@blamejs/blamejs-shop 0.3.14 → 0.3.16

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.16 (2026-05-30) — **Uploaded SVGs are sanitized, and product images can be reordered with a chosen primary.** Two things for product media in the admin console. First, when an SVG image is uploaded it now passes through a strict sanitizer: an SVG that carries script or other active content is repaired, or refused outright when it can't be made safe, so a stored image can't become a script-execution vector. Second, a product's images can now be reordered and any image promoted to the primary (hero) slot directly from the console — previously the order was fixed at attach time and the first-attached image was always the hero. The primary image is the one shown first on the product page. **Added:** *Reorder product images and set the primary from the console* — Each image on a product now has a "Make primary" control that moves it to the hero slot shown first on the product page, and a reorder control sets the full order. Both are no-JavaScript form actions. The product page renders images in this order, so changing it here changes what shoppers see first. **Changed:** *Vendored runtime updated to v0.14.8* — The vendored blamejs runtime is updated to v0.14.8, an internal source-comment and lint-hygiene release with no API, wire-format, or behavior changes. No operator action is required. **Security:** *Uploaded SVG images are sanitized or refused* — An uploaded SVG is now checked by a strict sanitizer before it is stored: active content (scripts, event handlers, external references) is stripped, and an SVG that cannot be made safe is rejected with a clear error and never written. This closes the path where a crafted SVG, once stored and served, could execute script. Raster image uploads (PNG, JPEG, WebP, GIF) are unaffected.
+
+- v0.3.15 (2026-05-30) — **Product image galleries are interactive — click a thumbnail to view that image full size.** A product page's image gallery now lets a shopper switch between the product's images: clicking a thumbnail swaps the main image, with no JavaScript required. Previously the thumbnail strip was decorative — the additional images were unreachable, a single-image product showed empty placeholder slots, and only the first four images were shown. Now the main image stacks the product's images and the thumbnails are real, keyboard-accessible controls that select which one is shown; a product with one image shows just that image (no empty slots), and the four-image cap is raised to twelve so far more images are reachable. The picker is pure HTML and CSS, so it works without scripting and degrades cleanly. **Fixed:** *The product image gallery actually switches images now* — Thumbnails on the product page are now interactive: selecting one shows that image as the main image, using a no-JavaScript radio/label control. The empty placeholder slots a single-image product used to show are gone, the four-image cap is raised to twelve so far more images are reachable, and the strip is keyboard-navigable with accessible labels. The edge and container renderers emit identical markup.
+
 - v0.3.14 (2026-05-30) — **Drop the inert Document-Policy header that only produced browser warnings.** Container-rendered pages were sending a Document-Policy response header whose feature tokens (document-write, unsized-media, oversized-images) are no longer recognized by current browsers — so it enforced nothing while making the browser log a warning for each token on every page. The header is now omitted; every other security header (Content-Security-Policy, Permissions-Policy, HSTS, X-Frame-Options, the COOP/CORP set, and the rest) is unchanged. The edge and container paths now agree — neither sends Document-Policy — closing a header-parity gap. **Fixed:** *No more Document-Policy console warnings* — The Document-Policy header is no longer emitted on container-rendered pages. Its tokens were rejected by current browsers (the policy applied nothing and logged a warning per token on every page), so the header is dropped rather than shipped inert; the full set of other security headers is retained unchanged. Edge and container responses are now consistent.
 
 - v0.3.13 (2026-05-30) — **Updated runtime hardens the storage and audit layers; admin error pages no longer show raw database text.** The vendored blamejs runtime is updated to v0.14.7, which tightens the data and audit layers the shop is built on: database queries are checked against each table's declared columns (a reference to an undeclared column fails closed), the database encryption key is bound to its deployment so a copied key can't be unsealed elsewhere, raw SQL fragments refuse embedded string literals so values bind through placeholders, audit-chain purges can require two authorizers, and breach-notification deadlines raise a running clock. Separately, when an admin form action fails the console now shows a short generic message with the correct status instead of rendering a raw database or parser string into its error banner. No operator action is required. **Changed:** *Vendored runtime updated to v0.14.7 (storage + audit hardening)* — The underlying runtime now checks every database query against the table's declared columns and fails closed on an undeclared reference, binds the database encryption key to its data directory and key path so a relocated key won't unseal, refuses embedded string literals in raw SQL fragments, supports two-authorizer dual control on audit-chain purges, can compute sealed-column lookup hashes as a keyed MAC, and ships a running clock for breach-notification deadlines. The shop inherits these protections; no configuration change is needed. **Fixed:** *Console error banners show a safe message, not internal text* — Every admin HTML form handler now routes a thrown error through one shared classifier: a duplicate key becomes a 409 "That value is already in use.", a missing referenced record a generic not-found, malformed input a generic "Invalid input.", and an unexpected failure a generic message whose detail is recorded server-side rather than shown. Operator-facing validation messages are unchanged. This closes the path where a create form could render a raw database constraint string into its error banner, matching the API behavior the bearer path already had.

package/lib/admin.js

@@ -1200,6 +1200,43 @@ function mount(router, deps) {
     // caller renders the problem.
     async function _storeAndAttach(buf, contentType, body) {
       var declared = String(contentType).split(";")[0].trim().toLowerCase();
+      // SVG is text — magic-byte sniffing can't classify it, so the type
+      // gate trusts the declared `image/svg+xml`. An SVG served same-origin
+      // from the media bucket is a stored-XSS vector on direct navigation
+      // (embedded <script>, on* handlers, javascript: URLs, foreignObject
+      // namespace escapes). Run the bytes through the framework's SVG guard
+      // before they reach the bucket: `refuse` (an unrepairable threat —
+      // <script>, DOCTYPE/XXE, SVGZ) is an operational failure the caller
+      // renders as a clean 4xx with no row written; `sanitize` stores the
+      // repaired bytes; `serve` stores the (clean) original. Composes the
+      // vendored b.guardSvg — never a hand-rolled SVG allowlist.
+      if (declared === "image/svg+xml") {
+        var verdict;
+        try {
+          verdict = await b.guardSvg.gate({ profile: "strict" }).check({ bytes: buf });
+        } catch (_e) {
+          return { status: 422, code: "svg-unsafe",
+            detail: "the uploaded SVG could not be validated as safe to serve" };
+        }
+        if (!verdict || verdict.action === "refuse") {
+          return { status: 422, code: "svg-unsafe",
+            detail: "the uploaded SVG carries active content that can't be served safely (scripts, external entities, or a compressed payload)" };
+        }
+        if (verdict.action === "sanitize") {
+          // The guard hands back the repaired bytes as a Buffer (the gate
+          // contract) — or, defensively, a string. Anything else is a guard
+          // malfunction; fail closed rather than store unvalidated bytes.
+          var clean = verdict.sanitized;
+          if (Buffer.isBuffer(clean)) {
+            buf = clean;
+          } else if (typeof clean === "string") {
+            buf = Buffer.from(clean, "utf8");
+          } else {
+            return { status: 422, code: "svg-unsafe",
+              detail: "the uploaded SVG could not be sanitized into safe-to-serve bytes" };
+          }
+        }
+      }
       var ext = _extFromContentType(declared);
       var id  = b.uuid.v7();
       var key = "media/" + id + (ext ? "." + ext : "");
@@ -1432,6 +1469,76 @@ function mount(router, deps) {
     },
   ));
 
+  // Reorder a product's media. The PDP gallery renders the media in list
+  // order with the first row as the hero, so this is "rearrange the gallery
+  // + choose which image leads." Browser form posts the full ordered id set
+  // as a comma-joined `ordered_media_ids` string (same convention as the
+  // collections-members reorder); the JSON API accepts an array. The
+  // primitive rewrites `position` to 0..N-1 and refuses a partial / foreign
+  // set (TypeError → clean 400 / ?err=1). DB-only — no R2 bridge needed.
+  router.post("/admin/products/:id/media/reorder", _pageOrApi(false,
+    W("media.reorder", async function (req, res) {
+      var body = req.body || {};
+      var ids = Array.isArray(body.ordered_media_ids) ? body.ordered_media_ids : null;
+      if (!ids || ids.length === 0) return _problem(res, 400, "bad-request", "ordered_media_ids array required");
+      try { await catalog.media.reorder(req.params.id, ids); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      _json(res, 200, { ok: true });
+      return { id: req.params.id };
+    }),
+    async function (req, res) {
+      var id  = req.params.id;
+      var enc = encodeURIComponent(id);
+      var body = req.body || {};
+      // The reorder form posts a single comma-joined id field; also accept
+      // repeated ordered_media_id rows for parity with the collections form.
+      var ids;
+      if (body.ordered_media_ids != null && typeof body.ordered_media_ids === "string") {
+        ids = body.ordered_media_ids.split(",").map(function (s) { return s.trim(); }).filter(Boolean);
+      } else {
+        var raw = body.ordered_media_id;
+        var rows = raw == null ? [] : (Array.isArray(raw) ? raw : [raw]);
+        ids = rows.map(function (s) { return String(s).trim(); }).filter(Boolean);
+      }
+      if (!ids.length) return _redirect(res, "/admin/products/" + enc + "?err=1");
+      try { await catalog.media.reorder(id, ids); }
+      catch (e) {
+        _safeNotice(e, "media.reorder");
+        return _redirect(res, "/admin/products/" + enc + "?err=1");
+      }
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".media.reorder", outcome: "success", metadata: { id: id } });
+      _redirect(res, "/admin/products/" + enc + "?saved=1");
+    },
+  ));
+
+  // Promote one media row to the hero slot (position 0). No body — the media
+  // id is in the path, the product id only used to PRG back to the detail.
+  // A malformed id throws TypeError (→ 400 / ?err=1); an unknown or
+  // variant-only row returns false (→ 404 / ?err=1). DB-only.
+  router.post("/admin/products/:id/media/:mid/primary", _pageOrApi(false,
+    W("media.set_primary", async function (req, res) {
+      var ok;
+      try { ok = await catalog.media.setPrimary(req.params.mid); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+      if (!ok) return _problem(res, 404, "media-not-found");
+      _json(res, 200, { ok: true });
+      return { id: req.params.mid };
+    }),
+    async function (req, res) {
+      var id  = req.params.id;
+      var enc = encodeURIComponent(id);
+      var ok = false;
+      try { ok = await catalog.media.setPrimary(req.params.mid); }
+      catch (e) {
+        _safeNotice(e, "media.set_primary");
+        return _redirect(res, "/admin/products/" + enc + "?err=1");
+      }
+      if (!ok) return _redirect(res, "/admin/products/" + enc + "?err=1");
+      b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".media.set_primary", outcome: "success", metadata: { id: req.params.mid } });
+      _redirect(res, "/admin/products/" + enc + "?saved=1");
+    },
+  ));
+
   // ---- bulk catalog import --------------------------------------------
 
   // POST /admin/catalog/import — Content-Type: text/csv body. The CSV
@@ -9658,24 +9765,50 @@ function renderAdminProduct(opts) {
   var variantsSection = "<section class=\"mt\"><h3 class=\"fs-105\">Variants</h3>" + variantsBody + addVariant + "</section>";
 
   // ---- media -----------------------------------------------------------
-  var mediaCards = mediaRows.map(function (m) {
+  var mediaCards = mediaRows.map(function (m, idx) {
     var mid = _htmlEscape(m.id);
     var url = assetPrefix + m.r2_key;
     var isImage = /^image\//.test(m.content_type || "");
     var thumb = isImage
       ? "<img class=\"media-thumb\" src=\"" + _htmlEscape(url) + "\" alt=\"" + _htmlEscape(m.alt_text || "") + "\" loading=\"lazy\">"
       : "<span class=\"media-thumb media-thumb--file\">" + _htmlEscape((m.content_type || "file").split("/")[0]) + "</span>";
+    // The first row is the hero shown on the product page — mark it with a
+    // pill; every other row offers a "Make primary" form that promotes it to
+    // position 0 (the CSRF field is injected into the form by the shell).
+    var makePrimary = (idx === 0)
+      ? "<span class=\"status-pill paid\">Primary</span>"
+      : "<form method=\"post\" action=\"/admin/products/" + pid + "/media/" + mid + "/primary\" class=\"form-inline\">" +
+          "<button class=\"btn btn--ghost\" type=\"submit\">Make primary</button></form>";
     return "<div class=\"media-card\">" +
       thumb +
       "<code class=\"order-id\">" + _htmlEscape(m.r2_key) + "</code>" +
       "<span class=\"u-mute\">" + _htmlEscape(m.content_type || "") + (m.alt_text ? " · " + _htmlEscape(m.alt_text) : "") + "</span>" +
-      "<a class=\"btn btn--danger\" href=\"/admin/media/" + mid + "/delete/confirm-page?product_id=" + pid + "\">Delete</a>" +
+      "<div class=\"actions-row mt-0\">" + makePrimary +
+        "<a class=\"btn btn--danger\" href=\"/admin/media/" + mid + "/delete/confirm-page?product_id=" + pid + "\">Delete</a>" +
+      "</div>" +
     "</div>";
   }).join("");
   var mediaGrid = mediaRows.length
     ? "<div class=\"media-grid\">" + mediaCards + "</div>"
     : "<p class=\"empty\">No media attached yet.</p>";
 
+  // Reorder: a single field of the current media ids, comma-joined, that the
+  // operator rewrites into the new order. No-JS-required and v1-defensible
+  // — the primitive normalises positions to 0..N-1 and the first row is the
+  // hero. Only shown when there's more than one image to order.
+  var currentMediaIds = mediaRows.map(function (m) { return m.id; }).join(",");
+  var mediaReorderForm = mediaRows.length > 1
+    ? "<div class=\"panel mt-1 mw-40\">" +
+        "<h3 class=\"subhead\">Reorder images</h3>" +
+        "<p class=\"meta\">The first image is the hero shown on the product page. Rewrite the comma-separated id list into the order you want — list every current image.</p>" +
+        "<form method=\"post\" action=\"/admin/products/" + pid + "/media/reorder\">" +
+          "<label class=\"form-field\"><span>Ordered media ids</span>" +
+            "<input type=\"text\" name=\"ordered_media_ids\" value=\"" + _htmlEscape(currentMediaIds) + "\"></label>" +
+          "<div class=\"actions-row\"><button class=\"btn btn--ghost\" type=\"submit\">Apply order</button></div>" +
+        "</form>" +
+      "</div>"
+    : "";
+
   var attachForm =
     "<div class=\"panel mt-1 mw-40\">" +
       "<h3 class=\"subhead\">Attach media by R2 key</h3>" +
@@ -9716,7 +9849,7 @@ function renderAdminProduct(opts) {
       "</div>"
     : "";
 
-  var mediaSection = "<section class=\"mt\"><h3 class=\"fs-105\">Media</h3>" + mediaGrid + fileUploadForm + attachForm + uploadForm + "</section>";
+  var mediaSection = "<section class=\"mt\"><h3 class=\"fs-105\">Media</h3>" + mediaGrid + mediaReorderForm + fileUploadForm + attachForm + uploadForm + "</section>";
 
   // ---- head + assembly -------------------------------------------------
   var statusCls = p.status === "active" ? "paid" : (p.status === "archived" ? "refunded" : "pending");

package/lib/asset-manifest.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.3.14",
+  "version": "0.3.16",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",
       "fingerprinted": "css/admin.72c808274ebcefd9.css"
     },
     "css/main.css": {
-      "integrity": "sha384-Ed0bwnHFBjIXGUR0F9xxiF4xNMDhWConBkMVtwphkMK8mnTPbotcw9hqgnPUwjcO",
-      "fingerprinted": "css/main.a3e517665e9a8f78.css"
+      "integrity": "sha384-kbtcIsmD7X/DDsTJIYQ49JexBKXkz/GU1aQ8430XEyHHW/hcOPMWqbgZ7wRqvsbT",
+      "fingerprinted": "css/main.37860144b12a94fe.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",

package/lib/catalog.js

@@ -8,10 +8,11 @@
  *   Five sub-modules:
  *
  *   - `products`   — create, get, bySlug, list, update, archive, restore
- *   - `variants`   — create, get, listForProduct, update, delete, reorder
+ *   - `variants`   — create, get, listForProduct, update, delete
  *   - `prices`     — set (versioned), current, history
  *   - `inventory`  — create, get, decrement, release, restock
- *   - `media`      — attach, listForProduct, listForVariant, delete, reorder
+ *   - `media`      — attach, get, listForProduct, listForVariant, delete,
+ *                    reorder, setPrimary
  *
  *   Every write validates input at entry; bad input throws TypeError
  *   with a descriptive message so the calling route handler can
@@ -789,6 +790,64 @@ function _mediaModule(query) {
       var r = await query("DELETE FROM media WHERE id = ?1", [id]);
       return r.rowCount > 0;
     },
+
+    // Reorder a product's media. `orderedIds` is the FULL set of this
+    // product's media ids in the desired order; `position` is rewritten to
+    // 0..N-1 to match. Throws TypeError on a non-array / id-shape error or
+    // when the set doesn't exactly match the product's current media (a
+    // missing / extra / foreign id) — a partial reorder would silently drop
+    // a row's ordering. D1 has no cross-statement transaction over the HTTP
+    // bridge, so positions are written one UPDATE per row, each scoped by
+    // product_id so a crafted id list can never reposition another product's
+    // row out of band. Returns the count written.
+    reorder: async function (productId, orderedIds) {
+      _id(productId, "product_id");
+      if (!Array.isArray(orderedIds) || orderedIds.length === 0) {
+        throw new TypeError("catalog.media.reorder: orderedIds must be a non-empty array");
+      }
+      orderedIds.forEach(function (id) { _id(id, "media id"); });
+      var existing = await query("SELECT id FROM media WHERE product_id = ?1", [productId]);
+      var have = existing.rows.map(function (r) { return r.id; }).sort();
+      var want = orderedIds.slice().sort();
+      if (have.length !== want.length ||
+          have.some(function (id, i) { return id !== want[i]; })) {
+        throw new TypeError("catalog.media.reorder: orderedIds must list exactly this product's current media");
+      }
+      for (var i = 0; i < orderedIds.length; i += 1) {
+        await query(
+          "UPDATE media SET position = ?1 WHERE id = ?2 AND product_id = ?3",
+          [i, orderedIds[i], productId],
+        );
+      }
+      return orderedIds.length;
+    },
+
+    // Promote one media row to the hero slot (position 0) and push every
+    // other row of the same product down by one, preserving their relative
+    // order. The PDP gallery renders media[0] as the hero, so this is the
+    // "set primary image" operation. Throws TypeError on a malformed id;
+    // returns false when the id doesn't resolve to a product-scoped row
+    // (an unknown id, or a variant-only row that has no product_id). Every
+    // UPDATE is scoped by product_id — same cross-product-IDOR guard as
+    // reorder.
+    setPrimary: async function (mediaId) {
+      _id(mediaId, "media id");
+      var row = (await query("SELECT id, product_id FROM media WHERE id = ?1", [mediaId])).rows[0];
+      if (!row || !row.product_id) return false;
+      var ordered = (await query(
+        "SELECT id FROM media WHERE product_id = ?1 ORDER BY position ASC, created_at ASC",
+        [row.product_id],
+      )).rows.map(function (r) { return r.id; });
+      var without = ordered.filter(function (id) { return id !== mediaId; });
+      var next = [mediaId].concat(without);
+      for (var i = 0; i < next.length; i += 1) {
+        await query(
+          "UPDATE media SET position = ?1 WHERE id = ?2 AND product_id = ?3",
+          [i, next[i], row.product_id],
+        );
+      }
+      return true;
+    },
   };
 }
 

