@blamejs/blamejs-shop 0.2.5 → 0.2.7

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.16",
+  "version": "0.13.18",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.17.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.17",
+  "date": "2026-05-27",
+  "headline": "Template engine can render from a string with no views directory — for serverless / read-only filesystems",
+  "summary": "b.template.create previously required a viewsDir that exists on disk, and rendering always read the template (and its layout/partials) from that directory — unusable on a read-only or ephemeral serverless filesystem where the templates aren't on disk. The engine now accepts a source string directly: viewsDir is optional, and the returned engine exposes renderString(source, data?, opts?) and compileString(source, opts?) that compile and render from a string with no disk read. {% extends %} and {{> partial}} in a string source resolve through an operator-supplied opts.resolve(name) -> string callback (without it, an extends throws a clear error and a missing partial inlines empty, matching the file path). The same HTML-escaping, expression grammar, and extends/partial-depth caps apply. The file-backed render / compile / precompileAll still work exactly as before when a viewsDir is configured, and now refuse with a clear error when one isn't.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`engine.renderString` / `engine.compileString` — render templates from a string, no viewsDir",
+          "body": "`b.template.create({})` (no `viewsDir`) returns a string-only engine; `renderString(source, data?, { resolve })` and `compileString(source, { resolve })` compile and render from a source string with zero filesystem access — the read-only / serverless path. `{% extends %}` and `{{> partial}}` resolve through `opts.resolve(name) -> string`. The HTML escaping, grammar, and depth caps are identical to the file path. When a `viewsDir` IS configured, `render`/`compile`/`precompileAll` behave exactly as before; without one they refuse with `viewsDir not configured`. `renderString(source, { resolve })` may omit the data argument — an opts object carrying a function `resolve` is recognized as opts, not data."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Vendored `@simplewebauthn/server` refreshed 13.3.0 → 13.3.1",
+          "body": "The vendored WebAuthn server bundle (`b.auth.passkey`'s registration/authentication verification) is refreshed to the latest upstream patch, with the MANIFEST version, CPE, and SHA-256 integrity hashes updated and the bundle re-verified."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.18.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.18",
+  "date": "2026-05-27",
+  "headline": "`bodyParser` multipart can buffer uploads in memory — no tmp directory for serverless / read-only filesystems",
+  "summary": "The multipart/form-data sub-parser previously streamed every file part to a tmp directory on disk (os.tmpdir() by default), which fails on a read-only or ephemeral serverless filesystem. A new multipart.storage option selects where file parts land: \"disk\" (default, unchanged — req.files[].path points at a tmp file cleaned up on response end) or \"memory\" (req.files[].buffer holds the assembled bytes, with no filesystem access at all). Both modes enforce the same per-file (fileSize), per-field, and total-request (totalSize) caps, so memory mode adds no new memory-exhaustion surface. The file object shape is stable across both modes — disk sets path with buffer null, memory sets buffer with path null — so a handler branches on whichever is non-null. An invalid storage value is rejected when the middleware is constructed.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`bodyParser` multipart `storage: \"memory\"` — buffer uploads in RAM instead of a tmp directory",
+          "body": "`b.middleware.bodyParser({ multipart: { storage: \"memory\" } })` buffers each uploaded file part in memory and exposes it as `req.files[].buffer` (a Buffer), with no `os.tmpdir()` write and no tmp-file cleanup — the read-only / serverless path. The default `storage: \"disk\"` is unchanged: file parts stream to a tmp file, `req.files[].path` points at it, and it is removed when the response finishes. Both modes apply the existing `fileSize` / per-field `maxBytes` / `totalSize` caps and SHA3-512 hash each part during streaming, so memory mode is bounded by the same limits and adds no new DoS surface. The `req.files[]` shape is stable across modes (disk: `path` set, `buffer` null; memory: `buffer` set, `path` null). A `storage` value other than `\"disk\"` or `\"memory\"` throws a `TypeError` at construction."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/00-primitives.js

@@ -1999,6 +1999,74 @@ function testTemplateBasicRender() {
   } finally { fs.rmSync(dir, { recursive: true, force: true }); }
 }
 
+function testTemplateRenderString() {
+  // Serverless / read-only-FS path: render from a source string with no
+  // viewsDir + no disk read. HTML escaping still applies.
+  var eng = b.template.create({});
+  check("renderString: no viewsDir engine created", eng.viewsDir === null);
+  var out = eng.renderString("<h1>{{ greeting }}, {{ name }}!</h1>", { greeting: "Hi", name: "Alice" });
+  check("renderString: substitutes + escapes",
+        out === "<h1>Hi, Alice!</h1>");
+  var hostile = eng.renderString("<p>{{ x }}</p>", { x: "<script>alert(1)</script>" });
+  check("renderString: user values escaped",
+        hostile.indexOf("<script>") === -1 && hostile.indexOf("&lt;script&gt;") !== -1);
+
+  // extends + partial resolved via opts.resolve (no disk).
+  var views = {
+    base:  "<html>{% block body %}default{% endblock %}</html>",
+    greet: "<p>hi {{ n }}</p>",
+  };
+  var composed = eng.renderString(
+    "{% extends \"base\" %}{% block body %}{{> greet}}{% endblock %}",
+    { n: "Bo" },
+    { resolve: function (name) { return views[name]; } });
+  check("renderString: extends + partial via opts.resolve",
+        composed === "<html><p>hi Bo</p></html>");
+
+  // extends with no resolver → clean throw (not a crash).
+  var threwExtends = null;
+  try { eng.renderString("{% extends \"base\" %}{% block body %}x{% endblock %}", {}); }
+  catch (e) { threwExtends = e; }
+  check("renderString: extends without opts.resolve refuses",
+        threwExtends && /extends/.test(threwExtends.message));
+
+  // A missing partial inlines empty (same as the file path).
+  check("renderString: missing partial inlines empty",
+        eng.renderString("a{{> nope}}b", {}, { resolve: function () { return undefined; } }) === "ab");
+
+  // Data omitted: renderString(source, { resolve }) treats the opts as
+  // opts (not data) when it carries a function `resolve` + no 3rd arg.
+  var noData = eng.renderString(
+    "{% extends \"base\" %}{% block body %}static{% endblock %}",
+    { resolve: function (name) { return views[name]; } });
+  check("renderString: opts-as-2nd-arg (data omitted) honored",
+        noData === "<html>static</html>");
+
+  // compileString returns a reusable AST.
+  var ast = eng.compileString("<b>{{ v }}</b>");
+  check("compileString: returns an AST", ast && ast.type === "Template");
+
+  // String templates are byte-capped against hostile input (untrusted
+  // source); the default cap refuses an oversize source, and a hostile
+  // tag stream can't drive a ReDoS through the block resolver.
+  var threwCap = null;
+  try { eng.compileString("x".repeat(300000)); } catch (e) { threwCap = e; }
+  check("compileString: oversize source refused (maxBytes)",
+        threwCap && /maxBytes/.test(threwCap.message));
+  check("compileString: opts.maxBytes raises the cap",
+        eng.compileString("y".repeat(300000), { maxBytes: 1000000 }) !== null);
+  var t0 = Date.now();
+  try { eng.compileString("{%block\tA%}".repeat(40000)); } catch (e2) { void e2; }
+  check("compileString: pathological block-open stream bounded (no ReDoS)",
+        (Date.now() - t0) < 1000);
+
+  // The file-backed methods refuse on a no-viewsDir engine.
+  var threwFile = null;
+  try { eng.render("anything", {}); } catch (e) { threwFile = e; }
+  check("render() without viewsDir refuses",
+        threwFile && /viewsDir not configured/.test(threwFile.message));
+}
+
 function testTemplateRawExpression() {
   var dir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-tpl-"));
   try {
@@ -2232,10 +2300,15 @@ function testTemplateMissingViewsDir() {
   catch (e) { threw = e; }
   check("create() rejects missing viewsDir",   threw && /viewsDir does not exist/.test(threw.message));
 
+  // viewsDir is now optional — create({}) returns a string-only engine
+  // (serverless path); the file-backed render() refuses instead.
   threw = null;
-  try { b.template.create({}); }
-  catch (e) { threw = e; }
-  check("create() requires viewsDir",          threw && /viewsDir.*required/.test(threw.message));
+  var eng = null;
+  try { eng = b.template.create({}); } catch (e) { threw = e; }
+  check("create() without viewsDir succeeds (string-only engine)", threw === null && eng !== null);
+  threw = null;
+  try { eng.render("x", {}); } catch (e) { threw = e; }
+  check("render() without viewsDir refuses",   threw && /viewsDir not configured/.test(threw.message));
 }
 
 function testTemplateSurface() {
@@ -6526,6 +6599,72 @@ async function testBodyParserMultipartFile() {
   }
 }
 
+async function testBodyParserMultipartMemoryStorage() {
+  // storage: "memory" — file parts buffered in RAM, exposed as
+  // req.files[].buffer with no filesystem touch (serverless / read-only fs).
+  var bp = b.middleware.bodyParser({ multipart: { storage: "memory" } });
+  var boundary = "----blamejs-test-boundary-mem";
+  var fileBytes = Buffer.from("hello in-memory file body");
+  var body = _buildMultipartBody(boundary, [
+    { name: "title",  value: "Mem File" },
+    { name: "upload", value: fileBytes, filename: "mem.txt", contentType: "text/plain" },
+  ]);
+  var req = _mockBodyReq("POST",
+    { "content-type": "multipart/form-data; boundary=" + boundary,
+      "content-length": String(body.length) }, body);
+  var res = _mockBodyRes();
+  await _runBodyParser(bp, req, res);
+  check("multipart memory: text field parsed",       req.body.title === "Mem File");
+  check("multipart memory: file captured",           req.files.length === 1);
+  check("multipart memory: buffer is a Buffer",      Buffer.isBuffer(req.files[0].buffer));
+  check("multipart memory: buffer content matches",  req.files[0].buffer.toString("utf8") === "hello in-memory file body");
+  check("multipart memory: path is null (no disk)",  req.files[0].path === null);
+  check("multipart memory: size matches",            req.files[0].size === fileBytes.length);
+  check("multipart memory: hash present",            typeof req.files[0].hash === "string" && req.files[0].hash.length === 128);
+  // res.finish cleanup is a no-op for memory files (no path) — must not throw.
+  var threwOnFinish = false;
+  try { res.emit("finish"); } catch (_e) { threwOnFinish = true; }
+  check("multipart memory: finish cleanup no-op (no throw)", !threwOnFinish);
+
+  // Per-file size cap still enforced in memory mode.
+  var bpCap = b.middleware.bodyParser({ multipart: { storage: "memory", fileSize: 8 } });
+  var capBody = _buildMultipartBody(boundary, [
+    { name: "upload", value: Buffer.from("way over the eight byte cap"),
+      filename: "big.txt", contentType: "text/plain" },
+  ]);
+  var capReq = _mockBodyReq("POST",
+    { "content-type": "multipart/form-data; boundary=" + boundary,
+      "content-length": String(capBody.length) }, capBody);
+  var capRes = _mockBodyRes();
+  await _runBodyParser(bpCap, capReq, capRes);
+  check("multipart memory: oversize file refused (413)", capRes.statusCode === 413);
+
+  // Bad storage value throws at construction (entry-point tier).
+  var threwBadStorage = false;
+  try { b.middleware.bodyParser({ multipart: { storage: "s3" } }); }
+  catch (e) { threwBadStorage = /storage must be/.test(e.message); }
+  check("multipart memory: invalid storage throws at config", threwBadStorage);
+
+  // Disk mode unchanged: still exposes .path, buffer null.
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-bp-mem-"));
+  try {
+    var bpDisk = b.middleware.bodyParser({ multipart: { storage: "disk", tmpDir: tmpDir } });
+    var dBody = _buildMultipartBody(boundary, [
+      { name: "upload", value: Buffer.from("on disk"), filename: "d.txt", contentType: "text/plain" },
+    ]);
+    var dReq = _mockBodyReq("POST",
+      { "content-type": "multipart/form-data; boundary=" + boundary,
+        "content-length": String(dBody.length) }, dBody);
+    var dRes = _mockBodyRes();
+    await _runBodyParser(bpDisk, dReq, dRes);
+    check("multipart memory: disk mode keeps .path",   typeof dReq.files[0].path === "string" && fs.existsSync(dReq.files[0].path));
+    check("multipart memory: disk mode buffer null",   dReq.files[0].buffer === null);
+    dRes.emit("finish");
+  } finally {
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch (_e) {}
+  }
+}
+
 async function testBodyParserMultipartFilenameTraversal() {
   var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-bp-"));
   try {
@@ -17597,6 +17736,7 @@ async function run() {
   testTemplateSurface();
   testTemplateEscapeHtml();
   testTemplateBasicRender();
+  testTemplateRenderString();
   testTemplateRawExpression();
   testTemplateIfElse();
   testTemplateForLoop();
@@ -17789,6 +17929,7 @@ async function run() {
   await testBodyParserKeepRawBody();
   await testBodyParserMultipartFields();
   await testBodyParserMultipartFile();
+  await testBodyParserMultipartMemoryStorage();
   await testBodyParserMultipartFilenameTraversal();
   await testBodyParserMultipartFileSizeLimit();
   await testBodyParserMultipartMimeAllowlist();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {