@blamejs/blamejs-shop 0.2.7 → 0.2.9

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.9 (2026-05-27) — **Storefront read pages stay fast for every visitor — the cart badge updates client-side.** Restores full edge-render speed for returning and signed-in shoppers. Every storefront read page (home, product listing, search, blog) now renders at the edge for all visitors again; the nav cart badge renders server-side and a tiny client island corrects the number from a new lightweight endpoint. The result: the fast cached page AND an accurate cart count, without sending a shopper-with-a-cart through the slower origin on every page. **Added:** *`GET /cart/count` + a cart-count island* — A new endpoint returns the current session's cart line count as JSON (`{"count": N}`), cached `no-store`, with no product hydration. A small deferred same-origin script (`assets/js/cart-count.js`) reads it on load and updates the nav badge text and its aria-label. A visitor with JavaScript off keeps the server-rendered badge. The script is a same-origin external file, so the existing `script-src 'self'` policy already permits it — no CSP change required. **Fixed:** *Fast read pages for shoppers who have a session* — A visitor carrying a cart or sign-in cookie is once again served the edge-rendered storefront pages instead of being routed to the origin container, so the home page and other read pages load quickly for returning visitors, not just first-time guests. The nav cart count stays correct via the island below.
+
+- v0.2.8 (2026-05-27) — **A complete shipping address at checkout, and an accurate cart count on every page.** Two storefront fixes. Checkout now collects a real, shippable address — a street line, an optional apt/suite line, and a city — alongside the region, postal code, and country it already took; a signed-in customer's default saved address pre-fills the form, the address shows on the order confirmation, and the order export carries it so fulfilment has everything it needs. Separately, the navigation cart badge now shows the correct item count on the catalog, product, search, and blog pages — not only on the cart and account pages — by rendering those pages for a shopper-with-a-cart on the path that can read their session. **Changed:** *Checkout collects a complete shipping address* — The shipping step now takes a street address (line 1, plus an optional apartment / suite / unit line) and a city in addition to the region, postal code, and country it already collected, so a placed order carries an address you can actually ship to. Street line and city are marked required for the common physical-goods path; the server treats them as optional so a digital-only order still completes. A signed-in customer's default saved address pre-fills the form. · *Shipping address on the confirmation page and in the order export* — The order confirmation now shows the ship-to address, and the order CSV / NDJSON export gains `shipping_line1`, `shipping_line2`, and `shipping_city` columns (inserted after `customer_name`) so a fulfilment handoff has the full address. Consumers that key on the header name are unaffected; a consumer that keys on absolute column position should re-map to the 27-column layout. **Fixed:** *Cart count is correct on every page* — The nav cart badge previously read zero on edge-rendered pages (home, product, search, blog) for a shopper who had items in their cart, while the cart and account pages showed the real count. A request that carries a session cookie is now rendered on the path that can unseal the session and read the cart, so the badge is consistent everywhere. Guests — who have no cart — still get the fast cached render with a count of zero, which is correct for them.
+
 - v0.2.7 (2026-05-27) — **Default-theme brand polish — broader favicon support and a larger logo.** Small refinements to the bundled default theme's branding. Every page head now advertises a PNG favicon and an Apple touch icon alongside the existing SVG favicon, so the site icon renders correctly on Safari / iOS home screens and on browsers that don't support SVG favicons, plus a theme-color so the mobile browser chrome matches the dark canvas. The header and footer logo are rendered larger for more presence. These affect the default theme only; a custom theme passed via the theme primitive is unchanged. **Changed:** *Fuller favicon + icon metadata* — The page head now includes a PNG favicon and an `apple-touch-icon` (Apple home-screen icons require PNG — SVG favicons aren't used there) in addition to the SVG favicon, plus a `theme-color` meta for the mobile browser UI. Emitted on every page across both the edge and container render paths. · *Larger header and footer logo* — The default theme renders the brand logo at a larger size in the header and footer for clearer presence.
 
 - v0.2.6 (2026-05-27) — **Business-hours page, a graceful unconfigured-checkout state, and the brand shield on the product page.** Three storefront changes. Operators can publish their open hours: define schedules (timezone + per-weekday open/close) from a new Hours screen in the admin console, and a public /hours page renders each as a weekly grid with a live open/closed status computed per request in the schedule's timezone. The cart now degrades gracefully when no payment provider is configured — instead of a checkout button that leads to a dead route, it shows a clear, disabled 'checkout isn't set up yet' notice, and a direct visit to /checkout returns a tidy 'unavailable' page rather than a 404. And the product page's post-quantum-checkout trust badge now uses the real brand shield mark (the site favicon) in place of a CSS approximation. **Added:** *Public /hours page* — A server-rendered page listing every active schedule as a weekday grid (closed days marked), with a live open/closed pill and the next transition ("Opens Monday at 09:00" / "Closes at 17:00"). Timezone-aware and computed per request, so it isn't cached stale. · *Admin console: Hours* — A new Hours screen (and matching JSON API) to create a schedule with a timezone and per-weekday open/close times (a blank day is closed), list schedules, and archive ones no longer in use. Holiday closures and one-off date exceptions — which override the weekly base — are available through the API. The screen appears only when the business-hours primitive is wired. **Changed:** *Cart and /checkout degrade gracefully without a payment provider* — When checkout isn't configured (no payment provider), the cart no longer shows a checkout button that leads nowhere — it shows a disabled control with a clear note that online checkout isn't set up yet and the cart is saved. A direct visit to /checkout now returns a tidy 503 'checkout unavailable' page instead of a 404. Configuring a payment provider restores the full cart → shipping → payment → confirmation flow with no other change. · *Product-page trust badge uses the brand shield* — The post-quantum-secured-checkout badge on the product page now renders the actual brand shield mark (the site icon) rather than a CSS-drawn hex approximation, so the badge matches the brand identity used elsewhere.

package/lib/asset-manifest.json

@@ -1,18 +1,22 @@
 {
-  "version": "0.2.7",
+  "version": "0.2.9",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-FgqvXcZygYkJjjOtXAeu9xi6AtYqkchPnJKcS0OeHm8lynhd9r4RfdpoT7P7j7/l",
       "fingerprinted": "css/admin.afd7b964c1f6fe1b.css"
     },
     "css/main.css": {
-      "integrity": "sha384-BRkvAnovRCuCGMQ4Wtfr+YuGLmcMvD6ScqePyRq7sdTrQEF+93ILtrO0dLv+I6Av",
-      "fingerprinted": "css/main.c9b731a59c0389cf.css"
+      "integrity": "sha384-6aJfYezHHWR7kgX0foRedjqZg90PP6xrD7oXFim5X2gzV3E3gzZaQTzqgZuCP9eU",
+      "fingerprinted": "css/main.d428a281f9f583d8.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",
       "fingerprinted": "js/announcement.59eab4872d2f3b4c.js"
     },
+    "js/cart-count.js": {
+      "integrity": "sha384-K/rkm//Dzg8nuOfpaeenJvLKKl+6DEuvuJi1LLgd46BK+dd1HYmU8R7/gHHjtEsr",
+      "fingerprinted": "js/cart-count.bfc2eb434b19c00a.js"
+    },
     "js/consent.js": {
       "integrity": "sha384-KKMQ0og8HPOykRRPpUyxX7dMhTvKySfVtpGX/jGWzZwNaN/c4OykvRvXpqBHcQST",
       "fingerprinted": "js/consent.517d6ad1fbf106a1.js"

package/lib/checkout.js

@@ -58,6 +58,22 @@ function _shipTo(s) {
   if (s.postal && (typeof s.postal !== "string" || !/^[A-Za-z0-9 -]{1,16}$/.test(s.postal))) {
     throw new TypeError("checkout: ship_to.postal malformed");
   }
+  // Street address + city are free-text (international addresses defy a
+  // tight character class), so validation is shape + length only. They
+  // are optional at this layer — a digital-only order ships nothing —
+  // and length-capped so a stored value can't bloat the order row; the
+  // values are HTML-escaped wherever they render (confirmation, admin,
+  // export). The checkout form marks line1 + city required so the
+  // common physical-goods path collects a complete address.
+  if (s.line1 && (typeof s.line1 !== "string" || s.line1.length > 200)) {
+    throw new TypeError("checkout: ship_to.line1 malformed");
+  }
+  if (s.line2 && (typeof s.line2 !== "string" || s.line2.length > 200)) {
+    throw new TypeError("checkout: ship_to.line2 malformed");
+  }
+  if (s.city  && (typeof s.city  !== "string" || s.city.length  > 120)) {
+    throw new TypeError("checkout: ship_to.city malformed");
+  }
   return s;
 }
 

package/lib/order-export.js

@@ -74,7 +74,7 @@ var b = require("./vendor/blamejs");
 
 // ---- column schema ------------------------------------------------------
 //
-// The 24-column built-in shape. Operators selecting `columns: [...]`
+// The 27-column built-in shape. Operators selecting `columns: [...]`
 // pick a subset; order in the produced output follows COLUMN_ORDER,
 // not the operator's input order, so consumers can rely on a stable
 // header layout independent of how the request was filed.
@@ -87,6 +87,9 @@ var COLUMN_ORDER = Object.freeze([
   "customer_id",
   "customer_email_hash",
   "customer_name",
+  "shipping_line1",
+  "shipping_line2",
+  "shipping_city",
   "shipping_country",
   "shipping_postal",
   "shipping_region",
@@ -281,6 +284,9 @@ function _projectOrder(row, _opts) {
     customer_id:          row.customer_id || "",
     customer_email_hash:  emailHash,
     customer_name:        row.customer_name || "",
+    shipping_line1:       shipTo.line1   || "",
+    shipping_line2:       shipTo.line2   || "",
+    shipping_city:        shipTo.city    || "",
     shipping_country:     shipTo.country || "",
     shipping_postal:      shipTo.postal  || "",
     shipping_region:      shipTo.state   || shipTo.region || "",

package/lib/storefront.js

@@ -266,6 +266,7 @@ var LAYOUT =
   "  </footer>\n" +
   CONSENT_BANNER +
   "RAW_CONSENT_SCRIPT" +
+  "RAW_CART_COUNT_SCRIPT" +
   "RAW_ANNOUNCEMENT_SCRIPT" +
   "</body>\n" +
   "</html>\n";
@@ -621,6 +622,7 @@ function _wrap(opts) {
     .replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
     .replace("RAW_ANNOUNCEMENT_BAR", announcementBarHtml)
     .replace("RAW_CONSENT_SCRIPT", _islandScript("consent.js", { id: "consent-island", policy: _activeConsentPolicy }))
+    .replace("RAW_CART_COUNT_SCRIPT", _islandScript("cart-count.js", { id: "cart-count-island" }))
     .replace("RAW_ANNOUNCEMENT_SCRIPT", announcementScript)
     .replace("RAW_CURRENCY_SWITCHER", switcherHtml)
     .replace("RAW_LOCALE_SWITCHER", localeCtx.switcher_html || "")
@@ -3367,6 +3369,54 @@ var CART_LINE_EDITABLE =
 
 // ---- checkout form + payment page + order confirmation -----------------
 
+// The shipping-address fieldset for checkout. Reuses `_addrField` (the
+// same labelled-input builder the account address book uses) so the
+// checkout + saved-address forms collect an identical address shape.
+// `p` pre-fills each field (from a signed-in customer's default shipping
+// address); every value is escaped by `_addrField` / the email builder.
+// Street line 1 + city are marked required for the common physical-goods
+// path; the backend (checkout._shipTo) is authoritative and treats them
+// as optional so a digital-only order still completes.
+function _checkoutShippingFields(p) {
+  p = p || {};
+  var esc = b.template.escapeHtml;
+  var email =
+    "<label class=\"form-field\">" +
+      "<span class=\"form-field__label\">Email <span class=\"form-field__req\" aria-hidden=\"true\">*</span></span>" +
+      "<input type=\"email\" name=\"email\" value=\"" + esc(p.email == null ? "" : String(p.email)) + "\" required autocomplete=\"email\">" +
+    "</label>";
+  return email +
+    _addrField("name",  "Full name",      p.name,  { required: true, maxlength: 120, autocomplete: "name" }) +
+    _addrField("line1", "Street address", p.line1, { required: true, maxlength: 200, autocomplete: "address-line1" }) +
+    _addrField("line2", "Apt / suite / unit (optional)", p.line2, { maxlength: 200, autocomplete: "address-line2" }) +
+    "<div class=\"form-row form-row--inline\">" +
+      _addrField("city",  "City", p.city, { required: true, maxlength: 120, autocomplete: "address-level2" }) +
+      _addrField("state", "State / province code", p.state, { maxlength: 5, pattern: "[A-Za-z0-9]{1,5}", autocomplete: "address-level1" }) +
+    "</div>" +
+    "<div class=\"form-row form-row--inline\">" +
+      _addrField("postal",  "Postal code", p.postal, { maxlength: 16, autocomplete: "postal-code" }) +
+      _addrField("country", "Country (ISO 3166-1)", p.country || "US", { required: true, maxlength: 2, pattern: "[A-Za-z]{2}", autocomplete: "country" }) +
+    "</div>";
+}
+
+// Build the order's ship_to from a checkout POST body. Shared by the
+// card-form POST and the PayPal create call so both persist an identical
+// address shape. A blank field becomes `undefined` (omitted) rather than
+// "" so checkout._shipTo's optional-field checks aren't tripped by an
+// empty input; country + state are upper-cased to match the ISO
+// validators, the free-text street/city fields are trimmed only.
+function _shipToFromBody(body) {
+  body = body || {};
+  return {
+    country: (body.country || "").toUpperCase(),
+    state:   body.state ? String(body.state).toUpperCase() : undefined,
+    postal:  body.postal || undefined,
+    line1:   body.line1 ? String(body.line1).trim() : undefined,
+    line2:   body.line2 ? String(body.line2).trim() : undefined,
+    city:    body.city  ? String(body.city).trim()  : undefined,
+  };
+}
+
 var CHECKOUT_PAGE =
   "<section class=\"checkout-page\">\n" +
   "  <header class=\"section-head\">\n" +
@@ -3375,13 +3425,7 @@ var CHECKOUT_PAGE =
   "    <p class=\"section-head__lede\">Enter where the order should ship. Payment runs through Stripe on the next step.</p>\n" +
   "  </header>\n" +
   "  <form method=\"post\" action=\"/checkout\" class=\"form-stack\">\n" +
-  "    <div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Email</span><input type=\"email\" name=\"email\" required autocomplete=\"email\"></label></div>\n" +
-  "    <div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Full name</span><input type=\"text\" name=\"name\" required autocomplete=\"name\"></label></div>\n" +
-  "    <div class=\"form-row form-row--inline\">\n" +
-  "      <label class=\"form-field\"><span class=\"form-field__label\">Country (ISO 3166-1)</span><input type=\"text\" name=\"country\" value=\"US\" maxlength=\"2\" pattern=\"[A-Z]{2}\" required autocomplete=\"country\" class=\"form-field__input--xs\"></label>\n" +
-  "      <label class=\"form-field\"><span class=\"form-field__label\">State / Region</span><input type=\"text\" name=\"state\" maxlength=\"5\" autocomplete=\"address-level1\" class=\"form-field__input--xs\"></label>\n" +
-  "      <label class=\"form-field\"><span class=\"form-field__label\">Postal code</span><input type=\"text\" name=\"postal\" maxlength=\"16\" autocomplete=\"postal-code\" class=\"form-field__input--sm\"></label>\n" +
-  "    </div>\n" +
+  "    RAW_SHIPPING_FIELDS" +
   "    <div class=\"form-row\"><label class=\"form-field\"><span class=\"form-field__label\">Gift card code <span class=\"small\">(optional)</span></span><input type=\"text\" name=\"gift_card_code\" autocomplete=\"off\" placeholder=\"XXXX-XXXX-XXXX-XXXX\" maxlength=\"24\"></label></div>\n" +
   "    <div class=\"checkout-summary\">\n" +
   "      <h3>Order summary</h3>\n" +
@@ -3431,7 +3475,8 @@ function renderCheckoutForm(opts) {
       asset_css_main: opts.theme.assetUrl("css/main.css"),
     });
   }
-  var body = _render(CHECKOUT_PAGE, { subtotal: subtotal });
+  var body = _render(CHECKOUT_PAGE, { subtotal: subtotal })
+    .replace("RAW_SHIPPING_FIELDS", _checkoutShippingFields(opts.prefill));
   // Signed-in customer with a spendable points balance — surface a
   // redeem-at-checkout field. The block is appended as raw HTML (the
   // balance + value are numbers we control, the conversion ratio is the
@@ -3534,7 +3579,7 @@ function _paypalCheckoutBlock(clientId, currency) {
     "if(!window.paypal){return;}" +
     "var form=document.querySelector('.checkout-page form');" +
     "var errEl=document.getElementById('paypal-error');" +
-    "function vals(){var d={};['email','name','country','state','postal'].forEach(function(k){var el=form&&form.elements[k];if(el){d[k]=el.value;}});return d;}" +
+    "function vals(){var d={};['email','name','line1','line2','city','country','state','postal'].forEach(function(k){var el=form&&form.elements[k];if(el){d[k]=el.value;}});return d;}" +
     "function showErr(m){if(errEl){errEl.hidden=false;errEl.textContent=m||'PayPal checkout could not be completed.';}}" +
     "paypal.Buttons({" +
     "onClick:function(_d,actions){if(form&&form.reportValidity&&!form.reportValidity()){return actions.reject();}return actions.resolve();}," +
@@ -3664,10 +3709,31 @@ var ORDER_PAGE =
   "        <div><dt>Shipping</dt><dd>{{shipping}}</dd></div>\n" +
   "        <div class=\"totals-list__grand\"><dt>Total</dt><dd>{{total}}</dd></div>\n" +
   "      </dl>\n" +
-  "    </aside>\n" +
+  "    RAW_SHIP_TO</aside>\n" +
   "  </div>\n" +
   "</section>\n";
 
+// Renders the order's shipping address as an <address> block for the
+// confirmation page. Built from the stored `ship_to` (country/state/
+// postal + line1/line2/city); shows whichever parts are present so a
+// legacy order with only a country still renders, and a digital order
+// with no address renders nothing. Every part is HTML-escaped.
+function _shipToAddressBlock(s) {
+  if (!s || typeof s !== "object") return "";
+  var esc = b.template.escapeHtml;
+  var cityLine = [s.city, s.state, s.postal]
+    .filter(function (x) { return x != null && String(x).trim().length; })
+    .map(String).join(", ");
+  var parts = [s.line1, s.line2, cityLine, s.country]
+    .filter(function (x) { return x != null && String(x).trim().length; })
+    .map(function (x) { return "<span>" + esc(String(x)) + "</span>"; });
+  if (!parts.length) return "";
+  return "<div class=\"order-page__ship\">" +
+    "<h2 class=\"pdp__variants-title\">Ship to</h2>" +
+    "<address class=\"order-ship-address\">" + parts.join("") + "</address>" +
+    "</div>";
+}
+
 function renderOrder(opts) {
   if (!opts || !opts.order) throw new TypeError("storefront.renderOrder: opts.order required");
   var o = opts.order;
@@ -3714,6 +3780,7 @@ function renderOrder(opts) {
       tax:                 tax,
       shipping:            shipping,
       total:               total,
+      ship_to:             o.ship_to || null,
       recommendations:     recs,
       has_recommendations: recs.length > 0,
       asset_css_main:      opts.theme.assetUrl("css/main.css"),
@@ -3742,7 +3809,7 @@ function renderOrder(opts) {
     tax:       tax,
     shipping:  shipping,
     total:     total,
-  }).replace("RAW_LINES", rows);
+  }).replace("RAW_LINES", rows).replace("RAW_SHIP_TO", _shipToAddressBlock(o.ship_to));
   // Post-purchase cross-sell rail — reuses the catalog grid + product-card
   // markup (so it inherits the storefront's card styling), rendered only
   // when the picker returned something.
@@ -5783,15 +5850,7 @@ function mount(router, deps) {
       }
     }
 
-    var sid = _readSidCookie(req);
-    var cartCount = 0;
-    if (sid) {
-      var c = await deps.cart.bySession(sid);
-      if (c) {
-        var lines = await deps.cart.listLines(c.id);
-        cartCount = lines.length;
-      }
-    }
+    var cartCount = await _cartCountForReq(req);
     var ccy = await _currencyForReq(req);
     _send(res, 200, renderSearch(Object.assign({
       q:               q,
@@ -5821,15 +5880,7 @@ function mount(router, deps) {
     // variant-select interaction we don't ship yet.
     var media = await deps.catalog.media.listForProduct(product.id);
     // Render cart count from the current session's cart, if any.
-    var sid = _readSidCookie(req);
-    var cartCount = 0;
-    if (sid) {
-      var c = await deps.cart.bySession(sid);
-      if (c) {
-        var lines = await deps.cart.listLines(c.id);
-        cartCount = lines.length;
-      }
-    }
+    var cartCount = await _cartCountForReq(req);
     // Published reviews aggregate + list. A failed read (e.g. the
     // reviews table not yet migrated) degrades to the empty state
     // rather than 500-ing the whole PDP — reviews are supplementary
@@ -6233,6 +6284,21 @@ function mount(router, deps) {
     });
   }
 
+  // Nav cart-badge count for the cart-count island. Every storefront
+  // chrome page server-renders the badge (0 on the cookie-less edge-cached
+  // render); the island fetches this on load and corrects the number for a
+  // visitor whose sealed `shop_sid` the edge can't read. JSON only — one
+  // session lookup, no product hydration — and never cached (a per-session
+  // value must not land in a shared cache).
+  router.get("/cart/count", async function (req, res) {
+    var count = await _cartCountForReq(req);
+    res.status(200);
+    res.setHeader && res.setHeader("content-type", "application/json; charset=utf-8");
+    res.setHeader && res.setHeader("cache-control", "no-store");
+    var payload = JSON.stringify({ count: count });
+    return res.end ? res.end(payload) : res.send(payload);
+  });
+
   router.get("/cart", async function (req, res) {
     var ccy = await _currencyForReq(req);
     var sid = _readSidCookie(req);
@@ -6335,22 +6401,49 @@ function mount(router, deps) {
         return res.end ? res.end() : res.send("");
       }
       var totals = pricing.totals(c, lines, {});
-      // Loyalty balance — only for a signed-in customer with loyalty
-      // wired. A read failure (table not migrated) degrades to no
-      // redeem field rather than 500-ing checkout.
+      // A signed-in customer drives two best-effort lookups, both keyed
+      // off the same auth env: the loyalty balance (for the redeem field)
+      // and the default shipping address (to pre-fill the form). Either
+      // read failing (table not migrated, no saved address) degrades to
+      // the un-prefilled / no-redeem checkout rather than 500-ing it.
+      var coAuth = _currentCustomerEnv(req);
       var loyaltyBalance = null;
-      if (deps.loyalty) {
-        var loyAuth = _currentCustomerEnv(req);
-        if (loyAuth) {
-          try { loyaltyBalance = await deps.loyalty.balance(loyAuth.customer_id); }
-          catch (_e) { loyaltyBalance = null; }
-        }
+      if (deps.loyalty && coAuth) {
+        try { loyaltyBalance = await deps.loyalty.balance(coAuth.customer_id); }
+        catch (_e) { loyaltyBalance = null; }
+      }
+      var prefill = null;
+      if (deps.addresses && coAuth) {
+        try {
+          var addrRows = await deps.addresses.listForCustomer(coAuth.customer_id, { limit: 50 });
+          var pick = null;
+          for (var ai = 0; ai < addrRows.length; ai += 1) {
+            if (Number(addrRows[ai].is_default_shipping) === 1) { pick = addrRows[ai]; break; }
+          }
+          if (!pick && addrRows.length) pick = addrRows[0];
+          if (pick) {
+            prefill = {
+              name:    pick.recipient_name,
+              line1:   pick.street_line1,
+              line2:   pick.street_line2,
+              city:    pick.city,
+              postal:  pick.postal_code,
+              country: pick.country,
+              // The saved `region` is free-text ("California"); checkout's
+              // `state` is a short subdivision code. Carry it over only when
+              // it already matches the code shape so we never pre-seed a
+              // value the field's own pattern would reject.
+              state:   (pick.region && /^[A-Za-z0-9]{1,5}$/.test(pick.region)) ? pick.region : undefined,
+            };
+          }
+        } catch (_e) { prefill = null; }
       }
       _send(res, 200, renderCheckoutForm({
         lines: lines, totals: totals, shop_name: shopName, theme: theme,
         paypal_client_id: deps.paypal ? deps.paypal_client_id : null,
         loyalty_balance: loyaltyBalance,
         loyalty_points_per_usd: deps.loyalty ? deps.loyalty.REDEMPTION_POINTS_PER_USD : null,
+        prefill: prefill,
       }));
     });
 
@@ -6371,11 +6464,7 @@ function mount(router, deps) {
         res.status(303); res.setHeader && res.setHeader("location", "/cart");
         return res.end ? res.end() : res.send("");
       }
-      var shipTo = {
-        country: (body.country || "").toUpperCase(),
-        state:   body.state ? String(body.state).toUpperCase() : undefined,
-        postal:  body.postal || undefined,
-      };
+      var shipTo = _shipToFromBody(body);
       try {
         // default_shipping_id may be a literal string or an
         // operator-supplied async resolver (e.g. backed by the
@@ -6446,11 +6535,7 @@ function mount(router, deps) {
         if (!sid) return _json(400, { error: "no-session" });
         var c = await deps.cart.bySession(sid);
         if (!c || c.status !== "active") return _json(409, { error: "no-active-cart" });
-        var shipTo = {
-          country: (body.country || "").toUpperCase(),
-          state:   body.state ? String(body.state).toUpperCase() : undefined,
-          postal:  body.postal || undefined,
-        };
+        var shipTo = _shipToFromBody(body);
         try {
           var defaultShipId = typeof deps.default_shipping_id === "function"
             ? await deps.default_shipping_id() : deps.default_shipping_id;

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.18",
-      "tag": "v0.13.18",
+      "version": "0.13.19",
+      "tag": "v0.13.19",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/.github/workflows/ci.yml

@@ -40,6 +40,11 @@ jobs:
   smoke:
     name: Framework smoke (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    # Backstop against a hung child no watchdog reaped (and against the
+    # watchdog logic itself regressing): without this a stuck job rides
+    # GitHub's 6-hour default. The full suite finishes in well under
+    # 20 min even on the slow macOS runners; 30 leaves headroom.
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -93,6 +98,7 @@ jobs:
   wiki-e2e:
     name: Wiki e2e (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 25
     strategy:
       fail-fast: false
       matrix:

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.19 (2026-05-27) — **`auditTools` export / archive / forensic-snapshot can return the bundle as bytes — no output directory for serverless / read-only filesystems.** b.auditTools.exportSlice, b.auditTools.archive, and b.auditTools.forensicSnapshot required an `out` directory to write the encrypted bundle (rows.enc + optional checkpoint.enc + manifest.json), which is unusable on a read-only or ephemeral serverless filesystem. Each now accepts `returnBytes: true` instead of `out` and returns the bundle as an in-memory `{ filename: Buffer }` map — ready to stream to object storage or over the wire with no filesystem access. `out` and `returnBytes` are mutually exclusive. The on-disk path is unchanged. The bundle's encryption (XChaCha20-Poly1305 + Argon2id), chain-proof material, and manifest checksums are identical to the written bundle, so an in-memory bundle written to disk verifies exactly as one produced by the `out` path. **Added:** *`returnBytes` on `auditTools.exportSlice` / `archive` / `forensicSnapshot` — in-memory bundles* — Pass `returnBytes: true` (and omit `out`) to get the encrypted audit bundle as an in-memory `{ filename: Buffer }` map instead of a directory write — the read-only / serverless path. `exportSlice` / `archive` return `{ manifest, files, rowCount, range }`; `forensicSnapshot` returns `{ ...manifest, files }` where `files` carries the slice's `rows.enc` + `manifest.json` plus the `forensic-snapshot.json` incident wrapper. The encryption, chain proof, and manifest checksums match the on-disk bundle byte-for-byte, so the bytes verify with `verifyBundle` once written out. `out` and `returnBytes` are mutually exclusive (passing both throws). **Fixed:** *`auditTools.forensicSnapshot` now honors the `since` window instead of capturing the entire audit history* — `forensicSnapshot` passed its `since` bound to the slice exporter under the wrong option name, so the time filter was silently dropped and the snapshot bundled every audit row regardless of `since`. The window is now applied — a snapshot scoped to an incident window contains only that window's rows. The snapshot manifest's `auditSliceFile` field, previously always undefined, now records the slice location.
+
 - v0.13.18 (2026-05-27) — **`bodyParser` multipart can buffer uploads in memory — no tmp directory for serverless / read-only filesystems.** The multipart/form-data sub-parser previously streamed every file part to a tmp directory on disk (os.tmpdir() by default), which fails on a read-only or ephemeral serverless filesystem. A new multipart.storage option selects where file parts land: "disk" (default, unchanged — req.files[].path points at a tmp file cleaned up on response end) or "memory" (req.files[].buffer holds the assembled bytes, with no filesystem access at all). Both modes enforce the same per-file (fileSize), per-field, and total-request (totalSize) caps, so memory mode adds no new memory-exhaustion surface. The file object shape is stable across both modes — disk sets path with buffer null, memory sets buffer with path null — so a handler branches on whichever is non-null. An invalid storage value is rejected when the middleware is constructed. **Added:** *`bodyParser` multipart `storage: "memory"` — buffer uploads in RAM instead of a tmp directory* — `b.middleware.bodyParser({ multipart: { storage: "memory" } })` buffers each uploaded file part in memory and exposes it as `req.files[].buffer` (a Buffer), with no `os.tmpdir()` write and no tmp-file cleanup — the read-only / serverless path. The default `storage: "disk"` is unchanged: file parts stream to a tmp file, `req.files[].path` points at it, and it is removed when the response finishes. Both modes apply the existing `fileSize` / per-field `maxBytes` / `totalSize` caps and SHA3-512 hash each part during streaming, so memory mode is bounded by the same limits and adds no new DoS surface. The `req.files[]` shape is stable across modes (disk: `path` set, `buffer` null; memory: `buffer` set, `path` null). A `storage` value other than `"disk"` or `"memory"` throws a `TypeError` at construction.
 
 - v0.13.17 (2026-05-27) — **Template engine can render from a string with no views directory — for serverless / read-only filesystems.** b.template.create previously required a viewsDir that exists on disk, and rendering always read the template (and its layout/partials) from that directory — unusable on a read-only or ephemeral serverless filesystem where the templates aren't on disk. The engine now accepts a source string directly: viewsDir is optional, and the returned engine exposes renderString(source, data?, opts?) and compileString(source, opts?) that compile and render from a string with no disk read. {% extends %} and {{> partial}} in a string source resolve through an operator-supplied opts.resolve(name) -> string callback (without it, an extends throws a clear error and a missing partial inlines empty, matching the file path). The same HTML-escaping, expression grammar, and extends/partial-depth caps apply. The file-backed render / compile / precompileAll still work exactly as before when a viewsDir is configured, and now refuse with a clear error when one isn't. **Added:** *`engine.renderString` / `engine.compileString` — render templates from a string, no viewsDir* — `b.template.create({})` (no `viewsDir`) returns a string-only engine; `renderString(source, data?, { resolve })` and `compileString(source, { resolve })` compile and render from a source string with zero filesystem access — the read-only / serverless path. `{% extends %}` and `{{> partial}}` resolve through `opts.resolve(name) -> string`. The HTML escaping, grammar, and depth caps are identical to the file path. When a `viewsDir` IS configured, `render`/`compile`/`precompileAll` behave exactly as before; without one they refuse with `viewsDir not configured`. `renderString(source, { resolve })` may omit the data argument — an opts object carrying a function `resolve` is recognized as opts, not data. **Security:** *Vendored `@simplewebauthn/server` refreshed 13.3.0 → 13.3.1* — The vendored WebAuthn server bundle (`b.auth.passkey`'s registration/authentication verification) is refreshed to the latest upstream patch, with the MANIFEST version, CPE, and SHA-256 integrity hashes updated and the bundle re-verified.

package/lib/vendor/blamejs/README.md

@@ -221,7 +221,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **PII redaction** — `b.redact`
 - **Decoy detection** — canary-credential / decoy-record framework auditing every positive lookup as `honeytoken.tripped` (`b.honeytoken`)
 - **Boot assertions** — operator-callable security policy assertions (`b.security.assertProduction`); tamper-evident config-baseline drift detection signed with audit-signing key + at-boot vendor-bundle SHA-256 integrity verification across `lib/vendor/*` (`b.configDrift`, `b.configDrift.verifyVendorIntegrity`)
-- **CSP reports + forensic export** — `b.middleware.cspReport`; post-incident audit-bundle composer (`b.auditTools.forensicSnapshot`)
+- **CSP reports + forensic export** — `b.middleware.cspReport`; post-incident audit-bundle composer (`b.auditTools.forensicSnapshot`); audit export / archive / forensic snapshot write to disk or return the encrypted bundle in memory (`returnBytes`) for read-only / serverless filesystems
 
 ### i18n + format helpers
 

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.18",
-  "createdAt": "2026-05-27T19:22:43.399Z",
+  "frameworkVersion": "0.13.19",
+  "createdAt": "2026-05-27T20:32:29.864Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/atomic-file.js

@@ -146,14 +146,18 @@ function fsync(fd) {
  *   b.atomicFile.fsyncDir("/var/lib/blamejs/data");
  */
 function fsyncDir(dirPath) {
-  // CodeQL js/insecure-temporary-file: dirPath is an operator-supplied
-  // framework data directory (e.g. /var/lib/blamejs/data) — never an
-  // os.tmpdir-reachable path. The fd is used solely for fsync and is
-  // closed immediately; no read or write occurs through it, so the
-  // tmp-file heuristic does not apply. Owner-only 0o700 dataDir
-  // perms are set by ensureDir.
+  // CodeQL js/insecure-temporary-file: this is a read-only open of an
+  // EXISTING directory to fsync its inode — no file is created, so the
+  // predictable-temp-name / symlink-race the query targets does not
+  // apply. The fd is opened "r", fsynced, and closed immediately; no
+  // write goes through it. The directory itself is created 0o700 by
+  // ensureDir. dirPath is normally an operator data dir (e.g.
+  // /var/lib/blamejs/data); when a caller fsyncs a dir under os.tmpdir
+  // (test fixtures via fs.mkdtempSync, or an audit bundle written to a
+  // tmp `out`), mkdtempSync already guarantees a unique 0o700 dir, so
+  // there is still no race surface.
   try {
-    var fd = nodeFs.openSync(dirPath, "r");
+    var fd = nodeFs.openSync(dirPath, "r"); // lgtm[js/insecure-temporary-file] — read-only fsync of an existing dir; no temp file created
     try { nodeFs.fsyncSync(fd); } catch (_e) { /* Windows rejects directory fsync */ }
     finally { nodeFs.closeSync(fd); }
   } catch (_e) { /* dir fsync is best-effort across filesystems */ }

package/lib/vendor/blamejs/lib/audit-tools.js

@@ -291,36 +291,43 @@ async function _defaultReadPredecessorRowHash(firstCounter) {
 
 // ---- Bundle writer ----
 
-async function _writeBundle(args) {
-  var outDir       = args.outDir;
+// Assemble the encrypted bundle entirely in memory: returns the
+// manifest plus an ordered { filename: Buffer } map. Pure — no
+// filesystem touch — so it backs both the on-disk writer and the
+// returnBytes / serverless path. The bundle is always the same 2-3
+// files (rows.enc, optional checkpoint.enc, manifest.json) whether it
+// lands on disk or ships as bytes.
+async function _buildBundle(args) {
   var kind         = args.kind;
   var rows         = args.rows;
   var checkpoint   = args.checkpoint || null;
   var passphrase   = args.passphrase;
   var predecessorRowHash = args.predecessorRowHash;
 
-  atomicFile.ensureDir(outDir);
-
   var firstRow = rows[0];
   var lastRow  = rows[rows.length - 1];
+  var files = {};
 
   // 1. Encrypt the rows JSONL
   var jsonl = rows.map(function (r) {
     return JSON.stringify(_rowToWireForm(r));
   }).join("\n") + "\n";
   var rowsEnc = await backupCrypto.encryptWithFreshSalt(jsonl, passphrase);
-  atomicFile.writeSync(nodePath.join(outDir, "rows.enc"), rowsEnc.encrypted, { fileMode: 0o600 });
+  files["rows.enc"] = rowsEnc.encrypted;
 
   // 2. (archive) Encrypt the checkpoint JSON
   var checkpointSalt = null;
+  var checkpointEncrypted = null;
   if (checkpoint) {
     var ckptJson = _canonicalize(_rowToWireForm(checkpoint));
     var ckptEnc = await backupCrypto.encryptWithFreshSalt(ckptJson, passphrase);
-    atomicFile.writeSync(nodePath.join(outDir, "checkpoint.enc"), ckptEnc.encrypted, { fileMode: 0o600 });
+    files["checkpoint.enc"] = ckptEnc.encrypted;
     checkpointSalt = ckptEnc.salt;
+    checkpointEncrypted = ckptEnc.encrypted;
   }
 
-  // 3. Build manifest
+  // 3. Build manifest — checksums computed from the in-memory buffers
+  // (no read-back of what we just wrote).
   var manifest = {
     format:         BUNDLE_FORMAT,
     kind:           kind,
@@ -342,8 +349,8 @@ async function _writeBundle(args) {
     },
     checksum: {
       rowsSha3_512:       backupCrypto.checksum(rowsEnc.encrypted),
-      checkpointSha3_512: checkpointSalt
-        ? backupCrypto.checksum(nodeFs.readFileSync(nodePath.join(outDir, "checkpoint.enc")))
+      checkpointSha3_512: checkpointEncrypted
+        ? backupCrypto.checksum(checkpointEncrypted)
         : null,
     },
   };
@@ -355,9 +362,22 @@ async function _writeBundle(args) {
       checkpointId:         String(checkpoint._id),
     };
   }
+  files["manifest.json"] = Buffer.from(_canonicalize(manifest), "utf8");
+  return { manifest: manifest, files: files };
+}
+
+async function _writeBundle(args) {
+  var outDir = args.outDir;
+  var built  = await _buildBundle(args);
+
+  atomicFile.ensureDir(outDir);
+  atomicFile.writeSync(nodePath.join(outDir, "rows.enc"), built.files["rows.enc"], { fileMode: 0o600 });
+  if (built.files["checkpoint.enc"]) {
+    atomicFile.writeSync(nodePath.join(outDir, "checkpoint.enc"), built.files["checkpoint.enc"], { fileMode: 0o600 });
+  }
   var manifestPath = nodePath.join(outDir, "manifest.json");
-  atomicFile.writeSync(manifestPath, _canonicalize(manifest), { fileMode: 0o600 });
-  return { manifest: manifest, manifestPath: manifestPath };
+  atomicFile.writeSync(manifestPath, built.files["manifest.json"], { fileMode: 0o600 });
+  return { manifest: built.manifest, manifestPath: manifestPath };
 }
 
 // ---- Bundle reader ----
@@ -437,8 +457,14 @@ async function _readBundle(inDir, passphrase) {
  * Refuses if `opts.out` exists, no rows match, or no signed
  * checkpoint covers the slice (run `b.audit.checkpoint()` first).
  *
+ * Pass `returnBytes: true` instead of `out` for the bundle as an
+ * in-memory `{ filename: Buffer }` map (`rows.enc` + `checkpoint.enc`
+ * + `manifest.json`) — the read-only / serverless path. `out` and
+ * `returnBytes` are mutually exclusive.
+ *
  * @opts
- *   out:        string,         // fresh directory path for the bundle
+ *   out:        string,         // fresh directory path (omit when returnBytes)
+ *   returnBytes:boolean,        // true → return { manifest, files } in memory, no disk
  *   before:     number|Date|string,  // archive rows recordedAt < this
  *   passphrase: Buffer|string,  // bundle-encryption passphrase
  *
@@ -455,7 +481,12 @@ async function _readBundle(inDir, passphrase) {
 async function archive(opts) {
   opts = opts || {};
   _requirePassphrase(opts.passphrase);
-  _requireOutDir(opts.out, "archive");
+  var returnBytes = opts.returnBytes === true;
+  if (returnBytes && opts.out !== undefined) {
+    throw new AuditToolsError("audit-tools/out-and-return-bytes",
+      "archive: specify either opts.out (write to disk) or opts.returnBytes (in-memory bytes), not both");
+  }
+  if (!returnBytes) _requireOutDir(opts.out, "archive");
   var beforeMs = _toMs(opts.before);
   if (beforeMs == null) {
     throw new AuditToolsError("audit-tools/no-before",
@@ -482,6 +513,22 @@ async function archive(opts) {
 
   var predecessorRowHash = await readPredecessorHash(firstCounter);
 
+  if (returnBytes) {
+    var built = await _buildBundle({
+      kind:       KIND_ARCHIVE,
+      rows:       rows,
+      checkpoint: checkpoint,
+      passphrase: opts.passphrase,
+      predecessorRowHash: predecessorRowHash,
+    });
+    return {
+      manifest: built.manifest,
+      files:    built.files,
+      rowCount: rows.length,
+      range:    built.manifest.range,
+    };
+  }
+
   var written = await _writeBundle({
     outDir:     opts.out,
     kind:       KIND_ARCHIVE,
@@ -517,8 +564,15 @@ async function archive(opts) {
  * action filter that drops intermediate counters is rejected with
  * `audit-tools/non-contiguous`.
  *
+ * Pass `returnBytes: true` instead of `out` to get the bundle as an
+ * in-memory `{ filename: Buffer }` map (`rows.enc` + `manifest.json`)
+ * with no filesystem touch — the read-only / serverless path; ship it
+ * to object storage or over the wire. `out` and `returnBytes` are
+ * mutually exclusive.
+ *
  * @opts
- *   out:        string,                // fresh directory path
+ *   out:        string,                // fresh directory path (omit when returnBytes)
+ *   returnBytes:boolean,               // true → return { manifest, files } in memory, no disk
  *   from:       number|Date|string,    // recordedAt >= this (inclusive)
  *   to:         number|Date|string,    // recordedAt <= this (inclusive)
  *   action:     string,                // exact action match (optional)
@@ -536,7 +590,12 @@ async function archive(opts) {
 async function exportSlice(opts) {
   opts = opts || {};
   _requirePassphrase(opts.passphrase);
-  _requireOutDir(opts.out, "export");
+  var returnBytes = opts.returnBytes === true;
+  if (returnBytes && opts.out !== undefined) {
+    throw new AuditToolsError("audit-tools/out-and-return-bytes",
+      "export: specify either opts.out (write to disk) or opts.returnBytes (in-memory bytes), not both");
+  }
+  if (!returnBytes) _requireOutDir(opts.out, "export");
   var fromMs = _toMs(opts.from);
   var toMs   = _toMs(opts.to);
   var readRows = opts.readRows || _defaultReadRows;
@@ -567,6 +626,22 @@ async function exportSlice(opts) {
   var firstCounter = Number(rows[0].monotonicCounter);
   var predecessorRowHash = await readPredecessorHash(firstCounter);
 
+  if (returnBytes) {
+    var built = await _buildBundle({
+      kind:       KIND_EXPORT,
+      rows:       rows,
+      checkpoint: null,
+      passphrase: opts.passphrase,
+      predecessorRowHash: predecessorRowHash,
+    });
+    return {
+      manifest: built.manifest,
+      files:    built.files,
+      rowCount: rows.length,
+      range:    built.manifest.range,
+    };
+  }
+
   var written = await _writeBundle({
     outDir:     opts.out,
     kind:       KIND_EXPORT,
@@ -852,9 +927,15 @@ async function _defaultApplyPurge(args) {
  * `audit.forensic_snapshot.composed` audit event so the act of
  * composing the snapshot is itself on-chain.
  *
+ * Pass `returnBytes: true` instead of `out` for the snapshot as an
+ * in-memory `{ filename: Buffer }` map (the slice's `rows.enc` +
+ * `manifest.json` plus `forensic-snapshot.json`) — the read-only /
+ * serverless path. `out` and `returnBytes` are mutually exclusive.
+ *
  * @opts
- *   out:        string,               // fresh directory path
- *   since:      number|Date|string,   // include rows recordedAt >= this
+ *   out:        string,               // fresh directory path (omit when returnBytes)
+ *   returnBytes:boolean,              // true → return { ...manifest, files } in memory, no disk
+ *   since:      number|Date|string,   // include rows recordedAt >= this (windowed since → now)
  *   passphrase: Buffer|string,        // bundle-encryption passphrase
  *   reason:     string,               // required incident-context reason
  *   incidentId: string,               // optional ticket / incident id
@@ -874,29 +955,39 @@ async function _defaultApplyPurge(args) {
 async function forensicSnapshot(opts) {
   opts = opts || {};
   _requirePassphrase(opts.passphrase);
-  _requireOutDir(opts.out, "forensicSnapshot");
+  var returnBytes = opts.returnBytes === true;
+  if (returnBytes && opts.out !== undefined) {
+    throw new AuditToolsError("audit-tools/out-and-return-bytes",
+      "forensicSnapshot: specify either opts.out (write to disk) or opts.returnBytes (in-memory bytes), not both");
+  }
+  if (!returnBytes) _requireOutDir(opts.out, "forensicSnapshot");
   var sinceMs = _toMs(opts.since);
   if (sinceMs == null) {
     throw new AuditToolsError("audit-tools/no-since",
       "forensicSnapshot: opts.since is required");
   }
   validateOpts.requireNonEmptyString(opts.reason, "reason", AuditToolsError, "audit-tools/no-reason");
+  // exportSlice windows by from/to — pass the requested `since` as `from`
+  // and now as `to` so the snapshot captures only the incident window
+  // rather than the entire audit history.
   var sliceResult = await exportSlice({
-    out:        opts.out,
-    since:      sinceMs,
-    until:      Date.now(),
-    passphrase: opts.passphrase,
-    readRows:   opts.readRows,
+    out:         returnBytes ? undefined : opts.out,
+    returnBytes: returnBytes,
+    from:        sinceMs,
+    to:          Date.now(),
+    passphrase:  opts.passphrase,
+    readRows:    opts.readRows,
     readCoveringCheckpoint: opts.readCoveringCheckpoint,
   });
-  // Compose snapshot manifest with operator-supplied IR context.
+  // Compose snapshot manifest with operator-supplied IR context. The
+  // audit slice lands as rows.enc inside the bundle either way.
   var manifest = {
     snapshotKind:      "forensic",
     incidentId:        opts.incidentId || null,
     reason:            opts.reason,
     actor:             opts.actor || null,
     composedAt:        new Date().toISOString(),
-    auditSliceFile:    sliceResult && sliceResult.path,
+    auditSliceFile:    returnBytes ? "rows.enc" : (sliceResult && sliceResult.manifestPath),
     auditSliceCount:   sliceResult && sliceResult.rowCount,
     runtime: {
       nodeVersion: process.version,
@@ -906,14 +997,18 @@ async function forensicSnapshot(opts) {
       uptimeSec:   Math.round(process.uptime()),
     },
   };
-  var manifestPath = require("node:path").join(opts.out, "forensic-snapshot.json");
-  require("node:fs").writeFileSync(manifestPath, _canonicalize(manifest), "utf8");
+  var manifestBytes = Buffer.from(_canonicalize(manifest), "utf8");
+  var manifestPath = null;
+  if (!returnBytes) {
+    manifestPath = nodePath.join(opts.out, "forensic-snapshot.json");
+    atomicFile.writeSync(manifestPath, manifestBytes, { fileMode: 0o600 });
+  }
   try {
     require("./audit").safeEmit({
       action:  "audit.forensic_snapshot.composed",
       outcome: "success",
       metadata: {
-        out:               opts.out,
+        out:               returnBytes ? null : opts.out,
         incidentId:        manifest.incidentId,
         reason:            opts.reason,
         actor:             opts.actor || null,
@@ -921,6 +1016,12 @@ async function forensicSnapshot(opts) {
       },
     });
   } catch (_e) { /* audit best-effort */ }
+  if (returnBytes) {
+    // Mirror the on-disk layout: the slice's files plus the IR wrapper.
+    var files = Object.assign({}, sliceResult.files);
+    files["forensic-snapshot.json"] = manifestBytes;
+    return Object.assign({}, manifest, { files: files });
+  }
   return Object.assign({}, manifest, { manifestPath: manifestPath });
 }
 

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.18",
+  "version": "0.13.19",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.19.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.19",
+  "date": "2026-05-27",
+  "headline": "`auditTools` export / archive / forensic-snapshot can return the bundle as bytes — no output directory for serverless / read-only filesystems",
+  "summary": "b.auditTools.exportSlice, b.auditTools.archive, and b.auditTools.forensicSnapshot required an `out` directory to write the encrypted bundle (rows.enc + optional checkpoint.enc + manifest.json), which is unusable on a read-only or ephemeral serverless filesystem. Each now accepts `returnBytes: true` instead of `out` and returns the bundle as an in-memory `{ filename: Buffer }` map — ready to stream to object storage or over the wire with no filesystem access. `out` and `returnBytes` are mutually exclusive. The on-disk path is unchanged. The bundle's encryption (XChaCha20-Poly1305 + Argon2id), chain-proof material, and manifest checksums are identical to the written bundle, so an in-memory bundle written to disk verifies exactly as one produced by the `out` path.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`returnBytes` on `auditTools.exportSlice` / `archive` / `forensicSnapshot` — in-memory bundles",
+          "body": "Pass `returnBytes: true` (and omit `out`) to get the encrypted audit bundle as an in-memory `{ filename: Buffer }` map instead of a directory write — the read-only / serverless path. `exportSlice` / `archive` return `{ manifest, files, rowCount, range }`; `forensicSnapshot` returns `{ ...manifest, files }` where `files` carries the slice's `rows.enc` + `manifest.json` plus the `forensic-snapshot.json` incident wrapper. The encryption, chain proof, and manifest checksums match the on-disk bundle byte-for-byte, so the bytes verify with `verifyBundle` once written out. `out` and `returnBytes` are mutually exclusive (passing both throws)."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`auditTools.forensicSnapshot` now honors the `since` window instead of capturing the entire audit history",
+          "body": "`forensicSnapshot` passed its `since` bound to the slice exporter under the wrong option name, so the time filter was silently dropped and the snapshot bundled every audit row regardless of `since`. The window is now applied — a snapshot scoped to an incident window contains only that window's rows. The snapshot manifest's `auditSliceFile` field, previously always undefined, now records the slice location."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/audit-tools-return-bytes.test.js

@@ -0,0 +1,119 @@
+"use strict";
+/**
+ * b.auditTools export verbs — `returnBytes` (serverless / read-only fs)
+ * path. exportSlice / archive / forensicSnapshot assemble the bundle
+ * in memory as a { filename: Buffer } map instead of writing to an
+ * `out` directory. The in-memory bytes must be byte-identical to a
+ * written bundle, so writing them to disk and verifyBundle-ing proves
+ * the round-trip.
+ */
+
+var helpers = require("../helpers");
+var b      = helpers.b;
+var check  = helpers.check;
+var backupCrypto = require("../../lib/backup/crypto");
+
+var PASS = "test-pass-".padEnd(32, "x");
+
+function _rows(n, baseMs) {
+  var rows = [];
+  for (var i = 1; i <= n; i++) {
+    rows.push({
+      _id:              "log-" + i,
+      monotonicCounter: i,
+      recordedAt:       baseMs + i * 1000,
+      action:           "user.login",
+      outcome:          "success",
+      actorUserId:      "alice",
+      actorUserIdHash:  "h-alice",
+      actorIp:          "10.0.0.5",
+      actorSessionId:   "s-" + i,
+      resourceKind:     "session",
+      resourceId:       "s-" + i,
+      reason:           null,
+      metadata:         null,
+      prevHash:         (i === 1 ? "00" : "ab").repeat(64),
+      rowHash:          "ab".repeat(64),
+    });
+  }
+  return rows;
+}
+
+async function run() {
+  var base = Date.UTC(2026, 4, 1, 12, 0, 0);
+  var fakeRows = _rows(5, base);
+  async function readRows(_criteria) { return fakeRows; }
+  async function readPredecessorRowHash(_c) { return "00".repeat(64); }
+
+  // exportSlice returnBytes → in-memory files, no disk.
+  var slice = await b.auditTools.exportSlice({
+    returnBytes: true,
+    from: base, to: base + 10000,
+    passphrase: PASS, readRows: readRows,
+    readPredecessorRowHash: readPredecessorRowHash,
+  });
+  check("exportSlice returnBytes: no manifestPath / outDir",
+    slice.manifestPath === undefined && slice.outDir === undefined);
+  check("exportSlice returnBytes: files is a map", slice.files && typeof slice.files === "object");
+  check("exportSlice returnBytes: rows.enc is a Buffer", Buffer.isBuffer(slice.files["rows.enc"]));
+  check("exportSlice returnBytes: manifest.json is a Buffer", Buffer.isBuffer(slice.files["manifest.json"]));
+  check("exportSlice returnBytes: rowCount matches", slice.rowCount === 5);
+  check("exportSlice returnBytes: no checkpoint.enc (export kind)",
+    slice.files["checkpoint.enc"] === undefined);
+
+  // The manifest describes the actual returned bytes: its checksum
+  // over rows.enc must match (computed with the same function the
+  // bundle uses), and rows.enc must decrypt back to the 5 rows.
+  var manifest = JSON.parse(slice.files["manifest.json"].toString("utf8"));
+  check("exportSlice returnBytes: manifest rowCount matches", manifest.rowCount === 5);
+  check("exportSlice returnBytes: manifest kind is export", manifest.kind === "export");
+  check("exportSlice returnBytes: manifest checksum matches rows.enc bytes",
+    backupCrypto.checksum(slice.files["rows.enc"]) === manifest.checksum.rowsSha3_512);
+  var plain = (await backupCrypto.decryptWithPassphrase(
+    slice.files["rows.enc"], PASS, manifest.salts.rows)).toString("utf8");
+  var decodedRows = plain.split("\n").filter(Boolean);
+  check("exportSlice returnBytes: rows.enc decrypts to the 5 rows", decodedRows.length === 5);
+
+  // out + returnBytes is rejected (mutually exclusive).
+  var threwBoth = null;
+  try {
+    await b.auditTools.exportSlice({ out: "/tmp/x", returnBytes: true,
+      from: base, to: base + 10000, passphrase: PASS, readRows: readRows });
+  } catch (e) { threwBoth = e; }
+  check("exportSlice: out + returnBytes throws",
+    threwBoth && /either.*out.*or.*returnBytes/i.test(threwBoth.message));
+
+  // forensicSnapshot returnBytes → slice files + the IR wrapper, and
+  // the `since` window is actually applied (regression: it used to be
+  // dropped because the value was passed as `until`, not `to`).
+  var windowCriteria = null;
+  async function windowedReadRows(criteria) { windowCriteria = criteria; return fakeRows; }
+  var snap = await b.auditTools.forensicSnapshot({
+    returnBytes: true,
+    since: base + 2000,
+    passphrase: PASS,
+    reason: "IR drill — verify returnBytes path",
+    incidentId: "inc-rb-1",
+    readRows: windowedReadRows,
+    readPredecessorRowHash: readPredecessorRowHash,
+  });
+  check("forensicSnapshot returnBytes: files has the IR wrapper",
+    snap.files && Buffer.isBuffer(snap.files["forensic-snapshot.json"]));
+  check("forensicSnapshot returnBytes: files has the slice rows.enc",
+    Buffer.isBuffer(snap.files["rows.enc"]));
+  check("forensicSnapshot returnBytes: no disk manifestPath",
+    snap.manifestPath === null || snap.manifestPath === undefined);
+  check("forensicSnapshot returnBytes: snapshotKind is forensic",
+    snap.snapshotKind === "forensic");
+  check("forensicSnapshot: since is applied as the from-bound (fromMs set)",
+    windowCriteria && windowCriteria.fromMs === base + 2000);
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[audit-tools-return-bytes] OK"); },
+    function (e) { console.error(e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -9777,6 +9777,49 @@ function testWikiPortAgreesAcrossArtifacts() {
     bad);
 }
 
+// v0.13.19 — a CI job that runs the long test suites (smoke / wiki
+// e2e) MUST declare `timeout-minutes`. Without it a hung child (a
+// leaked timer / socket / fs.watch handle — the macOS smoke-hang
+// class) rides GitHub's 6-hour default before the job is reaped. The
+// smoke runner's per-file watchdog (test/smoke.js) catches most
+// hangs; this job-level backstop catches the rest and a regressed
+// watchdog. Encoded so a new test-running workflow job can't ship
+// without the backstop.
+function testTestJobsDeclareTimeout() {
+  var bad = [];
+  var files = _workflowFiles();
+  for (var fi = 0; fi < files.length; fi += 1) {
+    var wf = files[fi];
+    var text;
+    try { text = fs.readFileSync(wf, "utf8"); }
+    catch (_e) { continue; }
+    var lines = text.split(/\r?\n/);
+    var jobs = [];            // { name, startLine, lines: [] }
+    var inJobs = false;
+    var cur = null;
+    for (var li = 0; li < lines.length; li += 1) {
+      var ln = lines[li];
+      if (!inJobs) { if (/^jobs:\s*$/.test(ln)) inJobs = true; continue; }
+      // A job key sits at exactly 2-space indent under `jobs:`.
+      var jm = ln.match(/^ {2}([A-Za-z0-9_-]+):\s*$/);
+      if (jm) { cur = { name: jm[1], startLine: li + 1, lines: [] }; jobs.push(cur); continue; }
+      if (cur) cur.lines.push(ln);
+    }
+    for (var ji = 0; ji < jobs.length; ji += 1) {
+      var body = jobs[ji].lines.join("\n");
+      var runsSuite = /node\s+test\/smoke\.js/.test(body) || /node\s+test\/e2e\.js/.test(body);
+      if (runsSuite && !/(^|\n)\s*timeout-minutes\s*:/.test(body)) {
+        bad.push({ file: wf, line: jobs[ji].startLine,
+          content: "CI job '" + jobs[ji].name + "' runs the test suite but declares no " +
+                   "timeout-minutes — a hung job would ride GitHub's 6h default. Add `timeout-minutes: <n>`." });
+      }
+    }
+  }
+  bad = _filterMarkers(bad, "ci-test-job-missing-timeout");
+  _report("every CI workflow job that runs the test suite declares timeout-minutes " +
+          "(v0.13.19 — no test job rides GitHub's 6h default when a child hangs)", bad);
+}
+
 // v0.11.43 drift cleanup — every `@nav` value in a lib/*.js @module
 // block MUST be one of the canonical category names below. The wiki
 // sidebar derives directly from `@nav`, so unreviewed drift surfaces
@@ -10319,6 +10362,10 @@ async function run() {
   // WIKI_PORT default must match the release-container.yml smoke
   // step's port mapping + curl host.
   testWikiPortAgreesAcrossArtifacts();
+  // v0.13.19 CI hang backstop: every workflow job that runs the test
+  // suite must declare timeout-minutes so a hung child can't ride
+  // GitHub's 6-hour default.
+  testTestJobsDeclareTimeout();
   // v0.12.1 compliance posture coverage detector: KNOWN_POSTURES ⊇
   // POSTURE_DEFAULTS + REGIME_MAP ⊇ KNOWN_POSTURES.
   testCompliancePostureCoverage();

package/lib/vendor/blamejs/test/smoke.js

@@ -166,6 +166,16 @@ if (!Number.isFinite(PARALLEL) || PARALLEL < 1) PARALLEL = 1;
 if (PARALLEL > 64) PARALLEL = 64;                                                // allow:raw-byte-literal — sanity ceiling on parallel children, not bytes
 void os;
 
+// Per-file watchdog budget. A forked child that never exits (leaked
+// timer / socket / fs.watch handle — more common on macOS) would
+// otherwise hang the whole run until the CI job's wall-clock limit.
+// Past this budget the child is SIGKILLed and the file reported as a
+// failure that NAMES the file, turning an unattributable multi-hour
+// hang into a fast, diagnosable error. Generous (the full host suite
+// runs in ~140s); override with SMOKE_FILE_TIMEOUT_MS.
+var FILE_TIMEOUT_MS = parseInt(process.env.SMOKE_FILE_TIMEOUT_MS || "300000", 10);
+if (!Number.isFinite(FILE_TIMEOUT_MS) || FILE_TIMEOUT_MS < 1000) FILE_TIMEOUT_MS = 300000;
+
 // _readTimings / _writeTimings — persist per-test durations under
 // .test-output/smoke-timings.json so the next run's LPT scheduler can
 // place long-tail tests on the first worker. Median of last 5 runs to
@@ -238,8 +248,46 @@ function _runFileForked(modulePath, displayName) {
     });
     var stdoutBuf = "";
     var stderrBuf = "";
+    // Single-resolve guard: close / error / watchdog can all fire; the
+    // first one wins and cancels the watchdog so a normal exit never
+    // trips it and a kill never double-resolves.
+    var settled = false;
+    function settle(result) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(watchdog);
+      resolve(result);
+    }
+    var watchdog = setTimeout(function () {
+      // Child overran the budget with no exit — reap it and report a
+      // failure that names the file + the most likely cause.
+      try { child.kill("SIGKILL"); } catch (_e) { /* already gone */ }
+      settle({
+        ok:     false,
+        ms:     Date.now() - fileStart,
+        checks: 0,
+        error:  "watchdog: '" + displayName + "' exceeded " + FILE_TIMEOUT_MS +
+                "ms with no exit — likely a leaked handle (timer / socket / fs.watch). " +
+                "Last stderr: " + (stderrBuf.slice(-500) || "(none)"),
+        stderr: stderrBuf,
+        displayName: displayName,
+      });
+    }, FILE_TIMEOUT_MS);
+    if (typeof watchdog.unref === "function") watchdog.unref();
     child.stdout.on("data", function (d) { stdoutBuf += d.toString("utf8"); });
     child.stderr.on("data", function (d) { stderrBuf += d.toString("utf8"); });
+    child.on("error", function (e) {
+      // fork() itself failed (ENOENT / EMFILE / spawn error) — without
+      // this handler the Promise would never resolve and hang the run.
+      settle({
+        ok:     false,
+        ms:     Date.now() - fileStart,
+        checks: 0,
+        error:  displayName + ": fork error: " + ((e && e.message) || String(e)),
+        stderr: stderrBuf,
+        displayName: displayName,
+      });
+    });
     child.on("close", function (code) {
       var ms = Date.now() - fileStart;
       // Last line of stdout is the JSON result line.
@@ -248,7 +296,7 @@ function _runFileForked(modulePath, displayName) {
       var parsed;
       try { parsed = JSON.parse(resultLine); }
       catch (_e) { parsed = { ok: false, error: "no result line; stderr: " + stderrBuf.slice(0, 500) }; }
-      resolve({
+      settle({
         ok:     code === 0 && parsed.ok,
         ms:     ms,
         checks: parsed.checks || 0,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {