@blamejs/blamejs-shop 0.3.12 → 0.3.14

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.14 (2026-05-30) — **Drop the inert Document-Policy header that only produced browser warnings.** Container-rendered pages were sending a Document-Policy response header whose feature tokens (document-write, unsized-media, oversized-images) are no longer recognized by current browsers — so it enforced nothing while making the browser log a warning for each token on every page. The header is now omitted; every other security header (Content-Security-Policy, Permissions-Policy, HSTS, X-Frame-Options, the COOP/CORP set, and the rest) is unchanged. The edge and container paths now agree — neither sends Document-Policy — closing a header-parity gap. **Fixed:** *No more Document-Policy console warnings* — The Document-Policy header is no longer emitted on container-rendered pages. Its tokens were rejected by current browsers (the policy applied nothing and logged a warning per token on every page), so the header is dropped rather than shipped inert; the full set of other security headers is retained unchanged. Edge and container responses are now consistent.
+
+- v0.3.13 (2026-05-30) — **Updated runtime hardens the storage and audit layers; admin error pages no longer show raw database text.** The vendored blamejs runtime is updated to v0.14.7, which tightens the data and audit layers the shop is built on: database queries are checked against each table's declared columns (a reference to an undeclared column fails closed), the database encryption key is bound to its deployment so a copied key can't be unsealed elsewhere, raw SQL fragments refuse embedded string literals so values bind through placeholders, audit-chain purges can require two authorizers, and breach-notification deadlines raise a running clock. Separately, when an admin form action fails the console now shows a short generic message with the correct status instead of rendering a raw database or parser string into its error banner. No operator action is required. **Changed:** *Vendored runtime updated to v0.14.7 (storage + audit hardening)* — The underlying runtime now checks every database query against the table's declared columns and fails closed on an undeclared reference, binds the database encryption key to its data directory and key path so a relocated key won't unseal, refuses embedded string literals in raw SQL fragments, supports two-authorizer dual control on audit-chain purges, can compute sealed-column lookup hashes as a keyed MAC, and ships a running clock for breach-notification deadlines. The shop inherits these protections; no configuration change is needed. **Fixed:** *Console error banners show a safe message, not internal text* — Every admin HTML form handler now routes a thrown error through one shared classifier: a duplicate key becomes a 409 "That value is already in use.", a missing referenced record a generic not-found, malformed input a generic "Invalid input.", and an unexpected failure a generic message whose detail is recorded server-side rather than shown. Operator-facing validation messages are unchanged. This closes the path where a create form could render a raw database constraint string into its error banner, matching the API behavior the bearer path already had.
+
 - v0.3.12 (2026-05-30) — **Currency and outbound-host validation consolidated behind one shared check.** Input validation that was duplicated across the codebase is now a single shared module. Currency codes are validated against the ISO 4217 catalog consistently wherever the admin binds money — the same check the gift-card flow gained last release — and the outbound webhook host guard (refusing loopback, private, link-local, reserved, and cloud-metadata destinations, including trailing-dot forms) is one shared function used by both the delivery and registration paths. The shared module composes the framework's Unicode codepoint catalog so free-text fields can reject control, bidi-override, and zero-width characters when needed. Behavior is equal-or-stricter than before; no operator action is required. **Changed:** *Currency validation is consistently ISO 4217* — Admin paths that bind a currency now validate it against the ISO 4217 catalog in one place, so a code that isn't a real currency is rejected consistently rather than only in some flows. · *Outbound-host SSRF guard is a single shared check* — The webhook delivery and registration paths now share one host guard — loopback, private (RFC 1918), link-local, reserved, and cloud-metadata addresses (by IP literal or known name, including trailing-dot forms) are refused identically on both, so the two can't drift apart.
 
 - v0.3.11 (2026-05-30) — **Webhook endpoints reject internal addresses; admin errors stay clean and typed.** Outbound webhook endpoints can no longer be pointed at loopback, private, link-local, or cloud-metadata addresses, closing a server-side request forgery path from operator-supplied URLs. Several admin endpoints that previously returned a 500 on bad input now return the correct 4xx — a duplicate slug or SKU is a 409 Conflict, a missing referenced record and malformed JSON are a 400 — and none of them echo internal database or parser text back in the response. Gift cards now reject a currency that isn't a real ISO 4217 code, and the returns refund action reports a malformed id the same way its sibling actions do. No configuration change is required; upgrading picks these up automatically. **Fixed:** *Admin errors return the right status and don't leak internals* — Creating a product, variant, or inventory row with a duplicate key now returns 409 Conflict instead of 500; attaching media to a missing product, and pasting malformed JSON into the shipping-zone editor, now return 400. None of these responses include raw database or JSON-parser text — the detail is a generic, operator-facing message and the underlying error is recorded server-side. The same applies to the receipt and packing-slip routes. · *Gift cards validate the currency* — Issuing a gift card with a currency that isn't a real ISO 4217 code is now rejected with a 400 instead of creating a card in a non-existent currency. · *Consistent error status for refunds* — The returns refund action reports a malformed return id with the same 400 its approve, receive, and reject siblings use; a well-formed id that doesn't exist is still a 404. **Security:** *Webhook endpoints can't target internal addresses* — A webhook endpoint URL that points at a loopback, private (RFC 1918), link-local, reserved, or cloud-metadata address — by IP literal or by a known name such as localhost, metadata.google.internal, or any *.internal host — is now refused when the subscription is created, on both the delivery and outbound-registration paths. A trailing-dot form of those hosts (for example localhost. or 169.254.169.254.) is normalized before the check so it can't slip past. Public https endpoints are unaffected.

package/lib/admin.js

@@ -386,6 +386,59 @@ function _redirect(res, location) {
   if (res.end) res.end(); else res.send("");
 }
 
+// Single classifier for a thrown admin error → an operator-safe outcome,
+// shared by BOTH the bearer JSON path (_wrap) and every cookie/HTML form
+// path so the two can never diverge on what a given error class is allowed
+// to reveal. Returns `{ status, code, message }`:
+//
+//   - TypeError          → 400 bad-request, `e.message` verbatim. These are
+//                          our own validation throws (`currency "ZZZ" is not
+//                          a known ISO 4217 code`, `regions_json must be valid
+//                          JSON`) — intended, operator-safe text the form must
+//                          surface so the operator can correct the input.
+//   - SyntaxError        → 400 bad-request, generic "Invalid input." A parser
+//                          SyntaxError that reached here echoes the parse
+//                          position ("...JSON at position 1"); never surface it.
+//   - UNIQUE / FOREIGN KEY constraint → 409 conflict, generic in-use /
+//                          referenced-record text — never the table/column/SQL.
+//   - CHECK / NOT NULL constraint     → 400 bad-request, generic
+//                          missing-or-invalid text.
+//   - anything else      → 500 internal-error, generic "Something went wrong
+//                          — please try again." The raw message is recorded
+//                          server-side via the framework audit (drop-silent,
+//                          outcome:"failure") so an operator can correlate;
+//                          it never reaches the client.
+//
+// `auditAction` (optional) names the audit action for the unknown-error
+// record; defaults to "request" so a bare call still files under a sensible
+// namespace.
+function _safeNotice(e, auditAction) {
+  if (e instanceof TypeError) {
+    return { status: 400, code: "bad-request", message: (e && e.message) || "Invalid input." };
+  }
+  if (e instanceof SyntaxError) {
+    return { status: 400, code: "bad-request", message: "Invalid input." };
+  }
+  var msg = (e && e.message) || "";
+  if (/UNIQUE constraint failed/i.test(msg) || /FOREIGN KEY constraint failed/i.test(msg)) {
+    return /FOREIGN KEY/i.test(msg)
+      ? { status: 409, code: "conflict", message: "A referenced record does not exist." }
+      : { status: 409, code: "conflict", message: "That value is already in use." };
+  }
+  if (/(?:CHECK|NOT NULL) constraint failed/i.test(msg)) {
+    return { status: 400, code: "bad-request", message: "A required value is missing or invalid." };
+  }
+  // Genuine unknown error — record it server-side via the framework audit
+  // (drop-silent) so operators can correlate, then hand back a generic
+  // message + a 500. The raw message never reaches the client.
+  b.audit.safeEmit({
+    action:   AUDIT_NAMESPACE + "." + (auditAction || "request") + ".error",
+    outcome:  "failure",
+    metadata: { message: msg || String(e) },
+  });
+  return { status: 500, code: "internal-error", message: "Something went wrong — please try again." };
+}
+
 function _wrap(handler, opts) {
   // Every admin handler routes through this wrapper: bearer-token
   // gate, error-to-problem-details translation, audit write on the
@@ -411,35 +464,13 @@ function _wrap(handler, opts) {
       }
       return result;
     } catch (e) {
-      if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
-      // Malformed JSON body — the body parser raises a SyntaxError whose
-      // message echoes the parser's position ("...JSON at position 1").
-      // Surface a clean 400 with a generic detail rather than leaking the
-      // parser internals (also the defense-in-depth net for any call site
-      // that JSON.parses an operator-supplied field without its own guard).
-      if (e instanceof SyntaxError) return _problem(res, 400, "bad-request", "Invalid JSON in request.");
-      // Storage-engine constraint violations reach here as plain Errors
-      // whose message names the table/column/SQL ("UNIQUE constraint
-      // failed: products.slug"). Map the class to a clean 4xx with a
-      // GENERIC operator-facing detail — never echo the table/column/SQL.
-      var msg = (e && e.message) || "";
-      if (/UNIQUE constraint failed/i.test(msg) || /FOREIGN KEY constraint failed/i.test(msg)) {
-        return _problem(res, 409, "conflict",
-          /FOREIGN KEY/i.test(msg) ? "A referenced record does not exist." : "That value is already in use.");
-      }
-      if (/(?:CHECK|NOT NULL) constraint failed/i.test(msg)) {
-        return _problem(res, 400, "bad-request", "A required value is missing or invalid.");
-      }
-      // Genuine unknown error — record it server-side via the framework
-      // audit (drop-silent) so operators can correlate, then return a
-      // generic 500 with NO detail. The raw message never reaches the
-      // client.
-      b.audit.safeEmit({
-        action:   AUDIT_NAMESPACE + "." + (opts.audit || "request") + ".error",
-        outcome:  "failure",
-        metadata: { message: msg || String(e) },
-      });
-      return _problem(res, 500, "internal-error");
+      // Single classification, shared with the cookie/HTML paths via
+      // _safeNotice. A 5xx carries NO error-derived detail (the unknown
+      // case is recorded server-side inside _safeNotice); 4xx surface the
+      // generic / validation message.
+      var n = _safeNotice(e, opts.audit);
+      if (n.status >= 500) return _problem(res, n.status, n.code);
+      return _problem(res, n.status, n.code, n.message);
     }
   };
 }
@@ -550,14 +581,12 @@ function mount(router, deps) {
       try {
         made = await catalog.products.create(req.body || {});
       } catch (e) {
-        if (e instanceof TypeError || e.code === "CATALOG_DUPLICATE" || /slug|exists|duplicate/i.test(e.message || "")) {
-          var page = await catalog.products.list({ limit: 100 });
-          return _sendHtml(res, 400, renderAdminProducts({
-            shop_name: deps.shop_name, nav_available: navAvailable, products: page.rows || [],
-            notice: (e && e.message) || "Couldn't create that product.",
-          }));
-        }
-        throw e;
+        var n = _safeNotice(e, "product.create");
+        var page = await catalog.products.list({ limit: 100 });
+        return _sendHtml(res, n.status, renderAdminProducts({
+          shop_name: deps.shop_name, nav_available: navAvailable, products: page.rows || [],
+          notice: n.message,
+        }));
       }
       b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".product.create", outcome: "success", metadata: { id: made.id } });
       _redirect(res, "/admin/products/" + encodeURIComponent(made.id) + "?created=1");
@@ -969,14 +998,12 @@ function mount(router, deps) {
         if (!body.sku) throw new TypeError("sku required");
         await catalog.inventory.create(body.sku, { stock_on_hand: parseInt(body.stock_on_hand, 10) || 0 });
       } catch (e) {
-        if (e instanceof TypeError || /exists|duplicate|UNIQUE/i.test(e.message || "")) {
-          var page = await catalog.inventory.list({ limit: 500 });
-          return _sendHtml(res, 400, renderAdminInventory({
-            shop_name: deps.shop_name, nav_available: navAvailable, inventory: page.rows || [],
-            notice: (e && e.message) || "Couldn't create that SKU.",
-          }));
-        }
-        throw e;
+        var n = _safeNotice(e, "inventory.create");
+        var page = await catalog.inventory.list({ limit: 500 });
+        return _sendHtml(res, n.status, renderAdminInventory({
+          shop_name: deps.shop_name, nav_available: navAvailable, inventory: page.rows || [],
+          notice: n.message,
+        }));
       }
       b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".inventory.create", outcome: "success", metadata: { sku: body.sku } });
       _redirect(res, "/admin/inventory?created=1");
@@ -1087,7 +1114,12 @@ function mount(router, deps) {
           alt_text:     typeof body.alt_text === "string" ? body.alt_text : undefined,
         });
       } catch (e) {
-        if (!(e instanceof TypeError)) throw e;
+        // Bad input (TypeError), a missing product (FOREIGN KEY constraint),
+        // or any other failure → a notice via PRG. _safeNotice records an
+        // unknown error server-side; the redirect itself carries no raw
+        // message, so the storage-engine string can't ride the query into
+        // the detail banner.
+        _safeNotice(e, "media.attach");
         return _redirect(res, "/admin/products/" + enc + "?err=1");
       }
       b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".media.attach", outcome: "success", metadata: { id: id } });
@@ -1879,17 +1911,15 @@ function mount(router, deps) {
         var win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
         try { status = _labelStatusParam(url); win = _labelWindow(url); }
         catch (e) {
-          if (!(e instanceof TypeError)) throw e;
-          notice = e.message.replace(/^admin:\s*/, "");
+          notice = _safeNotice(e, "shipping_label.list").message.replace(/^admin:\s*/, "");
         }
         var payload;
         try { payload = await _labelListPayload(status, win); }
         catch (e2) {
-          if (!(e2 instanceof TypeError)) throw e2;
           // A bad range that slipped past the param parse (primitive
           // re-validates from < to) → fall back to the default window.
           win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
-          notice = e2.message.replace(/^shipping-labels:\s*/, "");
+          notice = _safeNotice(e2, "shipping_label.list").message.replace(/^shipping-labels:\s*/, "");
           payload = await _labelListPayload(status, win);
         }
         _sendHtml(res, 200, renderAdminShippingLabels({
@@ -1910,8 +1940,7 @@ function mount(router, deps) {
         var rows = [], notice = null;
         try { rows = await shippingLabels.pendingLabels({ limit: MAX_LABEL_LIST_LIMIT }); }
         catch (e) {
-          if (!(e instanceof TypeError)) throw e;
-          notice = e.message.replace(/^shipping-labels:\s*/, "");
+          notice = _safeNotice(e, "shipping_label.pending").message.replace(/^shipping-labels:\s*/, "");
         }
         _sendHtml(res, 200, renderAdminShippingLabelsPending({
           shop_name: deps.shop_name, nav_available: navAvailable,
@@ -1937,16 +1966,14 @@ function mount(router, deps) {
         var win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
         try { win = _labelWindow(url); carrier = _labelCarrierParam(url); }
         catch (e) {
-          if (!(e instanceof TypeError)) throw e;
-          notice = e.message.replace(/^admin:\s*/, "");
+          notice = _safeNotice(e, "shipping_label.costs").message.replace(/^admin:\s*/, "");
         }
         var report;
         try { report = await _labelCostsReport(win, carrier); }
         catch (e2) {
-          if (!(e2 instanceof TypeError)) throw e2;
           win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
           carrier = null;
-          notice = e2.message.replace(/^shipping-labels:\s*/, "");
+          notice = _safeNotice(e2, "shipping_label.costs").message.replace(/^shipping-labels:\s*/, "");
           report = await _labelCostsReport(win, carrier);
         }
         _sendHtml(res, 200, renderAdminShippingLabelCosts({
@@ -3220,11 +3247,11 @@ function mount(router, deps) {
         try {
           ep = await webhooks.endpoints.create({ url: (typeof body.url === "string" ? body.url.trim() : body.url), events: events });
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "webhook.create");
           var rows = await webhooks.endpoints.list();
-          return _sendHtml(res, 400, renderAdminWebhooks({
+          return _sendHtml(res, n.status, renderAdminWebhooks({
             shop_name: deps.shop_name, nav_available: navAvailable, endpoints: rows,
-            known_events: KNOWN_WH_EVENTS, notice: e.message.replace(/^webhooks:\s*/, ""),
+            known_events: KNOWN_WH_EVENTS, notice: n.message.replace(/^webhooks:\s*/, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".webhook.create", outcome: "success", metadata: { id: ep.id } });
@@ -3459,10 +3486,6 @@ function mount(router, deps) {
       return n;
     }
 
-    function _cleanCreateMessage(e) {
-      return (e && e.message || "Couldn't create that collection.").replace(/^collections[.:]\s*/, "");
-    }
-
     // Map the ?active= query to a collections.list filter: 1/true →
     // active-only, 0/false → archived-only, absent → all.
     function _collectionsFilter(activeS) {
@@ -3545,11 +3568,11 @@ function mount(router, deps) {
             });
           }
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "collection.create");
           var rows = await _listForBrowser({});
-          return _sendHtml(res, 400, renderAdminCollections({
+          return _sendHtml(res, n.status, renderAdminCollections({
             shop_name: deps.shop_name, nav_available: navAvailable, collections: rows,
-            notice: _cleanCreateMessage(e), form_type: type,
+            notice: n.message.replace(/^collections[.:]\s*/, ""), form_type: type,
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".collection.create", outcome: "success" });
@@ -3863,11 +3886,11 @@ function mount(router, deps) {
         try {
           await announcements.defineAnnouncement(_announcementFromForm(req.body || {}));
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "announcement.define");
           var rows = await announcements.listAnnouncements({});
-          return _sendHtml(res, 400, renderAdminAnnouncements({
+          return _sendHtml(res, n.status, renderAdminAnnouncements({
             shop_name: deps.shop_name, nav_available: navAvailable, announcements: rows,
-            notice: (e && e.message || "Couldn't save that announcement.").replace(/^announcementBar[.:]\s*/, ""),
+            notice: n.message.replace(/^announcementBar[.:]\s*/, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".announcement.define", outcome: "success" });
@@ -3942,11 +3965,11 @@ function mount(router, deps) {
             questions: _standardSurveyQuestions(body.kind),
           });
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "survey.define");
           var rows = await surveys.listSurveys({});
-          return _sendHtml(res, 400, renderAdminSurveys({
+          return _sendHtml(res, n.status, renderAdminSurveys({
             shop_name: deps.shop_name, nav_available: navAvailable, surveys: rows,
-            notice: (e.message || "Couldn't create that survey.").replace(/^customerSurveys[.:]\s*/, ""),
+            notice: n.message.replace(/^customerSurveys[.:]\s*/, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".survey.define", outcome: "success" });
@@ -4055,11 +4078,11 @@ function mount(router, deps) {
         try {
           await hours.defineSchedule(_scheduleFromForm(req.body || {}));
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "hours.define");
           var rows = await hours.listSchedules();
-          return _sendHtml(res, 400, renderAdminHours({
+          return _sendHtml(res, n.status, renderAdminHours({
             shop_name: deps.shop_name, nav_available: navAvailable, schedules: rows,
-            notice: (e.message || "Couldn't save that schedule.").replace(/^businessHours[.:]\s*/, ""),
+            notice: n.message.replace(/^businessHours[.:]\s*/, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".hours.define", outcome: "success" });
@@ -4240,11 +4263,10 @@ function mount(router, deps) {
       var win, notice = null;
       try { win = _reportWindow(url); }
       catch (e) {
-        if (!(e instanceof TypeError)) throw e;
         // Bad range → re-render with the default window + a correction
         // notice (config/entry tier: the operator fixes the typo).
         win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
-        notice = e.message.replace(/^admin:\s*/, "");
+        notice = _safeNotice(e, "report.view").message.replace(/^admin:\s*/, "");
       }
       // CSV download from the browser surface too (a link, not a fetch).
       if (url && url.searchParams.get("format") === "csv") {
@@ -4265,9 +4287,8 @@ function mount(router, deps) {
       var report;
       try { report = await _buildReport(win); }
       catch (e3) {
-        if (!(e3 instanceof TypeError)) throw e3;
         win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
-        notice = e3.message.replace(/^salesReports:\s*/, "");
+        notice = _safeNotice(e3, "report.view").message.replace(/^salesReports:\s*/, "");
         report = await _buildReport(win);
       }
       _sendHtml(res, 200, renderAdminReports({
@@ -4467,11 +4488,11 @@ function mount(router, deps) {
         try {
           await subscriptions.plans.create(input);
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "subscription_plan.create");
           var rows = await subscriptions.plans.list({});
-          return _sendHtml(res, 400, renderAdminSubscriptionPlans({
+          return _sendHtml(res, n.status, renderAdminSubscriptionPlans({
             shop_name: deps.shop_name, nav_available: navAvailable, plans: rows,
-            notice: e.message.replace(/^subscriptions[.:]\s*/, ""),
+            notice: n.message.replace(/^subscriptions[.:]\s*/, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".subscription_plan.create", outcome: "success" });
@@ -4629,11 +4650,11 @@ function mount(router, deps) {
         try {
           issued = await _issueGiftCard(req.body || {});
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
+          var n = _safeNotice(e, "gift_card.issue");
           var rows = await giftcards.list({});
-          return _sendHtml(res, 400, renderAdminGiftCards({
+          return _sendHtml(res, n.status, renderAdminGiftCards({
             shop_name: deps.shop_name, nav_available: navAvailable, cards: rows,
-            notice: e.message.replace(/^giftcards?[.:]\s*/i, ""),
+            notice: n.message.replace(/^giftcards?[.:]\s*/i, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".gift_card.issue", outcome: "success", metadata: { id: issued.id } });
@@ -4821,12 +4842,18 @@ function mount(router, deps) {
         try {
           await taxRates.defineRate(_taxRateInput(body));
         } catch (e) {
-          if (!(e instanceof TypeError) && e.code !== "TAX_RATE_OVERLAP") throw e;
+          // The primitive's overlap code carries an operator-safe message;
+          // everything else routes through the shared classifier so a raw
+          // constraint / parser / unknown error can't reach the banner.
+          var overlap = e && e.code === "TAX_RATE_OVERLAP";
+          var n = overlap ? { status: 400, message: (e.message || "").replace(/^taxRates[.:]\s*/, "") }
+                          : _safeNotice(e, "tax_rate.create");
+          var noticeMsg = overlap ? n.message : n.message.replace(/^taxRates[.:]\s*/, "");
           var rows = await _taxRatesForBrowser(jurisdiction);
-          return _sendHtml(res, 400, renderAdminTaxRates({
+          return _sendHtml(res, n.status, renderAdminTaxRates({
             shop_name: deps.shop_name, nav_available: navAvailable, rates: rows,
             jurisdiction: jurisdiction, sources: taxRates.SOURCES,
-            notice: (e && e.message || "").replace(/^taxRates[.:]\s*/, ""),
+            notice: noticeMsg,
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".tax_rate.create", outcome: "success" });
@@ -5014,14 +5041,21 @@ function mount(router, deps) {
         var filing;
         try { filing = await salesTaxFilings.defineFilingPeriod(_filingPeriodInput(req.body || {})); }
         catch (e) {
-          if (!(e instanceof TypeError) && e.code !== "SALES_TAX_FILING_DUPLICATE") throw e;
+          // The primitive's own duplicate-period code carries an operator-safe
+          // message (a named UNIQUE index, no raw SQL); everything else routes
+          // through the shared classifier so a raw constraint / parser / unknown
+          // error can't reach the banner.
+          var dup = e && e.code === "SALES_TAX_FILING_DUPLICATE";
+          var n   = dup ? { status: 400, message: (e.message || "").replace(/^salesTaxFilings[.:]\s*/, "") }
+                        : _safeNotice(e, "tax_filing.create");
+          var noticeMsg = dup ? n.message : n.message.replace(/^salesTaxFilings[.:]\s*/, "");
           var rows     = await _filingsForBrowser({});
           var upcoming = await _upcomingForBrowser();
-          return _sendHtml(res, 400, renderAdminTaxFilings({
+          return _sendHtml(res, n.status, renderAdminTaxFilings({
             shop_name: deps.shop_name, nav_available: navAvailable,
             filings: rows, upcoming: upcoming,
             kinds: salesTaxFilings.KINDS, statuses: salesTaxFilings.STATUSES,
-            notice: (e && e.message || "").replace(/^salesTaxFilings[.:]\s*/, ""),
+            notice: noticeMsg,
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".tax_filing.create", outcome: "success", metadata: { id: filing.id } });
@@ -5064,7 +5098,7 @@ function mount(router, deps) {
           notice = "Enter both a from and a to date (epoch-ms) for the report window.";
         } else {
           try { report = await salesTaxFilings.auditReportForJurisdiction({ jurisdiction: jurisdiction, from: from, to: to }); }
-          catch (e) { if (!(e instanceof TypeError)) throw e; notice = (e.message || "").replace(/^salesTaxFilings[.:]\s*/, ""); }
+          catch (e) { notice = _safeNotice(e, "tax_filing.report").message.replace(/^salesTaxFilings[.:]\s*/, ""); }
         }
         _sendHtml(res, 200, renderAdminTaxFilingReport({
           shop_name: deps.shop_name, nav_available: navAvailable,
@@ -5132,10 +5166,13 @@ function mount(router, deps) {
           try {
             await run(req.params.id, req.body || {});
           } catch (e) {
-            if (!(e instanceof TypeError) &&
-                e.code !== "SALES_TAX_FILING_NOT_FOUND" &&
-                e.code !== "SALES_TAX_FILING_BAD_TRANSITION") throw e;
-            var msg = (e && e.message || "").replace(/^salesTaxFilings[.:]\s*/, "");
+            // The primitive's not-found / bad-transition codes carry
+            // operator-safe messages; everything else routes through the
+            // shared classifier so a raw constraint / parser / unknown error
+            // can't ride the err_msg query param into the detail banner.
+            var safe = e && (e.code === "SALES_TAX_FILING_NOT_FOUND" || e.code === "SALES_TAX_FILING_BAD_TRANSITION");
+            var msg  = (safe ? (e.message || "") : _safeNotice(e, "tax_filing." + audit).message)
+              .replace(/^salesTaxFilings[.:]\s*/, "");
             return _redirect(res, "/admin/tax-filings/" + enc + "?err=1&err_msg=" + encodeURIComponent(msg));
           }
           b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".tax_filing." + audit, outcome: "success", metadata: { id: req.params.id } });
@@ -5232,11 +5269,17 @@ function mount(router, deps) {
         try {
           await shippingZones.defineZone(_shippingZoneInput(req.body || {}));
         } catch (e) {
-          if (!(e instanceof TypeError) && e.code !== "SHIPPING_ZONE_EXISTS") throw e;
+          // The primitive's already-exists code carries an operator-safe
+          // message; everything else routes through the shared classifier so
+          // a raw constraint / parser / unknown error can't reach the banner.
+          var dup = e && e.code === "SHIPPING_ZONE_EXISTS";
+          var n   = dup ? { status: 400, message: (e.message || "").replace(/^shippingZones[.:]\s*/, "") }
+                        : _safeNotice(e, "shipping_zone.create");
+          var noticeMsg = dup ? n.message : n.message.replace(/^shippingZones[.:]\s*/, "");
           var rows = await shippingZones.listZones({});
-          return _sendHtml(res, 400, renderAdminShipping({
+          return _sendHtml(res, n.status, renderAdminShipping({
             shop_name: deps.shop_name, nav_available: navAvailable, zones: rows,
-            notice: (e && e.message || "").replace(/^shippingZones[.:]\s*/, ""),
+            notice: noticeMsg,
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".shipping_zone.create", outcome: "success" });
@@ -5430,9 +5473,9 @@ function mount(router, deps) {
         try {
           await autoDiscount.defineRule(_discountInput(req.body || {}));
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
-          return _sendHtml(res, 400, await _renderDiscounts({
-            notice: (e && e.message || "").replace(/^autoDiscount[.:]\s*/, ""),
+          var n = _safeNotice(e, "auto_discount.create");
+          return _sendHtml(res, n.status, await _renderDiscounts({
+            notice: n.message.replace(/^autoDiscount[.:]\s*/, ""),
           }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".auto_discount.create", outcome: "success" });
@@ -5523,9 +5566,9 @@ function mount(router, deps) {
           try {
             await couponStacking.definePolicy(_policyInput(req.body || {}));
           } catch (e) {
-            if (!(e instanceof TypeError)) throw e;
-            return _sendHtml(res, 400, await _renderDiscounts({
-              notice: (e && e.message || "").replace(/^couponStacking[.:]\s*/, ""),
+            var n = _safeNotice(e, "coupon_policy.create");
+            return _sendHtml(res, n.status, await _renderDiscounts({
+              notice: n.message.replace(/^couponStacking[.:]\s*/, ""),
             }));
           }
           b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".coupon_policy.create", outcome: "success" });
@@ -5639,10 +5682,6 @@ function mount(router, deps) {
       return input;
     }
 
-    function _qdCleanMessage(e) {
-      return (e && e.message || "Couldn't save that tier set.").replace(/^quantityDiscounts[.:]\s*/, "");
-    }
-
     async function _renderQdList(flags) {
       flags = flags || {};
       var rows = await quantityDiscounts.list(_qdFilter(flags.archived_filter));
@@ -5682,8 +5721,10 @@ function mount(router, deps) {
         try {
           await quantityDiscounts.defineTier(_qdDefineInput(req.body || {}));
         } catch (e) {
-          if (!(e instanceof TypeError)) throw e;
-          return _sendHtml(res, 400, await _renderQdList({ notice: _qdCleanMessage(e) }));
+          var n = _safeNotice(e, "quantity_discount.create");
+          return _sendHtml(res, n.status, await _renderQdList({
+            notice: n.message.replace(/^quantityDiscounts[.:]\s*/, ""),
+          }));
         }
         b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".quantity_discount.create", outcome: "success" });
         _redirect(res, "/admin/quantity-discounts?created=1");
@@ -6027,9 +6068,10 @@ function mount(router, deps) {
         if (values.support_url)   await config.put("shop.support_url", values.support_url);
         await config.put("setup.completed", true);
       } catch (e) {
-        return _sendHtml(res, 500, renderAdminSetup({
+        var n = _safeNotice(e, "setup.save");
+        return _sendHtml(res, n.status, renderAdminSetup({
           shop_name: deps.shop_name, values: values, nav_available: navAvailable,
-          notice: "Couldn't save — " + ((e && e.message) || "please try again."),
+          notice: n.message,
         }));
       }
       b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".setup.save", outcome: "success", metadata: {} });

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.12",
+  "version": "0.3.14",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/security-middleware.js

@@ -142,6 +142,33 @@ function clientKey(req) {
   return sock || "unknown";
 }
 
+/**
+ * Build the security-headers options for createApp's
+ * `middleware.securityHeaders`. The vendored blamejs default emits a
+ * `Document-Policy` header asserting `document-write=?0`,
+ * `unsized-media=?0`, and `oversized-images=?0`. Current Chromium
+ * recognizes none of those three feature names — it parses the header,
+ * rejects every token, logs "Unrecognized document policy feature name
+ * <x>" to the console, and applies nothing. The header is therefore
+ * inert: it adds console noise on every container response while
+ * enforcing no policy. (The recognized Document-Policy feature set today
+ * is `force-load-at-top` / `js-profiling` /
+ * `include-js-call-stacks-in-crash-reports` / `expect-no-linked-resources`
+ * / `network-efficiency-guardrails` — none of which is a control this
+ * storefront needs to assert.) We have no valid, useful Document-Policy
+ * to send, so disable the header rather than ship one the browser
+ * rejects. This also matches the edge: the Worker's `_SECURITY_HEADERS`
+ * set (worker/index.js) emits no Document-Policy, so suppressing it on
+ * the container makes the two substrates header-consistent. Every other
+ * vendored default (HSTS, CSP, Permissions-Policy, COOP/CORP, X-Frame-
+ * Options, etc.) stays ON. Pass-through to the framework primitive — we
+ * compose its `documentPolicy: false` override, never patch the vendored
+ * tree.
+ */
+function securityHeadersOpts() {
+  return { documentPolicy: false };
+}
+
 /**
  * Build the GLOBAL rate-limit options for createApp's
  * `middleware.rateLimit`. Token-bucket so a bursty-but-bounded browsing
@@ -282,6 +309,7 @@ function mountRouteGuards(r) {
 
 module.exports = {
   clientKey:            clientKey,
+  securityHeadersOpts:  securityHeadersOpts,
   globalRateLimitOpts:  globalRateLimitOpts,
   mountRouteGuards:     mountRouteGuards,
   WEBHOOK_PATHS:        WEBHOOK_PATHS,

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.14.6",
-      "tag": "v0.14.6",
+      "version": "0.14.7",
+      "tag": "v0.14.7",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.14.x
 
+- v0.14.7 (2026-05-30) — **Storage and audit-trail hardening: queries are gated to declared columns, raw SQL refuses embedded literals, the database key is bound to its location, sealed-column lookup hashes gain a keyed mode, audit-chain purges can require dual control, and breach deadlines ship a running clock.** This release tightens the data and audit layers against a set of failure modes that were previously reachable. Database queries are now checked against the columns a table declared in its schema: a reference to an undeclared column fails closed by default instead of silently matching nothing, and the `whereRaw` escape hatch refuses an embedded string literal so values bind through placeholders. The database encryption key is sealed with its purpose, data directory, and key path as additional authenticated data, so a key file cannot be relocated to another deployment and unsealed there; an older key without that binding upgrades itself on first load. Sealed-column equality-lookup hashes can now be computed as a keyed MAC (HMAC-SHAKE256) off a per-deployment key, making the lookup hash unforgeable without that key, while the salted-SHA3 default is unchanged. Purging the tamper-evident audit chain can be placed under a two-authorizer dual-control grant so one operator cannot erase it alone, and database credential-rejection audits now record which relation the rejected credential tried to reach. Finally, breach-notification deadlines get a running clock that raises approaching and passed alerts as each regime's window elapses. One behavior change to note: the column gate defaults to reject — if a service issues queries against columns it did not declare in its schema, set `db.init({ columnGate: "warn" })` (audited, allowed) or `"off"` while the schema is reconciled. **Added:** *Column-membership gate on every query* — `b.db.from(table)` now checks each referenced column against the table's declared schema. The mode is set with `db.init({ columnGate: "reject" | "warn" | "off" })` (default `reject`), and `query.allowedColumns([...])` narrows a single query to an explicit allowlist that is always enforced. `b.db.getDeclaredColumns(table)` returns a table's declared column names (or `null` for an unknown table). This is defense in depth against typo'd or caller-influenced column names reaching the SQL layer (CWE-89). · *Keyed mode for sealed-column lookup hashes* — Equality-lookup ("derived") hashes for sealed columns can be computed as `hmac-shake256` — a keyed MAC over a per-deployment key — instead of the default `salted-sha3`. Set it per table with `cryptoField.registerTable(name, { derivedHashMode: "hmac-shake256" })` or per column with `{ from, mode: "hmac-shake256" }`. The keyed hash is unforgeable and un-correlatable without the deployment's MAC key, which raises the bar against offline lookup-table attacks on low-entropy sealed values (CWE-916). `b.vault.getDerivedHashMacKey()` exposes the 32-byte per-deployment key; it is created on first use and re-sealed across key rotation automatically. · *Dual-control gate on audit-chain purge* — `b.auditTools.purge` accepts `dualControlGrant`. When `audit_log` is placed under dual control, a verified archive and `confirm: true` are no longer sufficient: the purge additionally requires a consumed m-of-n grant whose action is bound to the purge, so a grant minted for another operation cannot be replayed and one operator cannot erase the tamper-evident chain alone (NIST SP 800-53 AU-9, separation of duties). · *Running clock for breach-notification deadlines* — `b.incident.report.createDeadlineClock({ notify, approachThresholds })` tracks open incidents and raises `deadline_approaching` and `deadline_passed` alerts as each regime's window elapses (GDPR 72h, DORA, NIS2, and the rest of the registry). Alerts are deduplicated per incident and stage, suppressed once a submission stage is acknowledged, and the clock can run on an interval or be ticked manually. **Changed:** *Queries against undeclared columns now fail closed by default* — The column gate defaults to `reject`: a query that references a column the table did not declare throws rather than silently matching nothing. A service that intentionally queries undeclared columns can set `db.init({ columnGate: "warn" })` to audit and allow, or `"off"` to disable the gate, while its schema is reconciled. Framework-declared columns (including `_id` and derived-hash columns) are always members. **Security:** *Database encryption key bound to its location* — `db.key.enc` is sealed with additional authenticated data over its purpose, resolved data directory, and resolved key path. A sealed key copied to a different deployment or path no longer unseals there — the AEAD authentication fails — which prevents silent key relocation. A legacy key sealed without this binding is detected and re-sealed in the bound format on first load, with no operator action required. · *`whereRaw` refuses embedded string literals* — `whereRaw(sql, params)` and `WhereBuilder.raw(sql, params)` reject a raw fragment containing a string literal (`'...'`); values must bind through the `params` array. A static, operator-controlled literal can opt in with `{ allowLiterals: true }`. This closes a path where a value concatenated into a raw fragment would reintroduce SQL injection (CWE-89). · *Credential-rejection audits record the attempted relation* — A `db.auth.failed` audit row (SQLSTATE 28000 / 28P01 / 42501) now carries `attemptedTable`, the relation the rejected credential tried to reach, extracted defensively from the statement. Triage can scope the blast radius of a credential-abuse event without correlating back to the raw SQL log (CWE-778). **Detectors:** *Audit-purge dual-control gate* — A new check fails the build if a call to `purgeAuditChain` appears in a file that does not also route through the dual-control gate, so a future caller cannot physically delete chain rows without two-authorizer enforcement. · *Raw-SQL literal/interpolation guard* — A new check fails the build on a `whereRaw` / `.raw` call whose SQL argument is built by template interpolation or string concatenation, keeping the bound-params discipline enforceable in framework code. · *Hand-rolled lookup-hash guard* — A new check fails the build if a sealed-column lookup hash is derived from the per-deployment salt outside the canonical helper, so call sites cannot bypass the keyed-mode and per-column mode policy. · *Auth-audit attempted-relation guard* — A new check fails the build if a `db.auth.failed` audit is emitted in a file that does not name `attemptedTable`, so the forensic field cannot be dropped from a future emitter.
+
 - v0.14.6 (2026-05-30) — **Access-refusal middleware can return RFC 9457 problem+json or a custom response, and several documented-but-uncallable APIs are now reachable.** Every access-refusal middleware — the auth gates (bearer, DPoP, mTLS, AAL, bound-key), CSRF, CORS, rate-limit, bot-guard, age-gate, the host and network allowlists, and the method and content-type gates — now accepts two uniform options: `problemDetails: true` returns an RFC 9457 `application/problem+json` body, and `onDeny(req, res, info)` hands the response to the caller. With neither set the refusal is byte-for-byte what it was, so this is a drop-in change that lets a service standardize one error envelope across its API instead of working around each middleware's hardcoded body. Alongside that: `b.middleware.requireBoundKey` is now exported (it was documented and tested but never wired into the middleware surface), `b.middleware.bearerAuth` accepts `requiredScopes` (previously rejected at construction, which made its scope-enforcement path unreachable), API-key refusals send the RFC 6750 challenge code that matches the failure, two documented call paths that named a missing namespace segment are corrected, and the release flow now flags stale GitHub Actions and vendored bundles — with a ready-to-paste pin — before a dependency PR is needed. **Added:** *Uniform `onDeny` and `problemDetails` options on every access-refusal middleware* — Each request-lifecycle middleware that refuses a request now takes `problemDetails: true` to emit an RFC 9457 `application/problem+json` body (composing `b.problemDetails`) and `onDeny(req, res, info)` to take over the response entirely; `info` carries the status, a machine reason, and the middleware-specific fields. The deny-path response headers (`Allow`, `WWW-Authenticate`, `Retry-After`, `Accept`) survive every mode. When neither option is set the response is unchanged. Covers `requireAuth`, `requireAal`, `requireMethods`, `requireContentType`, `requireMtls`, `requireBoundKey`, `bearerAuth`, `dpop`, `csrfProtect`, `fetchMetadata`, `botGuard`, `ageGate`, `hostAllowlist`, `networkAllowlist`, `cors`, `rateLimit`, and `dailyByteQuota` (whose existing `onExceeded` keeps working as an alias of `onDeny`). **Fixed:** *`b.middleware.requireBoundKey` is now callable* — The Bearer-API-key middleware was documented (with examples and tests) but never exported on `b.middleware`, so `b.middleware.requireBoundKey(...)` threw `undefined is not a function`. It is now wired into the middleware surface. · *`b.middleware.bearerAuth` accepts `requiredScopes`* — The RFC 6750 scope-enforcement path read `opts.requiredScopes`, but the option was rejected at construction with `unknown option`, making the 403 `insufficient_scope` behavior unreachable. `requiredScopes` is now an accepted option. · *RFC 6750 challenge codes on API-key refusals* — `b.middleware.requireBoundKey` now sends the `WWW-Authenticate` error code that matches the failure: `insufficient_scope` on a 403 missing-scope, `invalid_token` on an unknown or revoked token, and no error code on a 401 that presented no credentials (RFC 6750 §3). It previously sent `invalid_request` for every refusal. · *Corrected two documented call paths* — The compliance and network references named a path that dropped a namespace segment: the conformity-assessment scaffold is at `b.cra.report.conformityAssessment` (not `b.cra.conformityAssessment`), and the per-socket tuning helper is at `b.network.socket.applyToSocket` (not `b.network.applyToSocket`). The documented signatures now match the callable paths. · *GitHub Actions pins refreshed* — `github/codeql-action` 4.35.5 to 4.36.0, and `docker/login-action`, `docker/setup-buildx-action`, and `docker/setup-qemu-action` to their latest releases. **Detectors:** *`@primitive` reachability gate* — A new check resolves every documented `b.X.Y` primitive against the actual public surface and fails the build when a documented path is not callable (factory-instance shorthands excluded). This is the gate that would have caught the `requireBoundKey` and call-path issues above. · *Deny-path composition gate* — A new check requires every access-refusal middleware to route its refusal through the shared deny-response writer, so a future middleware cannot reintroduce a hardcoded body that locks callers out of `onDeny` / `problemDetails`. · *Actions and vendor currency in the release flow* — The release flow now fails the cut when a SHA-pinned GitHub Action or a vendored bundle is behind its latest upstream release. The actions report prints a ready-to-paste `owner/repo@<sha>  # vX.Y.Z` pin and every file and line that uses it, so the bump is copy-paste rather than an after-the-fact dependency PR. Transient registry or API errors stay advisory so a flaky network response does not block an unrelated release.
 
 - v0.14.5 (2026-05-30) — **Finished cleaning up the mislabeled byte-literal lint suppressions, with no API or behavior changes.** A follow-up to the byte-literal lint tightening. The remaining suppression comments that named the byte-literal check on values that are not byte sizes — JSON-RPC error codes, HTTP status codes, octet ranges, day-in-milliseconds constants — are removed, keeping their explanatory text and any correctly-named companion suppression. Every byte-literal suppression that remains is now on genuine 1024-scale byte arithmetic. Source-comment hygiene only. **Changed:** *Remaining mislabeled byte-literal suppressions removed* — The byte-literal lint was previously a check on any multiple-of-8 integer, so suppression comments naming it were scattered across non-byte values. The last of those (in a handful of files, in mixed comment formats) are now removed — their explanatory text is retained as plain comments, and any correctly-named companion suppression is kept. The only byte-literal suppressions that remain are on genuine 1024-scale byte arithmetic. No change to any exported API, error code, wire format, or runtime behavior.