@blamejs/blamejs-shop 0.3.4 → 0.3.6

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.6 (2026-05-30) — **Update the vendored blamejs runtime to v0.14.5.** Refreshes the vendored blamejs runtime from v0.13.46 to v0.14.5, a maintenance update. The request-lifecycle security stack the storefront and admin depend on — CSRF, fetch-metadata, body-parser, cookies, and rate limiting — is unchanged across this range. The runtime's breaking changes in this window (stricter OAuth JAR request-object typing and a PGP signature return type) are in surfaces this shop does not use, so there is no behavior change and no operator action is required. **Changed:** *Vendored blamejs runtime updated to v0.14.5* — The pinned blamejs runtime moves from v0.13.46 to v0.14.5, picking up the framework's maintenance and hardening work across that range. The createApp request-lifecycle middleware the shop composes (CSRF, fetch-metadata, body-parser, cookie, and rate-limit layers) is unchanged, so this refresh carries no behavior change for the storefront or admin console.
+
+- v0.3.5 (2026-05-30) — **Shipping-label management in the admin console.** The admin console gains shipping-label tools. On an order, void a purchased label — with a reason — when it needs reprinting, alongside the existing mark-as-used action. A new Shipping labels section adds cross-order visibility: a status-filtered list, the mint queue of labels awaiting a broker, and a broker-spend report that totals label costs by carrier and currency over a date range. This is bookkeeping and reporting only — nothing in the storefront, cart, or checkout changes. **Added:** *Void a shipping label from the order* — Each purchased label on an order now offers a Void action with a reason, for when a label is reprinted at a different weight or carrier. Voiding is refused once a label has been used or already voided, or once it is past the carrier's void window. · *Shipping labels admin section* — A new Shipping labels section gives cross-order visibility: a status-filtered label list, the mint queue of labels awaiting a broker, and a broker-spend report totalling label cost grouped by carrier and currency over a date range.
+
 - v0.3.4 (2026-05-30) — **Sales-tax filings and remittance tracking in the admin console.** The admin console gains a Tax filings section for tracking sales-tax remittance across reporting periods. Open a filing period for a jurisdiction, compute the tax collected from completed orders in that window, then record the submission and the payment as you remit. Each filing carries a per-rate breakdown and an audit trail, and the list surfaces what's due soon or already overdue. A per-jurisdiction remittance report totals the tax owed across a date range. Every figure derives from completed orders — nothing in the storefront, cart, or checkout changes. **Added:** *Tax filings admin console* — A new Tax filings section tracks sales-tax remittance: open a filing period for a jurisdiction and reporting kind, compute the tax collected from completed orders in the window with a per-rate breakdown, then record submission and payment through the filing lifecycle. The list surfaces filings due soon or overdue, and a remittance report totals tax owed per jurisdiction across a date range. This is reporting only — it reads completed orders and changes nothing in checkout.
 
 - v0.3.3 (2026-05-30) — **Manage quantity-break (volume) pricing from the admin console.** The admin console gains a Quantity breaks section for creating and managing volume-pricing tier sets — buy-more-save-more rules scoped to a SKU, product, collection, vendor, category, or the whole store. Each set defines one or more quantity thresholds (e.g. buy 5, buy 10) with a percentage off, an amount off each unit, an amount off the line, or a fixed per-unit price, and can be marked exclusive or left to stack with others. A sample-price preview shows the discounted unit at each threshold before you commit, and sets archive and restore. The tiers take effect immediately on the product page, in the cart, and at checkout. **Added:** *Quantity Breaks admin console* — A new Quantity breaks section manages volume-pricing tier sets: create a set scoped to a SKU, product, collection, vendor, category, or globally; define one or more quantity thresholds with a percent-off, amount-off-each, amount-off-line, or fixed-per-unit discount; mark a set exclusive or let it stack. A sample-price preview shows the discounted unit at each threshold, and sets archive and restore. The tiers apply automatically on the product page, the cart, and at checkout.

package/lib/admin.js

@@ -145,6 +145,11 @@ var _UPLOAD_IMAGE_CT = {
 // generic 413.
 var _UPLOAD_MAX_BYTES = b.constants.BYTES.mib(10);
 
+// Cap on the standalone shipping-labels list / pending-queue reads. Matches
+// the labels primitive's own MAX_PENDING_LIMIT so a console drain can never
+// ask for more than the primitive will return.
+var MAX_LABEL_LIST_LIMIT = 200;
+
 // ---- shared helpers -----------------------------------------------------
 
 function _parseEpochMs(str, label) {
@@ -446,7 +451,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, quantityDiscounts: !!deps.quantityDiscounts, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, customerSurveys: !!deps.customerSurveys, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, quantityDiscounts: !!deps.quantityDiscounts, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -1671,6 +1676,46 @@ function mount(router, deps) {
         _redirect(res, "/admin/orders/" + enc + "?label=1");
       },
     ));
+
+    // Void a recorded label (broker void, within the 30-day window).
+    // purchased → voided. Mirrors the /used route: the primitive enforces
+    // the transition + window, a TypeError (bad id / missing reason) or a
+    // SHIPPING_LABELS_* coded error (wrong status / expired window) surfaces
+    // as a 400 on the JSON path and an `?err` notice on the browser path.
+    router.post("/admin/orders/:id/labels/:labelId/void", _pageOrApi(false,
+      W("order.shipment.label.void", async function (req, res) {
+        var body = req.body || {};
+        var out;
+        try {
+          out = await shippingLabels.voidLabel({ label_id: req.params.labelId, reason: body.reason });
+        } catch (e) {
+          if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+          if (e && e.code && /SHIPPING_LABELS/.test(e.code)) return _problem(res, 400, "bad-request", e.message);
+          throw e;
+        }
+        _json(res, 200, out);
+        return { id: req.params.id };
+      }),
+      async function (req, res) {
+        var id = req.params.id;
+        var enc = encodeURIComponent(id);
+        var body = req.body || {};
+        try {
+          await shippingLabels.voidLabel({
+            label_id: req.params.labelId,
+            // A blank reason field reaches the primitive as undefined so the
+            // operator-facing "reason required" message surfaces, rather than
+            // the empty string slipping past the non-empty check.
+            reason: (body.reason && body.reason.length) ? body.reason : undefined,
+          });
+        } catch (e) {
+          if (!(e instanceof TypeError) && !(e && e.code && /SHIPPING_LABELS/.test(e.code))) throw e;
+          return _redirect(res, "/admin/orders/" + enc + "?err=1");
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".order.shipment.label.void", outcome: "success", metadata: { id: id, label_id: req.params.labelId } });
+        _redirect(res, "/admin/orders/" + enc + "?label=1");
+      },
+    ));
   }
 
   // Compose requestLabel + markPurchased into one recorded label. The
@@ -1713,6 +1758,206 @@ function mount(router, deps) {
     });
   }
 
+  // ---- shipping labels (standalone back-office console) ---------------
+  //
+  // A cross-order view of the carrier-label store, separate from the
+  // per-shipment panel on the order detail. Three screens, each composing
+  // a labels-primitive read:
+  //   - /admin/shipping-labels         — a status-filtered list. The
+  //       primitive exposes a list read per backable status: `pending`
+  //       (pendingLabels) and `voided` (voidedInWindow over a date range).
+  //       There is no cross-order list for purchased/used labels — those
+  //       are reached from their order detail — so the filter offers the
+  //       two engine-backed views, defaulting to pending.
+  //   - /admin/shipping-labels/costs   — broker-spend report grouped by
+  //       broker + currency over a date range (costsByPeriod).
+  //   - /admin/shipping-labels/pending — the mint queue (pendingLabels,
+  //       capped at 200) the operator's broker worker drains.
+  // Mounted only when the labels primitive is wired. Every HTML handler
+  // parses its from/to/carrier query params defensively: a malformed value
+  // re-renders the page with a correction notice (never a 500). The bearer
+  // JSON contract returns the same composed payload.
+  if (shippingLabels) {
+    // Resolve a {from, to} epoch-ms window from the query string, accepting
+    // either raw epoch-ms (from/to — machine clients) or calendar dates
+    // (from-date/to-date — the browser date inputs). `to-date` is the
+    // inclusive end day, advanced to the next UTC midnight. Throws TypeError
+    // on a malformed value; defaults to the trailing 30 days. Mirrors the
+    // reports window resolver so both report surfaces parse identically.
+    function _labelWindow(url) {
+      var from = _parseEpochMs(url && url.searchParams.get("from"), "from");
+      var to   = _parseEpochMs(url && url.searchParams.get("to"),   "to");
+      if (from == null) from = _parseDateParam(url && url.searchParams.get("from-date"), "from");
+      if (to == null) {
+        var toDate = _parseDateParam(url && url.searchParams.get("to-date"), "to");
+        if (toDate != null) to = toDate + b.constants.TIME.days(1);
+      }
+      var now = Date.now();
+      return {
+        to:   to   == null ? now : to,
+        from: from == null ? (now - b.constants.TIME.days(30)) : from,
+      };
+    }
+
+    // The status filter on the standalone list — only the values the
+    // primitive exposes a cross-order list read for.
+    function _labelStatusParam(url) {
+      var raw = url && url.searchParams.get("status");
+      if (raw == null || raw === "") return "pending";
+      if (raw !== "pending" && raw !== "voided") {
+        throw new TypeError("admin: status must be one of pending, voided");
+      }
+      return raw;
+    }
+
+    // Optional carrier filter for the costs report. Validated against the
+    // primitive's frozen enum so a bad value is a notice, not a 500.
+    function _labelCarrierParam(url) {
+      var raw = url && url.searchParams.get("carrier");
+      if (raw == null || raw === "") return null;
+      if (shippingLabels.CARRIERS.indexOf(raw) === -1) {
+        throw new TypeError("admin: carrier must be one of " + shippingLabels.CARRIERS.join(", "));
+      }
+      return raw;
+    }
+
+    // Compose the list payload for the chosen status. `pending` drains the
+    // queue (limit 200, ignoring the window — a pending label has no
+    // purchased/voided timestamp to range on); `voided` ranges voided_at
+    // over the window.
+    async function _labelListPayload(status, win) {
+      if (status === "voided") {
+        var voided = await shippingLabels.voidedInWindow({ from: win.from, to: win.to });
+        return { status: "voided", from: win.from, to: win.to, labels: voided };
+      }
+      var pending = await shippingLabels.pendingLabels({ limit: MAX_LABEL_LIST_LIMIT });
+      return { status: "pending", from: win.from, to: win.to, labels: pending };
+    }
+
+    router.get("/admin/shipping-labels", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var status, win;
+        try { status = _labelStatusParam(url); win = _labelWindow(url); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        var payload;
+        try { payload = await _labelListPayload(status, win); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, payload);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var status = "pending", notice = null;
+        var win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
+        try { status = _labelStatusParam(url); win = _labelWindow(url); }
+        catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          notice = e.message.replace(/^admin:\s*/, "");
+        }
+        var payload;
+        try { payload = await _labelListPayload(status, win); }
+        catch (e2) {
+          if (!(e2 instanceof TypeError)) throw e2;
+          // A bad range that slipped past the param parse (primitive
+          // re-validates from < to) → fall back to the default window.
+          win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
+          notice = e2.message.replace(/^shipping-labels:\s*/, "");
+          payload = await _labelListPayload(status, win);
+        }
+        _sendHtml(res, 200, renderAdminShippingLabels({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          payload: payload, notice: notice,
+        }));
+      },
+    ));
+
+    router.get("/admin/shipping-labels/pending", _pageOrApi(true,
+      R(async function (req, res) {
+        var rows;
+        try { rows = await shippingLabels.pendingLabels({ limit: MAX_LABEL_LIST_LIMIT }); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, { limit: MAX_LABEL_LIST_LIMIT, labels: rows });
+      }),
+      async function (req, res) {
+        var rows = [], notice = null;
+        try { rows = await shippingLabels.pendingLabels({ limit: MAX_LABEL_LIST_LIMIT }); }
+        catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          notice = e.message.replace(/^shipping-labels:\s*/, "");
+        }
+        _sendHtml(res, 200, renderAdminShippingLabelsPending({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          labels: rows, notice: notice,
+        }));
+      },
+    ));
+
+    router.get("/admin/shipping-labels/costs", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var win, carrier;
+        try { win = _labelWindow(url); carrier = _labelCarrierParam(url); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        var report;
+        try { report = await _labelCostsReport(win, carrier); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        _json(res, 200, report);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var notice = null, carrier = null;
+        var win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
+        try { win = _labelWindow(url); carrier = _labelCarrierParam(url); }
+        catch (e) {
+          if (!(e instanceof TypeError)) throw e;
+          notice = e.message.replace(/^admin:\s*/, "");
+        }
+        var report;
+        try { report = await _labelCostsReport(win, carrier); }
+        catch (e2) {
+          if (!(e2 instanceof TypeError)) throw e2;
+          win = { to: Date.now(), from: Date.now() - b.constants.TIME.days(30) };
+          carrier = null;
+          notice = e2.message.replace(/^shipping-labels:\s*/, "");
+          report = await _labelCostsReport(win, carrier);
+        }
+        _sendHtml(res, 200, renderAdminShippingLabelCosts({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          report: report, carriers: shippingLabels.CARRIERS, notice: notice,
+        }));
+      },
+    ));
+  }
+
+  // Compose the broker-spend report: the per-(broker, currency) aggregate
+  // from costsByPeriod plus a per-currency rollup of the gross spend +
+  // label count across the window. `_strictMinorInt`-safe — the primitive
+  // already returns integer minor units; the rollup only sums them.
+  async function _labelCostsReport(win, carrier) {
+    var opts2 = { from: win.from, to: win.to };
+    if (carrier) opts2.carrier = carrier;
+    var rows = await shippingLabels.costsByPeriod(opts2);
+    var byCurrency = {};
+    for (var i = 0; i < rows.length; i += 1) {
+      var r = rows[i];
+      var cur = r.currency || "USD";
+      if (!byCurrency[cur]) byCurrency[cur] = { currency: cur, total_minor: 0, label_count: 0 };
+      // costsByPeriod coerces these to plain numbers already; treat them as
+      // integer minor units (admin never renders raw broker prose here).
+      byCurrency[cur].total_minor += _strictMinorInt(r.total_minor, "shippingLabels", "total_minor");
+      byCurrency[cur].label_count += _strictMinorInt(r.label_count, "shippingLabels", "label_count");
+    }
+    var totals = Object.keys(byCurrency).map(function (k) { return byCurrency[k]; });
+    totals.sort(function (a, c) { return a.currency < c.currency ? -1 : a.currency > c.currency ? 1 : 0; });
+    return {
+      from:     win.from,
+      to:       win.to,
+      carrier:  carrier || null,
+      by_broker: rows,
+      totals:    totals,
+    };
+  }
+
   // ---- split shipments (order-detail planner) -------------------------
   //
   // Splits one order into N parcels: ship some lines now, the rest later.
@@ -5894,6 +6139,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "tax",          href: "/admin/tax-rates",    label: "Tax",          requires: "taxRates" },
   { key: "tax-filings",  href: "/admin/tax-filings",  label: "Tax filings",  requires: "salesTaxFilings" },
   { key: "shipping",     href: "/admin/shipping",     label: "Shipping",     requires: "shippingZones" },
+  { key: "shipping-labels", href: "/admin/shipping-labels", label: "Shipping labels", requires: "shippingLabels" },
   { key: "pick-lists",   href: "/admin/pick-lists",   label: "Pick lists",   requires: "pickLists" },
   { key: "announcements", href: "/admin/announcements", label: "Announcements", requires: "announcementBar" },
   { key: "surveys",      href: "/admin/surveys",      label: "Surveys",      requires: "customerSurveys" },
@@ -6296,6 +6542,173 @@ function renderAdminReports(opts) {
   return _renderAdminShell(opts.shop_name, "Reports", body, "reports", opts.nav_available);
 }
 
+// A single shipping-label row for the standalone cross-order tables. Shows
+// carrier + service, tracking number, cost (via pricing.format from the
+// label's own minor units + currency), the broker it came from, its status
+// pill, and a link to the broker's label URL. Read-only — lifecycle actions
+// (mark used / void) live on the order detail where the shipment context is.
+function _shippingLabelRow(l) {
+  var costCell = (l.cost_minor != null && l.currency)
+    ? _htmlEscape(pricing.format(l.cost_minor, l.currency))
+    : "<span class=\"meta\">—</span>";
+  var trackCell = l.tracking_number
+    ? "<code class=\"order-id\">" + _htmlEscape(String(l.tracking_number)) + "</code>"
+    : "<span class=\"meta\">—</span>";
+  var urlCell = l.label_url
+    ? "<a class=\"order-id\" href=\"" + _htmlEscape(String(l.label_url)) + "\" rel=\"noopener nofollow\" target=\"_blank\">Open ↗</a>"
+    : "<span class=\"meta\">—</span>";
+  var viaCell = l.purchased_via
+    ? _htmlEscape(String(l.purchased_via))
+    : "<span class=\"meta\">—</span>";
+  return "<tr>" +
+    "<td>" + _htmlEscape(String(l.carrier)) + " <span class=\"meta\">" + _htmlEscape(String(l.service_level || "")) + "</span></td>" +
+    "<td>" + trackCell + "</td>" +
+    "<td class=\"num\">" + costCell + "</td>" +
+    "<td>" + viaCell + "</td>" +
+    "<td><span class=\"status-pill " + _htmlEscape(String(l.status)) + "\">" + _htmlEscape(String(l.status)) + "</span></td>" +
+    "<td>" + urlCell + "</td>" +
+    "<td>" + _htmlEscape(_fmtDate(l.created_at)) + "</td>" +
+  "</tr>";
+}
+
+// Sub-nav shared by the three standalone shipping-label screens — the
+// list, the broker-spend report, and the mint queue.
+function _shippingLabelSubnav(active) {
+  var tabs = [
+    ["list",    "/admin/shipping-labels",         "All labels"],
+    ["pending", "/admin/shipping-labels/pending", "Mint queue"],
+    ["costs",   "/admin/shipping-labels/costs",   "Broker spend"],
+  ];
+  return "<div class=\"order-filters\">" + tabs.map(function (t) {
+    return "<a class=\"chip" + (active === t[0] ? " chip--on" : "") + "\" href=\"" + t[1] + "\">" + _htmlEscape(t[2]) + "</a>";
+  }).join("") + "</div>";
+}
+
+// Standalone cross-order label list. The primitive exposes a list read for
+// two statuses — pending (the mint queue) and voided (over a date range) —
+// so the status filter offers those two. Purchased + used labels are
+// reached from their order's detail panel, not browsed cross-order. A date
+// range narrows the voided view (ignored for pending, which has no
+// purchased/voided timestamp to range on).
+function renderAdminShippingLabels(opts) {
+  opts = opts || {};
+  var payload = opts.payload || { status: "pending", labels: [], from: Date.now(), to: Date.now() };
+  var notice = opts.notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var labels = payload.labels || [];
+  var status = payload.status || "pending";
+
+  var statuses = [["pending", "Pending"], ["voided", "Voided"]];
+  var chips = "<div class=\"order-filters\">" + statuses.map(function (s) {
+    return "<a class=\"chip" + (status === s[0] ? " chip--on" : "") + "\" href=\"/admin/shipping-labels?status=" + encodeURIComponent(s[0]) + "\">" + _htmlEscape(s[1]) + "</a>";
+  }).join("") + "</div>";
+
+  // Date-range form only narrows the voided view (GET so the window lives in
+  // the URL). For pending it's still shown for consistency but the window is
+  // not applied.
+  var fromVal = _dateInputValue(payload.from);
+  var toVal   = _dateInputValue((payload.to || Date.now()) - b.constants.TIME.days(1));
+  var rangeForm =
+    "<form method=\"get\" action=\"/admin/shipping-labels\" class=\"order-filters\">" +
+      "<input type=\"hidden\" name=\"status\" value=\"" + _htmlEscape(status) + "\">" +
+      "<label class=\"form-field\"><span>From</span><input type=\"date\" name=\"from-date\" value=\"" + _htmlEscape(fromVal) + "\"></label>" +
+      "<label class=\"form-field\"><span>To</span><input type=\"date\" name=\"to-date\" value=\"" + _htmlEscape(toVal) + "\"></label>" +
+      "<button class=\"btn\" type=\"submit\">Apply</button>" +
+    "</form>";
+
+  var rows = labels.map(_shippingLabelRow).join("");
+  var table = labels.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Carrier</th><th scope=\"col\">Tracking</th><th scope=\"col\" class=\"num\">Cost</th><th scope=\"col\">Broker</th><th scope=\"col\">Status</th><th scope=\"col\">Label</th><th scope=\"col\">Created</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+    : "<p class=\"empty\">No " + _htmlEscape(status) + " labels" + (status === "voided" ? " in this window" : "") + ".</p>";
+
+  var body =
+    "<section><h2>Shipping labels</h2>" + notice +
+      _shippingLabelSubnav("list") +
+      chips +
+      (status === "voided" ? rangeForm : "") +
+      table +
+    "</section>";
+  return _renderAdminShell(opts.shop_name, "Shipping labels", body, "shipping-labels", opts.nav_available);
+}
+
+// The mint queue: pending labels awaiting a broker mint, oldest first. The
+// operator's broker worker drains this (requestLabel wrote each row;
+// markPurchased clears it). Read-only console view of the same queue.
+function renderAdminShippingLabelsPending(opts) {
+  opts = opts || {};
+  var labels = opts.labels || [];
+  var notice = opts.notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var rows = labels.map(_shippingLabelRow).join("");
+  var table = labels.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Carrier</th><th scope=\"col\">Tracking</th><th scope=\"col\" class=\"num\">Cost</th><th scope=\"col\">Broker</th><th scope=\"col\">Status</th><th scope=\"col\">Label</th><th scope=\"col\">Created</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+    : "<p class=\"empty\">No labels awaiting a broker mint.</p>";
+  var body =
+    "<section><h2>Shipping labels</h2>" + notice +
+      _shippingLabelSubnav("pending") +
+      "<p class=\"meta\">Pending labels awaiting a broker mint, oldest first (up to " + String(MAX_LABEL_LIST_LIMIT) + ").</p>" +
+      table +
+    "</section>";
+  return _renderAdminShell(opts.shop_name, "Shipping labels", body, "shipping-labels", opts.nav_available);
+}
+
+// Broker-spend report: gross label spend + label count grouped by broker +
+// currency over a date range, with an optional carrier filter and a
+// per-currency headline rollup. Money formats through the same pricing
+// helper the order + reports pages use.
+function renderAdminShippingLabelCosts(opts) {
+  opts = opts || {};
+  var report = opts.report || { from: Date.now(), to: Date.now(), by_broker: [], totals: [], carrier: null };
+  var carriers = opts.carriers || [];
+  var notice = opts.notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var fromVal = _dateInputValue(report.from);
+  var toVal   = _dateInputValue(report.to - b.constants.TIME.days(1));
+  var carrierOpts = "<option value=\"\">All carriers</option>" + carriers.map(function (c) {
+    return "<option value=\"" + _htmlEscape(c) + "\"" + (report.carrier === c ? " selected" : "") + ">" + _htmlEscape(c) + "</option>";
+  }).join("");
+  var rangeForm =
+    "<form method=\"get\" action=\"/admin/shipping-labels/costs\" class=\"order-filters\">" +
+      "<label class=\"form-field\"><span>From</span><input type=\"date\" name=\"from-date\" value=\"" + _htmlEscape(fromVal) + "\"></label>" +
+      "<label class=\"form-field\"><span>To</span><input type=\"date\" name=\"to-date\" value=\"" + _htmlEscape(toVal) + "\"></label>" +
+      "<label class=\"form-field\"><span>Carrier</span><select name=\"carrier\">" + carrierOpts + "</select></label>" +
+      "<button class=\"btn\" type=\"submit\">Apply</button>" +
+    "</form>";
+
+  // Per-currency headline cards — total gross spend + label count.
+  var totals = report.totals || [];
+  var statsBlock = totals.length
+    ? "<section><h2>Total spend</h2><div class=\"stat-grid\">" + totals.map(function (t) {
+        return _statCard("Spend (" + t.currency + ")", pricing.format(t.total_minor, t.currency)) +
+          _statCard("Labels (" + t.currency + ")", String(t.label_count));
+      }).join("") + "</div></section>"
+    : "<section><h2>Total spend</h2><p class=\"empty\">No labels purchased in this window.</p></section>";
+
+  var byBroker = report.by_broker || [];
+  var brokerRows = byBroker.length
+    ? byBroker.map(function (r) {
+        return "<tr>" +
+          "<td>" + _htmlEscape(String(r.purchased_via)) + "</td>" +
+          "<td>" + _htmlEscape(String(r.currency)) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(String(r.label_count)) + "</td>" +
+          "<td class=\"num\">" + _htmlEscape(pricing.format(r.total_minor, r.currency)) + "</td>" +
+        "</tr>";
+      }).join("")
+    : "<tr><td colspan=\"4\" class=\"empty\">No labels purchased in this window.</td></tr>";
+  var brokerBlock =
+    "<section><h2>By broker</h2><div class=\"panel\">" +
+      "<table><thead><tr><th scope=\"col\">Broker</th><th scope=\"col\">Currency</th><th scope=\"col\" class=\"num\">Labels</th><th scope=\"col\" class=\"num\">Spend</th></tr></thead><tbody>" + brokerRows + "</tbody></table>" +
+    "</div></section>";
+
+  var body =
+    "<section><h2>Shipping labels</h2>" + notice +
+      _shippingLabelSubnav("costs") +
+      "<p class=\"meta\">Window: " + _htmlEscape(_fmtDate(report.from)) + " → " + _htmlEscape(_fmtDate(report.to)) +
+        (report.carrier ? " · carrier " + _htmlEscape(String(report.carrier)) : "") + "</p>" +
+      rangeForm +
+    "</section>" +
+    statsBlock + brokerBlock;
+  return _renderAdminShell(opts.shop_name, "Shipping labels", body, "shipping-labels", opts.nav_available);
+}
+
 function renderAdminOrder(opts) {
   opts = opts || {};
   var o = opts.order;
@@ -6506,17 +6919,26 @@ function _orderLabelPanel(orderId, shipment, carriers, packageTypes, purchasedVi
     var urlCell = l.label_url
       ? "<a class=\"order-id\" href=\"" + _htmlEscape(String(l.label_url)) + "\" rel=\"noopener nofollow\" target=\"_blank\">Open ↗</a>"
       : "<span class=\"meta\">—</span>";
-    var usedForm = (l.status === "purchased")
-      ? "<form method=\"post\" action=\"/admin/orders/" + _htmlEscape(orderId) + "/labels/" + _htmlEscape(l.id) + "/used\" class=\"form-inline\">" +
-          "<button class=\"btn btn--ghost\" type=\"submit\">Mark used</button></form>"
-      : "<span class=\"meta\">—</span>";
+    // A purchased label can be marked used (handed to the carrier) OR voided
+    // (broker void, within the 30-day window). The void form carries a
+    // required reason input so the operator records WHY before the POST; the
+    // primitive refuses a blank/expired void with a 400 → notice.
+    var actionCell = "<span class=\"meta\">—</span>";
+    if (l.status === "purchased") {
+      actionCell =
+        "<form method=\"post\" action=\"/admin/orders/" + _htmlEscape(orderId) + "/labels/" + _htmlEscape(l.id) + "/used\" class=\"form-inline\">" +
+          "<button class=\"btn btn--ghost\" type=\"submit\">Mark used</button></form> " +
+        "<form method=\"post\" action=\"/admin/orders/" + _htmlEscape(orderId) + "/labels/" + _htmlEscape(l.id) + "/void\" class=\"form-inline\">" +
+          "<input type=\"text\" name=\"reason\" placeholder=\"Void reason\" maxlength=\"512\" aria-label=\"Void reason\" required>" +
+          "<button class=\"btn btn--danger\" type=\"submit\">Void</button></form>";
+    }
     return "<tr>" +
       "<td>" + _htmlEscape(String(l.carrier)) + " <span class=\"meta\">" + _htmlEscape(String(l.service_level || "")) + "</span></td>" +
       "<td>" + trackCell + "</td>" +
       "<td class=\"num\">" + costCell + "</td>" +
       "<td><span class=\"status-pill " + _htmlEscape(l.status) + "\">" + _htmlEscape(l.status) + "</span></td>" +
       "<td>" + urlCell + "</td>" +
-      "<td>" + usedForm + "</td>" +
+      "<td>" + actionCell + "</td>" +
     "</tr>";
   }).join("");
   var labelsTable = labels.length

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.4",
+  "version": "0.3.6",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.46",
-      "tag": "v0.13.46",
+      "version": "0.14.5",
+      "tag": "v0.14.5",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -13,7 +13,7 @@
         "server": "lib/vendor/blamejs/"
       },
       "bundler": "shallow git clone of release tag from github.com/blamejs/blamejs",
-      "bundledAt": "2026-05-29"
+      "bundledAt": "2026-05-30"
     }
   }
 }

package/lib/vendor/blamejs/CHANGELOG.md

@@ -6,6 +6,20 @@ Pre-1.0 the surface is intentionally evolving — every release may
 change something operators depend on. Read each entry before
 upgrading across more than a few patches at a time.
 
+## v0.14.x
+
+- v0.14.5 (2026-05-30) — **Finished cleaning up the mislabeled byte-literal lint suppressions, with no API or behavior changes.** A follow-up to the byte-literal lint tightening. The remaining suppression comments that named the byte-literal check on values that are not byte sizes — JSON-RPC error codes, HTTP status codes, octet ranges, day-in-milliseconds constants — are removed, keeping their explanatory text and any correctly-named companion suppression. Every byte-literal suppression that remains is now on genuine 1024-scale byte arithmetic. Source-comment hygiene only. **Changed:** *Remaining mislabeled byte-literal suppressions removed* — The byte-literal lint was previously a check on any multiple-of-8 integer, so suppression comments naming it were scattered across non-byte values. The last of those (in a handful of files, in mixed comment formats) are now removed — their explanatory text is retained as plain comments, and any correctly-named companion suppression is kept. The only byte-literal suppressions that remain are on genuine 1024-scale byte arithmetic. No change to any exported API, error code, wire format, or runtime behavior.
+
+- v0.14.4 (2026-05-30) — **Removed three pieces of dead code from the SAML, TLS, and JMAP surfaces; no API or behavior changes.** Cleanup of unreachable code. A reverse signature-algorithm lookup in the SAML verifier was never called — the actual verification path resolves the algorithm through the supported-signature table — so it is removed and a stale comment that referenced it is corrected. A leftover no-op placeholder in the TLS certificate re-encode path (a zero-length slice that was assigned and discarded) is removed, leaving the verbatim extension re-encode it sat next to. An unused JMAP well-known-path constant that existed only to be discarded is removed. None of this changes any exported API, error code, wire format, or runtime behavior. **Removed:** *Unreachable code in SAML, TLS, and JMAP* — Removed `_sigAlgFromUri` from the SAML module (a reverse alg lookup that was never called — the embedded XML-DSig verifier resolves the algorithm via the supported-signature table, and the redirect-binding path uses the forward `_sigAlgUrn`), a discarded zero-length-slice placeholder in the TLS certificate extension re-encode path, and an unused well-known-path constant in the JMAP server. Internal cleanup only — no change to any exported API, error code, wire format, or runtime behavior.
+
+- v0.14.3 (2026-05-30) — **A codebase check now ensures every lint-suppression marker names a real check, so a typo can't silently disable a guard.** Source files suppress an individual lint with an `// allow:<class>` comment. If the class is mistyped or stale, the comment suppresses nothing — the check it names does not exist — so the issue it was meant to explain ships unflagged. A new codebase check now verifies every `// allow:<class>` marker names a registered check class and fails if it does not, with the full set of valid classes maintained as an explicit registry. Two markers that named a non-kebab class were corrected as part of this. No runtime, API, or wire-format changes. **Detectors:** *Lint-suppression markers must name a registered check* — A new check flags any `// allow:<class>` suppression comment whose class is not one of the registered check classes — catching typos and stale markers (for example a marker that named a check which was later renamed) that would otherwise silently disable the guard they appear to explain. The valid classes are kept as an explicit registry, so adding a check with a new allow-class is a one-line registration. Source-comment hygiene only — no change to any exported API, error code, wire format, or runtime behavior.
+
+- v0.14.2 (2026-05-29) — **Internal lint hygiene: the byte-literal check now flags only genuine byte-scale arithmetic, with no API or behavior changes.** A no-behavior-change cleanup of the source tree's internal lint markers. The byte-literal lint previously flagged every integer that was a multiple of 8 — which is most numbers — so the source carried a large number of suppression comments on values that were not byte sizes at all (status codes, counts, lengths, radixes, opcodes). The lint now flags only 1024-scale byte arithmetic (the case the C.BYTES.kib/mib/gib helpers exist to replace), and the now-unnecessary suppression comments have been removed while keeping their explanatory text. Several lint-suppression markers that named a check that does not exist were also corrected. None of this changes any API, wire format, or runtime behavior. **Changed:** *Source-tree lint markers cleaned up* — The internal byte-literal lint was tightened to flag only genuine byte-scale (`* 1024`) arithmetic, and the suppression comments it previously required on non-byte integers were removed (their explanatory text is retained as plain comments). A handful of suppression markers that referenced a non-existent check were pointed at the correct one or removed. This is source-comment hygiene only — there is no change to any exported API, error code, wire format, or runtime behavior.
+
+- v0.14.1 (2026-05-29) — **Correctness fixes: JAR request-object typ enforcement, byte-faithful PGP multipart/signed, and SAML InResponseTo binding.** A set of correctness fixes across the auth, mail-crypto, TLS, and encoder surfaces. The most important: JWT-secured authorization requests (RFC 9101) now require the request object to carry the registered `oauth-authz-req+jwt` typ, closing a cross-JWT-confusion vector; the PGP multipart/signed wrapper is now assembled byte-faithfully so non-ASCII signed content can't be corrupted; and SAML response verification now returns the InResponseTo of the SubjectConfirmation that actually validated. Two of these change behavior — see Changed — and are bug fixes rather than new features. **Changed:** *JAR parsing rejects untyped request objects (breaking)* — Following the typ enforcement above, a request object whose header omits `typ` is now refused. An authorization server whose clients sign request objects without the `oauth-authz-req+jwt` typ must update those clients to set it. · *PGP sign() returns multipartSigned as a Buffer (breaking)* — `b.mail.crypto.pgp.sign(...).multipartSigned` is now a Buffer instead of a string. The OpenPGP signature covers the signed-part bytes exactly, and a JS-string round trip through latin1/utf8 could corrupt non-ASCII signed content and break verification, so the RFC 3156 multipart/signed wrapper is now assembled as bytes. Code that wrote the previous string to the wire works unchanged when it writes the Buffer; code that did string operations on the value should treat it as a Buffer (its `indexOf` / `toString` still work). **Fixed:** *SAML response verification binds InResponseTo to the validated confirmation* — `verifyResponse` returned the InResponseTo of the first SubjectConfirmationData in the assertion rather than of the SubjectConfirmation that actually passed bearer validation. When a response carried more than one SubjectConfirmation, the returned value could come from a non-validated confirmation. It is now the InResponseTo of the confirmation that validated. · *checkServerIdentity9525 emits the documented CN-fallback audit code* — A CN-only legacy certificate (a Common Name present, no subjectAltName) is now refused by the exported `b.network.tls.checkServerIdentity9525` with the distinct `tls/pkix-cn-fallback-refused` code its documentation promised, so audit logs can tell a CN-only certificate apart from one carrying neither a SAN nor a CN (which still yields `tls/pkix-san-required`). The accept/refuse outcome is unchanged — both are refused; only the audit granularity improved. · *OIDC back-channel logout / JARM no longer accept dead override parameters* — `verifyBackchannelLogoutToken` and `parseJarmResponse` passed `acceptedAlgs` / `jwksUri` / `maxClockSkewMs` through to the ID-token verifier, which ignored them and applied the configured (create()-time) values. The pass-throughs are removed so the code no longer reads as if those can be overridden per call; the configured trust anchor was — and remains — what applies. · *Queue lease failures are logged* — The consumer loop's lease-acquisition error path swallowed the backend error silently; it now logs at debug so a flapping backend that has not yet tripped the circuit breaker is visible. · *Protobuf and ASN.1 encoders reject out-of-range tags* — The protobuf tag encoder rejected nothing and would have emitted a wrong tag for field numbers at or above 2^28 (where the 32-bit shift overflows); the ASN.1 context-tag writers silently truncated tag numbers above 30 (which require the multi-byte high-tag-number form). Both now throw a RangeError rather than encode silently-wrong output. The values these encoders serve are well within range, so no current caller is affected. · *oid4vci proofAlgorithms default documented accurately* — The documented default proof-algorithm list now matches the code (`["ES256", "ES384", "EdDSA"]`); the doc previously omitted EdDSA, which the runtime has always accepted by default. **Security:** *JAR request objects must carry the registered typ (RFC 9101)* — `b.auth.jar.parse` now requires the request-object JWS header to carry `typ: "oauth-authz-req+jwt"` (with or without the `application/` prefix); a request object with an absent or different typ is refused with `auth-jar/bad-typ`. RFC 9101 §10.8 specifies this media type precisely to stop a JWT minted for another purpose (an ID token, an access token, a logout token) and signed by the same client key from being replayed as a request object. The existing `iss` / `aud` / `client_id` bindings already constrained that; this restores the explicit type check as well. This is stricter than before — see Changed.
+
+- v0.14.0 (2026-05-29) — **Operator-configurable header and field names across SSE, request-id, rate-limit, age-gate, AI-Act disclosure, GraphQL federation, and the HTTP cache.** This release makes operator-facing identifiers that were hardcoded configurable. The framework already let operators rename most names (CSRF cookie/field, cookie parser, i18n header/query/cookie, mTLS CA name, and so on); this closes the remaining gaps so a custom or framework-specific name is never frozen. Every new option defaults to the value emitted today, so upgrading changes no behavior — these are additive knobs. It also fixes a request-id asymmetry (the response header is now written on the same name the inbound id is read from) and wires an SSE proxy-buffering option whose escape hatch was documented but never implemented. **Added:** *Configurable cache-status header on the HTTP client* — The outbound HTTP client annotated every cached response with a hardcoded `x-blamejs-cache: HIT|MISS|STALE|REVALIDATED` header. `b.httpClient.cache.create` now takes `statusHeader` (default "x-blamejs-cache") — pass a custom name (e.g. "x-cache") to rename it, or null/false to suppress it entirely. The decision remains available programmatically on `res.cacheStatus`. · *Configurable rate-limit header names* — `b.middleware.rateLimit` emitted the de-facto `X-RateLimit-Limit` / `X-RateLimit-Remaining` headers (which are not RFC-pinned). It now accepts `headerPrefix` (default "X-RateLimit-") so operators can match the unprefixed IETF-draft `RateLimit-*` names or an upstream gateway's convention; the limit/remaining pair is always built from the same prefix. · *Configurable age-gate and AI-Act disclosure header names* — `b.middleware.ageGate` now takes `privacyPostureHeader` (default "X-Privacy-Posture"; null/false to suppress), and `b.middleware.aiActDisclosure` takes `headerPrefix` (default "AI-Act-") that prefixes the emitted Notice / Article / Policy headers. The EU AI Act mandates the disclosure, not the HTTP spelling, so operators matching a downstream convention can rename these. · *Configurable GraphQL-federation replay-nonce header* — `b.graphqlFederation.guardSdl` read the replay nonce from the Apollo-vendor `x-apollographql-router-nonce` header with no override. It now accepts `nonceHeader` (default unchanged) so an operator fronting the gateway with a non-Apollo router can point the replay check at their own header. · *SSE proxy-buffering opt-out* — `b.sse.create` and `b.middleware.sse` set `X-Accel-Buffering: no` (the nginx hint that disables proxy buffering). They now accept `proxyBuffer` (default true) — pass false when not behind nginx, or when buffering is controlled at the load balancer, to suppress the nginx-specific header. The opt-out was previously referenced in the documentation but not implemented. **Fixed:** *Request-id middleware reflects the configured header name* — `b.log.middleware` read the inbound request id from a configurable `headerName` but always wrote the response on the literal `X-Request-Id`. An operator who set a custom `headerName` (e.g. `X-Correlation-Id`) therefore read from one header and emitted another. The response is now written on the same configured name; the default remains `X-Request-Id`, so deployments that did not set `headerName` are unaffected.
+
 ## v0.13.x
 
 - v0.13.46 (2026-05-29) — **`createApp` now wires the documented security middleware ON by default — CSRF, CSP nonce, cookie parser, fetch-metadata, and body parser.** The README has long described a security middleware stack as "wired by createApp", but createApp only mounted request-ID, security-headers, and bot-guard by default — CSRF protection, the CSP nonce, the threat-aware cookie parser, the fetch-metadata guard, and the body parser were documented but not actually wired. This release closes that gap: createApp now mounts all of them by default, in dependency order (cookies, CSP nonce, fetch-metadata, then body parser, then CSRF last so it can read a body-field token). This is a behavior change — apps built with createApp now enforce CSRF on state-changing requests by default. Each layer is configurable via opts.middleware.<name> (operator cookie and field names flow straight through — nothing is hardcoded) or can be turned off with false, and disabling a security default now emits an app.middleware.disabled audit event. Every layer is idempotent: an operator who also mounts one of these inside opts.routes gets a no-op second mount rather than a double-apply. The default CSRF is a double-submit cookie that auto-skips requests carrying an Authorization header or no cookies at all, which are not CSRF-able, so token-authenticated API clients are not rejected. The README middleware list is now an accurate description of what createApp wires. **Added:** *Idempotent security middleware* — The cookie parser, CSP nonce, fetch-metadata, and CSRF middleware are now idempotent within a request: if one has already run (because createApp wired it and an operator also mounted it), the second instance is a no-op rather than re-parsing, re-generating a nonce, or issuing a second CSRF cookie. This lets an application compose its own middleware order on top of createApp's defaults without double-applying. The body parser already had this behavior. **Changed:** *createApp wires CSRF, CSP nonce, cookie parser, fetch-metadata, and body parser by default (breaking)* — Applications constructed with b.createApp now mount, in order: the threat-aware cookie parser, the CSP nonce generator, the fetch-metadata resource-isolation guard, the body parser (JSON / urlencoded / text / multipart), and CSRF protection — in addition to the request-ID, security-headers, and bot-guard layers already wired. The ordering guarantees CSRF runs after the body parser so a body-field token is available. This is a behavior change: state-changing requests (POST / PUT / DELETE / PATCH) that carry a session cookie are now CSRF-validated by default. Each layer is configured through opts.middleware.<name> (an object passes operator options straight through; cookie and field names are not hardcoded) or disabled with false. Operators who were mounting these middleware themselves inside opts.routes do not need to change anything — the second mount is now a no-op (see idempotency below). · *Default CSRF auto-skips token-authenticated and cookieless requests* — The CSRF middleware gains a skipStateless option (default false; createApp's default wiring sets it true). When on, token validation is skipped for requests that carry an Authorization header or no Cookie header at all — such requests are not CSRF-able, because CSRF abuses a victim's ambient cookie credential and these have none. The token is still issued on safe methods so a later cookie-authenticated browser flow works. Cross-site form CSRF is unaffected: the browser auto-sends the victim's cookies, so an attack request always carries a Cookie header and is validated. · *Disabling a default security middleware is audited* — Passing false for one of the security-on-by-default middleware (for example middleware: { csrf: false }) now emits an app.middleware.disabled audit event naming the middleware, so a weakened posture leaves a trace in the audit chain rather than being silent.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.46",
-  "createdAt": "2026-05-30T02:15:44.237Z",
+  "frameworkVersion": "0.14.5",
+  "createdAt": "2026-05-30T14:33:33.657Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/_test/crypto-fixtures.js

@@ -47,15 +47,15 @@ function mintLegacyEnvelope0xE1(plaintext, recipient) {
   var nonce = bCrypto.generateBytes(C.BYTES.bytes(24));
   // Legacy 0xE1 envelope header — 4 bytes: magic, kemId, cipherId, kdfId.
   var headerAad = Buffer.from([
-    0xE1,                                                                                            // allow:raw-byte-literal — legacy 0xE1 envelope magic byte
+    0xE1,                                                                                            // legacy 0xE1 envelope magic byte
     C.KEM_IDS.ML_KEM_1024_P384,
     C.CIPHER_IDS.XCHACHA20_POLY1305,
     C.KDF_IDS.SHAKE256,
   ]);
   var ct = xchacha20poly1305(key, nonce, headerAad).encrypt(Buffer.from(plaintext, "utf8"));
-  var kemCtLen = Buffer.alloc(2); kemCtLen.writeUInt16BE(kem.ciphertext.length);                     // allow:raw-byte-literal — 16-bit length-prefix field
+  var kemCtLen = Buffer.alloc(2); kemCtLen.writeUInt16BE(kem.ciphertext.length);                     // 16-bit length-prefix field
   var ecEphDer = ephEc.publicKey;
-  var ecEphLen = Buffer.alloc(2); ecEphLen.writeUInt16BE(ecEphDer.length);                           // allow:raw-byte-literal — 16-bit length-prefix field
+  var ecEphLen = Buffer.alloc(2); ecEphLen.writeUInt16BE(ecEphDer.length);                           // 16-bit length-prefix field
   return Buffer.concat([
     headerAad,
     kemCtLen, kem.ciphertext, ecEphLen, ecEphDer, nonce, Buffer.from(ct),