't
+// stall a page render — the request resolves against whatever the cache
+// last held (empty on a cold first request, then populated within the TTL).
+function _refreshAnnouncementCache(announcementBar) {
+  if (!announcementBar) return;
+  var now = Date.now();
+  if (_annCache.inflight) return;
+  if (now - _annCache.at < _BAR_TTL_MS && _annCache.at !== 0) return;
+  _annCache.inflight = true;
+  Promise.resolve()
+    .then(function () { return announcementBar.listAnnouncements({ active_only: true }); })
+    .then(function (rows) { _annCache.rows = Array.isArray(rows) ? rows : []; _annCache.at = Date.now(); })
+    .catch(function () { /* drop-silent — keep serving the prior cache */ })
+    .then(function () { _annCache.inflight = false; });
+}
+
+// Synchronous pick over the cached active rows: drop announcements whose
+// audience the viewer doesn't match (segment is never matched here — the
+// console doesn't offer it) and return the highest theme-rank survivor
+// (urgency > promo > info > success), ties broken by the cache's own order
+// (updated_at DESC, slug ASC from listAnnouncements).
+//
+// Dismissal is NOT filtered here: the bar is rendered identically for every
+// viewer of an audience (so an edge-cached response is correct for all) and
+// the announcement island hides any bar whose slug is in the visitor's
+// `shop_ann_dismissed` cookie — exactly the consent-banner pattern. This
+// keeps the container + edge renders byte-identical and the shared edge
+// cache key (URL) sound.
+function _resolveActiveAnnouncement(viewerKind) {
+  var rows = _annCache.rows;
+  if (!rows || !rows.length) return null;
+  var best = null;
+  var bestRank = -1;
+  for (var i = 0; i < rows.length; i += 1) {
+    var row = rows[i];
+    if (row.audience === "logged_in" && viewerKind !== "logged_in") continue;
+    if (row.audience === "guest"     && viewerKind !== "guest")     continue;
+    if (row.audience === "segment") continue;
+    var rank = _BAR_THEME_RANK[row.theme];
+    if (rank == null) rank = -1;
+    if (rank > bestRank) { best = row; bestRank = rank; }
+  }
+  return best;
+}
+
+// Parse the plain `shop_ann_dismissed` cookie into an array of slugs. The
+// cookie is a comma-separated slug list (slugs are [a-z0-9-], so no
+// escaping is needed); anything that isn't a well-shaped slug is ignored.
+function _readDismissedSlugs(req) {
+  var raw = _readCookie(req, ANNOUNCEMENT_DISMISS_COOKIE);
+  if (!raw || typeof raw !== "string") return [];
+  var out = [];
+  var parts = raw.split(",");
+  for (var i = 0; i < parts.length; i += 1) {
+    var s = parts[i].trim();
+    if (s && /^[a-z0-9-]{1,64}$/.test(s) && out.indexOf(s) === -1) out.push(s);
+  }
+  return out;
+}
+
+// Render the bar markup for a hydrated announcement row. Returns "" for a
+// null row so a no-announcement page renders unchanged. `currentColor`-free
+// — the theme color comes from the `--<theme>` modifier class in main.css.
+function _buildAnnouncementBar(row) {
+  if (!row) return "";
+  var esc = function (s) { return b.template.escapeHtml(String(s == null ? "" : s)); };
+  var theme = _BAR_THEME_RANK[row.theme] != null ? row.theme : "info";
+  var slug  = esc(row.slug);
+  var link  = "";
+  if (row.link_url && row.link_label) {
+    // Defense-in-depth at the href sink: only emit the link for an https://
+    // URL or a /-rooted absolute path (not protocol-relative `//`). The
+    // lib's `_linkUrl` already enforces exactly this at write time, but
+    // re-checking here means a `javascript:` / `data:` scheme can never
+    // reach the rendered href even if a row ever arrived by another path —
+    // HTML-escaping alone does not neutralise those schemes.
+    var href = String(row.link_url);
+    if (/^https:\/\//i.test(href) || (href.charAt(0) === "/" && href.charAt(1) !== "/")) {
+      link = " <a class=\"announcement-bar__link\" href=\"" + esc(href) + "\">" + esc(row.link_label) + "</a>";
+    }
+  }
+  var dismiss = "";
+  if (row.dismissible) {
+    dismiss =
+      "<form class=\"announcement-bar__dismiss\" method=\"post\" action=\"/announcements/" + slug + "/dismiss\">" +
+        "<input type=\"hidden\" name=\"return_to\" value=\"/\" data-announcement-return>" +
+        "<button type=\"submit\" class=\"announcement-bar__x\" aria-label=\"Dismiss this announcement\">&times;</button>" +
+      "</form>";
+  }
+  return "<aside class=\"announcement-bar announcement-bar--" + theme + "\" role=\"region\" aria-label=\"Store announcement\" data-announcement-slug=\"" + slug + "\">" +
+           "<div class=\"announcement-bar__inner\">" +
+             "<p class=\"announcement-bar__msg\">" + esc(row.message) + link + "</p>" +
+             dismiss +
+           "</div>" +
+         "</aside>";
+}
+
 // Multi-currency display switcher — a GET form in the footer listing the
 // operator's display currencies. Selecting one POSTs to /currency, which
 // sets the sealed `shop_ccy` cookie and redirects back. The currently
@@ -441,6 +565,17 @@ function _wrap(opts) {
   var localeCtx = (opts.locale_ctx && opts.locale_ctx.chrome)
     ? opts.locale_ctx
     : ((storeCtx && storeCtx.chrome) ? storeCtx : _DEFAULT_LOCALE_CTX);
+  // Announcement bar — the active row is resolved by the sync request
+  // middleware and carried on the locale ALS store; an explicit
+  // `opts.announcement` (a renderer or unit test threading its own) wins.
+  // Absent both, no bar renders.
+  var announcementRow = (opts.announcement !== undefined)
+    ? opts.announcement
+    : ((storeCtx && storeCtx.announcement) || null);
+  var announcementBarHtml = _buildAnnouncementBar(announcementRow);
+  var announcementScript  = (announcementRow && announcementRow.dismissible)
+    ? _islandScript("announcement.js", { id: "announcement-island" })
+    : "";
   var chrome = localeCtx.chrome;
   var cartCount = opts.cart_count == null ? 0 : opts.cart_count;
   // The cart aria-label carries the count: when the resolved string is
@@ -481,7 +616,9 @@ function _wrap(opts) {
 
   return _render(LAYOUT, vars)
     .replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
+    .replace("RAW_ANNOUNCEMENT_BAR", announcementBarHtml)
     .replace("RAW_CONSENT_SCRIPT", _islandScript("consent.js", { id: "consent-island", policy: _activeConsentPolicy }))
+    .replace("RAW_ANNOUNCEMENT_SCRIPT", announcementScript)
     .replace("RAW_CURRENCY_SWITCHER", switcherHtml)
     .replace("RAW_LOCALE_SWITCHER", localeCtx.switcher_html || "")
     .replace("RAW_BODY_PLACEHOLDER", opts.body);
@@ -4853,6 +4990,62 @@ function mount(router, deps) {
     });
   }
 
+  // Announcement-bar resolution — synchronous, so its `enterWith` reaches
+  // the page handler (an async middleware's would not). Runs AFTER the
+  // locale middleware so it can extend that request's ALS context rather
+  // than replace it. The active set comes from a short-TTL in-memory cache
+  // refreshed out-of-band here (fire-and-forget — never blocks the render);
+  // resolution itself reads the cache + the dismissed-slug cookie + a
+  // coarse logged-in/guest signal (auth-cookie presence — exact identity
+  // isn't needed to bucket audience). Best-effort: any failure drops the
+  // bar, never the page.
+  if (typeof router.use === "function" && deps.announcementBar) {
+    router.use(function announcementMiddleware(req, _res, next) {
+      try {
+        _refreshAnnouncementCache(deps.announcementBar);
+        var viewerKind = _cookieJar().read(req, AUTH_COOKIE_NAME) ? "logged_in" : "guest";
+        var row = _resolveActiveAnnouncement(viewerKind);
+        var cur = _localeAls.getStore() || {};
+        _localeAls.enterWith(Object.assign({}, cur, { announcement: row }));
+      } catch (_e) { /* drop-silent — no bar this request */ }
+      next();
+    });
+
+    // Dismiss an announcement (no-JS path; the island intercepts the click
+    // and stays on-page). Records the durable dismissal keyed on the
+    // session id when one is present, always appends the slug to the plain
+    // `shop_ann_dismissed` cookie (the cookie is what hides the bar on a
+    // cached edge response), and 303-redirects to a validated same-origin
+    // return path. Unknown slug / no session still sets the cookie + redirects
+    // — a hostile or stale slug can never 500 the route.
+    router.post("/announcements/:slug/dismiss", async function (req, res) {
+      var slug = (req.params && typeof req.params.slug === "string") ? req.params.slug : "";
+      var body = req.body || {};
+      var to = (typeof body.return_to === "string") ? body.return_to : "/";
+      if (to.charAt(0) !== "/" || to.charAt(1) === "/" || to.indexOf("\\") !== -1 || /[\x00-\x1f\x7f]/.test(to)) {
+        to = "/";
+      }
+      if (/^[a-z0-9-]{1,64}$/.test(slug)) {
+        // Durable record (best-effort — keyed on the cart session id; absent
+        // a session the cookie still carries the dismissal for this browser).
+        try {
+          var sid = _readSidCookie(req);
+          if (sid) await deps.announcementBar.recordDismissal({ slug: slug, session_id: sid });
+        } catch (_e) { /* slug not found / no session — cookie still set below */ }
+        // Append the slug to the dismissed-cookie set (deduped, capped).
+        var slugs = _readDismissedSlugs(req);
+        if (slugs.indexOf(slug) === -1) slugs.push(slug);
+        if (slugs.length > 50) slugs = slugs.slice(slugs.length - 50);
+        _cookieJar().write(res, ANNOUNCEMENT_DISMISS_COOKIE, slugs.join(","), {
+          expires: new Date(Date.now() + b.constants.TIME.days(180)), httpOnly: false,
+        });
+      }
+      res.status(303);
+      res.setHeader && res.setHeader("location", to);
+      return res.end ? res.end() : res.send("");
+    });
+  }
+
   // Persist a locale choice. A GET form (works with JS off) from the
   // footer switcher submits `lang` (the chosen tag) + `to` (the path to
   // return to). We validate the tag against the active locale set, set

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.14",
-      "tag": "v0.13.14",
+      "version": "0.13.16",
+      "tag": "v0.13.16",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.16 (2026-05-27) — **`b.mail.agent` docs now describe the facade accurately, and not-yet-wired verbs point to the primitive to use.** b.mail.agent's module documentation claimed it was "the standardization contract for every mail protocol" that JMAP / IMAP / POP3 all route through — but no protocol server actually dispatches through the agent (the framework's own JMAP EmailSubmission handler composes b.mail.send.deliver directly), and the compose / send / reply / forward, sieve.list / sieve.activate, identity / vacation / mdn.* and export / job / import verbs throw mail-agent/not-implemented. The docs are corrected to describe what the agent is: a mailbox-access facade (RBAC + posture + audit + dispatch around a mail store) whose read surface plus the mailbox-mutation and Sieve-upload methods are wired, with the remaining verbs not yet routed through it. Those verbs' error message now names the underlying primitive to compose directly (b.mail.send.deliver, b.mail.sieve, b.mailMdn, …) instead of citing a version tag that had long passed. The public WIRED_AT export (a method→version map that no longer reflected reality) is replaced by COMPOSE_HINT (a method→primitive-to-compose map). No behaviour change: the same methods are wired or throw exactly as before. **Changed:** *`b.mail.agent` documentation corrected; not-implemented errors point to the primitive to compose* — The `@module` / `@card` no longer claim the agent is the universal protocol-dispatch contract — it's documented as a mailbox-access facade with a wired read + mutation + Sieve-upload surface, and the compose/send/identity/vacation/MDN/export verbs documented as not yet routed through it (compose the underlying primitive directly until a protocol server adopts the agent). The `mail-agent/not-implemented` error now names that primitive (e.g. `b.mail.send.deliver`) rather than a passed version tag. **Removed:** *`b.mail.agent.WIRED_AT` export replaced by `COMPOSE_HINT`* — The `WIRED_AT` export mapped each method to a framework version that was supposed to "light it up" — versions that have all shipped without the wiring, so the map was misleading. It is replaced by `COMPOSE_HINT`, mapping each not-yet-wired method to the primitive an operator composes directly. Operators reading `b.mail.agent.WIRED_AT` should read `b.mail.agent.COMPOSE_HINT` instead (pre-1.0: no compatibility shim).
+
+- v0.13.15 (2026-05-27) — **Corrected more source citations and made deferred/reserved options honest in their docs.** A second accuracy pass over source threat-annotations and option docs. Three citation corrections: the base64url strict-decode guard cited CVE-2022-0235 (which is actually a node-fetch cookie-leak, unrelated) — it now names the weakness class it defends (CWE-347 / CWE-1286 signature canonicalization); the glob consecutive-wildcard ReDoS cap cited the wrong library (the CVE-2026-26996 ReDoS is minimatch, not picomatch — the adjacent picomatch one is CVE-2026-33671); and CVE-2026-32178 is reframed to the CWE-138 header-injection-spoofing class the public record actually documents (and dropped from the end-of-data SMTP-smuggling list, which is a different class). Several options/statuses are now honest about not-yet-implemented surface: b.archive.read.zip.fromTrustedStream is marked experimental (its methods throw and its options aren't honored yet — the example now shows the supported buffer-then-random-access path); b.acme revokeCert's useCertKey / certPrivateKey are marked reserved (the cert-key path throws; account-key signing is the supported default); and a stale message claiming passkey break-glass factors were a future feature is removed (passkeys are a live allowed factor). No runtime behaviour changes beyond message/doc text. **Changed:** *Deferred / reserved surface now documented honestly* — `b.archive.read.zip.fromTrustedStream` is marked `experimental` — its `inspect`/`entries`/`extract` throw and its `bombPolicy`/`audit` options aren't honored yet; the documented example now shows the supported path (buffer the stream, then use the random-access reader). `b.acme` `revokeCert`'s `useCertKey` / `certPrivateKey` options are marked reserved (the cert-key-signed-revocation path throws; account-key signing, the default, covers mainstream CAs). A `b.breakGlass` policy error and comment that called passkey factors a future feature are corrected — passkeys are a live allowed factor. **Fixed:** *Corrected misattributed CVE citations in source threat-annotations* — `b.crypto.fromBase64Url`'s strict-decode guard cited CVE-2022-0235 (a node-fetch header-leak, unrelated to base64/JWT decoding); it now cites the weakness class it actually defends — CWE-347 / CWE-1286 signature canonicalization. `b.guardRegex`'s consecutive-`*` cap attributed CVE-2026-26996 to picomatch; that ReDoS is in minimatch (the picomatch ReDoS it also defends is CVE-2026-33671) — the library name is corrected. CVE-2026-32178 is reframed to the CWE-138 header-injection spoofing class the public advisory documents, and removed from the end-of-data SMTP-smuggling trio (a distinct class). No behaviour change — the defenses are unchanged.
+
 - v0.13.14 (2026-05-27) — **DNSSEC chain validation now bounds KeyTrap (CVE-2023-50387) amplification with hard caps.** b.network.dns.dnssec.verifyChain tried every DNSKEY whose 16-bit key tag matched an RRSIG, with no cap on how many candidates or total signature verifications a single response could drive. A hostile zone publishing many DNSKEYs sharing one key tag (plus matching RRSIGs) could force O(keys x signatures) full public-key verifications from one query — the KeyTrap denial-of-service (CVE-2023-50387). Validation is now bounded by non-configurable caps that match the BIND / Unbound mitigations: at most 4 same-tag candidate keys are tried per RRSIG, at most 64 DNSKEYs per zone link and 16 DS records per delegation are accepted, the chain is at most 128 links deep, and the whole response is held to a signature-validation budget that scales with chain depth (so a legitimate deep delegation is never false-rejected while bounded collisions stay bounded); exceeding any of these refuses the response rather than performing the work. Separately, a domain name that encodes to more than 255 octets is now refused at canonicalization (RFC 1035 §2.3.4), which also bounds the NSEC3 closest-encloser label enumeration, and the NSEC3 iteration ceiling is lowered from 500 to 150 to match the BIND 9.16.33+ / Unbound 1.17.1 fix for the sibling CVE-2023-50868. **Security:** *`verifyChain` caps colliding-key fan-out and total signature validations (KeyTrap / CVE-2023-50387)* — A zone advertising many same-key-tag DNSKEYs and RRSIGs can no longer drive unbounded public-key verifications. New refusals: `dnssec/too-many-colliding-keys` (>4 same-tag candidates per RRSIG), `dnssec/too-many-dnskeys` (>64 DNSKEYs per zone link), `dnssec/too-many-ds` (>16 DS records per delegation), `dnssec/too-many-links` (chain deeper than 128), and `dnssec/validation-budget-exceeded` (signature validations beyond the depth-scaled budget). The caps are intentionally non-configurable — they sit well above any legitimate zone, and the budget scales with chain depth so deep delegations validate normally. · *Domain-name octet cap + lower NSEC3 iteration ceiling* — A name that canonicalizes to more than 255 octets is refused (`dnssec/bad-name`, RFC 1035 §2.3.4), which bounds the per-label NSEC3 closest-encloser enumeration (CVE-2023-50868 class). The default NSEC3 iteration ceiling drops from 500 to 150, matching the BIND 9.16.33+ / Unbound 1.17.1 post-CVE defaults (RFC 9276 recommends 0).
 
 - v0.13.13 (2026-05-27) — **Archive extraction-path verification now refuses Windows reserved names, NTFS data streams, and trailing-dot/space per segment.** b.guardFilename.verifyExtractionPath (the per-entry gate b.archive.read.zip.extract / b.safeArchive run on every extracted file) checked traversal, absolute paths, drive-letter and UNC prefixes, null bytes, PATH_MAX overflow, and realpath containment — but not the per-segment Windows write-target hazards the disk validate / sanitize paths already reject. An archive entry named CON, NUL.txt, subdir/LPT1, file.txt:hidden, or secret.txt. stayed inside the extraction root, so the containment and realpath checks passed it, yet on Windows it would resolve to a device, write a hidden NTFS stream, or (after Windows strips the trailing dot/space) overwrite a sibling file. These are now refused: any path segment that collides with a Windows reserved device name, uses NTFS alternate-data-stream syntax (name:stream), or carries a trailing dot or leading/trailing whitespace. The checks are platform-unconditional — a verifier running on Linux still refuses names that are only dangerous on the Windows host that ultimately extracts the archive — with a per-check opt-out (reservedNamePolicy / adsPolicy / leadingTrailingPolicy: "allow") for Linux-only targets. **Security:** *`verifyExtractionPath` refuses per-segment Windows extraction hazards (reserved names / NTFS ADS / trailing dot-space)* — Closes a within-root write-target-redirection gap: an extracted entry could stay inside the destination yet, on Windows, resolve to a device (`CON` / `NUL` / `COM1` / `LPT1`), write a hidden alternate data stream (`file.txt:payload`), or overwrite a sibling after Windows strips a trailing dot/space (`config.`). The verification gate now rejects all three per path segment. Refusal is platform-unconditional (the verifier may run on a different OS than the extractor); set `reservedNamePolicy` / `adsPolicy` / `leadingTrailingPolicy` to `"allow"` to opt a check out on a Linux-only target. Single-entry, name-only residuals — 8.3 short-name aliasing, case-insensitive cross-entry collisions, and archive symlink/hardlink entry-target validation — remain the extract orchestrator's responsibility (it owns the case-folded seen-set and the link-target gate).

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.14",
-  "createdAt": "2026-05-27T12:40:36.809Z",
+  "frameworkVersion": "0.13.16",
+  "createdAt": "2026-05-27T16:55:42.429Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -37552,54 +37552,17 @@
         "agent": {
           "type": "object",
           "members": {
-            "HEAVY_METHODS": {
-              "type": "object",
-              "members": {
-                "export": {
-                  "type": "primitive",
-                  "valueType": "boolean"
-                },
-                "search": {
-                  "type": "primitive",
-                  "valueType": "boolean"
-                }
-              }
-            },
-            "MailAgentError": {
-              "type": "function",
-              "arity": 4
-            },
-            "SCOPE_FOR_METHOD": {
+            "COMPOSE_HINT": {
               "type": "object",
               "members": {
                 "compose": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "delete": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
                 "export": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "expunge": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
-                "fetch": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
-                "flag": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
-                "folders": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
                 "forward": {
                   "type": "primitive",
                   "valueType": "string"
@@ -37628,56 +37591,73 @@
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "move": {
+                "reply": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "quota": {
+                "send": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "reply": {
+                "sieve.activate": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "search": {
+                "sieve.list": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "send": {
+                "vacation.set": {
                   "type": "primitive",
                   "valueType": "string"
+                }
+              }
+            },
+            "HEAVY_METHODS": {
+              "type": "object",
+              "members": {
+                "export": {
+                  "type": "primitive",
+                  "valueType": "boolean"
                 },
-                "sieve.activate": {
+                "search": {
+                  "type": "primitive",
+                  "valueType": "boolean"
+                }
+              }
+            },
+            "MailAgentError": {
+              "type": "function",
+              "arity": 4
+            },
+            "SCOPE_FOR_METHOD": {
+              "type": "object",
+              "members": {
+                "compose": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "sieve.list": {
+                "delete": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "sieve.put": {
+                "export": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "thread": {
+                "expunge": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "vacation.set": {
+                "fetch": {
                   "type": "primitive",
                   "valueType": "string"
-                }
-              }
-            },
-            "WIRED_AT": {
-              "type": "object",
-              "members": {
-                "compose": {
+                },
+                "flag": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "export": {
+                "folders": {
                   "type": "primitive",
                   "valueType": "string"
                 },
@@ -37709,10 +37689,22 @@
                   "type": "primitive",
                   "valueType": "string"
                 },
+                "move": {
+                  "type": "primitive",
+                  "valueType": "string"
+                },
+                "quota": {
+                  "type": "primitive",
+                  "valueType": "string"
+                },
                 "reply": {
                   "type": "primitive",
                   "valueType": "string"
                 },
+                "search": {
+                  "type": "primitive",
+                  "valueType": "string"
+                },
                 "send": {
                   "type": "primitive",
                   "valueType": "string"
@@ -37729,6 +37721,10 @@
                   "type": "primitive",
                   "valueType": "string"
                 },
+                "thread": {
+                  "type": "primitive",
+                  "valueType": "string"
+                },
                 "vacation.set": {
                   "type": "primitive",
                   "valueType": "string"

package/lib/vendor/blamejs/lib/acme.js

@@ -1079,14 +1079,17 @@ function create(opts) {
    * the DER-encoded cert (base64url-encoded automatically) plus an
    * optional `reason` code per RFC 5280 §5.3.1 (0=unspecified,
    * 1=keyCompromise, 3=affiliationChanged, 4=superseded, 5=cessationOfOperation).
-   * Signs with the account key by default; pass `useCertKey:true`
-   * + the cert's private key to authorize via the cert's own key
-   * when the account key is unavailable.
+   * Signs with the account key — the only supported path today, and
+   * sufficient for mainstream CAs. (The cert-key-signed variant —
+   * `useCertKey` / `certPrivateKey` — is reserved and not yet
+   * implemented; passing `useCertKey:true` throws.)
    *
    * @opts
    *   reason:          number,    // RFC 5280 §5.3.1 reason code; default 0 (unspecified)
-   *   useCertKey:      boolean,   // sign with the cert's own key instead of account key
-   *   certPrivateKey:  KeyObject, // required when useCertKey:true
+   *   useCertKey:      boolean,   // RESERVED — cert-key-signed revocation is not yet
+   *                               //   implemented; account-key signing (the default)
+   *                               //   covers mainstream CAs. Passing true throws.
+   *   certPrivateKey:  KeyObject, // RESERVED — consumed only by the cert-key path above
    *
    * @example
    *   await acme.revokeCert(certDerBuffer, { reason: 4 });   // 4 = superseded

package/lib/vendor/blamejs/lib/archive-read.js

@@ -772,7 +772,7 @@ function zip(adapter, opts) {
  * @primitive b.archive.read.zip.fromTrustedStream
  * @signature b.archive.read.zip.fromTrustedStream(adapter, opts?)
  * @since     0.12.7
- * @status    stable
+ * @status    experimental
  * @related   b.archive.read.zip, b.archive.adapters.trustedStream
  *
  * Forward-scan-only ZIP reader for trusted Readable sources. No
@@ -781,20 +781,23 @@ function zip(adapter, opts) {
  * `b.archive.zip().toStream()` output back into a reader for round-trip
  * verification).
  *
- * Adversarial input MUST use the random-access entry point with an
- * `fs` / `buffer` / `objectStore` / `http` adapter.
+ * NOT YET IMPLEMENTED: the streaming LFH walker is not built —
+ * `inspect()` / `entries()` / `extract()` throw
+ * `archive-read/trusted-stream-*-deferred`, and `bombPolicy` / `audit`
+ * are accepted but not yet honored. Re-opens when a streaming
+ * consumer needs it. Until then, collect the stream into a buffer and
+ * use the random-access reader, which is the supported path for both
+ * trusted round-trip verification and adversarial input.
  *
  * @opts
- *   bombPolicy:       { maxEntries, maxEntryDecompressedBytes,
- *                       maxTotalDecompressedBytes, maxExpansionRatio },
- *   audit:            b.audit,
+ *   bombPolicy:       { ... },   // reserved — not yet honored
+ *   audit:            b.audit,   // reserved — not yet honored
  *
  * @example
- *   var produced = fs.createReadStream("./own-export.zip");
- *   var reader   = b.archive.read.zip.fromTrustedStream(
- *     b.archive.adapters.trustedStream(produced)
- *   );
- *   for await (var e of reader.entries()) console.log(e.name, e.size);
+ *   // Supported path: buffer the stream, then read random-access.
+ *   var bytes  = await someStreamToBuffer(producedZipStream);
+ *   var reader = b.archive.read.zip(b.archive.adapters.buffer(bytes));
+ *   var entries = await reader.inspect();
  */
 function fromTrustedStream(adapter, opts) {
   if (!adapter || adapter.kind !== "trusted-sequential") {
@@ -805,25 +808,26 @@ function fromTrustedStream(adapter, opts) {
   var bombPolicy = _normalizeBombPolicy(opts.bombPolicy);
   void bombPolicy;
 
-  // Trusted stream walks LFH-by-LFH. v0.12.7 ships the API surface +
-  // a basic LFH walker for round-trip verification of the framework's
-  // own emitted archives. The full feature parity (extraction via
-  // streaming inflate, data-descriptor scanning) is intentionally
-  // deferred to v0.12.8 alongside the tar reader's sequential mode.
+  // The streaming LFH walker is not built — only the API surface +
+  // adapter validation exist. Extraction via streaming inflate +
+  // data-descriptor scanning re-opens when a streaming consumer needs
+  // it; until then the supported path is to buffer the stream and use
+  // the random-access reader (which handles both trusted round-trip
+  // verification and adversarial input).
   async function inspect() {
     throw new ArchiveReadError("archive-read/trusted-stream-inspect-deferred",
-      "fromTrustedStream.inspect() is deferred to v0.12.8 — use the random-access entry " +
-      "point with b.archive.adapters.buffer(await collect(readable)) for v0.12.7");
+      "fromTrustedStream.inspect() is not implemented — collect the stream into a buffer and " +
+      "use b.archive.read.zip(b.archive.adapters.buffer(bytes))");
   }
 
   async function* entries() {
     throw new ArchiveReadError("archive-read/trusted-stream-entries-deferred",
-      "fromTrustedStream.entries() is deferred to v0.12.8 — collect into buffer for v0.12.7");
+      "fromTrustedStream.entries() is not implemented — collect into a buffer and use the random-access reader");
   }
 
   async function extract() {
     throw new ArchiveReadError("archive-read/trusted-stream-extract-deferred",
-      "fromTrustedStream.extract() is deferred to v0.12.8 — collect into buffer for v0.12.7");
+      "fromTrustedStream.extract() is not implemented — collect into a buffer and use the random-access reader");
   }
 
   return {

package/lib/vendor/blamejs/lib/break-glass.js

@@ -130,9 +130,9 @@ function _ensureFactorLockout() {
 // keys + encryption-context binding (cross-cell tampering / accidental
 // row-swap fails closed). It does NOT defend against vault-key
 // compromise alone — the DEK is still vault-recoverable. True
-// second-factor cryptographic gating ships in v0.5.2 with passkey
-// integration (the passkey private key lives on the YubiKey, not in
-// the framework, so a vault leak alone can't unwrap).
+// second-factor cryptographic gating uses passkey integration (the
+// passkey private key lives on the YubiKey, not in the framework, so a
+// vault leak alone can't unwrap).
 
 // In-memory DEK cache. Keyed by table name. Cleared on _resetForTest.
 var dekCache = new Map();
@@ -520,8 +520,7 @@ function _validatePolicySet(table, opts) {
     if (ALLOWED_FACTORS.indexOf(opts.factors[j]) === -1) {
       throw new BreakGlassError("breakglass/bad-policy",
         "policy.set: factors[" + j + "] '" + opts.factors[j] +
-        "' not in v0.5.0 allowed factors [" + ALLOWED_FACTORS.join(",") + "]" +
-        " (passkey lands in v0.5.2)");
+        "' not in allowed factors [" + ALLOWED_FACTORS.join(",") + "]");
     }
   }
   // Model B (cryptographic mode) ships in v0.5.1. When enabled,

package/lib/vendor/blamejs/lib/crypto.js

@@ -789,10 +789,12 @@ function toBase64Url(buf) {
  *
  * Strict mode (default) refuses non-canonical input — chars outside
  * the RFC 4648 §5 alphabet, length-mod-4-of-1, mixed `+/` from
- * standard base64, trailing garbage. Defends a CVE-2022-0235 class
- * footgun where Node's permissive decoder silently tolerated
- * tampered JWT signatures. Operators with a documented lossy legacy
- * payload opt out per call via `{ strict: false }`.
+ * standard base64, trailing garbage. Defends the CWE-347 /
+ * CWE-1286 signature-canonicalization footgun where a permissive
+ * base64url decoder silently tolerates a tampered JWS / JWT signature
+ * (non-canonical bytes decoding to the same buffer). Operators with a
+ * documented lossy legacy payload opt out per call via
+ * `{ strict: false }`.
  *
  * @opts
  *   strict: boolean   // default: true — refuse non-canonical input
@@ -817,7 +819,8 @@ function fromBase64Url(s, opts) {
   // OAuth `state` round-tripping) MUST reject non-canonical / malformed
   // input. The Node base64url decoder silently tolerates trailing
   // garbage, mixed `+/` from standard base64, missing padding errors,
-  // and length-mod-4 shapes — CVE-2022-0235 class footgun. Strict mode
+  // and length-mod-4 shapes — the CWE-347 / CWE-1286 signature-
+  // canonicalization footgun. Strict mode
   // (the default) refuses anything outside the RFC 4648 §5 alphabet +
   // length rules. Operators with a known-lossy legacy payload pass
   // `{ strict: false }` to opt out per call.

package/lib/vendor/blamejs/lib/guard-dsn.js

@@ -84,8 +84,9 @@
  *     generating a DSN (the existing `b.mail.bounce` primitive does
  *     this); this guard parses INBOUND DSNs and gates the parse
  *     surface bounds, not the bounce-generation policy.
- *   - **DSN header-injection class** (CVE-2026-32178 .NET
- *     System.Net.Mail at outbound; the inbound parse path here)
+ *   - **DSN header-injection class** (CVE-2026-32178 — .NET CWE-138
+ *     special-element / header-injection spoofing, the System.Net.Mail
+ *     vector per MSRC, at outbound; the inbound parse path here)
  *     — refuses CR/LF/NUL/C0 in header lines.
  *   - **CSAF / iSchedule prose tampering** — operator inspecting
  *     the prose part for the original recipient runs into the

package/lib/vendor/blamejs/lib/guard-list-id.js

@@ -37,8 +37,9 @@
  *     octets. Total header value capped at 998 bytes per RFC 5322
  *     §2.1.1 line cap.
  *   - **CRLF + control-char refusal** — header-injection defense
- *     (CVE-2026-32178 .NET System.Net.Mail class on the wire-protocol
- *     surface; this primitive's job is the SEMANTIC shape).
+ *     (CVE-2026-32178 — .NET CWE-138 header-injection spoofing, the
+ *     System.Net.Mail vector per MSRC, on the wire-protocol surface;
+ *     this primitive's job is the SEMANTIC shape).
  *   - **Phrase-injection refusal** — Operator-supplied display
  *     phrase mustn't carry CRLF / `<` / `>` outside the angle
  *     brackets (a separate Bcc/Cc header smuggled into the phrase

package/lib/vendor/blamejs/lib/guard-regex.js

@@ -248,14 +248,14 @@ function _detectIssues(input, opts) {
 }
 
 // Consecutive-star wildcard cap (CVE-2026-26996). Operator-supplied
-// glob fragments compile to picomatch / RegExp; a long run of `*`
-// against a non-matching literal walks O(4^N). Three-or-more
+// glob fragments compile to minimatch / picomatch / RegExp; a long run
+// of `*` against a non-matching literal walks O(4^N). Three-or-more
 // consecutive `*` is the canonical bad shape; `**` (recursive glob)
 // stays permitted, gated by the profile's `maxConsecutiveStars`.
 function _detectConsecutiveStar(input, opts, issues) {
   if (opts.consecutiveStarPolicy === "allow") return;
-  // CVE-2026-26996 is a picomatch / glob-shape backtracking class —
-  // `***+literal` walks O(4^N) when picomatch translates the run to a
+  // CVE-2026-26996 is a minimatch glob-shape backtracking class —
+  // `***+literal` walks O(4^N) when minimatch translates the run to a
   // backtracking-heavy regex. Native ECMAScript regex syntax cannot
   // produce three consecutive `*` quantifiers (it's a SyntaxError),
   // so applying this detector to `inputKind: "regex"` strings only

package/lib/vendor/blamejs/lib/guard-smtp-command.js

@@ -15,8 +15,7 @@
  *   ## Smuggling defense — bare-CR / bare-LF refusal
  *
  *   The SMTP smuggling class (`CVE-2023-51764` Postfix, `CVE-2023-51765`
- *   Sendmail, `CVE-2023-51766` Exim, `CVE-2026-32178` .NET
- *   `System.Net.Mail`) exploits implementations that accept the
+ *   Sendmail, `CVE-2023-51766` Exim) exploits implementations that accept the
  *   non-standard end-of-data sequence `<LF>.<LF>` or `<LF>.<CR><LF>`
  *   instead of the standard `<CR><LF>.<CR><LF>`. The introduced break-
  *   out lets a malicious peer inject a second message past SPF / DMARC

package/lib/vendor/blamejs/lib/mail-agent.js

@@ -7,19 +7,26 @@
  * @featured   true
  *
  * @intro
- *   The standardization contract for every mail protocol blamejs ships.
- *   JMAP (v0.9.27), IMAP (v0.9.28), POP3 (v0.9.29), ManageSieve (v0.9.30),
- *   the inbound MX listener (v0.9.24), and the submission listener
- *   (v0.9.25) all translate their protocol calls into `agent.X(args)`.
- *   The agent owns RBAC, posture enforcement, audit emission,
- *   dispatch, and worker isolation; every protocol on top is a thin
- *   shell.
+ *   A mailbox-access facade that owns RBAC, posture enforcement, audit
+ *   emission, dispatch (local / worker-pool / queue), and worker
+ *   isolation around a mail store, so a protocol server built on top
+ *   can stay a thin shell. It is designed to be the shared dispatch
+ *   layer mail-protocol servers route through; today the read surface
+ *   and the mailbox-mutation + Sieve-upload methods are wired, while the
+ *   compose/send and identity/vacation/MDN/export verbs are not yet
+ *   wired into the facade (see below).
  *
- *   `agent.create()` returns the facade. Methods backed by v0.9.19's
- *   `b.mailStore` run immediately; methods that depend on later slices
- *   throw `mail-agent/not-implemented` with a `wiredAt` tag naming the
- *   version that lights them up (defer-with-condition — operator can
- *   match against the tag to scope their integration).
+ *   `agent.create()` returns the facade. Methods backed by
+ *   `b.mailStore` (folders / fetch / search / move / flag / delete /
+ *   expunge, plus `sieve.put`) run immediately. The remaining verbs —
+ *   compose / send / reply / forward, sieve.list / sieve.activate,
+ *   identity / vacation / mdn.*, export / job / import — throw
+ *   `mail-agent/not-implemented`: they are not yet routed through the
+ *   agent. Until they are, compose the underlying primitive directly
+ *   (`b.mail.send.deliver` for outbound, `b.mail.sieve` for Sieve,
+ *   `b.mailMdn` for MDN, etc.) — which is what the framework's own JMAP
+ *   `emailSubmissionSet` handler does. They wire into the facade when a
+ *   protocol server adopts the agent as its dispatch layer.
  *
  *   ```js
  *   var agent = b.mail.agent.create({
@@ -58,9 +65,11 @@
  *   on every entrypoint.
  *
  * @card
- *   The standardization contract for every mail protocol — JMAP / IMAP /
- *   POP3 all translate into `agent.X(args)`. RBAC + posture + audit +
- *   dispatch owned here; protocols on top are thin shells.
+ *   Mailbox-access facade — RBAC + posture + audit + dispatch around a
+ *   mail store, so a protocol server on top stays a thin shell. Read +
+ *   mailbox-mutation + Sieve-upload methods are wired; compose/send and
+ *   identity/vacation/MDN/export verbs compose the underlying primitive
+ *   directly until a protocol server routes them through the agent.
  */
 
 var lazyRequire        = require("./lazy-require");
@@ -118,25 +127,25 @@ var SCOPE_FOR_METHOD = Object.freeze({
   import:           "mail:import",
 });
 
-// Methods deferred behind a `wiredAt` version. Operator gets a clear
-// error pointing at the slice that lights them up — defer-with-
-// condition per the v1-defensible-scope rule.
-var WIRED_AT = Object.freeze({
-  compose:          "v0.9.25",
-  send:             "v0.9.25",
-  reply:            "v0.9.25",
-  forward:          "v0.9.25",
-  "sieve.list":     "v0.9.26",
-  "sieve.put":      "v0.9.26",
-  "sieve.activate": "v0.9.26",
-  "identity.set":   "v0.9.25",
-  "vacation.set":   "v0.9.25",
-  "mdn.send":       "v0.9.25",
-  "mdn.parse":      "v0.9.25",
-  "mdn.allowList":  "v0.9.25",
-  export:           "v0.9.34a",
-  job:              "v0.9.34a",
-  import:           "v0.9.34",
+// Verbs not yet routed through the agent facade. The error points the
+// operator at the underlying primitive to compose directly (the
+// escape hatch) — defer-with-condition: these wire into the agent when
+// a protocol server adopts it as its dispatch layer.
+var COMPOSE_HINT = Object.freeze({
+  compose:          "b.mail.send.deliver",
+  send:             "b.mail.send.deliver",
+  reply:            "b.mail.send.deliver",
+  forward:          "b.mail.send.deliver",
+  "sieve.list":     "b.mail.sieve",
+  "sieve.activate": "b.mail.sieve",
+  "identity.set":   "your identity store + b.mail.sieve",
+  "vacation.set":   "b.mail.sieve (vacation extension)",
+  "mdn.send":       "b.mailMdn",
+  "mdn.parse":      "b.mailMdn",
+  "mdn.allowList":  "b.mailMdn",
+  export:           "b.mailStore / b.auditTools",
+  job:              "the dispatch queue directly",
+  import:           "b.mailStore",
 });
 
 /**
@@ -653,9 +662,10 @@ function _notImplemented(ctx, method, args) {
   // the slice lights up.
   if (ctx.posture) guardMailQuery.validateActor(args && args.actor, ctx.posture);
   _checkPermission(ctx, method, args);
-  ctx.auditEmit("mail.agent.not_implemented", args && args.actor, { method: method, wiredAt: WIRED_AT[method] });
+  ctx.auditEmit("mail.agent.not_implemented", args && args.actor, { method: method, composeDirectly: COMPOSE_HINT[method] });
   return Promise.reject(new MailAgentError("mail-agent/not-implemented",
-    "agent." + method + ": wired at " + WIRED_AT[method] + " (defer-with-condition)"));
+    "agent." + method + " is not yet routed through the agent facade — compose " +
+    COMPOSE_HINT[method] + " directly"));
 }
 
 // ---- Internals ------------------------------------------------------------
@@ -771,7 +781,7 @@ module.exports = {
   consumer:         consumer,
   MailAgentError:   MailAgentError,
   SCOPE_FOR_METHOD: SCOPE_FOR_METHOD,
-  WIRED_AT:         WIRED_AT,
+  COMPOSE_HINT:     COMPOSE_HINT,
   HEAVY_METHODS:    HEAVY_METHODS,
   // Re-export the guard family so callers can introspect without
   // separate requires.

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.14",
+  "version": "0.13.16",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.15.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.15",
+  "date": "2026-05-27",
+  "headline": "Corrected more source citations and made deferred/reserved options honest in their docs",
+  "summary": "A second accuracy pass over source threat-annotations and option docs. Three citation corrections: the base64url strict-decode guard cited CVE-2022-0235 (which is actually a node-fetch cookie-leak, unrelated) — it now names the weakness class it defends (CWE-347 / CWE-1286 signature canonicalization); the glob consecutive-wildcard ReDoS cap cited the wrong library (the CVE-2026-26996 ReDoS is minimatch, not picomatch — the adjacent picomatch one is CVE-2026-33671); and CVE-2026-32178 is reframed to the CWE-138 header-injection-spoofing class the public record actually documents (and dropped from the end-of-data SMTP-smuggling list, which is a different class). Several options/statuses are now honest about not-yet-implemented surface: b.archive.read.zip.fromTrustedStream is marked experimental (its methods throw and its options aren't honored yet — the example now shows the supported buffer-then-random-access path); b.acme revokeCert's useCertKey / certPrivateKey are marked reserved (the cert-key path throws; account-key signing is the supported default); and a stale message claiming passkey break-glass factors were a future feature is removed (passkeys are a live allowed factor). No runtime behaviour changes beyond message/doc text.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Corrected misattributed CVE citations in source threat-annotations",
+          "body": "`b.crypto.fromBase64Url`'s strict-decode guard cited CVE-2022-0235 (a node-fetch header-leak, unrelated to base64/JWT decoding); it now cites the weakness class it actually defends — CWE-347 / CWE-1286 signature canonicalization. `b.guardRegex`'s consecutive-`*` cap attributed CVE-2026-26996 to picomatch; that ReDoS is in minimatch (the picomatch ReDoS it also defends is CVE-2026-33671) — the library name is corrected. CVE-2026-32178 is reframed to the CWE-138 header-injection spoofing class the public advisory documents, and removed from the end-of-data SMTP-smuggling trio (a distinct class). No behaviour change — the defenses are unchanged."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Deferred / reserved surface now documented honestly",
+          "body": "`b.archive.read.zip.fromTrustedStream` is marked `experimental` — its `inspect`/`entries`/`extract` throw and its `bombPolicy`/`audit` options aren't honored yet; the documented example now shows the supported path (buffer the stream, then use the random-access reader). `b.acme` `revokeCert`'s `useCertKey` / `certPrivateKey` options are marked reserved (the cert-key-signed-revocation path throws; account-key signing, the default, covers mainstream CAs). A `b.breakGlass` policy error and comment that called passkey factors a future feature are corrected — passkeys are a live allowed factor."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.16.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.16",
+  "date": "2026-05-27",
+  "headline": "`b.mail.agent` docs now describe the facade accurately, and not-yet-wired verbs point to the primitive to use",
+  "summary": "b.mail.agent's module documentation claimed it was \"the standardization contract for every mail protocol\" that JMAP / IMAP / POP3 all route through — but no protocol server actually dispatches through the agent (the framework's own JMAP EmailSubmission handler composes b.mail.send.deliver directly), and the compose / send / reply / forward, sieve.list / sieve.activate, identity / vacation / mdn.* and export / job / import verbs throw mail-agent/not-implemented. The docs are corrected to describe what the agent is: a mailbox-access facade (RBAC + posture + audit + dispatch around a mail store) whose read surface plus the mailbox-mutation and Sieve-upload methods are wired, with the remaining verbs not yet routed through it. Those verbs' error message now names the underlying primitive to compose directly (b.mail.send.deliver, b.mail.sieve, b.mailMdn, …) instead of citing a version tag that had long passed. The public WIRED_AT export (a method→version map that no longer reflected reality) is replaced by COMPOSE_HINT (a method→primitive-to-compose map). No behaviour change: the same methods are wired or throw exactly as before.",
+  "sections": [
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "`b.mail.agent` documentation corrected; not-implemented errors point to the primitive to compose",
+          "body": "The `@module` / `@card` no longer claim the agent is the universal protocol-dispatch contract — it's documented as a mailbox-access facade with a wired read + mutation + Sieve-upload surface, and the compose/send/identity/vacation/MDN/export verbs documented as not yet routed through it (compose the underlying primitive directly until a protocol server adopts the agent). The `mail-agent/not-implemented` error now names that primitive (e.g. `b.mail.send.deliver`) rather than a passed version tag."
+        }
+      ]
+    },
+    {
+      "heading": "Removed",
+      "items": [
+        {
+          "title": "`b.mail.agent.WIRED_AT` export replaced by `COMPOSE_HINT`",
+          "body": "The `WIRED_AT` export mapped each method to a framework version that was supposed to \"light it up\" — versions that have all shipped without the wiring, so the map was misleading. It is replaced by `COMPOSE_HINT`, mapping each not-yet-wired method to the primitive an operator composes directly. Operators reading `b.mail.agent.WIRED_AT` should read `b.mail.agent.COMPOSE_HINT` instead (pre-1.0: no compatibility shim)."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -541,23 +541,19 @@ var STALE_DEFER_ALLOWLIST = {
   // operator-feeds-metadata escape hatch. Defer-with-condition.
   "lib/ai-content-detect.js": ["IPTC PhotoMetadata reader lands in v0.10.9"],
   // GAP BACKLOG (being worked down — these are real overdue items):
-  //   archive-read ZIP64 read + fromTrustedStream (promised v0.12.8) — building.
+  //   archive-read ZIP64 read (promised v0.12.8) — building. (The
+  //   fromTrustedStream defer was reworded to a version-free "not
+  //   implemented / re-opens when needed" in v0.13.15, so it no longer
+  //   needs an allowlist entry.)
   "lib/archive-read.js": [
     "not supported in v0.12.7. Will land",
     "switch to tar — lands v0.12.8",
     "carries ZIP64 sentinel sizes (not supported in v0.12.7)",
-    "deferred to v0.12.8 alongside the tar reader",
-    "fromTrustedStream.inspect() is deferred to v0.12.8",
-    "fromTrustedStream.entries() is deferred to v0.12.8",
-    "fromTrustedStream.extract() is deferred to v0.12.8",
   ],
   "lib/safe-archive.js": [
     "tar lands v0.12.8, gz v0.12.9",
     "fromTrustedStream` is deferred to v0.12.8",
   ],
-  // STALE comments (feature shipped; phrased as future) — correcting to past
-  // tense as the backlog is worked; allowlisted until then.
-  "lib/break-glass.js": ["passkey lands in v0.5.2"],
 };
 
 function testNoStaleDefers() {

package/lib/vendor/blamejs/test/layer-0-primitives/mail-agent.test.js

@@ -46,7 +46,7 @@ function testSurface() {
   check("mail.agent.consumer is fn", typeof b.mail.agent.consumer === "function");
   check("MailAgentError is fn",      typeof b.mail.agent.MailAgentError === "function");
   check("SCOPE_FOR_METHOD frozen",   Object.isFrozen(b.mail.agent.SCOPE_FOR_METHOD));
-  check("WIRED_AT frozen",           Object.isFrozen(b.mail.agent.WIRED_AT));
+  check("COMPOSE_HINT frozen",       Object.isFrozen(b.mail.agent.COMPOSE_HINT));
 }
 
 async function testCreateRequiresStore() {

package/lib/vendor/blamejs/test/layer-0-primitives/watcher.test.js

@@ -100,8 +100,14 @@ async function run() {
     // Poll until the watcher surfaces the target event. macOS fs.watch
     // on CI runners can take 2-3s to deliver write events under load;
     // the helper widens the default wait budget to 15s for that drift.
+    // Re-write a.txt on every poll: FSEvents may not be listening yet
+    // when the initial write (above) lands, and an event for a write
+    // that happened before the watch primed is dropped entirely — no
+    // amount of polling recovers it. Re-touching until the watch
+    // catches one closes that start-up race without a fixed prime-sleep.
     try {
       await waitForWatcher(function () {
+        fs.writeFileSync(path.join(tmpDir, "a.txt"), "hello");
         w._flushForTest();
         return changes.some(function (e) {
           return e.relativePath === "a.txt" && e.type === "file";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {