npm - @blamejs/blamejs-shop - Versions diffs - 0.2.3 → 0.2.5 - Mend

@blamejs/blamejs-shop 0.2.3 → 0.2.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (24) hide show

package/CHANGELOG.md +4 -0
package/lib/admin.js +436 -1
package/lib/asset-manifest.json +7 -3
package/lib/customer-surveys.js +40 -0
package/lib/storefront.js +359 -0
package/lib/vendor/MANIFEST.json +2 -2
package/lib/vendor/blamejs/CHANGELOG.md +4 -0
package/lib/vendor/blamejs/api-snapshot.json +54 -58
package/lib/vendor/blamejs/lib/acme.js +8 -5
package/lib/vendor/blamejs/lib/archive-read.js +24 -20
package/lib/vendor/blamejs/lib/break-glass.js +4 -5
package/lib/vendor/blamejs/lib/crypto.js +8 -5
package/lib/vendor/blamejs/lib/guard-dsn.js +3 -2
package/lib/vendor/blamejs/lib/guard-list-id.js +3 -2
package/lib/vendor/blamejs/lib/guard-regex.js +4 -4
package/lib/vendor/blamejs/lib/guard-smtp-command.js +1 -2
package/lib/vendor/blamejs/lib/mail-agent.js +47 -37
package/lib/vendor/blamejs/package.json +1 -1
package/lib/vendor/blamejs/release-notes/v0.13.15.json +27 -0
package/lib/vendor/blamejs/release-notes/v0.13.16.json +27 -0
package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js +4 -8
package/lib/vendor/blamejs/test/layer-0-primitives/mail-agent.test.js +1 -1
package/lib/vendor/blamejs/test/layer-0-primitives/watcher.test.js +6 -0
package/package.json +1 -1

package/lib/storefront.js CHANGED Viewed

@@ -160,6 +160,7 @@ var LAYOUT =
   "</head>\n" +
   "<body>\n" +
   "  <a class=\"skip-link\" href=\"#main\">{{skip_to_content}}</a>\n" +
+  "RAW_ANNOUNCEMENT_BAR" +
   "\n" +
   "  <div class=\"utility-bar\" role=\"complementary\">\n" +
   "    <div class=\"utility-bar__inner\">\n" +
@@ -262,6 +263,7 @@ var LAYOUT =
   "  </footer>\n" +
   CONSENT_BANNER +
   "RAW_CONSENT_SCRIPT" +
+  "RAW_ANNOUNCEMENT_SCRIPT" +
   "</body>\n" +
   "</html>\n";
@@ -331,6 +333,128 @@ function _islandScript(name, opts) {
     (sri ? " integrity=\"" + sri + "\"" : "") + " defer" + policyAttr + "></script>";
 }
+// ---- announcement bar --------------------------------------------------
+//
+// Sitewide operator promo/notice strip rendered at the top of every page
+// (this container render + the worker/render/*.js LAYOUT mirror it). The
+// active row is resolved per request from a short-TTL in-memory cache of
+// the active announcements — NOT a per-request DB read — because the bar
+// is page-top chrome on every route and the active set changes rarely
+// (operator-managed). The cache is refreshed out-of-band (fire-and-forget)
+// so a request never blocks on it; resolution is synchronous, which is why
+// it can run in the same sync middleware that seeds the locale context
+// (an async middleware's `enterWith` would not reach the handler).
+//
+// Dismissal mirrors the consent banner: the bar is always server-rendered;
+// the `announcement.js` island hides any bar whose slug is listed in the
+// plain `shop_ann_dismissed` cookie and sets that cookie on dismiss. A
+// no-JS POST /announcements/:slug/dismiss records the durable dismissal +
+// sets the same cookie. The cookie-driven hide is what keeps a dismissed
+// bar from reappearing on an edge-cached page (the slug is in the markup;
+// the island removes it client-side per the visitor's cookie).
+var ANNOUNCEMENT_DISMISS_COOKIE = "shop_ann_dismissed";
+var _BAR_THEME_RANK = { urgency: 3, promo: 2, info: 1, success: 0 };
+var _BAR_TTL_MS = 30000;
+var _annCache = { rows: [], at: 0, inflight: false };
+// Refresh the active-announcement cache if it's older than the TTL. Async
+// + fire-and-forget: the caller never awaits it, so a slow D1 read can't
+// stall a page render — the request resolves against whatever the cache
+// last held (empty on a cold first request, then populated within the TTL).
+function _refreshAnnouncementCache(announcementBar) {
+  if (!announcementBar) return;
+  var now = Date.now();
+  if (_annCache.inflight) return;
+  if (now - _annCache.at < _BAR_TTL_MS && _annCache.at !== 0) return;
+  _annCache.inflight = true;
+  Promise.resolve()
+    .then(function () { return announcementBar.listAnnouncements({ active_only: true }); })
+    .then(function (rows) { _annCache.rows = Array.isArray(rows) ? rows : []; _annCache.at = Date.now(); })
+    .catch(function () { /* drop-silent — keep serving the prior cache */ })
+    .then(function () { _annCache.inflight = false; });
+}
+// Synchronous pick over the cached active rows: drop announcements whose
+// audience the viewer doesn't match (segment is never matched here — the
+// console doesn't offer it) and return the highest theme-rank survivor
+// (urgency > promo > info > success), ties broken by the cache's own order
+// (updated_at DESC, slug ASC from listAnnouncements).
+//
+// Dismissal is NOT filtered here: the bar is rendered identically for every
+// viewer of an audience (so an edge-cached response is correct for all) and
+// the announcement island hides any bar whose slug is in the visitor's
+// `shop_ann_dismissed` cookie — exactly the consent-banner pattern. This
+// keeps the container + edge renders byte-identical and the shared edge
+// cache key (URL) sound.
+function _resolveActiveAnnouncement(viewerKind) {
+  var rows = _annCache.rows;
+  if (!rows || !rows.length) return null;
+  var best = null;
+  var bestRank = -1;
+  for (var i = 0; i < rows.length; i += 1) {
+    var row = rows[i];
+    if (row.audience === "logged_in" && viewerKind !== "logged_in") continue;
+    if (row.audience === "guest"     && viewerKind !== "guest")     continue;
+    if (row.audience === "segment") continue;
+    var rank = _BAR_THEME_RANK[row.theme];
+    if (rank == null) rank = -1;
+    if (rank > bestRank) { best = row; bestRank = rank; }
+  }
+  return best;
+}
+// Parse the plain `shop_ann_dismissed` cookie into an array of slugs. The
+// cookie is a comma-separated slug list (slugs are [a-z0-9-], so no
+// escaping is needed); anything that isn't a well-shaped slug is ignored.
+function _readDismissedSlugs(req) {
+  var raw = _readCookie(req, ANNOUNCEMENT_DISMISS_COOKIE);
+  if (!raw || typeof raw !== "string") return [];
+  var out = [];
+  var parts = raw.split(",");
+  for (var i = 0; i < parts.length; i += 1) {
+    var s = parts[i].trim();
+    if (s && /^[a-z0-9-]{1,64}$/.test(s) && out.indexOf(s) === -1) out.push(s);
+  }
+  return out;
+}
+// Render the bar markup for a hydrated announcement row. Returns "" for a
+// null row so a no-announcement page renders unchanged. `currentColor`-free
+// — the theme color comes from the `--<theme>` modifier class in main.css.
+function _buildAnnouncementBar(row) {
+  if (!row) return "";
+  var esc = function (s) { return b.template.escapeHtml(String(s == null ? "" : s)); };
+  var theme = _BAR_THEME_RANK[row.theme] != null ? row.theme : "info";
+  var slug  = esc(row.slug);
+  var link  = "";
+  if (row.link_url && row.link_label) {
+    // Defense-in-depth at the href sink: only emit the link for an https://
+    // URL or a /-rooted absolute path (not protocol-relative `//`). The
+    // lib's `_linkUrl` already enforces exactly this at write time, but
+    // re-checking here means a `javascript:` / `data:` scheme can never
+    // reach the rendered href even if a row ever arrived by another path —
+    // HTML-escaping alone does not neutralise those schemes.
+    var href = String(row.link_url);
+    if (/^https:\/\//i.test(href) || (href.charAt(0) === "/" && href.charAt(1) !== "/")) {
+      link = " <a class=\"announcement-bar__link\" href=\"" + esc(href) + "\">" + esc(row.link_label) + "</a>";
+    }
+  }
+  var dismiss = "";
+  if (row.dismissible) {
+    dismiss =
+      "<form class=\"announcement-bar__dismiss\" method=\"post\" action=\"/announcements/" + slug + "/dismiss\">" +
+        "<input type=\"hidden\" name=\"return_to\" value=\"/\" data-announcement-return>" +
+        "<button type=\"submit\" class=\"announcement-bar__x\" aria-label=\"Dismiss this announcement\">&times;</button>" +
+      "</form>";
+  }
+  return "<aside class=\"announcement-bar announcement-bar--" + theme + "\" role=\"region\" aria-label=\"Store announcement\" data-announcement-slug=\"" + slug + "\">" +
+           "<div class=\"announcement-bar__inner\">" +
+             "<p class=\"announcement-bar__msg\">" + esc(row.message) + link + "</p>" +
+             dismiss +
+           "</div>" +
+         "</aside>";
+}
 // Multi-currency display switcher — a GET form in the footer listing the
 // operator's display currencies. Selecting one POSTs to /currency, which
 // sets the sealed `shop_ccy` cookie and redirects back. The currently
@@ -441,6 +565,17 @@ function _wrap(opts) {
   var localeCtx = (opts.locale_ctx && opts.locale_ctx.chrome)
     ? opts.locale_ctx
     : ((storeCtx && storeCtx.chrome) ? storeCtx : _DEFAULT_LOCALE_CTX);
+  // Announcement bar — the active row is resolved by the sync request
+  // middleware and carried on the locale ALS store; an explicit
+  // `opts.announcement` (a renderer or unit test threading its own) wins.
+  // Absent both, no bar renders.
+  var announcementRow = (opts.announcement !== undefined)
+    ? opts.announcement
+    : ((storeCtx && storeCtx.announcement) || null);
+  var announcementBarHtml = _buildAnnouncementBar(announcementRow);
+  var announcementScript  = (announcementRow && announcementRow.dismissible)
+    ? _islandScript("announcement.js", { id: "announcement-island" })
+    : "";
   var chrome = localeCtx.chrome;
   var cartCount = opts.cart_count == null ? 0 : opts.cart_count;
   // The cart aria-label carries the count: when the resolved string is
@@ -481,7 +616,9 @@ function _wrap(opts) {
   return _render(LAYOUT, vars)
     .replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
+    .replace("RAW_ANNOUNCEMENT_BAR", announcementBarHtml)
     .replace("RAW_CONSENT_SCRIPT", _islandScript("consent.js", { id: "consent-island", policy: _activeConsentPolicy }))
+    .replace("RAW_ANNOUNCEMENT_SCRIPT", announcementScript)
     .replace("RAW_CURRENCY_SWITCHER", switcherHtml)
     .replace("RAW_LOCALE_SWITCHER", localeCtx.switcher_html || "")
     .replace("RAW_BODY_PLACEHOLDER", opts.body);
@@ -4519,6 +4656,85 @@ function renderAccount(opts) {
   });
 }
+// ---- customer survey page ----------------------------------------------
+// Render one survey question as a fieldset. Rating → a 0/1..max radio
+// scale; select → radio options; free_text → a textarea. Field name is
+// `q_<id>`; the post handler maps it back. All operator-authored strings
+// are HTML-escaped at the sink.
+function _surveyQuestion(q) {
+  var esc = function (s) { return b.template.escapeHtml(String(s == null ? "" : s)); };
+  var name = "q_" + esc(q.id);
+  var req  = q.required ? " <abbr class=\"survey-req\" title=\"Required\">*</abbr>" : "";
+  var control = "";
+  if (q.kind === "rating") {
+    var lo = (q.max >= 9) ? 0 : 1; // 0..10 for NPS-scale, else 1..max
+    var scale = "";
+    for (var n = lo; n <= q.max; n += 1) {
+      scale += "<label class=\"survey-scale__opt\"><input type=\"radio\" name=\"" + name + "\" value=\"" + n + "\"" + (q.required ? " required" : "") + "><span>" + n + "</span></label>";
+    }
+    control = "<div class=\"survey-scale\">" + scale + "</div>";
+  } else if (q.kind === "select") {
+    var opts = "";
+    for (var k = 0; k < q.options.length; k += 1) {
+      var ov = esc(q.options[k]);
+      opts += "<label class=\"survey-opt\"><input type=\"radio\" name=\"" + name + "\" value=\"" + ov + "\"" + (q.required ? " required" : "") + "> " + ov + "</label>";
+    }
+    control = "<div class=\"survey-opts\">" + opts + "</div>";
+  } else {
+    control = "<textarea name=\"" + name + "\" maxlength=\"" + (q.max || 2000) + "\"" + (q.required ? " required" : "") + "></textarea>";
+  }
+  return "<fieldset class=\"survey-q\"><legend>" + esc(q.label) + req + "</legend>" + control + "</fieldset>";
+}
+// The token survey page. `state` selects the panel: form (answerable),
+// thankyou (just submitted), responded (already done), expired, closed, or
+// notfound. The token is rendered into the form action so the POST carries
+// it back (it's path-segment-safe — 43 base64url chars).
+function renderSurveyPage(opts) {
+  opts = opts || {};
+  var esc = function (s) { return b.template.escapeHtml(String(s == null ? "" : s)); };
+  var state = opts.state || "notfound";
+  var body;
+  if (state === "form") {
+    var survey = opts.survey || {};
+    var qs = (survey.questions || []).map(_surveyQuestion).join("");
+    var notice = opts.notice ? "<p class=\"form-notice\">" + esc(opts.notice) + "</p>" : "";
+    body =
+      "<section class=\"survey-page\"><div class=\"survey-page__inner\">" +
+        "<p class=\"eyebrow\">Your feedback</p>" +
+        "<h1 class=\"survey-page__title\">" + esc(survey.title) + "</h1>" +
+        notice +
+        "<form class=\"survey-form\" method=\"post\" action=\"/survey/" + esc(opts.token) + "\">" +
+          qs +
+          "<div class=\"survey-form__actions\"><button class=\"btn-primary\" type=\"submit\">Submit feedback</button></div>" +
+        "</form>" +
+      "</div></section>";
+  } else {
+    var heads = {
+      thankyou:  ["Thank you", "Your feedback's in — we appreciate you taking the time."],
+      responded: ["Already answered", "This feedback link has already been used. Thank you."],
+      expired:   ["This link has expired", "The feedback window for this survey has closed."],
+      closed:    ["This survey is closed", "This feedback link is no longer active."],
+      notfound:  ["Survey not found", "This feedback link isn't valid. Check the link from your email."],
+    };
+    var h = heads[state] || heads.notfound;
+    body =
+      "<section class=\"survey-page\"><div class=\"survey-page__inner survey-page__inner--msg\">" +
+        "<h1 class=\"survey-page__title\">" + esc(h[0]) + "</h1>" +
+        "<p class=\"survey-page__lede\">" + esc(h[1]) + "</p>" +
+        "<a class=\"btn-ghost\" href=\"/\">Back to the shop</a>" +
+      "</div></section>";
+  }
+  return _wrap({
+    title:      opts.title || "Survey",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
 function mount(router, deps) {
   if (!router || typeof router.get !== "function") throw new TypeError("storefront.mount: router with .get() required");
   if (!deps || !deps.catalog || !deps.cart) throw new TypeError("storefront.mount: deps.catalog + deps.cart required");
@@ -4853,6 +5069,149 @@ function mount(router, deps) {
     });
   }
+  // Announcement-bar resolution — synchronous, so its `enterWith` reaches
+  // the page handler (an async middleware's would not). Runs AFTER the
+  // locale middleware so it can extend that request's ALS context rather
+  // than replace it. The active set comes from a short-TTL in-memory cache
+  // refreshed out-of-band here (fire-and-forget — never blocks the render);
+  // resolution itself reads the cache + the dismissed-slug cookie + a
+  // coarse logged-in/guest signal (auth-cookie presence — exact identity
+  // isn't needed to bucket audience). Best-effort: any failure drops the
+  // bar, never the page.
+  if (typeof router.use === "function" && deps.announcementBar) {
+    router.use(function announcementMiddleware(req, _res, next) {
+      try {
+        _refreshAnnouncementCache(deps.announcementBar);
+        var viewerKind = _cookieJar().read(req, AUTH_COOKIE_NAME) ? "logged_in" : "guest";
+        var row = _resolveActiveAnnouncement(viewerKind);
+        var cur = _localeAls.getStore() || {};
+        _localeAls.enterWith(Object.assign({}, cur, { announcement: row }));
+      } catch (_e) { /* drop-silent — no bar this request */ }
+      next();
+    });
+    // Dismiss an announcement (no-JS path; the island intercepts the click
+    // and stays on-page). Records the durable dismissal keyed on the
+    // session id when one is present, always appends the slug to the plain
+    // `shop_ann_dismissed` cookie (the cookie is what hides the bar on a
+    // cached edge response), and 303-redirects to a validated same-origin
+    // return path. Unknown slug / no session still sets the cookie + redirects
+    // — a hostile or stale slug can never 500 the route.
+    router.post("/announcements/:slug/dismiss", async function (req, res) {
+      var slug = (req.params && typeof req.params.slug === "string") ? req.params.slug : "";
+      var body = req.body || {};
+      var to = (typeof body.return_to === "string") ? body.return_to : "/";
+      if (to.charAt(0) !== "/" || to.charAt(1) === "/" || to.indexOf("\\") !== -1 || /[\x00-\x1f\x7f]/.test(to)) {
+        to = "/";
+      }
+      if (/^[a-z0-9-]{1,64}$/.test(slug)) {
+        // Durable record (best-effort — keyed on the cart session id; absent
+        // a session the cookie still carries the dismissal for this browser).
+        try {
+          var sid = _readSidCookie(req);
+          if (sid) await deps.announcementBar.recordDismissal({ slug: slug, session_id: sid });
+        } catch (_e) { /* slug not found / no session — cookie still set below */ }
+        // Append the slug to the dismissed-cookie set (deduped, capped).
+        var slugs = _readDismissedSlugs(req);
+        if (slugs.indexOf(slug) === -1) slugs.push(slug);
+        if (slugs.length > 50) slugs = slugs.slice(slugs.length - 50);
+        _cookieJar().write(res, ANNOUNCEMENT_DISMISS_COOKIE, slugs.join(","), {
+          expires: new Date(Date.now() + b.constants.TIME.days(180)), httpOnly: false,
+        });
+      }
+      res.status(303);
+      res.setHeader && res.setHeader("location", to);
+      return res.end ? res.end() : res.send("");
+    });
+  }
+  // ---- customer survey (token-gated) ----------------------------------
+  // The invitation token IS the access — no login. GET renders the survey
+  // (or a state notice); POST records the response. Container-only (the
+  // token page is never edge-cached). Resilient: an unknown/garbage token,
+  // a used/expired/closed invitation, and a missing surveys table all
+  // resolve to a clean state page, never a 500.
+  if (deps.customerSurveys) {
+    var _surveyCtx = function (_req) {
+      return {
+        shop_name: (deps.config && deps.config.shop_name) || "blamejs.shop",
+        cart_count: 0,
+        theme_css: (deps.theme && deps.theme.assetUrl) ? deps.theme.assetUrl("css/main.css") : DEFAULT_THEME_CSS_URL,
+      };
+    };
+    router.get("/survey/:token", async function (req, res) {
+      var token = (req.params && req.params.token) || "";
+      var state = "notfound", survey = null;
+      try {
+        var preview = await deps.customerSurveys.previewByToken(token);
+        if (preview) {
+          survey = preview.survey;
+          var inv = preview.invitation;
+          if (inv.status === "responded")      state = "responded";
+          else if (inv.status === "closed")    state = "closed";
+          else if (inv.status === "expired" || Number(inv.expires_at) < Date.now()) state = "expired";
+          else state = "form";
+        }
+      } catch (_e) { state = "notfound"; }
+      var ctx = _surveyCtx(req);
+      _send(res, state === "notfound" ? 404 : 200, renderSurveyPage({
+        state: state, survey: survey, token: token,
+        shop_name: ctx.shop_name, cart_count: ctx.cart_count, theme_css: ctx.theme_css,
+      }));
+    });
+    router.post("/survey/:token", async function (req, res) {
+      var token = (req.params && req.params.token) || "";
+      var body = req.body || {};
+      var ctx = _surveyCtx(req);
+      // Resolve the survey first so we can re-render the form on a
+      // validation error (and map the token to its questions).
+      var preview = null;
+      try { preview = await deps.customerSurveys.previewByToken(token); }
+      catch (_e) { preview = null; }
+      if (!preview) {
+        return _send(res, 404, renderSurveyPage({ state: "notfound", token: token, shop_name: ctx.shop_name, theme_css: ctx.theme_css }));
+      }
+      // Build the answers object from the q_<id> fields, typed per question
+      // kind (rating → integer, select/free_text → string). Blank fields are
+      // omitted so optional questions stay unanswered.
+      var answers = {};
+      var questions = preview.survey.questions || [];
+      for (var i = 0; i < questions.length; i += 1) {
+        var q = questions[i];
+        var raw = body["q_" + q.id];
+        if (raw == null || raw === "") continue;
+        if (q.kind === "rating") {
+          var n = parseInt(raw, 10);
+          if (isFinite(n)) answers[q.id] = n;
+        } else {
+          answers[q.id] = String(raw);
+        }
+      }
+      try {
+        await deps.customerSurveys.submitResponse({ token: token, answers: answers });
+      } catch (e) {
+        // Known terminal states → the matching notice; a validation
+        // TypeError → re-render the form with the cleaned message.
+        var code = e && e.code;
+        if (code === "SURVEY_INVITATION_ALREADY_RESPONDED") return _send(res, 200, renderSurveyPage({ state: "responded", token: token, shop_name: ctx.shop_name, theme_css: ctx.theme_css }));
+        if (code === "SURVEY_INVITATION_EXPIRED")           return _send(res, 200, renderSurveyPage({ state: "expired", token: token, shop_name: ctx.shop_name, theme_css: ctx.theme_css }));
+        if (code === "SURVEY_INVITATION_CLOSED")            return _send(res, 200, renderSurveyPage({ state: "closed", token: token, shop_name: ctx.shop_name, theme_css: ctx.theme_css }));
+        if (code === "SURVEY_INVITATION_NOT_FOUND")         return _send(res, 404, renderSurveyPage({ state: "notfound", token: token, shop_name: ctx.shop_name, theme_css: ctx.theme_css }));
+        if (e instanceof TypeError) {
+          return _send(res, 400, renderSurveyPage({
+            state: "form", survey: preview.survey, token: token,
+            notice: (e.message || "Please check your answers.").replace(/^customerSurveys[.:]\s*/, ""),
+            shop_name: ctx.shop_name, theme_css: ctx.theme_css,
+          }));
+        }
+        throw e;
+      }
+      _send(res, 200, renderSurveyPage({ state: "thankyou", token: token, shop_name: ctx.shop_name, theme_css: ctx.theme_css }));
+    });
+  }
   // Persist a locale choice. A GET form (works with JS off) from the
   // footer switcher submits `lang` (the chosen tag) + `to` (the path to
   // return to). We validate the tag against the active locale set, set

package/lib/vendor/MANIFEST.json CHANGED Viewed

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.14",
-      "tag": "v0.13.14",
+      "version": "0.13.16",
+      "tag": "v0.13.16",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md CHANGED Viewed

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 ## v0.13.x
+- v0.13.16 (2026-05-27) — **`b.mail.agent` docs now describe the facade accurately, and not-yet-wired verbs point to the primitive to use.** b.mail.agent's module documentation claimed it was "the standardization contract for every mail protocol" that JMAP / IMAP / POP3 all route through — but no protocol server actually dispatches through the agent (the framework's own JMAP EmailSubmission handler composes b.mail.send.deliver directly), and the compose / send / reply / forward, sieve.list / sieve.activate, identity / vacation / mdn.* and export / job / import verbs throw mail-agent/not-implemented. The docs are corrected to describe what the agent is: a mailbox-access facade (RBAC + posture + audit + dispatch around a mail store) whose read surface plus the mailbox-mutation and Sieve-upload methods are wired, with the remaining verbs not yet routed through it. Those verbs' error message now names the underlying primitive to compose directly (b.mail.send.deliver, b.mail.sieve, b.mailMdn, …) instead of citing a version tag that had long passed. The public WIRED_AT export (a method→version map that no longer reflected reality) is replaced by COMPOSE_HINT (a method→primitive-to-compose map). No behaviour change: the same methods are wired or throw exactly as before. **Changed:** *`b.mail.agent` documentation corrected; not-implemented errors point to the primitive to compose* — The `@module` / `@card` no longer claim the agent is the universal protocol-dispatch contract — it's documented as a mailbox-access facade with a wired read + mutation + Sieve-upload surface, and the compose/send/identity/vacation/MDN/export verbs documented as not yet routed through it (compose the underlying primitive directly until a protocol server adopts the agent). The `mail-agent/not-implemented` error now names that primitive (e.g. `b.mail.send.deliver`) rather than a passed version tag. **Removed:** *`b.mail.agent.WIRED_AT` export replaced by `COMPOSE_HINT`* — The `WIRED_AT` export mapped each method to a framework version that was supposed to "light it up" — versions that have all shipped without the wiring, so the map was misleading. It is replaced by `COMPOSE_HINT`, mapping each not-yet-wired method to the primitive an operator composes directly. Operators reading `b.mail.agent.WIRED_AT` should read `b.mail.agent.COMPOSE_HINT` instead (pre-1.0: no compatibility shim).
+- v0.13.15 (2026-05-27) — **Corrected more source citations and made deferred/reserved options honest in their docs.** A second accuracy pass over source threat-annotations and option docs. Three citation corrections: the base64url strict-decode guard cited CVE-2022-0235 (which is actually a node-fetch cookie-leak, unrelated) — it now names the weakness class it defends (CWE-347 / CWE-1286 signature canonicalization); the glob consecutive-wildcard ReDoS cap cited the wrong library (the CVE-2026-26996 ReDoS is minimatch, not picomatch — the adjacent picomatch one is CVE-2026-33671); and CVE-2026-32178 is reframed to the CWE-138 header-injection-spoofing class the public record actually documents (and dropped from the end-of-data SMTP-smuggling list, which is a different class). Several options/statuses are now honest about not-yet-implemented surface: b.archive.read.zip.fromTrustedStream is marked experimental (its methods throw and its options aren't honored yet — the example now shows the supported buffer-then-random-access path); b.acme revokeCert's useCertKey / certPrivateKey are marked reserved (the cert-key path throws; account-key signing is the supported default); and a stale message claiming passkey break-glass factors were a future feature is removed (passkeys are a live allowed factor). No runtime behaviour changes beyond message/doc text. **Changed:** *Deferred / reserved surface now documented honestly* — `b.archive.read.zip.fromTrustedStream` is marked `experimental` — its `inspect`/`entries`/`extract` throw and its `bombPolicy`/`audit` options aren't honored yet; the documented example now shows the supported path (buffer the stream, then use the random-access reader). `b.acme` `revokeCert`'s `useCertKey` / `certPrivateKey` options are marked reserved (the cert-key-signed-revocation path throws; account-key signing, the default, covers mainstream CAs). A `b.breakGlass` policy error and comment that called passkey factors a future feature are corrected — passkeys are a live allowed factor. **Fixed:** *Corrected misattributed CVE citations in source threat-annotations* — `b.crypto.fromBase64Url`'s strict-decode guard cited CVE-2022-0235 (a node-fetch header-leak, unrelated to base64/JWT decoding); it now cites the weakness class it actually defends — CWE-347 / CWE-1286 signature canonicalization. `b.guardRegex`'s consecutive-`*` cap attributed CVE-2026-26996 to picomatch; that ReDoS is in minimatch (the picomatch ReDoS it also defends is CVE-2026-33671) — the library name is corrected. CVE-2026-32178 is reframed to the CWE-138 header-injection spoofing class the public advisory documents, and removed from the end-of-data SMTP-smuggling trio (a distinct class). No behaviour change — the defenses are unchanged.
 - v0.13.14 (2026-05-27) — **DNSSEC chain validation now bounds KeyTrap (CVE-2023-50387) amplification with hard caps.** b.network.dns.dnssec.verifyChain tried every DNSKEY whose 16-bit key tag matched an RRSIG, with no cap on how many candidates or total signature verifications a single response could drive. A hostile zone publishing many DNSKEYs sharing one key tag (plus matching RRSIGs) could force O(keys x signatures) full public-key verifications from one query — the KeyTrap denial-of-service (CVE-2023-50387). Validation is now bounded by non-configurable caps that match the BIND / Unbound mitigations: at most 4 same-tag candidate keys are tried per RRSIG, at most 64 DNSKEYs per zone link and 16 DS records per delegation are accepted, the chain is at most 128 links deep, and the whole response is held to a signature-validation budget that scales with chain depth (so a legitimate deep delegation is never false-rejected while bounded collisions stay bounded); exceeding any of these refuses the response rather than performing the work. Separately, a domain name that encodes to more than 255 octets is now refused at canonicalization (RFC 1035 §2.3.4), which also bounds the NSEC3 closest-encloser label enumeration, and the NSEC3 iteration ceiling is lowered from 500 to 150 to match the BIND 9.16.33+ / Unbound 1.17.1 fix for the sibling CVE-2023-50868. **Security:** *`verifyChain` caps colliding-key fan-out and total signature validations (KeyTrap / CVE-2023-50387)* — A zone advertising many same-key-tag DNSKEYs and RRSIGs can no longer drive unbounded public-key verifications. New refusals: `dnssec/too-many-colliding-keys` (>4 same-tag candidates per RRSIG), `dnssec/too-many-dnskeys` (>64 DNSKEYs per zone link), `dnssec/too-many-ds` (>16 DS records per delegation), `dnssec/too-many-links` (chain deeper than 128), and `dnssec/validation-budget-exceeded` (signature validations beyond the depth-scaled budget). The caps are intentionally non-configurable — they sit well above any legitimate zone, and the budget scales with chain depth so deep delegations validate normally. · *Domain-name octet cap + lower NSEC3 iteration ceiling* — A name that canonicalizes to more than 255 octets is refused (`dnssec/bad-name`, RFC 1035 §2.3.4), which bounds the per-label NSEC3 closest-encloser enumeration (CVE-2023-50868 class). The default NSEC3 iteration ceiling drops from 500 to 150, matching the BIND 9.16.33+ / Unbound 1.17.1 post-CVE defaults (RFC 9276 recommends 0).
 - v0.13.13 (2026-05-27) — **Archive extraction-path verification now refuses Windows reserved names, NTFS data streams, and trailing-dot/space per segment.** b.guardFilename.verifyExtractionPath (the per-entry gate b.archive.read.zip.extract / b.safeArchive run on every extracted file) checked traversal, absolute paths, drive-letter and UNC prefixes, null bytes, PATH_MAX overflow, and realpath containment — but not the per-segment Windows write-target hazards the disk validate / sanitize paths already reject. An archive entry named CON, NUL.txt, subdir/LPT1, file.txt:hidden, or secret.txt. stayed inside the extraction root, so the containment and realpath checks passed it, yet on Windows it would resolve to a device, write a hidden NTFS stream, or (after Windows strips the trailing dot/space) overwrite a sibling file. These are now refused: any path segment that collides with a Windows reserved device name, uses NTFS alternate-data-stream syntax (name:stream), or carries a trailing dot or leading/trailing whitespace. The checks are platform-unconditional — a verifier running on Linux still refuses names that are only dangerous on the Windows host that ultimately extracts the archive — with a per-check opt-out (reservedNamePolicy / adsPolicy / leadingTrailingPolicy: "allow") for Linux-only targets. **Security:** *`verifyExtractionPath` refuses per-segment Windows extraction hazards (reserved names / NTFS ADS / trailing dot-space)* — Closes a within-root write-target-redirection gap: an extracted entry could stay inside the destination yet, on Windows, resolve to a device (`CON` / `NUL` / `COM1` / `LPT1`), write a hidden alternate data stream (`file.txt:payload`), or overwrite a sibling after Windows strips a trailing dot/space (`config.`). The verification gate now rejects all three per path segment. Refusal is platform-unconditional (the verifier may run on a different OS than the extractor); set `reservedNamePolicy` / `adsPolicy` / `leadingTrailingPolicy` to `"allow"` to opt a check out on a Linux-only target. Single-entry, name-only residuals — 8.3 short-name aliasing, case-insensitive cross-entry collisions, and archive symlink/hardlink entry-target validation — remain the extract orchestrator's responsibility (it owns the case-folded seen-set and the link-target gate).

package/lib/vendor/blamejs/api-snapshot.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.14",
-  "createdAt": "2026-05-27T12:40:36.809Z",
+  "frameworkVersion": "0.13.16",
+  "createdAt": "2026-05-27T16:55:42.429Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -37552,54 +37552,17 @@
         "agent": {
           "type": "object",
           "members": {
-            "HEAVY_METHODS": {
-              "type": "object",
-              "members": {
-                "export": {
-                  "type": "primitive",
-                  "valueType": "boolean"
-                },
-                "search": {
-                  "type": "primitive",
-                  "valueType": "boolean"
-                }
-              }
-            },
-            "MailAgentError": {
-              "type": "function",
-              "arity": 4
-            },
-            "SCOPE_FOR_METHOD": {
+            "COMPOSE_HINT": {
               "type": "object",
               "members": {
                 "compose": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "delete": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
                 "export": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "expunge": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
-                "fetch": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
-                "flag": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
-                "folders": {
-                  "type": "primitive",
-                  "valueType": "string"
-                },
                 "forward": {
                   "type": "primitive",
                   "valueType": "string"
@@ -37628,56 +37591,73 @@
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "move": {
+                "reply": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "quota": {
+                "send": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "reply": {
+                "sieve.activate": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "search": {
+                "sieve.list": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "send": {
+                "vacation.set": {
                   "type": "primitive",
                   "valueType": "string"
+                }
+              }
+            },
+            "HEAVY_METHODS": {
+              "type": "object",
+              "members": {
+                "export": {
+                  "type": "primitive",
+                  "valueType": "boolean"
                 },
-                "sieve.activate": {
+                "search": {
+                  "type": "primitive",
+                  "valueType": "boolean"
+                }
+              }
+            },
+            "MailAgentError": {
+              "type": "function",
+              "arity": 4
+            },
+            "SCOPE_FOR_METHOD": {
+              "type": "object",
+              "members": {
+                "compose": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "sieve.list": {
+                "delete": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "sieve.put": {
+                "export": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "thread": {
+                "expunge": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "vacation.set": {
+                "fetch": {
                   "type": "primitive",
                   "valueType": "string"
-                }
-              }
-            },
-            "WIRED_AT": {
-              "type": "object",
-              "members": {
-                "compose": {
+                },
+                "flag": {
                   "type": "primitive",
                   "valueType": "string"
                 },
-                "export": {
+                "folders": {
                   "type": "primitive",
                   "valueType": "string"
                 },
@@ -37709,10 +37689,22 @@
                   "type": "primitive",
                   "valueType": "string"
                 },
+                "move": {
+                  "type": "primitive",
+                  "valueType": "string"
+                },
+                "quota": {
+                  "type": "primitive",
+                  "valueType": "string"
+                },
                 "reply": {
                   "type": "primitive",
                   "valueType": "string"
                 },
+                "search": {
+                  "type": "primitive",
+                  "valueType": "string"
+                },
                 "send": {
                   "type": "primitive",
                   "valueType": "string"
@@ -37729,6 +37721,10 @@
                   "type": "primitive",
                   "valueType": "string"
                 },
+                "thread": {
+                  "type": "primitive",
+                  "valueType": "string"
+                },
                 "vacation.set": {
                   "type": "primitive",
                   "valueType": "string"