@blamejs/blamejs-shop 0.3.11 → 0.3.13

package/lib/text-guard.js

@@ -0,0 +1,227 @@
+"use strict";
+/**
+ * @module shop.textGuard
+ * @title  Shop input-validation primitives over the framework's codepoint catalog
+ *
+ * @intro
+ *   One home for the cross-cutting string validators the shop's
+ *   handlers reach for at the request boundary: the ISO 4217 currency
+ *   code, the URL slug label, the outbound host label, and the
+ *   dangerous-codepoint screen for unconstrained free text. Each was
+ *   previously open-coded at several call sites with subtly different
+ *   shapes; centralizing them keeps the discipline identical
+ *   everywhere and gives the codebase one place to tighten.
+ *
+ *   The dangerous-codepoint surface (bidi overrides, C0 control bytes,
+ *   null bytes, zero-width / invisible formatting, mixed-script
+ *   confusables) is NOT reinvented here — it composes the framework's
+ *   own codepoint catalog, the single source of truth the guard-*
+ *   family already builds on. The framework does not yet re-export the
+ *   catalog on its public index; until it does, this module reaches
+ *   the catalog leaf directly. The leaf has no dependency on any shop
+ *   module, so requiring it is refresh-safe; an upstream one-line
+ *   `module.exports` add would let this collapse to `b.codepointClass`
+ *   with no behavior change.
+ *
+ *   Validators THROW a `TypeError` on bad input. The admin / account
+ *   request wrappers map a thrown `TypeError` to a clean 400, so a
+ *   typo or a hostile value surfaces as a bad-request to the caller
+ *   instead of a 500 — the validators are written to be called at the
+ *   handler boundary, before the value reaches storage or an outbound
+ *   dial.
+ *
+ *   Surface:
+ *     - re-exports of the framework codepoint catalog (BIDI_RE,
+ *       C0_CTRL_RE, ZERO_WIDTH_RE, NULL_BYTE, scriptFor,
+ *       detectMixedScripts, detectCharThreats, assertNoCharThreats,
+ *       applyCharStripPolicies) so consumers grab one import
+ *     - asciiUpperLetters(s, label, n?) — fixed-length A-Z token
+ *     - currencyCode(s, label?) — ISO 4217 shape + catalog membership
+ *     - slugLabel(s, label, opts?) — lowercase URL-slug label
+ *     - hostLabel(host, label?) — outbound host SSRF + by-name denylist
+ *     - freeText(s, label, policy?) — dangerous-codepoint screen for
+ *       unconstrained UTF-8 text fields
+ *
+ * @primitive textGuard
+ * @related   b.money, b.ssrfGuard, b.safeUrl, shop.currencyRounding,
+ *            shop.webhooks, shop.webhookSubscriptions
+ */
+
+var b = require("./vendor/blamejs");
+
+// The framework's codepoint catalog (bidi / control / null / zero-width
+// tables + regexes, the script ranges, and the detect/assert/strip
+// helpers the guard-* family composes). It is not on the framework's
+// public index yet; the catalog leaf has no shop-module dependency, so
+// composing it directly stays refresh-safe and keeps a single source of
+// truth instead of a second copy of the tables.
+// allow:vendor-hand-edit — composing the framework's codepoint catalog leaf (no shop dependency, refresh-safe); collapses to b.codepointClass once upstream re-exports it
+var codepointClass = require("./vendor/blamejs/lib/codepoint-class");
+
+// ---- shop validators ----------------------------------------------------
+
+// asciiUpperLetters(s, label, n?) — exactly `n` (default 3) ASCII
+// uppercase letters, nothing else. The generalized shape behind every
+// `/^[A-Z]{3}$/` token check. ASCII-allowlist by construction, so bidi
+// / control / zero-width / confusable codepoints are rejected for free
+// (they are not in A-Z). Throws TypeError on a miss.
+function asciiUpperLetters(s, label, n) {
+  var name = label || "value";
+  var len = n == null ? 3 : n;
+  if (typeof len !== "number" || !Number.isInteger(len) || len <= 0) {
+    throw new TypeError("textGuard: length must be a positive integer, got " + JSON.stringify(n));
+  }
+  // allow:dynamic-regex — len is a validated positive integer, not external input
+  var re = new RegExp("^[A-Z]{" + len + "}$");
+  if (typeof s !== "string" || !re.test(s)) {
+    throw new TypeError(
+      name + " must be exactly " + len + " uppercase ASCII letter(s), got " + JSON.stringify(s)
+    );
+  }
+  return s;
+}
+
+// currencyCode(s, label?) — ISO 4217 currency code: the asciiUpperLetters
+// shape check THEN membership in the framework's catalog (b.money.CURRENCIES,
+// the same surface currency-rounding + currency-display compose). Rejects
+// both malformed codes ("usd", "US") and well-formed-but-nonexistent codes
+// ("ZZZ") that would shape-check past `/^[A-Z]{3}$/` but bind money to a
+// currency the rest of the shop can't price. Throws TypeError on a miss.
+function currencyCode(s, label) {
+  var name = label || "currency";
+  if (typeof s !== "string" || !/^[A-Z]{3}$/.test(s)) {
+    throw new TypeError(
+      name + " must be a 3-letter uppercase ISO 4217 code, got " + JSON.stringify(s)
+    );
+  }
+  if (!Object.prototype.hasOwnProperty.call(b.money.CURRENCIES, s)) {
+    throw new TypeError(name + " " + JSON.stringify(s) + " is not in the ISO 4217 catalog");
+  }
+  return s;
+}
+
+// slugLabel(s, label, opts?) — a lowercase URL-slug label: starts and
+// ends with [a-z0-9], inner chars [a-z0-9-], no leading / trailing /
+// doubled hyphen, length 1..maxLen (default 80). ASCII-allowlist, so
+// dangerous codepoints are rejected by construction. Throws TypeError.
+function slugLabel(s, label, opts) {
+  var name = label || "slug";
+  opts = opts || {};
+  var maxLen = opts.maxLen == null ? 80 : opts.maxLen;
+  if (typeof maxLen !== "number" || !Number.isInteger(maxLen) || maxLen <= 0) {
+    throw new TypeError("textGuard: maxLen must be a positive integer, got " + JSON.stringify(opts.maxLen));
+  }
+  if (typeof s !== "string" || s.length < 1 || s.length > maxLen) {
+    throw new TypeError(
+      name + " must be a 1.." + maxLen + "-character lowercase slug, got " + JSON.stringify(s)
+    );
+  }
+  // Single char must itself be [a-z0-9]; longer must match start/inner/end.
+  var ok = s.length === 1
+    ? /^[a-z0-9]$/.test(s)
+    : /^[a-z0-9][a-z0-9-]*[a-z0-9]$/.test(s);
+  if (!ok || /--/.test(s)) {
+    throw new TypeError(
+      name + " must be a lowercase URL slug ([a-z0-9] separated by single hyphens), got " + JSON.stringify(s)
+    );
+  }
+  return s;
+}
+
+// Hostnames that name an internal / metadata destination by name rather
+// than by IP literal. The cloud-metadata services answer on a hostname as
+// well as the 169.254.169.254 link-local IP; localhost resolves to
+// loopback. A literal-IP host is classified directly via b.ssrfGuard
+// (no DNS); these names cover the by-name reach of the same targets.
+var BLOCKED_HOSTS = Object.freeze({
+  "localhost":                1,
+  "metadata.google.internal": 1,
+});
+
+// hostLabel(host, label?) — refuse an outbound host that targets an
+// internal / loopback / link-local / reserved / cloud-metadata
+// destination. A literal-IP host is classified via b.ssrfGuard.classify
+// (IPv4 + IPv6 + IPv4-mapped, no DNS); a hostname is matched against the
+// by-name metadata / loopback denylist plus the *.internal suffix. A
+// trailing FQDN dot and IPv6 brackets are stripped first so neither check
+// is evaded. DNS-rebinding (a public name resolving to a private IP) is
+// out of scope at this gate by design — the resolving guard belongs on
+// the delivery dial. Throws TypeError when the host is not allowed.
+// Returns the normalized (bracket / trailing-dot stripped, lowercased)
+// host on success.
+function hostLabel(host, label) {
+  var name = label || "host";
+  if (typeof host !== "string" || host.length === 0) {
+    throw new TypeError(name + " must be a non-empty string");
+  }
+  var h = host.replace(/^\[|\]$/g, "").toLowerCase().replace(/\.+$/, "");
+  if (b.ssrfGuard.classify(h) ||
+      BLOCKED_HOSTS[h] ||
+      h === "internal" || /\.internal$/.test(h)) {
+    throw new TypeError(name + " is not allowed (internal/loopback/metadata address)");
+  }
+  return h;
+}
+
+// freeText(s, label, policy?) — the dangerous-codepoint screen for an
+// UNCONSTRAINED UTF-8 text field (customer note, review body, gift
+// message, product Q&A). Unlike the ASCII-allowlist validators above,
+// these fields legitimately carry arbitrary letters, so the codepoint
+// catalog is the right backing: bidi overrides (CVE-2021-42574 Trojan
+// Source), null bytes, and C0 control characters are refused by default;
+// zero-width / invisible formatting is refused when policy.zeroWidth is
+// "reject"; a mixed-script confusable (Cyrillic 'а' inside an otherwise
+// Latin label) is refused when policy.mixedScript is "reject". Throws
+// TypeError on a refused codepoint. Returns the input on success.
+function freeText(s, label, policy) {
+  var name = label || "value";
+  if (typeof s !== "string") {
+    throw new TypeError(name + " must be a string");
+  }
+  policy = policy || {};
+  var bidiP    = policy.bidi    || "reject";
+  var nullP    = policy.nullByte || "reject";
+  var controlP = policy.control || "reject";
+  if (bidiP === "reject" && codepointClass.BIDI_RE.test(s)) {
+    throw new TypeError(name + " contains a Unicode bidi override (CVE-2021-42574 Trojan Source)");
+  }
+  if (nullP === "reject" && s.indexOf(codepointClass.NULL_BYTE) !== -1) {
+    throw new TypeError(name + " contains a null byte");
+  }
+  if (controlP === "reject" && codepointClass.C0_CTRL_RE.test(s)) {
+    throw new TypeError(name + " contains a C0 control character");
+  }
+  if (policy.zeroWidth === "reject" && codepointClass.ZERO_WIDTH_RE.test(s)) {
+    throw new TypeError(name + " contains a zero-width / invisible formatting character");
+  }
+  if (policy.mixedScript === "reject") {
+    var scripts = codepointClass.detectMixedScripts(s, policy.allowedScripts);
+    if (scripts) {
+      throw new TypeError(
+        name + " mixes writing systems (" + scripts.join(", ") + ") — possible confusable / homograph"
+      );
+    }
+  }
+  return s;
+}
+
+module.exports = {
+  // Re-exports of the framework codepoint catalog (single source of truth).
+  BIDI_RE:                codepointClass.BIDI_RE,
+  C0_CTRL_RE:             codepointClass.C0_CTRL_RE,
+  ZERO_WIDTH_RE:          codepointClass.ZERO_WIDTH_RE,
+  NULL_BYTE:              codepointClass.NULL_BYTE,
+  BOM_CHAR:               codepointClass.BOM_CHAR,
+  scriptFor:              codepointClass.scriptFor,
+  detectMixedScripts:     codepointClass.detectMixedScripts,
+  detectCharThreats:      codepointClass.detectCharThreats,
+  assertNoCharThreats:    codepointClass.assertNoCharThreats,
+  applyCharStripPolicies: codepointClass.applyCharStripPolicies,
+
+  // Shop validators.
+  asciiUpperLetters: asciiUpperLetters,
+  currencyCode:      currencyCode,
+  slugLabel:         slugLabel,
+  hostLabel:         hostLabel,
+  freeText:          freeText,
+};

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.14.6",
-      "tag": "v0.14.6",
+      "version": "0.14.7",
+      "tag": "v0.14.7",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.14.x
 
+- v0.14.7 (2026-05-30) — **Storage and audit-trail hardening: queries are gated to declared columns, raw SQL refuses embedded literals, the database key is bound to its location, sealed-column lookup hashes gain a keyed mode, audit-chain purges can require dual control, and breach deadlines ship a running clock.** This release tightens the data and audit layers against a set of failure modes that were previously reachable. Database queries are now checked against the columns a table declared in its schema: a reference to an undeclared column fails closed by default instead of silently matching nothing, and the `whereRaw` escape hatch refuses an embedded string literal so values bind through placeholders. The database encryption key is sealed with its purpose, data directory, and key path as additional authenticated data, so a key file cannot be relocated to another deployment and unsealed there; an older key without that binding upgrades itself on first load. Sealed-column equality-lookup hashes can now be computed as a keyed MAC (HMAC-SHAKE256) off a per-deployment key, making the lookup hash unforgeable without that key, while the salted-SHA3 default is unchanged. Purging the tamper-evident audit chain can be placed under a two-authorizer dual-control grant so one operator cannot erase it alone, and database credential-rejection audits now record which relation the rejected credential tried to reach. Finally, breach-notification deadlines get a running clock that raises approaching and passed alerts as each regime's window elapses. One behavior change to note: the column gate defaults to reject — if a service issues queries against columns it did not declare in its schema, set `db.init({ columnGate: "warn" })` (audited, allowed) or `"off"` while the schema is reconciled. **Added:** *Column-membership gate on every query* — `b.db.from(table)` now checks each referenced column against the table's declared schema. The mode is set with `db.init({ columnGate: "reject" | "warn" | "off" })` (default `reject`), and `query.allowedColumns([...])` narrows a single query to an explicit allowlist that is always enforced. `b.db.getDeclaredColumns(table)` returns a table's declared column names (or `null` for an unknown table). This is defense in depth against typo'd or caller-influenced column names reaching the SQL layer (CWE-89). · *Keyed mode for sealed-column lookup hashes* — Equality-lookup ("derived") hashes for sealed columns can be computed as `hmac-shake256` — a keyed MAC over a per-deployment key — instead of the default `salted-sha3`. Set it per table with `cryptoField.registerTable(name, { derivedHashMode: "hmac-shake256" })` or per column with `{ from, mode: "hmac-shake256" }`. The keyed hash is unforgeable and un-correlatable without the deployment's MAC key, which raises the bar against offline lookup-table attacks on low-entropy sealed values (CWE-916). `b.vault.getDerivedHashMacKey()` exposes the 32-byte per-deployment key; it is created on first use and re-sealed across key rotation automatically. · *Dual-control gate on audit-chain purge* — `b.auditTools.purge` accepts `dualControlGrant`. When `audit_log` is placed under dual control, a verified archive and `confirm: true` are no longer sufficient: the purge additionally requires a consumed m-of-n grant whose action is bound to the purge, so a grant minted for another operation cannot be replayed and one operator cannot erase the tamper-evident chain alone (NIST SP 800-53 AU-9, separation of duties). · *Running clock for breach-notification deadlines* — `b.incident.report.createDeadlineClock({ notify, approachThresholds })` tracks open incidents and raises `deadline_approaching` and `deadline_passed` alerts as each regime's window elapses (GDPR 72h, DORA, NIS2, and the rest of the registry). Alerts are deduplicated per incident and stage, suppressed once a submission stage is acknowledged, and the clock can run on an interval or be ticked manually. **Changed:** *Queries against undeclared columns now fail closed by default* — The column gate defaults to `reject`: a query that references a column the table did not declare throws rather than silently matching nothing. A service that intentionally queries undeclared columns can set `db.init({ columnGate: "warn" })` to audit and allow, or `"off"` to disable the gate, while its schema is reconciled. Framework-declared columns (including `_id` and derived-hash columns) are always members. **Security:** *Database encryption key bound to its location* — `db.key.enc` is sealed with additional authenticated data over its purpose, resolved data directory, and resolved key path. A sealed key copied to a different deployment or path no longer unseals there — the AEAD authentication fails — which prevents silent key relocation. A legacy key sealed without this binding is detected and re-sealed in the bound format on first load, with no operator action required. · *`whereRaw` refuses embedded string literals* — `whereRaw(sql, params)` and `WhereBuilder.raw(sql, params)` reject a raw fragment containing a string literal (`'...'`); values must bind through the `params` array. A static, operator-controlled literal can opt in with `{ allowLiterals: true }`. This closes a path where a value concatenated into a raw fragment would reintroduce SQL injection (CWE-89). · *Credential-rejection audits record the attempted relation* — A `db.auth.failed` audit row (SQLSTATE 28000 / 28P01 / 42501) now carries `attemptedTable`, the relation the rejected credential tried to reach, extracted defensively from the statement. Triage can scope the blast radius of a credential-abuse event without correlating back to the raw SQL log (CWE-778). **Detectors:** *Audit-purge dual-control gate* — A new check fails the build if a call to `purgeAuditChain` appears in a file that does not also route through the dual-control gate, so a future caller cannot physically delete chain rows without two-authorizer enforcement. · *Raw-SQL literal/interpolation guard* — A new check fails the build on a `whereRaw` / `.raw` call whose SQL argument is built by template interpolation or string concatenation, keeping the bound-params discipline enforceable in framework code. · *Hand-rolled lookup-hash guard* — A new check fails the build if a sealed-column lookup hash is derived from the per-deployment salt outside the canonical helper, so call sites cannot bypass the keyed-mode and per-column mode policy. · *Auth-audit attempted-relation guard* — A new check fails the build if a `db.auth.failed` audit is emitted in a file that does not name `attemptedTable`, so the forensic field cannot be dropped from a future emitter.
+
 - v0.14.6 (2026-05-30) — **Access-refusal middleware can return RFC 9457 problem+json or a custom response, and several documented-but-uncallable APIs are now reachable.** Every access-refusal middleware — the auth gates (bearer, DPoP, mTLS, AAL, bound-key), CSRF, CORS, rate-limit, bot-guard, age-gate, the host and network allowlists, and the method and content-type gates — now accepts two uniform options: `problemDetails: true` returns an RFC 9457 `application/problem+json` body, and `onDeny(req, res, info)` hands the response to the caller. With neither set the refusal is byte-for-byte what it was, so this is a drop-in change that lets a service standardize one error envelope across its API instead of working around each middleware's hardcoded body. Alongside that: `b.middleware.requireBoundKey` is now exported (it was documented and tested but never wired into the middleware surface), `b.middleware.bearerAuth` accepts `requiredScopes` (previously rejected at construction, which made its scope-enforcement path unreachable), API-key refusals send the RFC 6750 challenge code that matches the failure, two documented call paths that named a missing namespace segment are corrected, and the release flow now flags stale GitHub Actions and vendored bundles — with a ready-to-paste pin — before a dependency PR is needed. **Added:** *Uniform `onDeny` and `problemDetails` options on every access-refusal middleware* — Each request-lifecycle middleware that refuses a request now takes `problemDetails: true` to emit an RFC 9457 `application/problem+json` body (composing `b.problemDetails`) and `onDeny(req, res, info)` to take over the response entirely; `info` carries the status, a machine reason, and the middleware-specific fields. The deny-path response headers (`Allow`, `WWW-Authenticate`, `Retry-After`, `Accept`) survive every mode. When neither option is set the response is unchanged. Covers `requireAuth`, `requireAal`, `requireMethods`, `requireContentType`, `requireMtls`, `requireBoundKey`, `bearerAuth`, `dpop`, `csrfProtect`, `fetchMetadata`, `botGuard`, `ageGate`, `hostAllowlist`, `networkAllowlist`, `cors`, `rateLimit`, and `dailyByteQuota` (whose existing `onExceeded` keeps working as an alias of `onDeny`). **Fixed:** *`b.middleware.requireBoundKey` is now callable* — The Bearer-API-key middleware was documented (with examples and tests) but never exported on `b.middleware`, so `b.middleware.requireBoundKey(...)` threw `undefined is not a function`. It is now wired into the middleware surface. · *`b.middleware.bearerAuth` accepts `requiredScopes`* — The RFC 6750 scope-enforcement path read `opts.requiredScopes`, but the option was rejected at construction with `unknown option`, making the 403 `insufficient_scope` behavior unreachable. `requiredScopes` is now an accepted option. · *RFC 6750 challenge codes on API-key refusals* — `b.middleware.requireBoundKey` now sends the `WWW-Authenticate` error code that matches the failure: `insufficient_scope` on a 403 missing-scope, `invalid_token` on an unknown or revoked token, and no error code on a 401 that presented no credentials (RFC 6750 §3). It previously sent `invalid_request` for every refusal. · *Corrected two documented call paths* — The compliance and network references named a path that dropped a namespace segment: the conformity-assessment scaffold is at `b.cra.report.conformityAssessment` (not `b.cra.conformityAssessment`), and the per-socket tuning helper is at `b.network.socket.applyToSocket` (not `b.network.applyToSocket`). The documented signatures now match the callable paths. · *GitHub Actions pins refreshed* — `github/codeql-action` 4.35.5 to 4.36.0, and `docker/login-action`, `docker/setup-buildx-action`, and `docker/setup-qemu-action` to their latest releases. **Detectors:** *`@primitive` reachability gate* — A new check resolves every documented `b.X.Y` primitive against the actual public surface and fails the build when a documented path is not callable (factory-instance shorthands excluded). This is the gate that would have caught the `requireBoundKey` and call-path issues above. · *Deny-path composition gate* — A new check requires every access-refusal middleware to route its refusal through the shared deny-response writer, so a future middleware cannot reintroduce a hardcoded body that locks callers out of `onDeny` / `problemDetails`. · *Actions and vendor currency in the release flow* — The release flow now fails the cut when a SHA-pinned GitHub Action or a vendored bundle is behind its latest upstream release. The actions report prints a ready-to-paste `owner/repo@<sha>  # vX.Y.Z` pin and every file and line that uses it, so the bump is copy-paste rather than an after-the-fact dependency PR. Transient registry or API errors stay advisory so a flaky network response does not block an unrelated release.
 
 - v0.14.5 (2026-05-30) — **Finished cleaning up the mislabeled byte-literal lint suppressions, with no API or behavior changes.** A follow-up to the byte-literal lint tightening. The remaining suppression comments that named the byte-literal check on values that are not byte sizes — JSON-RPC error codes, HTTP status codes, octet ranges, day-in-milliseconds constants — are removed, keeping their explanatory text and any correctly-named companion suppression. Every byte-literal suppression that remains is now on genuine 1024-scale byte arithmetic. Source-comment hygiene only. **Changed:** *Remaining mislabeled byte-literal suppressions removed* — The byte-literal lint was previously a check on any multiple-of-8 integer, so suppression comments naming it were scattered across non-byte values. The last of those (in a handful of files, in mixed comment formats) are now removed — their explanatory text is retained as plain comments, and any correctly-named companion suppression is kept. The only byte-literal suppressions that remain are on genuine 1024-scale byte arithmetic. No change to any exported API, error code, wire format, or runtime behavior.

package/lib/vendor/blamejs/README.md

@@ -61,7 +61,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 ### Data layer
 
 - **SQLite with sealed-by-default columns** — `b.db`, migrations, seeders, atomic-file writes
-- **Chainable query builder** — atomic `.increment(col, delta)`, closure-form `.whereGroup` / top-level `.orWhere` OR composition, `.search(fields, term)` LIKE-OR with safe `%`/`_` ESCAPE handling, `.paginate(opts)` returning `{ items, total, page, totalPages }`
+- **Chainable query builder** — atomic `.increment(col, delta)`, closure-form `.whereGroup` / top-level `.orWhere` OR composition, `.search(fields, term)` LIKE-OR with safe `%`/`_` ESCAPE handling, `.paginate(opts)` returning `{ items, total, page, totalPages }`; a column-membership gate (`db.init({ columnGate })`, default reject) fails a query closed when it names a column the table never declared, and `whereRaw` refuses an embedded string literal so values bind through placeholders
 - **Mongo-style document-store facade** — `b.db.collection(name, opts?)` with `$set` / `$inc` / `$unset` / `$eq` / `$ne` / `$gt` / `$gte` / `$lt` / `$lte` / `$in` / `$like`; schemaless-document opts via `overflow: "<col>"` (folds unknown fields into a JSON-text column; rewrites `WHERE` on virtual fields to `JSON_EXTRACT`), `jsonColumns: [...]` (auto-stringify on write + parse via `b.safeJson` on read), `sealedFields: { email: "emailHash" }` (co-locates a `b.cryptoField` sealed-column / derived-hash declaration so plaintext lookups auto-rewrite to hash-column lookups)
 - **DB lifecycle** — in-memory encrypted snapshot via `b.db.snapshot()`; standalone encrypted-DB-file lifecycle (`b.db.fileLifecycle({ dataDir, vault })` — decrypt-to-tmpfs, periodic re-encrypt flush, graceful shutdown — same envelope as `b.db`, no schema/audit-chain coupling); `db.init` opt-outs `frameworkTables: false` / `auditSigning: false` and path overrides `encryptedDbPath` / `encryptedDbName` / `dbKeyPath`
 - **External RDBMS** — bring-your-own Postgres / MySQL with pool tuning + role-aware connect + read-replica routing (`b.externalDb`); declarative role-narrowed views and Postgres row-level-security migrations (`b.db.declareView`, `b.db.declareRowPolicy`)
@@ -98,7 +98,8 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **At-rest envelope** — envelope-versioned PQC (ML-KEM-1024 + P-384 hybrid, XChaCha20-Poly1305, SHAKE256); vault sealing (`b.crypto`, `b.vault`)
 - **Power-on self-test** — `b.crypto.selfTest()` runs FIPS 140-3-style integrity checks: NIST FIPS 202 known-answer tests (SHA3-256/512, SHAKE256), AEAD round-trip + tamper-detect, and ML-KEM-1024 / ML-DSA-87 / SLH-DSA-SHAKE-256f pairwise-consistency + negative tests; fails closed (throws) on any mismatch
 - **Field-level + crypto-shred** — `b.cryptoField.eraseRow`; per-column data residency tagging + per-row keys (`K_row = HKDF(K_table, rowId)`) so erasing the per-row key makes WAL / replica residuals undecryptable (`b.cryptoField.declareColumnResidency`, `b.cryptoField.declarePerRowKey`)
-- **AAD-bound sealed columns** — AEAD tag tied to `(table, rowId, column, schemaVersion)`; copy-paste between rows or schema-version replay surfaces as refused decrypt (`b.vault.aad`)
+- **AAD-bound sealed columns** — AEAD tag tied to `(table, rowId, column, schemaVersion)`; copy-paste between rows or schema-version replay surfaces as refused decrypt (`b.vault.aad`). The database encryption key is sealed the same way — bound to its purpose, data directory, and key path — so a relocated key file fails to unseal; an older unbound key upgrades itself on first load
+- **Keyed lookup hashes** — sealed-column equality-lookup hashes default to salted SHA3-512 and can opt into a keyed `hmac-shake256` MAC off a per-deployment key (`cryptoField.registerTable({ derivedHashMode })`, `b.vault.getDerivedHashMacKey`), making the lookup hash unforgeable and un-correlatable across deployments
 - **Signed webhooks + API encryption** — SLH-DSA-SHAKE-256f default; ML-DSA-65 opt-in; ECIES API encryption (`b.webhook`, `b.crypto`)
 - **HPKE / HTTP signatures** — RFC 9180 HPKE with ML-KEM-1024 + HKDF-SHA3-512 + ChaCha20-Poly1305 (`b.crypto.hpke`); RFC 9421 HTTP Message Signatures with derived components and ed25519 / ML-DSA-65 (`b.crypto.httpSig`); RFC 9530 Content-Digest / Repr-Digest body-integrity fields (SHA-256 / SHA-512, legacy algorithms refused — `b.contentDigest`) to sign the digest rather than the whole body
 - **X-Wing hybrid KEM** — `b.crypto.xwing` (draft-connolly-cfrg-xwing-kem, experimental): ML-KEM-768 + X25519 bound by SHA3-256, secure if either component holds — the conservative key-encapsulation shape for migrating off classical ECDH. `keygen` / `encapsulate` / `decapsulate` with a 1216-byte public key, 1120-byte ciphertext, and 32-byte shared secret

package/lib/vendor/blamejs/SECURITY.md

@@ -194,6 +194,8 @@ What blamejs defends against, by design:
 - **Disk theft of an offline data dir** — `vault.key.sealed` (wrapped mode) + sealed columns + audit chain mean the data dir alone is opaque without the vault passphrase. Plaintext mode is dev-only and prints a `WARNING:` on every boot.
 - **Future quantum decrypt of currently-stored ciphertext** — every encrypted-at-rest blob uses ML-KEM-1024 + P-384 hybrid KEM and XChaCha20-Poly1305. There's no classical-only fallback to harvest now and decrypt later.
 - **Audit-chain tampering** — every audit row carries `prevHash` + `rowHash` + `nonce` + `fencingToken`; the chain is verified at boot via `auditChain.verifyChain` and any mismatch refuses subsequent appends. Checkpoints are signed with SLH-DSA-SHAKE-256f. An attacker rewriting history needs to rewrite every subsequent hash AND forge the signing key.
+- **Single-operator erasure of the audit chain** — physically purging archived rows already requires a verified archive bundle plus `confirm: true`. Placing `audit_log` under dual control (`b.db.declareRequireDualControl`) additionally requires `b.auditTools.purge({ dualControlGrant })` to carry a consumed m-of-n grant whose action is bound to the purge, so a single compromised operator cannot truncate the tamper-evident chain alone and a grant minted for another operation cannot be replayed.
+- **Stolen / relocated database key file** — `db.key.enc` is sealed with additional authenticated data over its purpose, resolved data directory, and resolved key path. A key file copied into a different deployment or path no longer unseals there (the AEAD authentication fails), so an attacker who exfiltrates the key cannot point it at a different data dir to decrypt. An older key sealed without the binding upgrades to the bound format on first load, with no operator action.
 - **Cross-site request forgery on state-changing routes** — `csrfProtect` cookie-mode (double-submit pattern) + `SameSite=Lax` cookie + `Origin` / `Sec-Fetch-Site` checks in CORS.
 - **Drive-by scrapers / low-effort bots** — `botGuard` middleware fingerprints `User-Agent` + `Sec-Fetch-*` + `Accept-Language`.
 - **Online brute-force against credentials** — `b.auth.lockout` tracks failed attempts per account (or any operator-chosen key) and engages an exponential-backoff lockout (1m → 5m → 15m → 1h → 6h+, clamped). State lives in `b.cache` so it shares across cluster nodes when the cluster backend is wired. Operator-driven `unlock(key, { req, reason })` audits with the admin's 5 W's. Backend errors fail open (the framework's job is to slow attackers, not to lock operators out of their own admin accounts when Redis dies).
@@ -287,6 +289,7 @@ This is the minimum-viable security posture for a production deployment. The fra
 - [ ] Rotate the audit signing key annually (or per compliance schedule)
 - [ ] Archive old audit rows monthly: `blamejs audit archive --before <date> --out ./audit-archives/`
 - [ ] Back up the audit-archive bundles to a separate location with a different passphrase
+- [ ] Place `audit_log` under dual control (`b.db.declareRequireDualControl`) so a physical purge requires a two-authorizer m-of-n grant in addition to a verified archive — one operator cannot erase the chain alone
 
 **Backups**
 - [ ] Schedule nightly backups via the framework's `b.backup` primitive (encrypted with `BLAMEJS_BACKUP_PASSPHRASE`, separate from vault passphrase)

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.14.6",
-  "createdAt": "2026-05-30T16:00:48.364Z",
+  "frameworkVersion": "0.14.7",
+  "createdAt": "2026-05-30T20:25:42.630Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -14518,6 +14518,10 @@
           "type": "function",
           "arity": 0
         },
+        "getDeclaredColumns": {
+          "type": "function",
+          "arity": 1
+        },
         "getMode": {
           "type": "function",
           "arity": 0
@@ -37103,6 +37107,10 @@
             "create": {
               "type": "function",
               "arity": 1
+            },
+            "createDeadlineClock": {
+              "type": "function",
+              "arity": 1
             }
           }
         }
@@ -49732,6 +49740,10 @@
           "type": "function",
           "arity": 0
         },
+        "getDerivedHashMacKey": {
+          "type": "function",
+          "arity": 0
+        },
         "getDerivedHashSalt": {
           "type": "function",
           "arity": 0

package/lib/vendor/blamejs/lib/agent-event-bus.js

@@ -136,7 +136,7 @@ function _registerTopic(topics, name, topicOpts, auditImpl) {
     throw new AgentEventBusError("agent-event-bus/bad-schema",
       "registerTopic: schema required (flat key→type map)");
   }
-  // BUG-12 — `kind` is now captured on register so listTopics's kind
+  // `kind` is now captured on register so listTopics's kind
   // filter actually matches. Prior shape never set entry.kind, so the
   // filter at args.kind was dead. Default value derives from the
   // dotted topic name's first segment ("mail.scan.x" → "mail"), giving
@@ -164,7 +164,7 @@ function _registerTopic(topics, name, topicOpts, auditImpl) {
   });
 }
 
-// SUBSTRATE-22 — operators reloading a module (test runners between
+// Operators reloading a module (test runners between
 // runs, hot-reload tools, multi-tenant onboarding flows that
 // register-deregister topics) need a clean unregister path; without
 // it the second register throws topic-duplicate and the operator is
@@ -183,7 +183,7 @@ function _unregisterTopic(topics, name, auditImpl) {
 function _listTopics(topics, args, permissions) {
   // Permission gate: list-topics requires no special scope by default;
   // operator can wrap with their own permissions instance for stricter.
-  // BUG-12 — kind filter now matches because register captures kind.
+  // Kind filter now matches because register captures kind.
   var out = [];
   topics.forEach(function (entry) {
     if (args.kind && entry.kind !== args.kind) return;
@@ -229,7 +229,7 @@ async function _publish(topics, pubsub, name, payload, pOpts, permissions, audit
   }
   // Schema validation.
   guardEventBusPayload.validate(payload, entry.schema);
-  // SUBSTRATE-6 — when a topic is tenant-scoped, require the publisher
+  // When a topic is tenant-scoped, require the publisher
   // to declare a tenantId BEFORE the event reaches the durable bus
   // backend. Prior shape allowed `wrapped._tenantId: null` to land on
   // the bus, and the receive-side drop only fired AFTER persistence —

package/lib/vendor/blamejs/lib/agent-idempotency.js

@@ -158,7 +158,7 @@ function create(opts) {
   return {
     get:        function (method, actorId, key)                       { return _get(store, method, actorId, key, auditImpl, ttlMs, maxResultBytes); },
     put:        function (method, actorId, key, result, putOpts)      { return _put(store, method, actorId, key, result, putOpts || {}, ttlMs, maxResultBytes, fingerprintArgs, auditImpl); },
-    // SUBSTRATE-4 — putIfAbsent gates concurrent retries at the cache
+    // putIfAbsent gates concurrent retries at the cache
     // boundary so only one consumer runs the handler. Operator wraps:
     //   var claim = await idem.putIfAbsent(method, actor, key, args);
     //   if (claim.alreadyClaimed) return claim.result; // another retry won
@@ -173,7 +173,7 @@ function create(opts) {
   };
 }
 
-// SUBSTRATE-4 — atomic claim/check/run pattern. Returns one of:
+// Atomic claim/check/run pattern. Returns one of:
 //   { alreadyClaimed: false, fingerprint }          — caller runs the handler
 //   { alreadyClaimed: true,  pending: true }        — another in-flight claim holds the slot
 //   { alreadyClaimed: true,  result: <cached> }     — prior handler completed; cached result
@@ -299,7 +299,7 @@ async function _get(store, method, actorId, key, auditImpl, ttlMs, maxResultByte
     throw new AgentIdempotencyError("agent-idempotency/corrupt-result",
       "get: cached result failed to parse — " + (e && e.message ? e.message : String(e)));
   }
-  // SUBSTRATE-12 — atomic replayCount increment. The prior shape
+  // Atomic replayCount increment. The prior shape
   // (read row → mutate → put row) raced two concurrent retries: each
   // saw replayCount=N, both wrote replayCount=N+1, so the counter
   // missed bumps and the put-with-fresh-result race-clobbered prior
@@ -439,7 +439,7 @@ function _fingerprintArgs(args) {
   // unique fingerprint and defeat the args-mismatch defense. Strip
   // _traceContext (varies per-hop, doesn't change result).
   //
-  // SUBSTRATE-11 — DO NOT strip _postureChain. The prior shape ignored
+  // DO NOT strip _postureChain. The prior shape ignored
   // _postureChain.postureSet, so a request made under
   // postureSet:["hipaa","pci-dss"] cached the same result that a
   // downgrade attempt under postureSet:["pci-dss"] would replay
@@ -493,7 +493,7 @@ function _inMemoryBackend(maxEntries) {
       map.set(_k(method, actorId, hash), row);
       return Promise.resolve();
     },
-    // SUBSTRATE-4 — atomic insert. Map.set is synchronous so the
+    // Atomic insert. Map.set is synchronous so the
     // get+set pair below is naturally race-free within the in-memory
     // backend (V8 single-threaded). Returns true when inserted, false
     // when the row already exists.
@@ -503,7 +503,7 @@ function _inMemoryBackend(maxEntries) {
       map.set(k, row);
       return Promise.resolve(true);
     },
-    // SUBSTRATE-12 — atomic replayCount increment. Operators wiring
+    // Atomic replayCount increment. Operators wiring
     // a SQL backend implement this with `UPDATE ... SET
     // replay_count = replay_count + 1 WHERE keyHash = $1 RETURNING *`
     // — read-modify-write race-free. In-memory backend is naturally

package/lib/vendor/blamejs/lib/agent-orchestrator.js

@@ -119,7 +119,7 @@ function _unsealRegistryRow(row) {
 var DEFAULT_DRAIN_TIMEOUT_MS = C.TIME.minutes(2);
 var STREAM_ID_RAND_BYTES     = 8;                                                                     // stream-id random-suffix byte length, not a size cap
 var DEFAULT_PER_CONSUMER_STOP_MS = C.TIME.seconds(5);
-// SUBSTRATE-20 — FNV-1a offset basis salted with the first 32 bits of
+// FNV-1a offset basis salted with the first 32 bits of
 // SHA3-512(vault master). Attackers who don't have read access to the
 // vault keypair can't compute the salt, so they can't engineer
 // tenantIds that all map to one shard. Cached per-process; rotation
@@ -183,7 +183,7 @@ function create(opts) {
     // operator-supplied metadata (kind / tenantId / posture / ...);
     // every consuming process holds its own runtime map of name → agent.
     liveAgents:  new Map(),
-    // SUBSTRATE-8 — drain quiesce wiring. Operator passes
+    // Drain quiesce wiring. Operator passes
     // { outbox, sagaInFlightCount, pubsubFlush } via create() so the
     // drain phase can quiesce real in-flight work, not just stop
     // consumers. Optional — operators with no outbox / saga / pubsub
@@ -192,7 +192,7 @@ function create(opts) {
     sagaInFlightCount: typeof opts.sagaInFlightCount === "function" ? opts.sagaInFlightCount : null,
     pubsubFlush:      typeof opts.pubsubFlush === "function" ? opts.pubsubFlush : null,
     perConsumerStopMs: typeof opts.perConsumerStopMs === "number" ? opts.perConsumerStopMs : DEFAULT_PER_CONSUMER_STOP_MS,
-    // SUBSTRATE-9 — onTransition handler invalidates election cache
+    // onTransition handler invalidates election cache
     // on lease-lost / acquired / released. Operator opts out via
     // { cacheElections: false } to always re-query b.cluster.
     cacheElections:   opts.cacheElections !== false,
@@ -205,7 +205,7 @@ function create(opts) {
     });
   }
 
-  // SUBSTRATE-9 — subscribe to cluster lease transitions so cached
+  // Subscribe to cluster lease transitions so cached
   // election state can't go stale after a partition. b.cluster
   // .onTransition fires for every lease-acquired / lease-lost / lease-
   // released event; we invalidate the affected resource's cached
@@ -254,7 +254,7 @@ function create(opts) {
  * @status    stable
  * @related   b.agent.orchestrator.create
  *
- * SUBSTRATE-3 — attach an in-process live agent reference to a row
+ * Attach an in-process live agent reference to a row
  * that already exists in the persistent registry backend. The
  * canonical boot-phase contract: the *first* process to start a new
  * agent calls `register()` (writes the backend row + holds the live
@@ -499,7 +499,7 @@ function _spawnSingleConsumer(ctx, agent, queue, topic, maxConcurrency) {
  *   // → integer in [0, 8)
  */
 function _saltedFnvBasis() {
-  // SUBSTRATE-20 — salt FNV-1a offset basis with the vault master so
+  // Salt FNV-1a offset basis with the vault master so
   // an attacker can't engineer tenantIds that all hash to one shard.
   // Vault-less path (single-process tests / dev) falls back to the
   // standard FNV offset basis; production deployments with vault
@@ -561,7 +561,7 @@ async function _elect(ctx, args) {
     });
     return elec;
   }
-  // SUBSTRATE-9 — cluster mode: ALWAYS query truth from b.cluster.
+  // Cluster mode: ALWAYS query truth from b.cluster.
   // The onTransition handler installed in create() invalidates the
   // cache on every lease event, so a cache hit here is safe (it
   // means no lease event has fired since the last query). But the
@@ -600,10 +600,10 @@ async function _drain(ctx, args) {
   var drained = 0;
   var startedAt = Date.now();
   var perConsumerMs = ctx.perConsumerStopMs;
-  // SUBSTRATE-8 — drain phases:
+  // Drain phases:
   //   1. set ctx.draining so streams emit drain-markers + new task
   //      dispatches refuse (consumers re-check on every envelope).
-  //   2. stop each consumer with BUG-6 per-consumer timeout race —
+  //   2. stop each consumer with a per-consumer timeout race —
   //      one hung consumer can't block the full drain budget.
   //   3. quiesce in-flight: poll outbox.pendingCount + sagaInFlightCount
   //      until 0 OR remaining-budget-ms elapses.

package/lib/vendor/blamejs/lib/agent-posture-chain.js

@@ -65,7 +65,7 @@ var AgentPostureChainError = defineClass("AgentPostureChainError", { alwaysPerma
 
 var BUILTIN_REGIMES = Object.freeze(["hipaa", "pci-dss", "gdpr", "soc2"]);
 
-// SUBSTRATE-10 — envelope MAC vocabulary. Cross-process envelope
+// Envelope MAC vocabulary. Cross-process envelope
 // integrity: an attacker with queue / event-bus write access who
 // strips postureSet to [] and re-sends a saga / sub-agent envelope
 // can bypass the downgrade refusal in _validate (which only checks
@@ -73,7 +73,7 @@ var BUILTIN_REGIMES = Object.freeze(["hipaa", "pci-dss", "gdpr", "soc2"]);
 // envelope bytes, computed at appendHop and verified at validate.
 var ENVELOPE_MAC_LABEL = "blamejs.agent.postureChain/v1";
 var ENVELOPE_MAC_KEY_BYTES = 32;                                                                        // HMAC-SHA3-512 keyed bytes
-// SUBSTRATE-21 — hop count cap defends infinite recursion across
+// Hop count cap defends infinite recursion across
 // agent delegation. 16 is the spec default; operators can lower via
 // opts.maxHopCount but never raise (audit fan-out without a cap is a
 // DoS class).
@@ -111,7 +111,7 @@ function _resolveMacKey() {
 
 function _envelopeMacBytes(envelope) {
   // Sign every field that downstream consumers verify off the wire,
-  // except the `_mac` field itself. SUBSTRATE-21 — also includes
+  // except the `_mac` field itself. Also includes
   // hopCount + chainTrail so a hostile rewriter can't roll back the
   // trail to evade the cap.
   var payload = {
@@ -163,8 +163,8 @@ function create(opts) {
                     opts.maxHopCount <= DEFAULT_MAX_HOP_COUNT
                       ? Math.floor(opts.maxHopCount)
                       : DEFAULT_MAX_HOP_COUNT;
-  // SUBSTRATE-10 escape hatch — only operator-confirmed single-process
-  // unit tests should opt out of envelope MAC. Production / multi-
+  // Escape hatch — only single-process unit tests should opt out of
+  // envelope MAC. Production / multi-
   // process / queue-spanning deployments leave the default on; the
   // gate audit-emits when bypassed so the posture is visible.
   var requireMac = opts.requireMac !== false;
@@ -257,7 +257,7 @@ function _appendHop(ctx, envelope, hopName) {
       "appendHop: hopName must be a non-empty string");
   }
   var trail = Array.isArray(envelope.chainTrail) ? envelope.chainTrail.slice() : [];
-  // SUBSTRATE-21 — cap enforced BEFORE the push so the hop-cap throw
+  // Cap enforced BEFORE the push so the hop-cap throw
   // fires consistently regardless of whether the operator inspects
   // trail.length first. Cap is a hard refusal (no truncation) because
   // a silently-dropped hop loses audit provenance for the call.
@@ -279,8 +279,8 @@ function _appendHop(ctx, envelope, hopName) {
     hopCount:   trail.length,
   });
   guardPostureChain.validate(newEnvelope);
-  // SUBSTRATE-10 — sign at every hop. Verify-side enforces requireMac.
-  // ctx.requireMac=false (operator-confirmed test escape hatch) skips
+  // Sign at every hop. Verify-side enforces requireMac.
+  // ctx.requireMac=false (test escape hatch) skips
   // the sign so a vault-less test path still works.
   if (ctx.requireMac) {
     try {
@@ -301,7 +301,7 @@ function _appendHop(ctx, envelope, hopName) {
 
 function _validate(ctx, envelope, agentPostureSet) {
   guardPostureChain.validate(envelope);
-  // SUBSTRATE-10 — MAC verification BEFORE any field-based decision so
+  // MAC verification BEFORE any field-based decision so
   // the wire-rewrite attack (postureSet:[] downgrade with valid SHAPE
   // but no integrity binding) is refused. ctx.requireMac=false skips
   // verification and emits an audit so the bypass is visible.
@@ -326,7 +326,7 @@ function _validate(ctx, envelope, agentPostureSet) {
       chainTrail: envelope.chainTrail,
     });
   }
-  // SUBSTRATE-21 — hop cap also enforced at validate-time. A hostile
+  // Hop cap also enforced at validate-time. A hostile
   // envelope might arrive with hopCount > cap if a prior hop's
   // requireMac was off; refuse here regardless.
   if (Array.isArray(envelope.chainTrail) && envelope.chainTrail.length > ctx.maxHopCount) {