package/lib/storefront.js

@@ -1709,42 +1709,57 @@ var PRODUCT_PAGE =
   "RAW_RELATED_PLACEHOLDER";
 
 // PDP gallery markup — composed once per render call from the
-// product's media rows. When media is present, the first row drives
-// the main figure (with `alt_text` for a11y) and up to three more
-// rows feed the thumbnail strip below it. When media is absent the
-// gallery falls back to the existing letter-mark placeholder so a
+// product's media rows. A no-JS, CSS-`:checked` picker: every media row
+// is rendered both as a hidden radio + a stacked main `<img>` (only the
+// `:checked` radio's image is visible) and as a `<label for>` thumbnail
+// (clicking/keyboard-activating it checks the radio → CSS swaps the
+// visible image). The first image is selected on load. A single-image
+// product renders just that image with no thumbnail strip; when media is
+// absent the gallery falls back to the letter-mark placeholder so a
 // freshly-seeded product never renders an empty square.
+//
+// Byte-identical to the edge renderer (`worker/render/product.js
+// #_buildPdpGallery`) — keep the two in sync on every change.
 function _buildPdpGallery(product, media, assetPrefix) {
   var prefix = assetPrefix || "/assets/";
   function _escAttr(s) { return b.template.escapeHtml(s); }
   if (!media || media.length === 0) {
     return "<figure class=\"pdp__media pdp__media--placeholder\" aria-hidden=\"true\">" +
              "<svg class=\"media-ph__svg\" viewBox=\"0 0 240 240\" aria-hidden=\"true\"><rect width=\"240\" height=\"240\" fill=\"none\"/><g stroke=\"currentColor\" stroke-opacity=\"0.10\" stroke-width=\"1\"><path d=\"M0 40 H240 M0 80 H240 M0 120 H240 M0 160 H240 M0 200 H240 M40 0 V240 M80 0 V240 M120 0 V240 M160 0 V240 M200 0 V240\"/></g><g fill=\"none\" stroke=\"#AD38DB\" stroke-width=\"3\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M120 64 L162 80 L162 122 C162 152 144 168 120 178 C96 168 78 152 78 122 L78 80 Z\" stroke=\"#732A8D\" stroke-width=\"2.4\"/><path d=\"M120 92 L146 105 L146 134 L120 147 L94 134 L94 105 Z\"/><path d=\"M94 105 L120 118 L146 105 M120 118 V147\" stroke=\"#732A8D\" stroke-width=\"2.4\"/><path d=\"M107 101 L112 105 L107 109\" stroke=\"currentColor\" stroke-width=\"2.4\"/><path d=\"M116 110 H128\" stroke=\"currentColor\" stroke-width=\"2.4\"/></g><text x=\"120\" y=\"208\" text-anchor=\"middle\" font-family=\"ui-monospace,Menlo,Consolas,monospace\" font-size=\"12\" letter-spacing=\"2\" fill=\"#6b6b78\">no image yet</text></svg>" +
-           "</figure>" +
-           "<ul class=\"pdp__thumbs\" aria-hidden=\"true\">" +
-             "<li class=\"is-active\"></li><li></li><li></li><li></li>" +
-           "</ul>";
+           "</figure>";
   }
   var hero = media[0];
-  var heroUrl = prefix + hero.r2_key;
   var heroAlt = hero.alt_text || product.title || "Product image";
-  var heroImg = "<figure class=\"pdp__media pdp__media--image\">" +
-                  "<img src=\"" + _escAttr(heroUrl) + "\" alt=\"" + _escAttr(heroAlt) + "\" loading=\"eager\">" +
-                "</figure>";
-  // Thumbnail strip — up to four slots, the active one is the hero.
-  // Real thumbnails come from additional media rows; missing slots
-  // render as dashed placeholders so the strip's grid doesn't
-  // collapse on a single-image product.
-  var thumbs = ["<li class=\"is-active\">" +
-                  "<img src=\"" + _escAttr(heroUrl) + "\" alt=\"\">" +
-                "</li>"];
-  for (var i = 1; i < Math.min(media.length, 4); i += 1) {
-    var t = media[i];
-    var tUrl = prefix + t.r2_key;
-    thumbs.push("<li><img src=\"" + _escAttr(tUrl) + "\" alt=\"\"></li>");
-  }
-  while (thumbs.length < 4) thumbs.push("<li></li>");
-  return heroImg + "<ul class=\"pdp__thumbs\" aria-hidden=\"true\">" + thumbs.join("") + "</ul>";
+  // The CSS picker (main.css) maps :checked radios through nth-of-type(12),
+  // so render at most that many — a thumbnail that checked a radio with no
+  // matching visibility rule would blank the gallery. Twelve covers any
+  // realistic product; keep this in lockstep with the rule count in main.css.
+  var shown = media.length < 12 ? media.length : 12;
+  var radios = "";
+  var imgs = "";
+  var thumbs = "";
+  for (var i = 0; i < shown; i += 1) {
+    var m = media[i];
+    var url = prefix + m.r2_key;
+    var id = "pdp-img-" + i;
+    var checked = i === 0 ? " checked" : "";
+    var alt = i === 0 ? heroAlt : (m.alt_text || product.title || "Product image");
+    var loading = i === 0 ? "eager" : "lazy";
+    radios += "<input class=\"pdp__radio\" type=\"radio\" name=\"pdp-img\" id=\"" + _escAttr(id) + "\"" + checked + ">";
+    imgs += "<img class=\"pdp__img\" src=\"" + _escAttr(url) + "\" alt=\"" + _escAttr(alt) + "\" loading=\"" + loading + "\">";
+    thumbs += "<li>" +
+                "<label class=\"pdp__thumb\" for=\"" + _escAttr(id) + "\">" +
+                  "<img src=\"" + _escAttr(url) + "\" alt=\"\">" +
+                  "<span class=\"sr-only\">Show image " + (i + 1) + "</span>" +
+                "</label>" +
+              "</li>";
+  }
+  // Radios are siblings of the figure + thumbnail list (not nested), so a
+  // checked radio can reach both the stacked images and the matching
+  // thumbnail through the general-sibling combinator in CSS.
+  var figure = "<figure class=\"pdp__media pdp__media--image pdp__media--gallery\">" + imgs + "</figure>";
+  if (shown === 1) return radios + figure;
+  return radios + figure + "<ul class=\"pdp__thumbs\">" + thumbs + "</ul>";
 }
 
 // Accessible star glyph row — the precise figure rides in a visually-

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.14.7",
-      "tag": "v0.14.7",
+      "version": "0.14.8",
+      "tag": "v0.14.8",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.14.x
 
+- v0.14.8 (2026-05-30) — **Source-comment and codebase-check hygiene, plus a new require-block alignment check; no API or behaviour changes.** Internal lint and comment cleanup with no operator-facing surface change. Several codebase-check comments and one stub helper name that described behaviour the check no longer has are corrected; an unused lint-suppression class and a set of stale duplicate-cluster qualifiers (functions that were since renamed or extracted) are pruned or re-pointed. Fifty-nine `// allow:` markers that named the byte-size or time-literal check on values those checks no longer flag are removed, and twenty self-negating rationales on markers the time check genuinely fires on are rewritten to say why the value coincidentally matches. A new codebase check holds top-of-file require blocks to consistent `=` column alignment, with the files that currently carry drift listed as a migration allowlist. No exported API, error code, wire format, or runtime behaviour changes. **Changed:** *Lint-suppression and codebase-check comment cleanup* — Corrected codebase-check comments that overstated their check's scope (a duplicate-code threshold described as three files when the advisory threshold is two, a narrowed byte-literal check carrying its pre-narrowing description, and a deferred-scan helper named as though it enforced a guarantee it does not yet provide). Removed an unused lint-suppression class and its one dead in-code marker, and pruned or re-pointed stale duplicate-cluster qualifiers that named functions since renamed or extracted into shared helpers. Removed fifty-nine `// allow:` markers that suppressed nothing, and rewrote twenty self-negating marker rationales (which read "not seconds" while sitting on a value the time check fires on) to explain the coincidental match. Source-comment and test hygiene only. **Detectors:** *Require-block `=` alignment check* — A new codebase check flags a top-of-file require block that mixes its `=` column alignment — a fittable line whose `=` drifts off the column the rest of the block shares. Compact single-space blocks are exempt (only blocks that declare alignment intent are checked), as are destructures and long names physically too wide to reach the column, and blank- or comment-separated tiers align independently. The files that currently carry such drift are an explicit migration allowlist, reflowed over time; new code is held to the rule.
+
 - v0.14.7 (2026-05-30) — **Storage and audit-trail hardening: queries are gated to declared columns, raw SQL refuses embedded literals, the database key is bound to its location, sealed-column lookup hashes gain a keyed mode, audit-chain purges can require dual control, and breach deadlines ship a running clock.** This release tightens the data and audit layers against a set of failure modes that were previously reachable. Database queries are now checked against the columns a table declared in its schema: a reference to an undeclared column fails closed by default instead of silently matching nothing, and the `whereRaw` escape hatch refuses an embedded string literal so values bind through placeholders. The database encryption key is sealed with its purpose, data directory, and key path as additional authenticated data, so a key file cannot be relocated to another deployment and unsealed there; an older key without that binding upgrades itself on first load. Sealed-column equality-lookup hashes can now be computed as a keyed MAC (HMAC-SHAKE256) off a per-deployment key, making the lookup hash unforgeable without that key, while the salted-SHA3 default is unchanged. Purging the tamper-evident audit chain can be placed under a two-authorizer dual-control grant so one operator cannot erase it alone, and database credential-rejection audits now record which relation the rejected credential tried to reach. Finally, breach-notification deadlines get a running clock that raises approaching and passed alerts as each regime's window elapses. One behavior change to note: the column gate defaults to reject — if a service issues queries against columns it did not declare in its schema, set `db.init({ columnGate: "warn" })` (audited, allowed) or `"off"` while the schema is reconciled. **Added:** *Column-membership gate on every query* — `b.db.from(table)` now checks each referenced column against the table's declared schema. The mode is set with `db.init({ columnGate: "reject" | "warn" | "off" })` (default `reject`), and `query.allowedColumns([...])` narrows a single query to an explicit allowlist that is always enforced. `b.db.getDeclaredColumns(table)` returns a table's declared column names (or `null` for an unknown table). This is defense in depth against typo'd or caller-influenced column names reaching the SQL layer (CWE-89). · *Keyed mode for sealed-column lookup hashes* — Equality-lookup ("derived") hashes for sealed columns can be computed as `hmac-shake256` — a keyed MAC over a per-deployment key — instead of the default `salted-sha3`. Set it per table with `cryptoField.registerTable(name, { derivedHashMode: "hmac-shake256" })` or per column with `{ from, mode: "hmac-shake256" }`. The keyed hash is unforgeable and un-correlatable without the deployment's MAC key, which raises the bar against offline lookup-table attacks on low-entropy sealed values (CWE-916). `b.vault.getDerivedHashMacKey()` exposes the 32-byte per-deployment key; it is created on first use and re-sealed across key rotation automatically. · *Dual-control gate on audit-chain purge* — `b.auditTools.purge` accepts `dualControlGrant`. When `audit_log` is placed under dual control, a verified archive and `confirm: true` are no longer sufficient: the purge additionally requires a consumed m-of-n grant whose action is bound to the purge, so a grant minted for another operation cannot be replayed and one operator cannot erase the tamper-evident chain alone (NIST SP 800-53 AU-9, separation of duties). · *Running clock for breach-notification deadlines* — `b.incident.report.createDeadlineClock({ notify, approachThresholds })` tracks open incidents and raises `deadline_approaching` and `deadline_passed` alerts as each regime's window elapses (GDPR 72h, DORA, NIS2, and the rest of the registry). Alerts are deduplicated per incident and stage, suppressed once a submission stage is acknowledged, and the clock can run on an interval or be ticked manually. **Changed:** *Queries against undeclared columns now fail closed by default* — The column gate defaults to `reject`: a query that references a column the table did not declare throws rather than silently matching nothing. A service that intentionally queries undeclared columns can set `db.init({ columnGate: "warn" })` to audit and allow, or `"off"` to disable the gate, while its schema is reconciled. Framework-declared columns (including `_id` and derived-hash columns) are always members. **Security:** *Database encryption key bound to its location* — `db.key.enc` is sealed with additional authenticated data over its purpose, resolved data directory, and resolved key path. A sealed key copied to a different deployment or path no longer unseals there — the AEAD authentication fails — which prevents silent key relocation. A legacy key sealed without this binding is detected and re-sealed in the bound format on first load, with no operator action required. · *`whereRaw` refuses embedded string literals* — `whereRaw(sql, params)` and `WhereBuilder.raw(sql, params)` reject a raw fragment containing a string literal (`'...'`); values must bind through the `params` array. A static, operator-controlled literal can opt in with `{ allowLiterals: true }`. This closes a path where a value concatenated into a raw fragment would reintroduce SQL injection (CWE-89). · *Credential-rejection audits record the attempted relation* — A `db.auth.failed` audit row (SQLSTATE 28000 / 28P01 / 42501) now carries `attemptedTable`, the relation the rejected credential tried to reach, extracted defensively from the statement. Triage can scope the blast radius of a credential-abuse event without correlating back to the raw SQL log (CWE-778). **Detectors:** *Audit-purge dual-control gate* — A new check fails the build if a call to `purgeAuditChain` appears in a file that does not also route through the dual-control gate, so a future caller cannot physically delete chain rows without two-authorizer enforcement. · *Raw-SQL literal/interpolation guard* — A new check fails the build on a `whereRaw` / `.raw` call whose SQL argument is built by template interpolation or string concatenation, keeping the bound-params discipline enforceable in framework code. · *Hand-rolled lookup-hash guard* — A new check fails the build if a sealed-column lookup hash is derived from the per-deployment salt outside the canonical helper, so call sites cannot bypass the keyed-mode and per-column mode policy. · *Auth-audit attempted-relation guard* — A new check fails the build if a `db.auth.failed` audit is emitted in a file that does not name `attemptedTable`, so the forensic field cannot be dropped from a future emitter.
 
 - v0.14.6 (2026-05-30) — **Access-refusal middleware can return RFC 9457 problem+json or a custom response, and several documented-but-uncallable APIs are now reachable.** Every access-refusal middleware — the auth gates (bearer, DPoP, mTLS, AAL, bound-key), CSRF, CORS, rate-limit, bot-guard, age-gate, the host and network allowlists, and the method and content-type gates — now accepts two uniform options: `problemDetails: true` returns an RFC 9457 `application/problem+json` body, and `onDeny(req, res, info)` hands the response to the caller. With neither set the refusal is byte-for-byte what it was, so this is a drop-in change that lets a service standardize one error envelope across its API instead of working around each middleware's hardcoded body. Alongside that: `b.middleware.requireBoundKey` is now exported (it was documented and tested but never wired into the middleware surface), `b.middleware.bearerAuth` accepts `requiredScopes` (previously rejected at construction, which made its scope-enforcement path unreachable), API-key refusals send the RFC 6750 challenge code that matches the failure, two documented call paths that named a missing namespace segment are corrected, and the release flow now flags stale GitHub Actions and vendored bundles — with a ready-to-paste pin — before a dependency PR is needed. **Added:** *Uniform `onDeny` and `problemDetails` options on every access-refusal middleware* — Each request-lifecycle middleware that refuses a request now takes `problemDetails: true` to emit an RFC 9457 `application/problem+json` body (composing `b.problemDetails`) and `onDeny(req, res, info)` to take over the response entirely; `info` carries the status, a machine reason, and the middleware-specific fields. The deny-path response headers (`Allow`, `WWW-Authenticate`, `Retry-After`, `Accept`) survive every mode. When neither option is set the response is unchanged. Covers `requireAuth`, `requireAal`, `requireMethods`, `requireContentType`, `requireMtls`, `requireBoundKey`, `bearerAuth`, `dpop`, `csrfProtect`, `fetchMetadata`, `botGuard`, `ageGate`, `hostAllowlist`, `networkAllowlist`, `cors`, `rateLimit`, and `dailyByteQuota` (whose existing `onExceeded` keeps working as an alias of `onDeny`). **Fixed:** *`b.middleware.requireBoundKey` is now callable* — The Bearer-API-key middleware was documented (with examples and tests) but never exported on `b.middleware`, so `b.middleware.requireBoundKey(...)` threw `undefined is not a function`. It is now wired into the middleware surface. · *`b.middleware.bearerAuth` accepts `requiredScopes`* — The RFC 6750 scope-enforcement path read `opts.requiredScopes`, but the option was rejected at construction with `unknown option`, making the 403 `insufficient_scope` behavior unreachable. `requiredScopes` is now an accepted option. · *RFC 6750 challenge codes on API-key refusals* — `b.middleware.requireBoundKey` now sends the `WWW-Authenticate` error code that matches the failure: `insufficient_scope` on a 403 missing-scope, `invalid_token` on an unknown or revoked token, and no error code on a 401 that presented no credentials (RFC 6750 §3). It previously sent `invalid_request` for every refusal. · *Corrected two documented call paths* — The compliance and network references named a path that dropped a namespace segment: the conformity-assessment scaffold is at `b.cra.report.conformityAssessment` (not `b.cra.conformityAssessment`), and the per-socket tuning helper is at `b.network.socket.applyToSocket` (not `b.network.applyToSocket`). The documented signatures now match the callable paths. · *GitHub Actions pins refreshed* — `github/codeql-action` 4.35.5 to 4.36.0, and `docker/login-action`, `docker/setup-buildx-action`, and `docker/setup-qemu-action` to their latest releases. **Detectors:** *`@primitive` reachability gate* — A new check resolves every documented `b.X.Y` primitive against the actual public surface and fails the build when a documented path is not callable (factory-instance shorthands excluded). This is the gate that would have caught the `requireBoundKey` and call-path issues above. · *Deny-path composition gate* — A new check requires every access-refusal middleware to route its refusal through the shared deny-response writer, so a future middleware cannot reintroduce a hardcoded body that locks callers out of `onDeny` / `problemDetails`. · *Actions and vendor currency in the release flow* — The release flow now fails the cut when a SHA-pinned GitHub Action or a vendored bundle is behind its latest upstream release. The actions report prints a ready-to-paste `owner/repo@<sha>  # vX.Y.Z` pin and every file and line that uses it, so the bump is copy-paste rather than an after-the-fact dependency PR. Transient registry or API errors stay advisory so a flaky network response does not block an unrelated release.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.14.7",
-  "createdAt": "2026-05-30T20:25:42.630Z",
+  "frameworkVersion": "0.14.8",
+  "createdAt": "2026-05-30T23:08:17.846Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/a2a-tasks.js

@@ -62,17 +62,17 @@ var A2aTasksError = defineClass("A2aTasksError", { alwaysPermanent: true });
 var JSONRPC_VERSION = "2.0";
 
 // JSON-RPC 2.0 fixed error codes — A2A inherits these.
-var JSONRPC_PARSE_ERROR      = -32700;                                                             // allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_REQUEST  = -32600;                                                             // allow:raw-time-literal — not seconds
-var JSONRPC_METHOD_NOT_FOUND = -32601;                                                             // allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_PARAMS   = -32602;                                                             // allow:raw-time-literal — not seconds
-var JSONRPC_INTERNAL_ERROR   = -32603;                                                             // allow:raw-time-literal — not seconds
+var JSONRPC_PARSE_ERROR      = -32700;                                                             // allow:raw-time-literal — JSON-RPC error code -32700; coincidental multiple-of-60, not a time value, C.TIME N/A
+var JSONRPC_INVALID_REQUEST  = -32600;
+var JSONRPC_METHOD_NOT_FOUND = -32601;
+var JSONRPC_INVALID_PARAMS   = -32602;
+var JSONRPC_INTERNAL_ERROR   = -32603;
 
 // A2A-specific error codes per the spec's task-error vocabulary.
 // A2A_TASK_NOT_FOUND (-32002) + A2A_TASK_NOT_CANCELABLE (-32003) are
 // raised by operator handlers — they're reserved here for documentation
 // purposes only.
-var A2A_SCOPE_DENIED         = -32001;                                                             // allow:raw-time-literal — not seconds
+var A2A_SCOPE_DENIED         = -32001;
 
 var ALLOWED_METHODS = Object.freeze(["tasks/send", "tasks/get", "tasks/cancel"]);
 

package/lib/vendor/blamejs/lib/ai-input.js

@@ -26,7 +26,7 @@ var audit = require("./audit");
 var { AiInputError } = require("./framework-error");
 
 var SAMPLE_TRUNC = 80;                                                                       // sample truncation length, not bytes
-var CONFIDENCE_BASE = 60;                                                                    // allow:raw-time-literal — not seconds
+var CONFIDENCE_BASE = 60;                                                                    // allow:raw-time-literal — confidence-score base 60; coincidental multiple-of-60, not a duration, C.TIME N/A
 
 var PATTERNS = [
   { id: "ignore-prior-instructions", severity: 3, re:

package/lib/vendor/blamejs/lib/auth/acr-vocabulary.js

@@ -90,7 +90,7 @@ var BUILTIN_RANKS = {
   "urn:mace:incommon:iap:silver":      32,    // ACR rank, not bytes
 
   // Phishing-resistant multi-factor (passkey UV)
-  "phrh":                              60,    // allow:raw-time-literal — ACR rank, not seconds
+  "phrh":                              60,    // allow:raw-time-literal — ACR rank value 60; coincidental multiple-of-60, not a duration, C.TIME N/A
 
   // Hardware-bound + phishing-resistant + multi-factor
   "loa3":                              70,

package/lib/vendor/blamejs/lib/auth/ciba.js

@@ -68,9 +68,9 @@ var emit = validateOpts.makeNamespacedEmitters("auth.ciba", { audit: audit, obse
 var DEFAULT_INTERVAL_SEC = 5;
 var DEFAULT_EXPIRES_SEC  = 600;
 var MAX_BINDING_MSG_LEN  = 200;
-var MAX_RESPONSE_BYTES   = 64 * 1024;                                                            // allow:raw-byte-literal — JSON token-response cap
+var MAX_RESPONSE_BYTES   = 64 * 1024;
 var MIN_INTERVAL_SEC     = 1;
-var MAX_INTERVAL_SEC     = 300;                                                                  // allow:raw-time-literal — interval ceiling
+var MAX_INTERVAL_SEC     = 300;                                                                  // allow:raw-time-literal — 300s polling-interval ceiling; time-derived literal, C.TIME.seconds(300) applies, retained pending migration
 
 // _emitAudit emits under the "auth.ciba.<action>" namespace; _emitMetric
 // fires the matching observability counter. Implementations live in
@@ -490,7 +490,7 @@ function create(opts) {
         var current = entry ? entry.interval : DEFAULT_INTERVAL_SEC;
         var idpSuggested = err.cibaError && typeof err.cibaError.interval === "number"
           ? err.cibaError.interval : null;
-        var next = current + 5;                                                                 // allow:raw-time-literal — §11.3 mandates +5s minimum
+        var next = current + 5;
         if (idpSuggested !== null && idpSuggested > next && idpSuggested <= MAX_INTERVAL_SEC) {
           next = idpSuggested;
         }

package/lib/vendor/blamejs/lib/auth/oauth.js

@@ -220,7 +220,7 @@ var PSS_SALT_BYTES_SHA512      = C.BYTES.bytes(64);
 // CSPRNG output and refuses pathological payloads.
 var MAX_DEVICE_CODE_BYTES      = C.BYTES.kib(8);
 // RFC 8628 §3.4 — 5s is the spec-documented MINIMUM polling interval.
-var MIN_DEVICE_POLL_INTERVAL_SEC = 5;                                                              // allow:raw-time-literal — RFC 8628 §3.4 spec floor
+var MIN_DEVICE_POLL_INTERVAL_SEC = 5;
 // OIDC Back-Channel Logout §2.6 — replay defense via jti store catches
 // duplicate-jti reuse, but pre-v0.9.x an old captured logout-token
 // with a fresh jti could still pass. Enforce iat freshness against

package/lib/vendor/blamejs/lib/auth/oid4vci.js

@@ -69,7 +69,7 @@ var emit = validateOpts.makeNamespacedEmitters("auth.oid4vci", { audit: audit, o
 var DEFAULT_PRE_AUTH_TTL_MS  = C.TIME.minutes(5);
 var DEFAULT_ACCESS_TOKEN_TTL = C.TIME.minutes(15);
 var DEFAULT_C_NONCE_TTL_MS   = C.TIME.minutes(5);
-var MAX_PROOF_BYTES          = 32 * 1024;                                                       // allow:raw-byte-literal — proof-JWT cap
+var MAX_PROOF_BYTES          = 32 * 1024;
 var SUPPORTED_CREDENTIAL_FORMATS = ["vc+sd-jwt", "dc+sd-jwt"];
 
 var _emitAudit  = emit.audit;

package/lib/vendor/blamejs/lib/auth/openid-federation.js

@@ -81,7 +81,7 @@ var _emitAudit  = emit.audit;
 var _emitMetric = emit.metric;
 
 var SUPPORTED_ALGS = ["ES256", "ES384", "ES512", "PS256", "PS384", "PS512", "RS256", "EdDSA"];
-var MAX_STATEMENT_BYTES = 64 * 1024;                                                            // allow:raw-byte-literal — entity-statement size cap
+var MAX_STATEMENT_BYTES = 64 * 1024;
 var MAX_CHAIN_DEPTH = 10;                                                                       // federation chain depth ceiling
 
 function _b64uDecodeStr(s) { return Buffer.from(s, "base64url").toString("utf8"); }

package/lib/vendor/blamejs/lib/breach-deadline.js

@@ -48,8 +48,8 @@ var STATE_DEADLINES = Object.freeze({
   // Each entry: { days, statute, asapCeilingDays }
   // Days = statutory hard deadline in days. asapCeilingDays = the
   // operator-defensible ceiling for "without unreasonable delay" states.
-  AL: { days: 45,  statute: "Ala. Code §8-38-5" }, /* allow:raw-time-literal — statutory deadline days */
-  AK: { days: 45,  statute: "Alaska Stat. §45.48.010" }, /* allow:raw-time-literal — statutory deadline days */
+  AL: { days: 45,  statute: "Ala. Code §8-38-5" },
+  AK: { days: 45,  statute: "Alaska Stat. §45.48.010" },
   AZ: { days: 45,  statute: "Ariz. Rev. Stat. §18-552" }, /* allow:raw-time-literal — statutory deadline days */
   AR: { days: 45,  statute: "Ark. Code §4-110-105" }, /* allow:raw-time-literal — statutory deadline days */
   CA: { days: WITHOUT_UNREASONABLE_DELAY, statute: "Cal. Civ. Code §1798.82", asapCeilingDays: 60 }, /* allow:raw-time-literal — statutory ASAP ceiling days */
@@ -67,7 +67,7 @@ var STATE_DEADLINES = Object.freeze({
   KS: { days: WITHOUT_UNREASONABLE_DELAY, statute: "Kan. Stat. §50-7a02", asapCeilingDays: 60 }, /* allow:raw-time-literal — statutory ASAP ceiling days */
   KY: { days: WITHOUT_UNREASONABLE_DELAY, statute: "Ky. Rev. Stat. §365.732", asapCeilingDays: 60 }, /* allow:raw-time-literal — statutory ASAP ceiling days */
   LA: { days: 60,  statute: "La. Rev. Stat. §51:3074" }, /* allow:raw-time-literal — statutory deadline days */
-  ME: { days: 30,  statute: "Me. Rev. Stat. tit. 10 §1348" }, /* allow:raw-time-literal — statutory deadline days */
+  ME: { days: 30,  statute: "Me. Rev. Stat. tit. 10 §1348" },
   MD: { days: 45,  statute: "Md. Code Com. Law §14-3504" }, /* allow:raw-time-literal — statutory deadline days */
   MA: { days: WITHOUT_UNREASONABLE_DELAY, statute: "Mass. Gen. Laws ch. 93H §3", asapCeilingDays: 30 }, /* allow:raw-time-literal — statutory ASAP ceiling days */
   MI: { days: WITHOUT_UNREASONABLE_DELAY, statute: "Mich. Comp. Laws §445.72", asapCeilingDays: 60 }, /* allow:raw-time-literal — statutory ASAP ceiling days */

package/lib/vendor/blamejs/lib/calendar.js

@@ -697,7 +697,7 @@ function _expandSingleRule(rule, startMs, ctx) {
   }
   var byHourSet   = _bySet(rule.byHour,   0, 23);                                                      // RFC 5545 hour range
   var byMinuteSet = _bySet(rule.byMinute, 0, 59);                                                      // RFC 5545 minute range
-  var bySecondSet = _bySet(rule.bySecond, 0, 60);                                                      // allow:raw-time-literal — second-of-minute bound, not a duration
+  var bySecondSet = _bySet(rule.bySecond, 0, 60);                                                      // allow:raw-time-literal — second-of-minute upper bound (0..60); coincidental multiple-of-60, not a duration, C.TIME N/A
 
   function _isoWeekParts(d) {
     // ISO 8601 week-of-year + week-year. The week-YEAR can differ
@@ -709,7 +709,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     tmp.setUTCDate(tmp.getUTCDate() + 4 - dayOfWeek);                                                  // ISO week-year anchor (Thursday)
     var weekYear = tmp.getUTCFullYear();
     var yearStart = new Date(Date.UTC(weekYear, 0, 1));
-    var week = Math.ceil((((tmp - yearStart) / 86400000) + 1) / 7);                                    // allow:raw-time-literal — 86400000 ms/day, 7 days/week
+    var week = Math.ceil((((tmp - yearStart) / 86400000) + 1) / 7);
     return { week: week, year: weekYear };
   }
   function _isoWeekOf(d) {