@blamejs/blamejs-shop 0.3.11 → 0.3.12

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.12 (2026-05-30) — **Currency and outbound-host validation consolidated behind one shared check.** Input validation that was duplicated across the codebase is now a single shared module. Currency codes are validated against the ISO 4217 catalog consistently wherever the admin binds money — the same check the gift-card flow gained last release — and the outbound webhook host guard (refusing loopback, private, link-local, reserved, and cloud-metadata destinations, including trailing-dot forms) is one shared function used by both the delivery and registration paths. The shared module composes the framework's Unicode codepoint catalog so free-text fields can reject control, bidi-override, and zero-width characters when needed. Behavior is equal-or-stricter than before; no operator action is required. **Changed:** *Currency validation is consistently ISO 4217* — Admin paths that bind a currency now validate it against the ISO 4217 catalog in one place, so a code that isn't a real currency is rejected consistently rather than only in some flows. · *Outbound-host SSRF guard is a single shared check* — The webhook delivery and registration paths now share one host guard — loopback, private (RFC 1918), link-local, reserved, and cloud-metadata addresses (by IP literal or known name, including trailing-dot forms) are refused identically on both, so the two can't drift apart.
+
 - v0.3.11 (2026-05-30) — **Webhook endpoints reject internal addresses; admin errors stay clean and typed.** Outbound webhook endpoints can no longer be pointed at loopback, private, link-local, or cloud-metadata addresses, closing a server-side request forgery path from operator-supplied URLs. Several admin endpoints that previously returned a 500 on bad input now return the correct 4xx — a duplicate slug or SKU is a 409 Conflict, a missing referenced record and malformed JSON are a 400 — and none of them echo internal database or parser text back in the response. Gift cards now reject a currency that isn't a real ISO 4217 code, and the returns refund action reports a malformed id the same way its sibling actions do. No configuration change is required; upgrading picks these up automatically. **Fixed:** *Admin errors return the right status and don't leak internals* — Creating a product, variant, or inventory row with a duplicate key now returns 409 Conflict instead of 500; attaching media to a missing product, and pasting malformed JSON into the shipping-zone editor, now return 400. None of these responses include raw database or JSON-parser text — the detail is a generic, operator-facing message and the underlying error is recorded server-side. The same applies to the receipt and packing-slip routes. · *Gift cards validate the currency* — Issuing a gift card with a currency that isn't a real ISO 4217 code is now rejected with a 400 instead of creating a card in a non-existent currency. · *Consistent error status for refunds* — The returns refund action reports a malformed return id with the same 400 its approve, receive, and reject siblings use; a well-formed id that doesn't exist is still a 404. **Security:** *Webhook endpoints can't target internal addresses* — A webhook endpoint URL that points at a loopback, private (RFC 1918), link-local, reserved, or cloud-metadata address — by IP literal or by a known name such as localhost, metadata.google.internal, or any *.internal host — is now refused when the subscription is created, on both the delivery and outbound-registration paths. A trailing-dot form of those hosts (for example localhost. or 169.254.169.254.) is normalized before the check so it can't slip past. Public https endpoints are unaffected.
 
 - v0.3.10 (2026-05-30) — **Order discounts are split across lines for accurate partial refunds.** When an order carries a cart-level discount, the admin console now records how that discount split across the order's lines — proportional to each line's value — so a later partial refund of one line knows that line's discounted share rather than the whole-order amount. A new read-only Discount splits screen shows the per-line breakdown for an order. This is back-office bookkeeping recorded after the order is placed; it has no effect on what the shopper is charged, and an order with no discount records nothing. **Added:** *Per-line discount allocation + admin view* — An order that carried an automatic cart discount now gets a recorded breakdown of how that discount split across its lines — proportional to each line's subtotal, summing exactly to the discount. A read-only Discount splits admin screen shows the breakdown for an order. The recording runs after the order is placed and never affects the charged amount; an order with no discount records nothing.

package/lib/admin.js

@@ -33,6 +33,7 @@
 var pricing = require("./pricing");
 var collectionsModule = require("./collections");
 var quantityDiscountsModule = require("./quantity-discounts");
+var textGuard = require("./text-guard");
 var { AsyncLocalStorage } = require("node:async_hooks");   // allow:non-shop-require — Node-core per-request context (no npm dep); the framework itself composes it in db-role-context / log. No b.* request-context primitive exists to wrap it.
 
 var b = require("./vendor/blamejs");
@@ -4769,10 +4770,7 @@ function mount(router, deps) {
     // framework's ISO 4217 catalog (the same b.money.CURRENCIES surface the
     // currency-rounding + display primitives compose) and refuse unknown
     // codes with a clean 400.
-    if (typeof input.currency === "string" && /^[A-Z]{3}$/.test(input.currency) &&
-        !Object.prototype.hasOwnProperty.call(b.money.CURRENCIES, input.currency)) {
-      throw new TypeError("giftcards: currency " + JSON.stringify(input.currency) + " is not a known ISO 4217 code");
-    }
+    textGuard.currencyCode(input.currency, "giftcards: currency");
     if (body.amount_minor != null && body.amount_minor !== "") {
       input.amount_minor = _strictMinorInt(body.amount_minor, "giftcards", "amount_minor (minor units)");
     }

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.11",
+  "version": "0.3.12",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/currency-rounding.js

@@ -81,6 +81,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -97,20 +98,7 @@ var MAX_LIST_LIMIT = 500;
 // typo at config-time rather than at the first checkout that touches
 // the bad code.
 function _currency(code) {
-  if (typeof code !== "string" || !/^[A-Z]{3}$/.test(code)) {
-    throw new TypeError(
-      "currencyRounding: currency must be a 3-letter uppercase ISO 4217 code, got " +
-      JSON.stringify(code)
-    );
-  }
-  var catalog = b.money.CURRENCIES;
-  if (!Object.prototype.hasOwnProperty.call(catalog, code)) {
-    throw new TypeError(
-      "currencyRounding: currency " + JSON.stringify(code) +
-      " is not in the ISO 4217 catalog"
-    );
-  }
-  return code;
+  return textGuard.currencyCode(code, "currencyRounding: currency");
 }
 
 function _incrementMinor(n) {

package/lib/index.js

@@ -252,4 +252,5 @@ Object.assign(module.exports, {
   winbackCampaigns:      require("./winback-campaigns"),
   wishlistDigest:        require("./wishlist-digest"),
   operatorHelpCenter:    require("./operator-help-center"),
+  textGuard:             require("./text-guard"),
 });

package/lib/text-guard.js

@@ -0,0 +1,227 @@
+"use strict";
+/**
+ * @module shop.textGuard
+ * @title  Shop input-validation primitives over the framework's codepoint catalog
+ *
+ * @intro
+ *   One home for the cross-cutting string validators the shop's
+ *   handlers reach for at the request boundary: the ISO 4217 currency
+ *   code, the URL slug label, the outbound host label, and the
+ *   dangerous-codepoint screen for unconstrained free text. Each was
+ *   previously open-coded at several call sites with subtly different
+ *   shapes; centralizing them keeps the discipline identical
+ *   everywhere and gives the codebase one place to tighten.
+ *
+ *   The dangerous-codepoint surface (bidi overrides, C0 control bytes,
+ *   null bytes, zero-width / invisible formatting, mixed-script
+ *   confusables) is NOT reinvented here — it composes the framework's
+ *   own codepoint catalog, the single source of truth the guard-*
+ *   family already builds on. The framework does not yet re-export the
+ *   catalog on its public index; until it does, this module reaches
+ *   the catalog leaf directly. The leaf has no dependency on any shop
+ *   module, so requiring it is refresh-safe; an upstream one-line
+ *   `module.exports` add would let this collapse to `b.codepointClass`
+ *   with no behavior change.
+ *
+ *   Validators THROW a `TypeError` on bad input. The admin / account
+ *   request wrappers map a thrown `TypeError` to a clean 400, so a
+ *   typo or a hostile value surfaces as a bad-request to the caller
+ *   instead of a 500 — the validators are written to be called at the
+ *   handler boundary, before the value reaches storage or an outbound
+ *   dial.
+ *
+ *   Surface:
+ *     - re-exports of the framework codepoint catalog (BIDI_RE,
+ *       C0_CTRL_RE, ZERO_WIDTH_RE, NULL_BYTE, scriptFor,
+ *       detectMixedScripts, detectCharThreats, assertNoCharThreats,
+ *       applyCharStripPolicies) so consumers grab one import
+ *     - asciiUpperLetters(s, label, n?) — fixed-length A-Z token
+ *     - currencyCode(s, label?) — ISO 4217 shape + catalog membership
+ *     - slugLabel(s, label, opts?) — lowercase URL-slug label
+ *     - hostLabel(host, label?) — outbound host SSRF + by-name denylist
+ *     - freeText(s, label, policy?) — dangerous-codepoint screen for
+ *       unconstrained UTF-8 text fields
+ *
+ * @primitive textGuard
+ * @related   b.money, b.ssrfGuard, b.safeUrl, shop.currencyRounding,
+ *            shop.webhooks, shop.webhookSubscriptions
+ */
+
+var b = require("./vendor/blamejs");
+
+// The framework's codepoint catalog (bidi / control / null / zero-width
+// tables + regexes, the script ranges, and the detect/assert/strip
+// helpers the guard-* family composes). It is not on the framework's
+// public index yet; the catalog leaf has no shop-module dependency, so
+// composing it directly stays refresh-safe and keeps a single source of
+// truth instead of a second copy of the tables.
+// allow:vendor-hand-edit — composing the framework's codepoint catalog leaf (no shop dependency, refresh-safe); collapses to b.codepointClass once upstream re-exports it
+var codepointClass = require("./vendor/blamejs/lib/codepoint-class");
+
+// ---- shop validators ----------------------------------------------------
+
+// asciiUpperLetters(s, label, n?) — exactly `n` (default 3) ASCII
+// uppercase letters, nothing else. The generalized shape behind every
+// `/^[A-Z]{3}$/` token check. ASCII-allowlist by construction, so bidi
+// / control / zero-width / confusable codepoints are rejected for free
+// (they are not in A-Z). Throws TypeError on a miss.
+function asciiUpperLetters(s, label, n) {
+  var name = label || "value";
+  var len = n == null ? 3 : n;
+  if (typeof len !== "number" || !Number.isInteger(len) || len <= 0) {
+    throw new TypeError("textGuard: length must be a positive integer, got " + JSON.stringify(n));
+  }
+  // allow:dynamic-regex — len is a validated positive integer, not external input
+  var re = new RegExp("^[A-Z]{" + len + "}$");
+  if (typeof s !== "string" || !re.test(s)) {
+    throw new TypeError(
+      name + " must be exactly " + len + " uppercase ASCII letter(s), got " + JSON.stringify(s)
+    );
+  }
+  return s;
+}
+
+// currencyCode(s, label?) — ISO 4217 currency code: the asciiUpperLetters
+// shape check THEN membership in the framework's catalog (b.money.CURRENCIES,
+// the same surface currency-rounding + currency-display compose). Rejects
+// both malformed codes ("usd", "US") and well-formed-but-nonexistent codes
+// ("ZZZ") that would shape-check past `/^[A-Z]{3}$/` but bind money to a
+// currency the rest of the shop can't price. Throws TypeError on a miss.
+function currencyCode(s, label) {
+  var name = label || "currency";
+  if (typeof s !== "string" || !/^[A-Z]{3}$/.test(s)) {
+    throw new TypeError(
+      name + " must be a 3-letter uppercase ISO 4217 code, got " + JSON.stringify(s)
+    );
+  }
+  if (!Object.prototype.hasOwnProperty.call(b.money.CURRENCIES, s)) {
+    throw new TypeError(name + " " + JSON.stringify(s) + " is not in the ISO 4217 catalog");
+  }
+  return s;
+}
+
+// slugLabel(s, label, opts?) — a lowercase URL-slug label: starts and
+// ends with [a-z0-9], inner chars [a-z0-9-], no leading / trailing /
+// doubled hyphen, length 1..maxLen (default 80). ASCII-allowlist, so
+// dangerous codepoints are rejected by construction. Throws TypeError.
+function slugLabel(s, label, opts) {
+  var name = label || "slug";
+  opts = opts || {};
+  var maxLen = opts.maxLen == null ? 80 : opts.maxLen;
+  if (typeof maxLen !== "number" || !Number.isInteger(maxLen) || maxLen <= 0) {
+    throw new TypeError("textGuard: maxLen must be a positive integer, got " + JSON.stringify(opts.maxLen));
+  }
+  if (typeof s !== "string" || s.length < 1 || s.length > maxLen) {
+    throw new TypeError(
+      name + " must be a 1.." + maxLen + "-character lowercase slug, got " + JSON.stringify(s)
+    );
+  }
+  // Single char must itself be [a-z0-9]; longer must match start/inner/end.
+  var ok = s.length === 1
+    ? /^[a-z0-9]$/.test(s)
+    : /^[a-z0-9][a-z0-9-]*[a-z0-9]$/.test(s);
+  if (!ok || /--/.test(s)) {
+    throw new TypeError(
+      name + " must be a lowercase URL slug ([a-z0-9] separated by single hyphens), got " + JSON.stringify(s)
+    );
+  }
+  return s;
+}
+
+// Hostnames that name an internal / metadata destination by name rather
+// than by IP literal. The cloud-metadata services answer on a hostname as
+// well as the 169.254.169.254 link-local IP; localhost resolves to
+// loopback. A literal-IP host is classified directly via b.ssrfGuard
+// (no DNS); these names cover the by-name reach of the same targets.
+var BLOCKED_HOSTS = Object.freeze({
+  "localhost":                1,
+  "metadata.google.internal": 1,
+});
+
+// hostLabel(host, label?) — refuse an outbound host that targets an
+// internal / loopback / link-local / reserved / cloud-metadata
+// destination. A literal-IP host is classified via b.ssrfGuard.classify
+// (IPv4 + IPv6 + IPv4-mapped, no DNS); a hostname is matched against the
+// by-name metadata / loopback denylist plus the *.internal suffix. A
+// trailing FQDN dot and IPv6 brackets are stripped first so neither check
+// is evaded. DNS-rebinding (a public name resolving to a private IP) is
+// out of scope at this gate by design — the resolving guard belongs on
+// the delivery dial. Throws TypeError when the host is not allowed.
+// Returns the normalized (bracket / trailing-dot stripped, lowercased)
+// host on success.
+function hostLabel(host, label) {
+  var name = label || "host";
+  if (typeof host !== "string" || host.length === 0) {
+    throw new TypeError(name + " must be a non-empty string");
+  }
+  var h = host.replace(/^\[|\]$/g, "").toLowerCase().replace(/\.+$/, "");
+  if (b.ssrfGuard.classify(h) ||
+      BLOCKED_HOSTS[h] ||
+      h === "internal" || /\.internal$/.test(h)) {
+    throw new TypeError(name + " is not allowed (internal/loopback/metadata address)");
+  }
+  return h;
+}
+
+// freeText(s, label, policy?) — the dangerous-codepoint screen for an
+// UNCONSTRAINED UTF-8 text field (customer note, review body, gift
+// message, product Q&A). Unlike the ASCII-allowlist validators above,
+// these fields legitimately carry arbitrary letters, so the codepoint
+// catalog is the right backing: bidi overrides (CVE-2021-42574 Trojan
+// Source), null bytes, and C0 control characters are refused by default;
+// zero-width / invisible formatting is refused when policy.zeroWidth is
+// "reject"; a mixed-script confusable (Cyrillic 'а' inside an otherwise
+// Latin label) is refused when policy.mixedScript is "reject". Throws
+// TypeError on a refused codepoint. Returns the input on success.
+function freeText(s, label, policy) {
+  var name = label || "value";
+  if (typeof s !== "string") {
+    throw new TypeError(name + " must be a string");
+  }
+  policy = policy || {};
+  var bidiP    = policy.bidi    || "reject";
+  var nullP    = policy.nullByte || "reject";
+  var controlP = policy.control || "reject";
+  if (bidiP === "reject" && codepointClass.BIDI_RE.test(s)) {
+    throw new TypeError(name + " contains a Unicode bidi override (CVE-2021-42574 Trojan Source)");
+  }
+  if (nullP === "reject" && s.indexOf(codepointClass.NULL_BYTE) !== -1) {
+    throw new TypeError(name + " contains a null byte");
+  }
+  if (controlP === "reject" && codepointClass.C0_CTRL_RE.test(s)) {
+    throw new TypeError(name + " contains a C0 control character");
+  }
+  if (policy.zeroWidth === "reject" && codepointClass.ZERO_WIDTH_RE.test(s)) {
+    throw new TypeError(name + " contains a zero-width / invisible formatting character");
+  }
+  if (policy.mixedScript === "reject") {
+    var scripts = codepointClass.detectMixedScripts(s, policy.allowedScripts);
+    if (scripts) {
+      throw new TypeError(
+        name + " mixes writing systems (" + scripts.join(", ") + ") — possible confusable / homograph"
+      );
+    }
+  }
+  return s;
+}
+
+module.exports = {
+  // Re-exports of the framework codepoint catalog (single source of truth).
+  BIDI_RE:                codepointClass.BIDI_RE,
+  C0_CTRL_RE:             codepointClass.C0_CTRL_RE,
+  ZERO_WIDTH_RE:          codepointClass.ZERO_WIDTH_RE,
+  NULL_BYTE:              codepointClass.NULL_BYTE,
+  BOM_CHAR:               codepointClass.BOM_CHAR,
+  scriptFor:              codepointClass.scriptFor,
+  detectMixedScripts:     codepointClass.detectMixedScripts,
+  detectCharThreats:      codepointClass.detectCharThreats,
+  assertNoCharThreats:    codepointClass.assertNoCharThreats,
+  applyCharStripPolicies: codepointClass.applyCharStripPolicies,
+
+  // Shop validators.
+  asciiUpperLetters: asciiUpperLetters,
+  currencyCode:      currencyCode,
+  slugLabel:         slugLabel,
+  hostLabel:         hostLabel,
+  freeText:          freeText,
+};

package/lib/webhook-subscriptions.js

@@ -49,6 +49,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var OWNER_TYPES         = Object.freeze(["operator", "app", "customer"]);
 var MAX_OWNER_ID_LEN    = 200;
@@ -116,15 +117,6 @@ function _ownerId(s) {
   return s;
 }
 
-// Hostnames that name an internal/metadata destination by name rather
-// than by IP literal — the same denylist the delivery primitive
-// (lib/webhooks.js) applies. A literal-IP host is classified directly via
-// b.ssrfGuard.classify (no DNS); these names cover the by-name reach.
-var SUBSCRIPTION_BLOCKED_HOSTS = Object.freeze({
-  "localhost":                1,
-  "metadata.google.internal": 1,
-});
-
 function _endpointUrl(url) {
   if (typeof url !== "string" || url.length === 0) {
     throw new TypeError("webhookSubscriptions: endpoint_url must be a non-empty string");
@@ -143,21 +135,16 @@ function _endpointUrl(url) {
   }
   // SSRF: refuse internal / loopback / link-local / cloud-metadata
   // destinations so a registered subscription can't probe the host's own
-  // network or the instance-credential metadata service. A literal-IP host
-  // is classified via b.ssrfGuard.classify (no DNS); a hostname is matched
-  // against the by-name metadata/loopback denylist plus *.internal.
-  // DNS-rebinding (a public name resolving to a private IP) is out of scope
-  // here by design — resolving the name would add a DNS dependency the
-  // registration path avoids; the resolving guard belongs on the delivery
-  // dial.
-  // Strip a trailing FQDN dot (and IPv6 brackets) BEFORE every check: a
-  // trailing dot is semantically the same host but otherwise evades both the
-  // by-name denylist ("localhost." / "metadata.google.internal.") and the
-  // literal-IP classifier ("169.254.169.254." won't parse as an IP).
-  var host = (parsed.hostname || "").replace(/^\[|\]$/g, "").toLowerCase().replace(/\.+$/, "");
-  if (b.ssrfGuard.classify(host) ||
-      SUBSCRIPTION_BLOCKED_HOSTS[host] ||
-      host === "internal" || /\.internal$/.test(host)) {
+  // network or the instance-credential metadata service. textGuard.hostLabel
+  // classifies a literal-IP host via the framework SSRF guard (no DNS) and
+  // matches a hostname against the by-name metadata / loopback denylist plus
+  // the *.internal suffix, after stripping a trailing FQDN dot + IPv6
+  // brackets so neither check is evaded. DNS-rebinding (a public name
+  // resolving to a private IP) is out of scope here by design — the
+  // resolving guard belongs on the delivery dial.
+  try {
+    textGuard.hostLabel(parsed.hostname, "webhookSubscriptions: endpoint_url host");
+  } catch (_e) {
     throw new TypeError("webhookSubscriptions: endpoint_url host is not allowed (internal/loopback/metadata address)");
   }
   return url;

package/lib/webhooks.js

@@ -37,6 +37,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var C = b.constants;
 
@@ -85,16 +86,6 @@ var RATE_WINDOW_MS = C.TIME.minutes(1);
 
 function _now() { return Date.now(); }
 
-// Hostnames that name an internal/metadata destination by name rather
-// than by IP literal. The cloud-metadata services answer on a hostname
-// as well as the 169.254.169.254 link-local IP; localhost resolves to
-// loopback. A literal-IP host is classified directly via b.ssrfGuard
-// (no DNS); these names cover the by-name reach of the same targets.
-var WEBHOOK_BLOCKED_HOSTS = Object.freeze({
-  "localhost":                1,
-  "metadata.google.internal": 1,
-});
-
 function _validateUrl(url) {
   if (typeof url !== "string" || url.length === 0) {
     throw new TypeError("webhooks: url must be a non-empty string");
@@ -110,29 +101,17 @@ function _validateUrl(url) {
   // SSRF: refuse any internal / loopback / link-local / cloud-metadata
   // destination so a registered receiver can't be turned into a probe of
   // the host's own network or the instance-credential metadata service.
-  // A literal-IP host is classified directly via b.ssrfGuard.classify
-  // (loopback / private / link-local / reserved / cloud-metadata all
-  // refused, IPv4 + IPv6 + IPv4-mapped); a hostname is matched against
-  // the by-name metadata/loopback denylist plus the *.internal suffix.
-  // DNS-rebinding (a public name that resolves to a private IP) is OUT OF
-  // SCOPE here by design — resolving the name would add a DNS dependency
-  // the outbound path otherwise avoids, and the delivery send path is the
-  // place a resolving guard belongs. This gate stops the literal-IP and
-  // known-name SSRF reachable directly from operator-supplied input.
-  // Strip a trailing FQDN dot (and IPv6 brackets) BEFORE every check: a
-  // trailing dot is semantically the same host but otherwise evades both the
-  // by-name denylist ("localhost." / "metadata.google.internal.") and the
-  // literal-IP classifier ("169.254.169.254." won't parse as an IP).
-  var host = (parsed.hostname || "").replace(/^\[|\]$/g, "").toLowerCase().replace(/\.+$/, "");
-  var isBlocked = false;
-  if (b.ssrfGuard.classify(host)) {
-    isBlocked = true;                                   // literal IP in a refused range
-  } else if (WEBHOOK_BLOCKED_HOSTS[host]) {
-    isBlocked = true;                                   // localhost / metadata.google.internal
-  } else if (host === "internal" || /\.internal$/.test(host)) {
-    isBlocked = true;                                   // any *.internal cloud-private name
-  }
-  if (isBlocked) {
+  // textGuard.hostLabel classifies a literal-IP host directly via the
+  // framework SSRF guard (loopback / private / link-local / reserved /
+  // cloud-metadata, IPv4 + IPv6 + IPv4-mapped) and matches a hostname
+  // against the by-name metadata / loopback denylist plus the *.internal
+  // suffix, after stripping a trailing FQDN dot + IPv6 brackets so neither
+  // check is evaded. DNS-rebinding (a public name that resolves to a
+  // private IP) is OUT OF SCOPE here by design — the resolving guard
+  // belongs on the delivery dial.
+  try {
+    textGuard.hostLabel(parsed.hostname, "webhooks: url host");
+  } catch (_e) {
     throw new TypeError("webhooks: url host is not allowed (internal/loopback/metadata address)");
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.11",
+  "version": "0.3.12",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {