@blamejs/blamejs-shop 0.3.4 → 0.3.6

package/lib/vendor/blamejs/release-notes/v0.14.0.json

@@ -0,0 +1,43 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.0",
+  "date": "2026-05-29",
+  "headline": "Operator-configurable header and field names across SSE, request-id, rate-limit, age-gate, AI-Act disclosure, GraphQL federation, and the HTTP cache",
+  "summary": "This release makes operator-facing identifiers that were hardcoded configurable. The framework already let operators rename most names (CSRF cookie/field, cookie parser, i18n header/query/cookie, mTLS CA name, and so on); this closes the remaining gaps so a custom or framework-specific name is never frozen. Every new option defaults to the value emitted today, so upgrading changes no behavior — these are additive knobs. It also fixes a request-id asymmetry (the response header is now written on the same name the inbound id is read from) and wires an SSE proxy-buffering option whose escape hatch was documented but never implemented.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "Configurable cache-status header on the HTTP client",
+          "body": "The outbound HTTP client annotated every cached response with a hardcoded `x-blamejs-cache: HIT|MISS|STALE|REVALIDATED` header. `b.httpClient.cache.create` now takes `statusHeader` (default \"x-blamejs-cache\") — pass a custom name (e.g. \"x-cache\") to rename it, or null/false to suppress it entirely. The decision remains available programmatically on `res.cacheStatus`."
+        },
+        {
+          "title": "Configurable rate-limit header names",
+          "body": "`b.middleware.rateLimit` emitted the de-facto `X-RateLimit-Limit` / `X-RateLimit-Remaining` headers (which are not RFC-pinned). It now accepts `headerPrefix` (default \"X-RateLimit-\") so operators can match the unprefixed IETF-draft `RateLimit-*` names or an upstream gateway's convention; the limit/remaining pair is always built from the same prefix."
+        },
+        {
+          "title": "Configurable age-gate and AI-Act disclosure header names",
+          "body": "`b.middleware.ageGate` now takes `privacyPostureHeader` (default \"X-Privacy-Posture\"; null/false to suppress), and `b.middleware.aiActDisclosure` takes `headerPrefix` (default \"AI-Act-\") that prefixes the emitted Notice / Article / Policy headers. The EU AI Act mandates the disclosure, not the HTTP spelling, so operators matching a downstream convention can rename these."
+        },
+        {
+          "title": "Configurable GraphQL-federation replay-nonce header",
+          "body": "`b.graphqlFederation.guardSdl` read the replay nonce from the Apollo-vendor `x-apollographql-router-nonce` header with no override. It now accepts `nonceHeader` (default unchanged) so an operator fronting the gateway with a non-Apollo router can point the replay check at their own header."
+        },
+        {
+          "title": "SSE proxy-buffering opt-out",
+          "body": "`b.sse.create` and `b.middleware.sse` set `X-Accel-Buffering: no` (the nginx hint that disables proxy buffering). They now accept `proxyBuffer` (default true) — pass false when not behind nginx, or when buffering is controlled at the load balancer, to suppress the nginx-specific header. The opt-out was previously referenced in the documentation but not implemented."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Request-id middleware reflects the configured header name",
+          "body": "`b.log.middleware` read the inbound request id from a configurable `headerName` but always wrote the response on the literal `X-Request-Id`. An operator who set a custom `headerName` (e.g. `X-Correlation-Id`) therefore read from one header and emitted another. The response is now written on the same configured name; the default remains `X-Request-Id`, so deployments that did not set `headerName` are unaffected."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.14.1.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.1",
+  "date": "2026-05-29",
+  "headline": "Correctness fixes: JAR request-object typ enforcement, byte-faithful PGP multipart/signed, and SAML InResponseTo binding",
+  "summary": "A set of correctness fixes across the auth, mail-crypto, TLS, and encoder surfaces. The most important: JWT-secured authorization requests (RFC 9101) now require the request object to carry the registered `oauth-authz-req+jwt` typ, closing a cross-JWT-confusion vector; the PGP multipart/signed wrapper is now assembled byte-faithfully so non-ASCII signed content can't be corrupted; and SAML response verification now returns the InResponseTo of the SubjectConfirmation that actually validated. Two of these change behavior — see Changed — and are bug fixes rather than new features.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "JAR request objects must carry the registered typ (RFC 9101)",
+          "body": "`b.auth.jar.parse` now requires the request-object JWS header to carry `typ: \"oauth-authz-req+jwt\"` (with or without the `application/` prefix); a request object with an absent or different typ is refused with `auth-jar/bad-typ`. RFC 9101 §10.8 specifies this media type precisely to stop a JWT minted for another purpose (an ID token, an access token, a logout token) and signed by the same client key from being replayed as a request object. The existing `iss` / `aud` / `client_id` bindings already constrained that; this restores the explicit type check as well. This is stricter than before — see Changed."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "JAR parsing rejects untyped request objects (breaking)",
+          "body": "Following the typ enforcement above, a request object whose header omits `typ` is now refused. An authorization server whose clients sign request objects without the `oauth-authz-req+jwt` typ must update those clients to set it."
+        },
+        {
+          "title": "PGP sign() returns multipartSigned as a Buffer (breaking)",
+          "body": "`b.mail.crypto.pgp.sign(...).multipartSigned` is now a Buffer instead of a string. The OpenPGP signature covers the signed-part bytes exactly, and a JS-string round trip through latin1/utf8 could corrupt non-ASCII signed content and break verification, so the RFC 3156 multipart/signed wrapper is now assembled as bytes. Code that wrote the previous string to the wire works unchanged when it writes the Buffer; code that did string operations on the value should treat it as a Buffer (its `indexOf` / `toString` still work)."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "SAML response verification binds InResponseTo to the validated confirmation",
+          "body": "`verifyResponse` returned the InResponseTo of the first SubjectConfirmationData in the assertion rather than of the SubjectConfirmation that actually passed bearer validation. When a response carried more than one SubjectConfirmation, the returned value could come from a non-validated confirmation. It is now the InResponseTo of the confirmation that validated."
+        },
+        {
+          "title": "checkServerIdentity9525 emits the documented CN-fallback audit code",
+          "body": "A CN-only legacy certificate (a Common Name present, no subjectAltName) is now refused by the exported `b.network.tls.checkServerIdentity9525` with the distinct `tls/pkix-cn-fallback-refused` code its documentation promised, so audit logs can tell a CN-only certificate apart from one carrying neither a SAN nor a CN (which still yields `tls/pkix-san-required`). The accept/refuse outcome is unchanged — both are refused; only the audit granularity improved."
+        },
+        {
+          "title": "OIDC back-channel logout / JARM no longer accept dead override parameters",
+          "body": "`verifyBackchannelLogoutToken` and `parseJarmResponse` passed `acceptedAlgs` / `jwksUri` / `maxClockSkewMs` through to the ID-token verifier, which ignored them and applied the configured (create()-time) values. The pass-throughs are removed so the code no longer reads as if those can be overridden per call; the configured trust anchor was — and remains — what applies."
+        },
+        {
+          "title": "Queue lease failures are logged",
+          "body": "The consumer loop's lease-acquisition error path swallowed the backend error silently; it now logs at debug so a flapping backend that has not yet tripped the circuit breaker is visible."
+        },
+        {
+          "title": "Protobuf and ASN.1 encoders reject out-of-range tags",
+          "body": "The protobuf tag encoder rejected nothing and would have emitted a wrong tag for field numbers at or above 2^28 (where the 32-bit shift overflows); the ASN.1 context-tag writers silently truncated tag numbers above 30 (which require the multi-byte high-tag-number form). Both now throw a RangeError rather than encode silently-wrong output. The values these encoders serve are well within range, so no current caller is affected."
+        },
+        {
+          "title": "oid4vci proofAlgorithms default documented accurately",
+          "body": "The documented default proof-algorithm list now matches the code (`[\"ES256\", \"ES384\", \"EdDSA\"]`); the doc previously omitted EdDSA, which the runtime has always accepted by default."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.14.2.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.2",
+  "date": "2026-05-29",
+  "headline": "Internal lint hygiene: the byte-literal check now flags only genuine byte-scale arithmetic, with no API or behavior changes",
+  "summary": "A no-behavior-change cleanup of the source tree's internal lint markers. The byte-literal lint previously flagged every integer that was a multiple of 8 — which is most numbers — so the source carried a large number of suppression comments on values that were not byte sizes at all (status codes, counts, lengths, radixes, opcodes). The lint now flags only 1024-scale byte arithmetic (the case the C.BYTES.kib/mib/gib helpers exist to replace), and the now-unnecessary suppression comments have been removed while keeping their explanatory text. Several lint-suppression markers that named a check that does not exist were also corrected. None of this changes any API, wire format, or runtime behavior.",
+  "sections": [
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Source-tree lint markers cleaned up",
+          "body": "The internal byte-literal lint was tightened to flag only genuine byte-scale (`* 1024`) arithmetic, and the suppression comments it previously required on non-byte integers were removed (their explanatory text is retained as plain comments). A handful of suppression markers that referenced a non-existent check were pointed at the correct one or removed. This is source-comment hygiene only — there is no change to any exported API, error code, wire format, or runtime behavior."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.14.3.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.3",
+  "date": "2026-05-30",
+  "headline": "A codebase check now ensures every lint-suppression marker names a real check, so a typo can't silently disable a guard",
+  "summary": "Source files suppress an individual lint with an `// allow:<class>` comment. If the class is mistyped or stale, the comment suppresses nothing — the check it names does not exist — so the issue it was meant to explain ships unflagged. A new codebase check now verifies every `// allow:<class>` marker names a registered check class and fails if it does not, with the full set of valid classes maintained as an explicit registry. Two markers that named a non-kebab class were corrected as part of this. No runtime, API, or wire-format changes.",
+  "sections": [
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Lint-suppression markers must name a registered check",
+          "body": "A new check flags any `// allow:<class>` suppression comment whose class is not one of the registered check classes — catching typos and stale markers (for example a marker that named a check which was later renamed) that would otherwise silently disable the guard they appear to explain. The valid classes are kept as an explicit registry, so adding a check with a new allow-class is a one-line registration. Source-comment hygiene only — no change to any exported API, error code, wire format, or runtime behavior."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.14.4.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.4",
+  "date": "2026-05-30",
+  "headline": "Removed three pieces of dead code from the SAML, TLS, and JMAP surfaces; no API or behavior changes",
+  "summary": "Cleanup of unreachable code. A reverse signature-algorithm lookup in the SAML verifier was never called — the actual verification path resolves the algorithm through the supported-signature table — so it is removed and a stale comment that referenced it is corrected. A leftover no-op placeholder in the TLS certificate re-encode path (a zero-length slice that was assigned and discarded) is removed, leaving the verbatim extension re-encode it sat next to. An unused JMAP well-known-path constant that existed only to be discarded is removed. None of this changes any exported API, error code, wire format, or runtime behavior.",
+  "sections": [
+    {
+      "heading": "Removed",
+      "items": [
+        {
+          "title": "Unreachable code in SAML, TLS, and JMAP",
+          "body": "Removed `_sigAlgFromUri` from the SAML module (a reverse alg lookup that was never called — the embedded XML-DSig verifier resolves the algorithm via the supported-signature table, and the redirect-binding path uses the forward `_sigAlgUrn`), a discarded zero-length-slice placeholder in the TLS certificate extension re-encode path, and an unused well-known-path constant in the JMAP server. Internal cleanup only — no change to any exported API, error code, wire format, or runtime behavior."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.14.5.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.5",
+  "date": "2026-05-30",
+  "headline": "Finished cleaning up the mislabeled byte-literal lint suppressions, with no API or behavior changes",
+  "summary": "A follow-up to the byte-literal lint tightening. The remaining suppression comments that named the byte-literal check on values that are not byte sizes — JSON-RPC error codes, HTTP status codes, octet ranges, day-in-milliseconds constants — are removed, keeping their explanatory text and any correctly-named companion suppression. Every byte-literal suppression that remains is now on genuine 1024-scale byte arithmetic. Source-comment hygiene only.",
+  "sections": [
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Remaining mislabeled byte-literal suppressions removed",
+          "body": "The byte-literal lint was previously a check on any multiple-of-8 integer, so suppression comments naming it were scattered across non-byte values. The last of those (in a handful of files, in mixed comment formats) are now removed — their explanatory text is retained as plain comments, and any correctly-named companion suppression is kept. The only byte-literal suppressions that remain are on genuine 1024-scale byte arithmetic. No change to any exported API, error code, wire format, or runtime behavior."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/00-primitives.js

@@ -12563,6 +12563,21 @@ async function testLogMiddlewareSetsRequestId() {
     mw(req3, res3, function () { t.log.info("during req3"); resolve(); });
   });
   check("middleware strips CRLF from inbound id",   req3.id === "evil");
+
+  // Custom headerName: the response is written on the SAME configured
+  // header the inbound id is read from (read/write symmetry).
+  var customMw = t.log.middleware({ headerName: "X-Correlation-Id" });
+  var setHeaderCalls4 = [];
+  var req4 = { headers: { "x-correlation-id": "corr-123" } };
+  var res4 = { setHeader: function (k, v) { setHeaderCalls4.push([k, v]); } };
+  await new Promise(function (resolve) {
+    customMw(req4, res4, function () { resolve(); });
+  });
+  check("custom headerName reads inbound id",        req4.id === "corr-123");
+  check("custom headerName writes the same header",
+        setHeaderCalls4.length === 1 &&
+        setHeaderCalls4[0][0] === "X-Correlation-Id" &&
+        setHeaderCalls4[0][1] === "corr-123");
 }
 
 function testLogRedactsExtras() {

package/lib/vendor/blamejs/test/layer-0-primitives/age-gate.test.js

@@ -32,6 +32,28 @@ function _mockRes() {
   ag(_mockReq({ user: { age: 12 } }), belowRes, function () {});
   check("below-threshold sets X-Privacy-Posture", belowRes._captured.headers["X-Privacy-Posture"] === "below-threshold");
 
+  // privacyPostureHeader override + suppression
+  var customHdr = b.middleware.ageGate({
+    audit: false,
+    getAge:               function (req) { return req.user && req.user.age; },
+    consentRequired:      18,
+    privacyPostureHeader: "X-Age-Band",
+  });
+  var customRes = _mockRes();
+  customHdr(_mockReq({ user: { age: 12 } }), customRes, function () {});
+  check("custom privacyPostureHeader used", customRes._captured.headers["X-Age-Band"] === "below-threshold");
+  check("custom privacyPostureHeader replaces default", customRes._captured.headers["X-Privacy-Posture"] === undefined);
+
+  var suppressed = b.middleware.ageGate({
+    audit: false,
+    getAge:               function (req) { return req.user && req.user.age; },
+    consentRequired:      18,
+    privacyPostureHeader: false,
+  });
+  var suppressedRes = _mockRes();
+  suppressed(_mockReq({ user: { age: 12 } }), suppressedRes, function () {});
+  check("privacyPostureHeader:false suppresses the header", suppressedRes._captured.headers["X-Privacy-Posture"] === undefined);
+
   // requireAge gate
   var hardGate = b.middleware.ageGate({
     audit: false,

package/lib/vendor/blamejs/test/layer-0-primitives/auth-jar.test.js

@@ -135,12 +135,41 @@ async function testValidation() {
   check("parse: missing algorithms refused (verifyExternal — no alg defaults)", noAlg !== null);
 }
 
+// RFC 9101 §10.8 — the request object MUST be typed so a same-client JWT
+// minted for another purpose can't be replayed as a request object.
+async function testTypEnforcement() {
+  function _withTyp(typ) {
+    var payload = {
+      iss: CLIENT, aud: AS, client_id: CLIENT, response_type: "code",
+      redirect_uri: "https://app.example.com/cb",
+      iat: _nowSec(), exp: _nowSec() + 120,
+    };
+    var header = { alg: "RS256", kid: "c1" };
+    if (typ !== undefined) header.typ = typ;
+    return _signRs256(KEYS.privateKey, header, payload);
+  }
+  var okBare = await b.auth.jar.parse(_withTyp("oauth-authz-req+jwt"), _parseOpts());
+  check("parse: typ 'oauth-authz-req+jwt' accepted", okBare.params.response_type === "code");
+  var okPrefixed = await b.auth.jar.parse(_withTyp("application/oauth-authz-req+jwt"), _parseOpts());
+  check("parse: typ 'application/oauth-authz-req+jwt' accepted", okPrefixed.params.response_type === "code");
+
+  var eWrong = null;
+  try { await b.auth.jar.parse(_withTyp("JWT"), _parseOpts()); } catch (e) { eWrong = e; }
+  check("parse: wrong typ refused (cross-JWT confusion, RFC 9101 §10.8)",
+    eWrong && eWrong.code === "auth-jar/bad-typ");
+
+  var eAbsent = null;
+  try { await b.auth.jar.parse(_withTyp(undefined), _parseOpts()); } catch (e) { eAbsent = e; }
+  check("parse: absent typ refused (strict)", eAbsent && eAbsent.code === "auth-jar/bad-typ");
+}
+
 async function run() {
   await testRoundTrip();
   await testAntiNesting();
   await testClientIdBinding();
   await testAlgConfusionDelegated();
   await testValidation();
+  await testTypEnforcement();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -279,15 +279,105 @@ function _report(label, matches) {
 // Adding a marker at a violation line allowlists that one specific
 // occurrence; the reason follows the marker on the same comment line.
 
+// Every `// allow:<class>` suppression marker must name a REGISTERED detector
+// allow-class. A typo'd or stale class (e.g. the historical `setinterval-unref`
+// when the real check is `timer-no-unref`, or `protocol-constant` which names
+// no detector at all) suppresses NOTHING — the detector it claims to silence
+// does not exist — so the underlying violation it was meant to explain ships
+// unflagged. When you add a detector with a new allow-class, register it here.
+var VALID_ALLOW_CLASSES = {
+  "ai-disclosure-on-request-without-requested-gate": 1,
+  "archive-gz-without-safedecompress": 1,
+  "archive-wrap-partial-recipient": 1,
+  "backup-adapter-storage-without-posture-check": 1,
+  "bare-canonicalize-walk": 1,
+  "bare-error-throw": 1,
+  "bare-json-parse": 1,
+  "bare-split-on-quoted-header": 1,
+  "console-direct": 1,
+  "duplicate-regex": 1,
+  "dynamic-regex": 1,
+  "dynamic-require": 1,
+  "from-base64url-untrapped": 1,
+  "fs-path-from-operator-identifier-without-traversal-refusal": 1,
+  "gitleaks-entropy": 1,
+  "handrolled-buffer-collect": 1,
+  "handrolled-debounce": 1,
+  "hostname-compare-trailing-dot": 1,
+  "inline-numeric-bounds-cascade": 1,
+  "inline-require": 1,
+  "inline-require-non-empty-string-validation": 1,
+  "internal-binding-in-prose": 1,
+  "list-without-pagination": 1,
+  "math-random-noncrypto": 1,
+  "no-number-money-arithmetic": 1,
+  "numeric-opt-Infinity": 1,
+  "numeric-opt-no-bounds-check": 1,
+  "process-exit": 1,
+  "raw-byte-literal": 1,
+  "raw-hash-compare": 1,
+  "raw-new-url": 1,
+  "raw-outbound-http": 1,
+  "raw-process-env": 1,
+  "raw-randombytes-token": 1,
+  "raw-time-literal": 1,
+  "raw-timing-safe-equal": 1,
+  "regex-no-length-cap": 1,
+  "seal-without-aad": 1,
+  "silent-catch": 1,
+  "slsa-framework-action-not-sha-pinned": 1,
+  "timer-no-unref": 1,
+  "wildcard-suffix-match-without-single-label-check": 1,
+};
+
+function testNoOrphanAllowClass() {
+  // scanScope: lib + test (every shipped + test source).
+  var files = _libFiles().concat(_testFiles());
+  var bad = [];
+  var re = /\ballow:([a-z][a-zA-Z0-9-]*)/g;
+  for (var fi = 0; fi < files.length; fi++) {
+    var rel = _relPath(files[fi]);
+    // Skip THIS file: it holds the marker machinery + the registry itself,
+    // where `allow:` appears in regexes and the VALID_ALLOW_CLASSES keys.
+    if (rel === "test/layer-0-primitives/codebase-patterns.test.js") continue;
+    var content;
+    try { content = fs.readFileSync(files[fi], "utf8"); }
+    catch (_e) { continue; }
+    var lines = content.split(/\r?\n/);
+    for (var li = 0; li < lines.length; li++) {
+      // Only inspect the `//` line-comment portion — markers are always
+      // comments, never string literals.
+      var hashIdx = lines[li].indexOf("//");
+      if (hashIdx === -1) continue;
+      var comment = lines[li].slice(hashIdx);
+      var m;
+      re.lastIndex = 0;
+      while ((m = re.exec(comment)) !== null) {
+        var cls = m[1];
+        if (!Object.prototype.hasOwnProperty.call(VALID_ALLOW_CLASSES, cls)) {
+          bad.push({
+            file:    rel,
+            line:    li + 1,
+            content: "unregistered allow-class '" + cls + "' — names no detector " +
+                     "(fix the typo, or register it in VALID_ALLOW_CLASSES)",
+          });
+        }
+      }
+    }
+  }
+  _report("every // allow:<class> marker names a registered detector class", bad);
+}
+
 function testNoRawByteLiterals() {
   // class: raw-byte-literal
-  // Systemic detection: any integer literal `n >= 8 && n % 8 === 0` is
-  // a byte-shape candidate (8-bit alignment is the universal byte unit).
-  // Use C.BYTES.kib / mib / gib (n) so the framework's byte math has a
-  // single source of truth.
-  // Strings, regex literals, and hex constants are excluded. HTTP
-  // status comparisons, year literals (which can also be multiples of
-  // 8), and lines already routed through C.BYTES.* are skipped.
+  // Byte-SCALE arithmetic — `n * 1024` (KiB), `* 1024 * 1024` (MiB),
+  // `* 1024 * 1024 * 1024` (GiB) — must route through C.BYTES.kib / mib /
+  // gib(n) so the framework's byte math has a single source of truth.
+  // That 1024-scale is exactly what the C.BYTES helpers replace; a bare
+  // multiple-of-8 in any other context (an HTTP status, a radix, a count,
+  // a length, an opcode, an octet, a field width …) is NOT a byte size and
+  // is deliberately NOT flagged. Strings, regex, hex, and C.BYTES-wrapped
+  // lines are excluded.
   var files = _libFiles();
   var bad = [];
   for (var fi = 0; fi < files.length; fi++) {
@@ -312,6 +402,11 @@ function testNoRawByteLiterals() {
       // byte literal (`C.BYTES.mib(64)`, `C.TIME.seconds(8)`) and the
       // wrapping primitive is the single source of truth.
       if (/\bC\.(BYTES|TIME)\.\w+\(/.test(stripped)) continue;
+      // NARROWED: only 1024-scale byte arithmetic is a real byte size that
+      // C.BYTES.kib / mib / gib replaces. Skip every line that is not
+      // byte-scale `* 1024` math — a bare multiple-of-8 elsewhere is not a
+      // byte literal and no longer needs a marker.
+      if (!/\*\s*1024\b/.test(stripped)) continue;
       // Skip lines whose left-hand side explicitly names a non-byte
       // unit. Match the unit token at any position in a SCREAMING_SNAKE
       // identifier (start, middle, or end). Examples:
@@ -383,8 +478,8 @@ function testNoRawByteLiterals() {
     }
   }
   bad = _filterMarkers(bad, "raw-byte-literal");
-  _report("no raw byte-shaped literals (n >= 8 && n % 8 === 0; use " +
-          "C.BYTES.kib / mib / gib or name as protocol constant)",
+  _report("no raw byte-scale literals (1024-scale `* 1024` arithmetic; " +
+          "use C.BYTES.kib / mib / gib)",
     bad);
 }
 
@@ -10380,6 +10475,7 @@ function testSafeGuardHasMustComposeDetector() {
 }
 
 async function run() {
+  testNoOrphanAllowClass();
   testNoRawByteLiterals();
   testNoRawTimeLiterals();
   testNumericOptsValidate();

package/lib/vendor/blamejs/test/layer-0-primitives/compliance-ai-act.test.js

@@ -374,6 +374,21 @@ function run() {
   res4.writeHead(404, {});
   check("middleware: no inject on 4xx",                  res4._headers["AI-Act-Notice"] == null);
 
+  // headerPrefix override — the disclosure headers carry a custom prefix
+  var mwPfx = b.middleware.aiActDisclosure({
+    kind:         "ai-interaction",
+    policyUri:    "https://myco.example.com/ai-policy",
+    headerPrefix: "X-AI-",
+    audit:        false,
+  });
+  var req5 = { headers: {}, url: "/pfx" };
+  var res5 = _mockRes();
+  mwPfx(req5, res5, function () {});
+  res5.writeHead(200, {});
+  check("middleware: custom headerPrefix on Notice",     res5._headers["X-AI-Notice"] === "ai-interaction");
+  check("middleware: custom headerPrefix on Article",    res5._headers["X-AI-Article"] === "Art. 50(1)");
+  check("middleware: custom headerPrefix replaces default", res5._headers["AI-Act-Notice"] == null);
+
   // ---- expanded prohibited classifier ----
   var hits7 = aiAct.prohibited.classify({
     purpose: "predictive-policing", usesProfileOnly: true,

package/lib/vendor/blamejs/test/layer-0-primitives/graphql-federation.test.js

@@ -27,6 +27,16 @@ async function run() {
 
   var pub = b.graphqlFederation.guardSdl({ publicSchemaOk: true });
   check("guardSdl: public schema", typeof pub === "function");
+
+  // nonceHeader override — the replay nonce can be read from a custom
+  // request header (not just the Apollo-vendor default), for operators
+  // fronting the gateway with a non-Apollo router.
+  var withNonce = b.graphqlFederation.guardSdl({
+    routerToken: "a".repeat(64),
+    nonceStore:  { has: function () { return false; }, remember: function () {} },
+    nonceHeader: "x-my-nonce",
+  });
+  check("guardSdl: accepts custom nonceHeader", typeof withNonce === "function");
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/http-client-cache.test.js

@@ -98,6 +98,18 @@ function testCreateBadOpts() {
   try { b.httpClient.cache.memoryStore({ evictionPolicy: "fifo" }); }
   catch (_e) { threw = true; }
   check("memoryStore: throws on unknown evictionPolicy", threw);
+
+  // statusHeader: default / custom / suppress / bad
+  check("cache.create: default statusHeader is x-blamejs-cache",
+        b.httpClient.cache.create({ store: _newCache().store }).statusHeader === "x-blamejs-cache");
+  check("cache.create: custom statusHeader honored",
+        b.httpClient.cache.create({ store: _newCache().store, statusHeader: "X-Cache" }).statusHeader === "x-cache");
+  check("cache.create: statusHeader null suppresses",
+        b.httpClient.cache.create({ store: _newCache().store, statusHeader: null }).statusHeader === null);
+  threw = false;
+  try { b.httpClient.cache.create({ store: _newCache().store, statusHeader: 123 }); }
+  catch (_e) { threw = true; }
+  check("cache.create: throws on non-string statusHeader", threw);
 }
 
 // ---- Hit / miss / store ---------------------------------------------

package/lib/vendor/blamejs/test/layer-0-primitives/mail-crypto-pgp.test.js

@@ -116,6 +116,13 @@ function testPgpEd25519RoundTrip() {
   check("ed25519 multipart wrapper present",  rv.multipartSigned.indexOf("multipart/signed") !== -1);
   check("ed25519 multipart protocol is pgp",  rv.multipartSigned.indexOf('protocol="application/pgp-signature"') !== -1);
   check("ed25519 micalg is pgp-sha512",       rv.multipartSigned.indexOf('micalg="pgp-sha512"') !== -1);
+  check("ed25519 multipartSigned is a Buffer", Buffer.isBuffer(rv.multipartSigned));
+  // Byte-fidelity: a UTF-8 multibyte signed part must appear verbatim in the
+  // wrapper (a latin1 string round-trip would corrupt it and break the sig).
+  var utf8Part = Buffer.from("Subject: éè 中文\r\n\r\nbody\r\n", "utf8");
+  var rvU = pgp.sign({ message: utf8Part, privateKeyPem: kp.privateKey, creationTime: t0 });
+  check("ed25519 multipartSigned preserves UTF-8 signed bytes verbatim",
+        rvU.multipartSigned.indexOf(utf8Part) !== -1);
 
   var verify = pgp.verify({
     message:      message,

package/lib/vendor/blamejs/test/layer-0-primitives/network-tls.test.js

@@ -276,13 +276,19 @@ function testPkixSanRequiredWhenAbsent() {
 }
 
 function testPkixCnFallbackRefused() {
-  // Legacy CN-only cert (no SAN, but has CN) -> distinct code.
+  // Legacy CN-only cert (no SAN, but has CN) -> distinct CN-fallback code,
+  // emitted by the exported drop-in itself (RFC 9525 §6.4.4; matches the
+  // @primitive doc which promises operators can grep the distinct shape).
   var err = b.network.tls.checkServerIdentity9525("foo.example.com",
     _cert(undefined, "foo.example.com"));
-  check("CN-only cert refuses with tls/pkix-san-required (CN-fallback inferred)",
-        err && err.code === "tls/pkix-san-required");
-  // The internal _checkServerIdentityStrict surfaces the more specific
-  // CN-fallback-refused code:
+  check("CN-only cert refuses with tls/pkix-cn-fallback-refused",
+        err && err.code === "tls/pkix-cn-fallback-refused");
+  // No SAN AND no CN still falls through to the generic san-required code.
+  var sanErr = b.network.tls.checkServerIdentity9525("foo.example.com",
+    _cert(undefined));
+  check("no-SAN no-CN cert still refuses with tls/pkix-san-required",
+        sanErr && sanErr.code === "tls/pkix-san-required");
+  // The internal _checkServerIdentityStrict surfaces the same code:
   var strictErr = b.network.tls._checkServerIdentityStrict("foo.example.com",
     _cert(undefined, "foo.example.com"));
   check("internal strict combiner surfaces tls/pkix-cn-fallback-refused",

package/lib/vendor/blamejs/test/layer-0-primitives/rate-limit-registry.test.js

@@ -37,6 +37,40 @@ async function run() {
   check("instances() entries expose .resetAll",
         typeof mwA.resetAll === "function");
 
+  // headerPrefix: the X-RateLimit-* response header names are configurable
+  // (default "X-RateLimit-", or e.g. the unprefixed IETF-draft "RateLimit-").
+  function _mkRes() {
+    var h = {};
+    return { _h: h, setHeader: function (k, v) { h[k] = v; }, writeHead: function () {}, end: function () {} };
+  }
+  function _runRl(mw, key) {
+    return new Promise(function (resolve) {
+      var res = _mkRes();
+      mw({ headers: {}, url: "/", method: "GET", socket: { remoteAddress: "127.0.0.1" } },
+         res, function () { resolve(res); });
+    });
+  }
+  var rlDefault = b.middleware.rateLimit({
+    backend: "memory", burst: 5, refillPerSecond: 1, keyFn: function () { return "hp-d"; },
+  });
+  var rlDefaultRes = await _runRl(rlDefault);
+  check("rateLimit default emits X-RateLimit-Limit",
+        rlDefaultRes._h["X-RateLimit-Limit"] !== undefined);
+  var rlCustom = b.middleware.rateLimit({
+    backend: "memory", burst: 5, refillPerSecond: 1, headerPrefix: "RateLimit-",
+    keyFn: function () { return "hp-c"; },
+  });
+  var rlCustomRes = await _runRl(rlCustom);
+  check("rateLimit custom headerPrefix on limit",
+        rlCustomRes._h["RateLimit-Limit"] !== undefined);
+  check("rateLimit custom headerPrefix on remaining",
+        rlCustomRes._h["RateLimit-Remaining"] !== undefined);
+  check("rateLimit custom headerPrefix replaces default",
+        rlCustomRes._h["X-RateLimit-Limit"] === undefined);
+  // Deregister so the registry-count assertions below stay exact.
+  rlDefault.close();
+  rlCustom.close();
+
   // Seed each backend so resetAll has observable state to flush.
   // Drive .take() through the middleware function via a fake req/res.
   var fakeReq = { socket: { remoteAddress: "1.2.3.4" }, method: "GET", url: "/" };

package/lib/vendor/blamejs/test/layer-0-primitives/sse.test.js

@@ -118,6 +118,18 @@ async function run() {
         /data: plain\n\n/.test(captured.body));
   check("sse: handler ran fully",         sent.length === 2);
   check("sse: stream closed",             captured.ended === true);
+  check("sse: default sets X-Accel-Buffering: no",
+        captured.headers["X-Accel-Buffering"] === "no");
+
+  // ---- proxyBuffer: false suppresses the nginx hint ----
+  var mwNB = b.middleware.sse(async function (channel) {
+    channel.send({ data: "x" });
+    channel.close();
+  }, { heartbeatMs: false, proxyBuffer: false });
+  var resNB = _mockRes();
+  await mwNB(_mockReq(), resNB);
+  check("sse: proxyBuffer:false suppresses X-Accel-Buffering",
+        resNB._captured().headers["X-Accel-Buffering"] === undefined);
 
   // ---- onAbort runs on res close ----
   var aborted = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {

package/lib/vendor/blamejs/release-notes/v0.13.0.json

@@ -1,22 +0,0 @@
-{
-  "$schema": "../scripts/release-notes-schema.json",
-  "version": "0.13.0",
-  "date": "2026-05-26",
-  "headline": "`b.crypto.oprf` — RFC 9497 Oblivious PRFs",
-  "summary": "Compute F(serverKey, input) without the server learning the input and without the client learning the key — the Oblivious PRF primitive behind password hardening (the server peppers a password it never sees), private set intersection, and Privacy Pass. b.crypto.oprf.suite(name) returns an RFC 9497 ciphersuite — ristretto255-sha512, p256-sha256, p384-sha384, or p521-sha512 — each exposing the base oprf mode and the verifiable voprf mode (a DLEQ proof lets the client confirm the server used the key committed in its public key). The client blinds its input, the server blind-evaluates with its secret key, and the client finalizes by un-blinding and hashing; because un-blinding cancels the blind, the output depends only on key and input. Validated byte-for-byte against the RFC 9497 Appendix-A test vectors. Group and hash-to-curve operations come from the newly vendored @noble/curves (Paul Miller, MIT) — the same maintainer as the framework's existing vendored @noble/post-quantum and @noble/ciphers, with no added npm runtime dependency.",
-  "sections": [
-    {
-      "heading": "Added",
-      "items": [
-        {
-          "title": "`b.crypto.oprf` — RFC 9497 OPRF / VOPRF",
-          "body": "`suite(name)` returns `{ name, oprf, voprf }` for one of the four RFC 9497 ciphersuites (ristretto255-SHA512 / P-256-SHA256 / P-384-SHA384 / P-521-SHA512). The `oprf` (base) mode provides `deriveKeyPair` / `generateKeyPair` / `blind` / `blindEvaluate` / `finalize` / `evaluate`; `voprf` (verifiable) adds a DLEQ proof so the client can prove the server used the committed key. Use it for password hardening, private set intersection, and OPRF-based tokens. Verified against the RFC 9497 Appendix-A vectors. The partially-oblivious `poprf` mode is not yet exposed (the vendored `@noble/curves` does not implement it) and will follow upstream."
-        },
-        {
-          "title": "Vendored `@noble/curves`",
-          "body": "`@noble/curves` 2.2.0 (Paul Miller, MIT) is vendored under `lib/vendor/` (no npm runtime dependency), supplying the ristretto255 / NIST-curve group and hash-to-curve operations behind `b.crypto.oprf`. It joins the existing vendored `@noble/post-quantum` and `@noble/ciphers` from the same maintainer; tracked in the SBOM and the vendor-currency gate."
-        }
-      ]
-    }
-  ]
-}