@blamejs/blamejs-shop 0.3.42 → 0.3.44

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.42",
+  "version": "0.3.44",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/order-ratings.js

@@ -455,6 +455,41 @@ function create(opts) {
     return _topRatings(input, "topNegativeRatings", "negative");
   }
 
+  // ---- listFlagged -----------------------------------------------------
+
+  // The moderation queue: every rating whose comment an operator has
+  // flagged, most-recent-first, backed by the (comment_flagged,
+  // occurred_at) index. Unlike topNegativeRatings (score-ordered, capped
+  // at MAX_TOP_LIMIT), this surfaces ALL flagged comments regardless of
+  // their score — so a flagged comment on an otherwise high rating is
+  // never hidden behind the score cap. The from/to window is optional and
+  // applied only when supplied; the row count is capped by `limit`.
+  async function listFlagged(input) {
+    input = (input && typeof input === "object") ? input : {};
+    var limit = _limit(input.limit, DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT, "limit");
+
+    var sql = "SELECT * FROM order_ratings WHERE comment_flagged = 1";
+    var params = [];
+    if (input.from != null || input.to != null) {
+      var from = _epoch(input.from, "from");
+      var to   = _epoch(input.to,   "to");
+      if (from > to) {
+        throw new TypeError("orderRatings.listFlagged: from must be <= to");
+      }
+      params.push(from);
+      sql += " AND occurred_at >= ?" + params.length;
+      params.push(to);
+      sql += " AND occurred_at <= ?" + params.length;
+    }
+    params.push(limit);
+    sql += " ORDER BY occurred_at DESC, id DESC LIMIT ?" + params.length;
+
+    var r = await query(sql, params);
+    var out = [];
+    for (var i = 0; i < r.rows.length; i += 1) out.push(_decode(r.rows[i]));
+    return out;
+  }
+
   return {
     RATING_AXES:           RATING_AXES.slice(),
     MIN_RATING:            MIN_RATING,
@@ -471,6 +506,7 @@ function create(opts) {
     responseToCustomer:    responseToCustomer,
     topPositiveRatings:    topPositiveRatings,
     topNegativeRatings:    topNegativeRatings,
+    listFlagged:           listFlagged,
   };
 }
 

package/lib/storefront.js

@@ -6128,6 +6128,7 @@ var ORDER_PAGE =
   "        </table>\n" +
   "      </div>\n" +
   "      RAW_ORDER_ACTIONS" +
+  "      RAW_ORDER_RATING" +
   "    </div>\n" +
   "    <aside class=\"order-page__totals\">\n" +
   "      RAW_ORDER_TIMELINE" +
@@ -6335,6 +6336,134 @@ function _orderActionsBlock(o) {
   return "<div class=\"order-page__actions\">" + btns.join("") + "</div>";
 }
 
+// A post-purchase rating is offered on the same window a return is: a paid
+// (or further-along) order, never a still-pending (unpaid) one nor the
+// terminal off-ramps (cancelled / refunded). The order FSM has no
+// `fulfilled` status — the post-payment states are paid / fulfilling /
+// shipped / delivered — so the rating window mirrors _orderEligibleForReturn
+// rather than gating on a status the primitive doesn't expose.
+function _orderEligibleForRating(status) {
+  return status === "paid" || status === "fulfilling" ||
+    status === "shipped" || status === "delivered";
+}
+
+// The three rating axes the customer scores, in display order. Labels are
+// static framework copy; the axis key matches the submitRating field name.
+var ORDER_RATING_AXES = [
+  { key: "shipping",  label: "Shipping",         field: "shipping_rating" },
+  { key: "packaging", label: "Packaging",        field: "packaging_rating" },
+  { key: "recommend", label: "Recommend us",     field: "recommend_rating" },
+];
+
+// 1–5 selector for one rating axis. Rendered as native radio buttons so the
+// form works with no JavaScript and a screen reader announces each option.
+// `field` is the submitRating field name; nothing here is operator/customer
+// input, but the labels are escaped at the sink for consistency.
+function _ratingAxisField(axis) {
+  var esc = b.template.escapeHtml;
+  var opts = "";
+  for (var v = 1; v <= 5; v += 1) {
+    opts +=
+      "<label class=\"order-rating__option\">" +
+        "<input type=\"radio\" name=\"" + esc(axis.field) + "\" value=\"" + v + "\" required>" +
+        "<span>" + v + "</span>" +
+      "</label>";
+  }
+  return "<fieldset class=\"order-rating__axis\">" +
+    "<legend>" + esc(axis.label) + "</legend>" +
+    "<div class=\"order-rating__scale\">" + opts + "</div>" +
+    "</fieldset>";
+}
+
+// The rating form (eligible, not-yet-rated order). Posts to
+// /orders/:id/rate; the container CSRF injection tokens it automatically
+// (the action is not an EDGE_POST_PATHS prefix). A correction notice from a
+// rejected submit (bad value / over-length comment / duplicate) renders
+// above the form.
+function _orderRatingForm(o, notice) {
+  var esc = b.template.escapeHtml;
+  var noticeHtml = notice
+    ? "<p class=\"form-notice form-notice--err\" role=\"alert\">" + esc(String(notice)) + "</p>"
+    : "";
+  var axes = ORDER_RATING_AXES.map(_ratingAxisField).join("");
+  return "<section class=\"order-rating order-rating--form\">" +
+    "<h2 class=\"pdp__variants-title\">Rate this order</h2>" +
+    "<p class=\"order-rating__lede\">How did the delivery go? Your feedback helps us improve.</p>" +
+    noticeHtml +
+    "<form class=\"form-stack\" method=\"post\" action=\"/orders/" + esc(String(o.id)) + "/rate\">" +
+      axes +
+      "<label class=\"form-field\"><span>Comment <small>(optional)</small></span>" +
+        "<textarea name=\"comment\" rows=\"3\" maxlength=\"2000\" " +
+          "placeholder=\"Tell us about your delivery experience\"></textarea></label>" +
+      "<div class=\"order-page__actions\">" +
+        "<button type=\"submit\" class=\"btn-primary\">Submit rating</button>" +
+      "</div>" +
+    "</form>" +
+    "</section>";
+}
+
+// The submitted rating (the three scores) plus, when present, the
+// customer's own comment and the operator's public reply. ESCAPE-BY-DEFAULT:
+// the comment and the reply are spliced from the primitive's pre-escaped
+// `comment_html` / `response_html` fields (escaped via b.template.escapeHtml
+// at the primitive's render layer), NEVER the raw `comment` / `response_text`
+// — so a `<script>`/`onerror` payload a customer typed is inert here. A
+// flagged comment is suppressed (operators moderate via the admin queue).
+function _orderRatingDisplay(rating) {
+  var esc = b.template.escapeHtml;
+  var scoreRows = ORDER_RATING_AXES.map(function (axis) {
+    return "<div><dt>" + esc(axis.label) + "</dt>" +
+      "<dd>" + esc(String(rating[axis.field])) + " / 5</dd></div>";
+  }).join("");
+  // comment_html is already escaped by the primitive — splice it, do not
+  // re-escape (double-escaping would render visible entities) and never
+  // reach for rating.comment (the raw, un-escaped string).
+  var commentHtml = (rating.comment_html && !rating.comment_flagged)
+    ? "<div class=\"order-rating__comment\"><h3>Your comment</h3>" +
+        "<p>" + rating.comment_html + "</p></div>"
+    : "";
+  // response_html is the operator's public reply, also pre-escaped — splice
+  // it, never rating.response_text.
+  var responseHtml = rating.response_html
+    ? "<div class=\"order-rating__response\"><h3>Our reply</h3>" +
+        "<p>" + rating.response_html + "</p></div>"
+    : "";
+  return "<section class=\"order-rating order-rating--done\">" +
+    "<h2 class=\"pdp__variants-title\">Your rating</h2>" +
+    "<dl class=\"order-rating__scores\">" + scoreRows + "</dl>" +
+    commentHtml +
+    responseHtml +
+    "</section>";
+}
+
+// Resolve the rating panel for the order page: the submitted rating (read-
+// only display) when one exists, the submission form when the order is
+// eligible and unrated, and nothing otherwise (a pending / cancelled /
+// refunded order, or a renderer reached without the ratings primitive
+// wired). `opts.rating` is the getRating row (or null); `opts.rating_notice`
+// is a correction message echoed back onto a rejected submit.
+function _orderRatingBlock(opts) {
+  var o = opts.order;
+  if (opts.rating) return _orderRatingDisplay(opts.rating);
+  if (opts.rating_eligible && _orderEligibleForRating(o.status)) {
+    return _orderRatingForm(o, opts.rating_notice || null);
+  }
+  return "";
+}
+
+// Map a ?rate_err= code (set by a rejected rating POST on its PRG redirect)
+// to a clean, operator-safe correction message rendered above the rating
+// form. Defensive request reader — an unknown / absent code yields no
+// notice, never a raw error or a leak. The duplicate / value / length codes
+// mirror the primitive's refusal classes without echoing its raw message.
+function _ratingNoticeFor(code) {
+  if (code === "dupe")    return "You've already rated this order.";
+  if (code === "value")   return "Please give each rating a score from 1 to 5.";
+  if (code === "comment") return "Your comment couldn't be saved — please shorten it and try again.";
+  if (code === "input")   return "Please check your rating and try again.";
+  return null;
+}
+
 function renderOrder(opts) {
   if (!opts || !opts.order) throw new TypeError("storefront.renderOrder: opts.order required");
   var o = opts.order;
@@ -6376,6 +6505,10 @@ function renderOrder(opts) {
   var timelineHtml = _orderTimelineBlock(o.status);
   var trackingHtml = _orderTrackingBlock(shipments);
   var actionsHtml  = _orderActionsBlock(o);
+  // Post-purchase rating panel — container-only (session-gated). The route
+  // passes the resolved getRating row (rating) + the eligibility/notice
+  // flags; the edge render never does, so the panel is empty at the edge.
+  var ratingHtml   = _orderRatingBlock(opts);
   if (opts.theme) {
     return opts.theme.render("order", {
       title:               "Order " + o.id,
@@ -6393,6 +6526,7 @@ function renderOrder(opts) {
       timeline_html:       timelineHtml,
       tracking_html:       trackingHtml,
       actions_html:        actionsHtml,
+      rating_html:         ratingHtml,
       can_return:          _orderEligibleForReturn(o.status),
       can_reorder:         _orderEligibleForReorder(o.status),
       can_cancel:          _orderEligibleForCancel(o.status),
@@ -6444,6 +6578,11 @@ function renderOrder(opts) {
     .replace("RAW_ORDER_TRACKING", trackingHtml)
     .replace("RAW_ORDER_ACTIONS", actionsHtml)
     .replace("RAW_SHIP_TO", _shipToAddressBlock(o.ship_to));
+  // The rating panel carries customer/operator free text (already escaped
+  // into comment_html / response_html, but a `$` in that text would still
+  // trip String.replace's dollar substitution) — splice it via the
+  // replacer-function helper, never a replacement-string .replace.
+  body = _spliceRaw(body, "RAW_ORDER_RATING", ratingHtml);
   // Post-purchase cross-sell rail — reuses the catalog grid + product-card
   // markup (so it inherits the storefront's card styling), rendered only
   // when the picker returned something.
@@ -10738,12 +10877,35 @@ function mount(router, deps) {
           }
         } catch (_e) { shipments = []; }
       }
+      // Post-purchase fulfillment rating. Surfaced only on a signed-in
+      // customer's OWN order (the IDOR gate above already proved
+      // o.customer_id === orderAuth.customer_id when set) — a guest order
+      // carries no owner, so the rating form/display is suppressed there.
+      // Best-effort: an absent ratings primitive (or its table unmigrated)
+      // degrades to "no rating panel" rather than 500-ing the order page.
+      var ratingRow = null;
+      var ratingEligible = false;
+      if (deps.orderRatings && o.customer_id && orderAuth && o.customer_id === orderAuth.customer_id) {
+        // Offer the rating surface only AFTER a successful read: an absent /
+        // unmigrated ratings table degrades to "no rating panel" rather than
+        // rendering a form whose POST would then 500 against the same missing
+        // table. Eligibility also tracks the order-status window so the form
+        // shows only when a submit would actually be accepted (the POST gates
+        // on the same _orderEligibleForRating check).
+        try {
+          ratingRow = await deps.orderRatings.getRating({ order_id: o.id });
+          ratingEligible = _orderEligibleForRating(o.status);
+        } catch (_e) { ratingRow = null; ratingEligible = false; }
+      }
       var ordUrl = req.url ? new URL(req.url, "http://localhost") : null;
       _send(res, 200, renderOrder({
         order:           o,
         product_lookup:  productLookup,
         recommendations: recommendations,
         shipments:       shipments,
+        rating:          ratingRow,
+        rating_eligible: ratingEligible,
+        rating_notice:   ordUrl ? _ratingNoticeFor(ordUrl.searchParams.get("rate_err")) : null,
         reordered:       ordUrl ? ordUrl.searchParams.get("reordered") === "1" : false,
         cancelled:       ordUrl ? ordUrl.searchParams.get("cancelled") === "1" : false,
         shop_name:       shopName,
@@ -14661,6 +14823,97 @@ function mount(router, deps) {
       res.setHeader && res.setHeader("location", "/orders/" + encodeURIComponent(o.id) + "?cancelled=1");
       return res.end ? res.end() : res.send("");
     });
+
+    // POST /orders/:id/rate — a customer rates one of their OWN orders
+    // (shipping / packaging / recommend, plus an optional comment). The
+    // rating's customer_id is pinned to the SESSION customer — never a
+    // form/query field — and the order_id is verified to belong to that
+    // session before submitRating runs. Two refusals guard against IDOR: an
+    // unauthenticated POST goes to login (never near an order), and a
+    // foreign / guest-owned / unknown / malformed order is a clean 404
+    // (never rated, never leaked). Bad input (rating out of [1,5], over-
+    // length comment) and a duplicate submission map to a clean correction
+    // redirect, never a 500 or a raw-error leak. Mounts only when the
+    // ratings primitive is wired.
+    if (deps.orderRatings) {
+      router.post("/orders/:order_id/rate", async function (req, res) {
+        var orderId = req.params && req.params.order_id;
+        // Rating is a logged-in-customer action — resolve the session first
+        // so an unauthenticated POST goes to login, never near the order.
+        var rateAuth = _currentCustomerEnv(req);
+        if (!rateAuth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          return res.end ? res.end() : res.send("");
+        }
+        var o;
+        try { o = orderId ? await deps.order.get(orderId) : null; }
+        catch (e) { if (e instanceof TypeError) { o = null; } else throw e; }
+        // Ownership gate against IDOR: a missing order, a malformed id, an
+        // order owned by another customer, OR a guest order with no owner
+        // all 404 — the rating never touches an order the caller doesn't own.
+        if (!o || !o.customer_id || o.customer_id !== rateAuth.customer_id) {
+          return _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+        }
+        // Eligibility gate mirrors the rating window (paid → delivered). A
+        // pending / cancelled / refunded order bounces back unchanged.
+        if (!_orderEligibleForRating(o.status)) {
+          res.status(303);
+          res.setHeader && res.setHeader("location", "/orders/" + encodeURIComponent(o.id));
+          return res.end ? res.end() : res.send("");
+        }
+        var body = req.body || {};
+        // Defensive request-shape readers: the rating axes arrive as form
+        // strings — coerce to integers so the primitive's strict [1,5]
+        // integer validator sees a number (a blank / garbage field becomes
+        // NaN, which the primitive refuses as a clean TypeError → "value").
+        function _scoreField(raw) {
+          // Whole-string integer only. parseInt would silently accept a
+          // crafted "5abc" (→5) or "1.9" (→1) and persist a value the
+          // shopper never chose; require the entire field to be digits so
+          // anything else becomes NaN, which the primitive's strict [1,5]
+          // validator refuses as a clean "value" correction.
+          var s = String(raw == null ? "" : raw).trim();
+          if (!/^-?\d+$/.test(s)) return NaN;
+          var n = Number(s);
+          return Number.isInteger(n) ? n : NaN;
+        }
+        function _rateRedirect(code) {
+          res.status(303);
+          res.setHeader && res.setHeader("location",
+            "/orders/" + encodeURIComponent(o.id) + (code ? "?rate_err=" + code : ""));
+          return res.end ? res.end() : res.send("");
+        }
+        var comment = typeof body.comment === "string" && body.comment.length ? body.comment : undefined;
+        try {
+          await deps.orderRatings.submitRating({
+            order_id:         o.id,
+            customer_id:      rateAuth.customer_id,   // session-pinned, never from the form
+            shipping_rating:  _scoreField(body.shipping_rating),
+            packaging_rating: _scoreField(body.packaging_rating),
+            recommend_rating: _scoreField(body.recommend_rating),
+            comment:          comment,
+          });
+        } catch (e) {
+          // Coded errors first (a plain Error with .code), then the
+          // primitive's TypeErrors — so a duplicate surfaces its own notice
+          // rather than the generic bad-input one. Any of these is a clean
+          // correction redirect, never a 500.
+          if (e && e.code === "ORDER_RATING_ALREADY_EXISTS") return _rateRedirect("dupe");
+          if (e instanceof TypeError) {
+            // The comment validator's message names "comment"; everything
+            // else is a rating-value problem. Either way, no raw leak.
+            var isComment = /comment/.test(String(e.message || ""));
+            return _rateRedirect(isComment ? "comment" : "value");
+          }
+          throw e;
+        }
+        // PRG back to the order page — the submitted rating now renders in
+        // place of the form (a refresh doesn't re-submit).
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/orders/" + encodeURIComponent(o.id));
+        return res.end ? res.end() : res.send("");
+      });
+    }
   }
 
   // POST /cart/lines — add a line. Reads variant_id + qty from the

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.14.15",
-      "tag": "v0.14.15",
+      "version": "0.14.16",
+      "tag": "v0.14.16",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.14.x
 
+- v0.14.16 (2026-05-31) — **Connection entry-point ports are validated at config time.** Six connection entry points previously read opts.port with a bare `|| <default>` fallback, silently coercing a string, negative, NaN, or out-of-range port instead of catching the operator's typo. A new b.validateOpts.optionalPort enforces the RFC 6335 §6 wire-valid range and is wired into b.mail.smtpTransport, b.ntpCheck.querySingle, b.networkDns.useDnsOverTls, b.networkNts (KE handshake / query / facade), b.redisClient.create, and createApp().listen — each now throws at construction with a clear message naming the bad value. The app.listen / createApp bind site opts into allowZero so port 0 (the legitimate ephemeral-bind sentinel) still works; the five outbound-connect sites require [1,65535]. **Added:** *`b.validateOpts.optionalPort`* — A config-time port validator: `optionalPort(value, label, errorClass, code, opts?)` returns an omitted (`undefined` / `null`) port unchanged, and otherwise requires an integer in the RFC 6335 §6 wire-valid range [1,65535] — rejecting a string, negative, NaN, Infinity, fractional, or out-of-range value. Pass `{ allowZero: true }` for a listen-bind site where port 0 is the OS ephemeral-bind sentinel. The thrown message reports the offending shape (so `Infinity` / `"443"` stay visible), and routes a caller-supplied typed framework error (or a plain Error when none is given), matching the existing `optionalPositiveFinite` family. **Changed:** *Connection entry points reject a malformed port at construction* — `b.mail.smtpTransport`, `b.ntpCheck.querySingle`, `b.networkDns.useDnsOverTls`, `b.networkNts.performKeHandshake` / `query` / `querySingle`, `b.redisClient.create`, and `createApp().listen` (plus the `createApp` constructor's default port) now validate `opts.port` and throw synchronously on a non-integer / out-of-range value rather than coercing it through `||` to a default. This is a behavior change for a caller that was passing a non-canonical port (e.g. the string `"587"` or a NaN) and relying on the silent fallback — pass an integer in [1,65535] instead (or `0` for an ephemeral `createApp().listen` bind). `b.ntpCheck` gains a typed `NtpCheckError` for this (it had no error class before). **Detectors:** *Connection entry points must compose the port validator* — A new check flags a lib connection entry point that reads `opts.port` / `opts.kePort` / `opts.ntpPort` with a `|| <default>` fallback without composing `b.validateOpts.optionalPort` (or the equivalent `numericBounds.isPositiveFiniteInt` + 65535 cap), so an unvalidated port read can't slip back in. **Migration:** *Pass an integer port to connection primitives* — If you were passing a non-integer or out-of-range `opts.port` to a mail / NTP / NTS / DNS-over-TLS / Redis transport or to `createApp().listen` and relying on the silent `|| default` fallback, that now throws at construction. Pass an integer in [1,65535]; for an ephemeral `createApp().listen` bind, pass `0` (still accepted).
+
 - v0.14.14 (2026-05-31) — **Recognized consent purposes with lawful-basis gating, and a new b.privacy namespace for annual EdTech vendor-review attestations.** Closes the student-data gap where an educational-only consent purpose and an annual third-party vendor-review report were described but never implemented. b.consent gains a recognized-purpose vocabulary: a purpose value matching a recognized key carries lawful-basis constraints that grant() enforces, and the named educational-only purpose (FERPA's school-official exception and California's SOPIPA) refuses a legitimate_interests lawful basis. The new b.privacy namespace ships vendorReview(), a builder for the dated, clause-by-clause annual EdTech third-party / processor review FERPA and SOPIPA expect a school or district to keep — it computes whether every required clause (no targeted advertising, no commercial profiling, no sale of student data, deletion on request, school-official designation, and so on) is attested, names the gaps, and stamps a 365-day re-review clock. Free-form consent purposes keep working unchanged, so the vocabulary is opt-in and additive. **Added:** *`b.consent` recognized-purpose vocabulary + lawful-basis gating* — `b.consent.recognizedPurpose(name)` looks up a recognized purpose and `b.consent.listPurposes()` enumerates them. When a `grant({ purpose })` value matches a recognized key, `grant()` enforces that purpose's lawful-basis constraints; the `educational-only` purpose forbids a `legitimate_interests` basis (FERPA 34 CFR 99.31(a)(1) school-official exception; California SOPIPA Cal. B&P 22584; FTC school-authorized COPPA consent 16 CFR 312.5(c)(10)) and marks the data commercial-use-prohibited. The commercial-use prohibition is an operator trust-boundary obligation — `isGranted()` does not re-derive it. Any purpose value NOT in the vocabulary stays free-form and unconstrained, so existing callers are unaffected; the hash-chain column set is unchanged, so `b.consent.verify()` over existing rows is unaffected. · *`b.privacy.vendorReview` — annual EdTech vendor-review attestation* — A new `b.privacy` namespace whose `vendorReview(opts)` builds the dated third-party / processor review a FERPA school-official arrangement and California SOPIPA expect for every vendor that touches student data. The operator supplies a boolean attestation per clause (educational-purpose-only, no-targeted-advertising, no-commercial-profiling, no-sale-of-student-data, security-safeguards, deletion-on-request, sub-processor-currency, breach-notification, school-official-designation, directory-information-handling); `vendorReview` validates the shape, computes whether every required clause is attested (`attested`) and which are not (`gaps`), and stamps `reviewedAt` plus a 365-day `nextReviewDueAt` re-review clock. `b.privacy.listVendorReviewClauses()` returns the clause set with citations. Operator-feeds-metadata: the frozen report is not framework-persisted — compose it into your retention / audit / export sink. A best-effort `privacy.vendor_review.recorded` audit event fires when an audit sink is wired. **Detectors:** *A gated consent purpose must go through `b.consent`* — A new check flags any lib code that mints a consent row with a hardcoded `educational-only` purpose literal without composing the recognized-purpose vocabulary — which would record the value while never enforcing its FERPA / SOPIPA lawful-basis constraint.
 
 - v0.14.13 (2026-05-31) — **Close advertised-but-missing surface: SRS1 chained forwarding, DCQL array-wildcard claim paths, and in-memory safe-archive extraction.** Three primitives advertised a capability in their documentation or card but refused or omitted it at runtime; this release implements each. b.mail.srs gains srs1Rewrite for the SRS1 double-forward (and multi-hop) case — previously the @intro described SRS1 and create() threw, pointing at a function that was never exported. b.safeArchive gains extractToMemory, the in-memory counterpart to extract for read-only / serverless filesystems — previously the card advertised in-memory extraction but the orchestrator required a destination directory. b.auth.oid4vp.matchDcql now honours a null claims-path segment as the array wildcard the OpenID4VP DCQL spec defines, rather than refusing it as unsupported while the card advertised DCQL. A stale version-pinned wording in a safe-archive error message is corrected. Every change is additive or message-only — no existing caller changes behaviour. **Added:** *`b.mail.srs` SRS1 chained forwarding — `srs1Rewrite`* — `b.mail.srs.create(...)` now returns `srs1Rewrite` alongside `rewrite` / `reverse`. `srs1Rewrite(srsAddress)` chains an already-SRS0 (or SRS1) envelope-from for a further forwarding hop: it keeps the original SRS0 body verbatim, prepends the SRS0 originator's domain, and binds the pair with this forwarder's own HMAC-SHA-256 tag — no new timestamp, no repeated original local-part — emitting `SRS1=tag=originator==<SRS0-body>@thisForwarder`. `reverse()` now detects an SRS1 address, verifies this hop's tag and forwarder-domain binding, and unwraps exactly one hop back to the originator's SRS0 so a multi-hop bounce routes straight to the forwarder that can recover the original sender. Typed failure modes: `srs/not-srs0` (input not SRS-encoded), `srs/malformed` (missing the `==` separator), `srs/bad-tag` (tampered), `srs/too-long` (chain exceeds the RFC 5321 256-octet path limit). Implements the Sender Rewriting Scheme SRS1 wire format; the second-hop SPF rationale is RFC 7208 §2.4. · *`b.safeArchive.extractToMemory` — in-memory safe extraction* — An async generator counterpart to `b.safeArchive.extract` for read-only / serverless filesystems: it resolves the source, sniffs the format, auto-unwraps recipient (`BAWRP`) / passphrase (`BAWPP`) envelopes, and dispatches to the zip / tar / tar.gz reader's in-memory `extractEntries()`, yielding `{ name, bytes, size }` per regular-file entry without ever writing to disk. It takes no `destination`. Every defense the disk path runs applies unchanged: the zip-bomb caps (entry-count / per-entry / total / expansion-ratio), the `b.guardArchive` metadata cascade (Zip-Slip / path-traversal / symlink-escape / encrypted-entry refusal, CVE-2025-3445 class), and the entry-type policy. The disk-only realpath-agreement check (CVE-2025-4517 PATH_MAX TOCTOU defense) is intentionally absent — there is no extraction root — so the archive-level name refusals carry containment. Trusted-stream sources are refused upfront (the adversarial-safe central-directory walk needs random access). gzip magic per RFC 1952 §2.3.1. **Fixed:** *OID4VP DCQL `null` claim-path segment now resolves the array wildcard* — `b.auth.oid4vp.matchDcql` previously threw `auth-oid4vp/null-path-segment-not-supported` for a `null` claims-path segment while the namespace card advertised DCQL — under-disclosing a legitimate presentation (CWE-863). Per OpenID4VP 1.0 §7.1.1 a `null` segment selects all elements of the array at that depth; the matcher now recurses over array elements with existence semantics (with DCQL value-matching applied to any selected leaf), composed to arbitrary depth. A `null` segment on a non-array node — like an integer index into a non-array, or a string key into an array — is a clean non-match, not a thrown error, because the matcher walks holder credential data rather than operator config. String and integer claim paths are byte-identical to before; only queries that previously threw now succeed or fail cleanly. · *safe-archive trusted-stream refusal message no longer cites a stale version* — The thrown `safe-archive/trusted-stream-unsupported` message and its comment claimed trusted-stream extraction was "deferred to v0.12.8 / when the v0.12.8 sequential extract path lands." That path shipped long ago — `b.archive.read.zip.fromTrustedStream` and the tar sequential mode exist — so the message now points at them as present capabilities and drops the version-pinned wording. The error code is unchanged. **Detectors:** *A primitive may not advertise a capability and then throw an unimplemented stub* — A new check flags a bare `not yet supported` / `operator demand TBD` / `not supported in v1` refusal in a lib throw string (comments excluded). A defer is only complete with a written re-open condition; the SRS1 and DCQL stubs that this release implements both carried this bare-defer shape, and the detector keeps it from re-entering. · *DCQL `null` path segments must recurse, never refuse* — A new check flags the `null path segment not supported` refusal shape in `lib/auth/oid4vp.js`, so the spec-mandated array wildcard cannot be re-stubbed. · *`extractToMemory` must stay disk-free* — A new check flags any `writeFileSync` / `renameSync` / `mkdirSync` / `createWriteStream` inside the `extractToMemory` generator body, so the read-only / serverless contract cannot regress into a disk write.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.14.14",
-  "createdAt": "2026-05-31T19:48:38.125Z",
+  "frameworkVersion": "0.14.16",
+  "createdAt": "2026-06-01T01:11:20.010Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -43286,6 +43286,10 @@
           "type": "primitive",
           "valueType": "number"
         },
+        "NtpCheckError": {
+          "type": "function",
+          "arity": 4
+        },
         "bootCheck": {
           "type": "function",
           "arity": 1

package/lib/vendor/blamejs/lib/app.js

@@ -93,6 +93,7 @@ var nodeFs = require("node:fs");
 var nodePath = require("node:path");
 var appShutdown = require("./app-shutdown");
 var audit = require("./audit");
+var validateOpts = require("./validate-opts");
 var C = require("./constants");
 var cluster = require("./cluster");
 var db = require("./db");
@@ -139,6 +140,9 @@ async function createApp(opts) {
   if (!opts.dataDir || typeof opts.dataDir !== "string") {
     throw new Error("createApp: opts.dataDir is required");
   }
+  // Constructor-time default port (used by listen() when listenOpts.port is
+  // omitted); allowZero for the ephemeral-bind sentinel.
+  validateOpts.optionalPort(opts.port, "createApp: opts.port", undefined, undefined, { allowZero: true });
   var dataDir = nodePath.resolve(opts.dataDir);
   if (!nodeFs.existsSync(dataDir)) {
     nodeFs.mkdirSync(dataDir, { recursive: true });
@@ -279,6 +283,10 @@ async function createApp(opts) {
 
   function listen(listenOpts) {
     listenOpts = listenOpts || {};
+    // Port 0 is the legitimate ephemeral-bind sentinel for a listen socket
+    // (RFC 6335 §6 / POSIX bind), so allowZero — but a non-integer / NaN /
+    // out-of-range port is an operator typo that must fail at boot.
+    validateOpts.optionalPort(listenOpts.port, "createApp.listen: listenOpts.port", undefined, undefined, { allowZero: true });
     var port = (listenOpts.port !== undefined) ? listenOpts.port
              : (opts.port !== undefined) ? opts.port
              : 0;

package/lib/vendor/blamejs/lib/mail.js

@@ -767,6 +767,7 @@ function smtpTransport(opts) {
       "dkimSigner must be an object with a .sign(rfc822) method " +
       "(see b.mail.dkim.create)", true);
   }
+  validateOpts.optionalPort(opts.port, "smtp transport: opts.port", MailError, "mail/smtp-misconfigured");
   var port = opts.port || 587;
   var useImplicitTLS = port === 465 || opts.implicitTls === true;
   var rejectUnauthorized = opts.rejectUnauthorized !== false;

package/lib/vendor/blamejs/lib/network-dns.js

@@ -253,6 +253,7 @@ function useDnsOverTls(opts) {
   opts = opts || {};
   validateOpts(opts, ["host", "port", "servername", "ca"], "dns.useDnsOverTls");
   validateOpts.requireNonEmptyString(opts.host, "dns.useDnsOverTls: host", DnsError, "dns/bad-dot-host");
+  validateOpts.optionalPort(opts.port, "dns.useDnsOverTls: opts.port", DnsError, "dns/bad-dot-port");
   if (opts.ca !== undefined && opts.ca !== null &&
       !Buffer.isBuffer(opts.ca) && typeof opts.ca !== "string" && !Array.isArray(opts.ca)) {
     throw new DnsError("dns/bad-dot-ca",

package/lib/vendor/blamejs/lib/network-nts.js

@@ -241,6 +241,7 @@ function performKeHandshake(opts) {
   opts = opts || {};
   validateOpts(opts, ["host", "port", "servername", "aead", "ca", "timeoutMs"], "nts.performKeHandshake");
   validateOpts.requireNonEmptyString(opts.host, "nts.performKeHandshake: host", NtsError, "nts/bad-host");
+  validateOpts.optionalPort(opts.port, "nts.performKeHandshake: opts.port", NtsError, "nts/bad-ke-port");
   var timeoutMs = opts.timeoutMs || C.TIME.seconds(10);
   return new Promise(function (resolve, reject) {
     var settled = false;
@@ -408,6 +409,7 @@ function _walkExtensions(msg, startOff) {
 function querySingle(opts) {
   opts = opts || {};
   validateOpts(opts, ["host", "port", "aeadId", "c2sKey", "s2cKey", "cookies", "timeoutMs"], "nts.querySingle");
+  validateOpts.optionalPort(opts.port, "nts.querySingle: opts.port", NtsError, "nts/bad-ntp-port");
   if (!Buffer.isBuffer(opts.c2sKey) || opts.c2sKey.length === 0) {
     throw new NtsError("nts/no-c2s-key", "nts.querySingle: c2sKey required (Buffer)");
   }
@@ -542,6 +544,8 @@ function querySingle(opts) {
 async function query(opts) {
   opts = opts || {};
   validateOpts(opts, ["host", "kePort", "ntpPort", "aead", "ca", "timeoutMs", "servername"], "nts.query");
+  validateOpts.optionalPort(opts.kePort, "nts.query: opts.kePort", NtsError, "nts/bad-ke-port");
+  validateOpts.optionalPort(opts.ntpPort, "nts.query: opts.ntpPort", NtsError, "nts/bad-ntp-port");
   var ke = await performKeHandshake({
     host:       opts.host,
     port:       opts.kePort,

package/lib/vendor/blamejs/lib/ntp-check.js

@@ -48,10 +48,16 @@ var dgram = require("node:dgram");
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
+var validateOpts = require("./validate-opts");
+var { defineClass } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
 var observability = lazyRequire(function () { return require("./observability"); });
 
+// Config-time misuse (a bad opts.port) throws a typed, permanent error so an
+// operator catches the typo at boot rather than as a Promise rejection.
+var NtpCheckError = defineClass("NtpCheckError", { alwaysPermanent: true });
+
 // NTP epoch: 1900-01-01. Unix epoch: 1970-01-01. Offset: 70 years incl. 17
 // leap days = 2,208,988,800 seconds.
 var NTP_TO_UNIX_OFFSET_SECONDS = 2208988800;
@@ -166,6 +172,7 @@ function _resetThresholdsForTest() {
  */
 function querySingle(server, opts) {
   opts = opts || {};
+  validateOpts.optionalPort(opts.port, "ntpCheck.querySingle: opts.port", NtpCheckError, "ntp/bad-port");
   var port = opts.port || DEFAULT_PORT;
   var timeoutMs = opts.timeoutMs || DEFAULT_TIMEOUT_MS;
 
@@ -445,6 +452,7 @@ function monitor(opts) {
 
 module.exports = {
   querySingle:               querySingle,
+  NtpCheckError:             NtpCheckError,
   checkDrift:                checkDrift,
   bootCheck:                 bootCheck,
   monitor:                   monitor,

package/lib/vendor/blamejs/lib/redis-client.js

@@ -155,9 +155,17 @@ function _frameToValue(frame) {
 function create(opts) {
   opts = opts || {};
   validateOpts.requireNonEmptyString(opts.url, "redis.create: opts.url", RedisError, "BAD_OPTS");
+  // Validate an operator-supplied opts.port up front for a clear typo
+  // message (e.g. the string "6379" or a negative value).
+  validateOpts.optionalPort(opts.port, "redis.create: opts.port", RedisError, "BAD_OPTS");
   var parsed = _parseRedisUrl(opts.url);
   var host = opts.host || parsed.host;
   var port = opts.port || parsed.port;
+  // Re-validate the RESOLVED port. A url-supplied port (redis://h:0,
+  // redis://h:99999) is not range-checked by _parseRedisUrl, so without
+  // this an outbound connect could inherit a zero / out-of-range port that
+  // the opts.port guard above never sees.
+  validateOpts.optionalPort(port, "redis.create: resolved port (opts.port or url)", RedisError, "BAD_OPTS");
   var useTls = opts.tls !== undefined ? !!opts.tls : parsed.tls;
   var password = opts.password !== undefined ? opts.password : parsed.password;
   var username = opts.username !== undefined ? opts.username : parsed.username;

package/lib/vendor/blamejs/lib/validate-opts.js

@@ -27,6 +27,8 @@
  * a typed error wrap the call.
  */
 
+var numericBounds = require("./numeric-bounds");
+
 function _format(primitive, unknownKey, allowedKeys) {
   return primitive + ": unknown option '" + unknownKey + "'. " +
     "Allowed keys: " + allowedKeys.slice().sort().join(", ") + ".";
@@ -150,6 +152,26 @@ function optionalFunction(value, label, errorClass, code) {
   return value;
 }
 
+// optionalPort — a TCP/UDP port number must be an integer in the wire-valid
+// range (RFC 6335 §6). Outbound-connect sites require [1,65535]; pass
+// { allowZero: true } for a listen-bind site where port 0 is the legitimate
+// ephemeral-bind sentinel the OS replaces with a kernel-assigned port. Uses
+// numericBounds.shape() in the message so Infinity / NaN / "443" stay visible.
+function optionalPort(value, label, errorClass, code, opts) {
+  if (value === undefined || value === null) return value;
+  opts = opts || {};
+  var ok = opts.allowZero
+    ? (numericBounds.isNonNegativeFiniteInt(value) && value <= 65535)
+    : (numericBounds.isPositiveFiniteInt(value) && value <= 65535);
+  if (!ok) {
+    _throw(errorClass, code, (label || "opt") + " must be " +
+           (opts.allowZero ? "0 (ephemeral) or " : "") +
+           "an integer in [" + (opts.allowZero ? 0 : 1) + ",65535], got " + numericBounds.shape(value),
+           "validate-opts/bad-port");
+  }
+  return value;
+}
+
 // applyDefaults — resolve every key in DEFAULTS against opts. For each
 // key, the operator's value (if not undefined) wins; otherwise the
 // default is used. Returns a new plain object — NOT a frozen one, so
@@ -391,6 +413,7 @@ module.exports.optionalBoolean = optionalBoolean;
 module.exports.optionalPositiveInt = optionalPositiveInt;
 module.exports.optionalFiniteNonNegative = optionalFiniteNonNegative;
 module.exports.optionalPositiveFinite = optionalPositiveFinite;
+module.exports.optionalPort = optionalPort;
 module.exports.optionalFunction = optionalFunction;
 module.exports.optionalNonEmptyString = optionalNonEmptyString;
 module.exports.optionalNonEmptyStringArray = optionalNonEmptyStringArray;

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.14",
+  "version": "0.14.16",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",