@blamejs/blamejs-shop 0.3.56 → 0.3.58

package/lib/vendor/blamejs/lib/sse.js

@@ -287,7 +287,7 @@ function create(req, res, opts) {
     _writeRaw(":" + text + "\n\n");
   }
 
-  function close() {
+  function close(cause) {
     if (closed) return;
     closed = true;
     if (heartbeatTimer) {
@@ -296,10 +296,12 @@ function create(req, res, opts) {
     }
     try { res.end(); } catch (_e) { /* already destroyed */ }
     if (auditOn) {
+      var closeMeta = { lastEventId: lastEventId };
+      if (cause) closeMeta.reason = cause.reason || "fault";
       audit.safeEmit({
         action:   "sse.channel_closed",
-        outcome:  "success",
-        metadata: { lastEventId: lastEventId },
+        outcome:  cause ? "failure" : "success",
+        metadata: closeMeta,
       });
     }
   }
@@ -308,7 +310,7 @@ function create(req, res, opts) {
   // the heartbeat timer.
   if (typeof res.on === "function") {
     res.on("close",  close);
-    res.on("error",  function (_e) { close(); });
+    res.on("error",  function (_e) { close({ reason: "stream-error" }); });
     res.on("finish", function () { closed = true; if (heartbeatTimer) { clearInterval(heartbeatTimer); heartbeatTimer = null; } });
   }
 
@@ -325,7 +327,7 @@ function create(req, res, opts) {
     heartbeatTimer = setInterval(function () {
       if (closed) return;
       try { _writeRaw(":keepalive\n\n"); }
-      catch (_e) { close(); }
+      catch (_e) { close({ reason: "heartbeat-write-failed" }); }
     }, heartbeatMs).unref();
   }
 

package/lib/vendor/blamejs/lib/static.js

@@ -6,7 +6,8 @@
  * quotas (cluster-shared via b.cache), Range support (RFC 7233 single-range),
  * the full conditional-request set (If-None-Match / If-Match /
  * If-Modified-Since / If-Unmodified-Since), MIME allowlist with magic-byte
- * verification (composes b.fileType), per-request operator hook, idle-stream
+ * verification (composes b.fileType), per-request operator hooks (onServe
+ * on the success path, onError on every refusal path), idle-stream
  * timeout, cancellation propagation, force-revoke, and compliance-retention
  * gating.
  *
@@ -16,6 +17,12 @@
  *   var mw = serve.middleware;                       // (req, res, next)
  *   await b.staticServe.integrity(absFilePath);      // SRI helper (SHA-384)
  *
+ *   // onError mirrors onServe for the refusal paths (403 / 404 / 415 /
+ *   // 412 / 416 / 429 / 451 / 500): it receives
+ *   // { req, res, urlPath, absPath, status, code, actor } AFTER the
+ *   // refusal response is written. Observability-only — a throw is
+ *   // swallowed so a broken hook can't tear down the socket.
+ *
  * Backwards compatible: every existing opt (root, mountPath,
  * hashedPathPattern, indexFile, defaultMaxAge, contentTypes) keeps its
  * original meaning. New opts (permissions, cache, audit, observability,
@@ -450,6 +457,7 @@ function _validateCreateOpts(opts) {
   validateOpts.auditShape(opts.audit, "staticServe.create", StaticServeError);
   validateOpts.observabilityShape(opts.observability, "staticServe.create", StaticServeError);
   validateOpts.optionalFunction(opts.onServe, "staticServe.create: onServe", StaticServeError);
+  validateOpts.optionalFunction(opts.onError, "staticServe.create: onError", StaticServeError);
   // contentSafety — extension-keyed gate map. Default behaviour: when
   // undefined, the framework wires b.guardAll.byExtension({ profile:
   // "strict" }) automatically so every shipped guard is ON by default.
@@ -604,7 +612,7 @@ function create(opts) {
     "root", "mountPath", "hashedPathPattern",
     "indexFile", "defaultMaxAge", "contentTypes",
     "permissions", "cache", "fileType", "retention", "revokeStore",
-    "allowedFileTypes", "audit", "observability", "onServe",
+    "allowedFileTypes", "audit", "observability", "onServe", "onError",
     "acceptRanges", "auditSuccess", "auditFailures",
     "maxBytesPerActorPerWindowMs", "maxBytesAllActorsPerWindowMs",
     "bandwidthWindowMs", "maxConcurrentDownloadsPerActor", "maxIdleMs",
@@ -657,6 +665,7 @@ function create(opts) {
     contentSafety = opts.contentSafety;
   }
   var onServe         = opts.onServe || null;
+  var onError         = opts.onError || null;
   var audit           = opts.audit || null;
   var auditSuccess    = cfg.auditSuccess;
   var auditFailures   = cfg.auditFailures;
@@ -756,6 +765,26 @@ function create(opts) {
     var actorCtx = requestHelpers.extractActorContext(req);
     var actorKey = _actorKeyFromContext(actorCtx);
 
+    // Request-scoped error writer. Wraps the module-level _writeError so
+    // every refusal path (403 / 404 / 415 / 412 / 416 / 429 / 451 / 500)
+    // also invokes the operator's onError hook — the success-path mirror
+    // of onServe. The signature matches _writeError exactly; the `code`
+    // argument routes through to the hook so operators can branch on the
+    // refusal reason. The hook is observability-only: it runs AFTER the
+    // response is written and a throw is swallowed so a broken sink can't
+    // turn a 4xx into a torn-down socket.
+    function writeErr(r, status, code, message, headers) {
+      _writeError(r, status, code, message, headers);
+      if (onError) {
+        try {
+          onError({
+            req: req, res: r, urlPath: urlPath, absPath: absPath,
+            status: status, code: code, actor: actorCtx,
+          });
+        } catch (_he) { /* hook best-effort */ }
+      }
+    }
+
     // Permission gate (403)
     var perm = await _checkPermission(req);
     if (!perm.ok) {
@@ -766,7 +795,7 @@ function create(opts) {
           outcome: "failure", reason: "permission_denied", resource: urlPath,
         }, actorCtx));
       }
-      return _writeError(res, HTTP.FORBIDDEN, "permission_denied",
+      return writeErr(res, HTTP.FORBIDDEN, "permission_denied",
         "Forbidden");
     }
 
@@ -788,7 +817,7 @@ function create(opts) {
           outcome: "failure", reason: "revoked", resource: urlPath,
         }, actorCtx));
       }
-      return _writeError(res, HTTP.NOT_FOUND, "not_found", "Not Found");
+      return writeErr(res, HTTP.NOT_FOUND, "not_found", "Not Found");
     }
 
     // Compliance retention (451)
@@ -800,7 +829,7 @@ function create(opts) {
           outcome: "failure", reason: "retention_blocked", resource: urlPath,
         }, actorCtx));
       }
-      return _writeError(res, HTTP.UNAVAILABLE_FOR_LEGAL_REASONS,
+      return writeErr(res, HTTP.UNAVAILABLE_FOR_LEGAL_REASONS,
         "retention_blocked", "Unavailable For Legal Reasons");
     }
 
@@ -820,7 +849,7 @@ function create(opts) {
             detectedMime: mimeCheck.detected || null,
           }, actorCtx));
         }
-        return _writeError(res, HTTP.UNSUPPORTED_MEDIA_TYPE,
+        return writeErr(res, HTTP.UNSUPPORTED_MEDIA_TYPE,
           "mime_rejected", "Unsupported Media Type");
       }
     }
@@ -861,7 +890,7 @@ function create(opts) {
         catch (_e) {
           stats.failures += 1;
           if (gateHandle) { try { await gateHandle.close(); } catch (_ce) { /* close best-effort */ } }
-          return _writeError(res, HTTP.INTERNAL_SERVER_ERROR,
+          return writeErr(res, HTTP.INTERNAL_SERVER_ERROR,
             "read_failed", "Internal Server Error");
         }
         try { await gateHandle.close(); } catch (_ce) { /* close best-effort */ }
@@ -885,7 +914,7 @@ function create(opts) {
               error: gateErr && gateErr.message,
             }, actorCtx));
           }
-          return _writeError(res, HTTP.INTERNAL_SERVER_ERROR,
+          return writeErr(res, HTTP.INTERNAL_SERVER_ERROR,
             "content_safety_threw", "Internal Server Error");
         }
         if (!gateDecision.ok || gateDecision.action === "refuse") {
@@ -898,7 +927,7 @@ function create(opts) {
               issues: gateContract.summarizeIssues(gateDecision.issues),
             }, actorCtx));
           }
-          return _writeError(res, HTTP.UNSUPPORTED_MEDIA_TYPE,
+          return writeErr(res, HTTP.UNSUPPORTED_MEDIA_TYPE,
             "content_safety_refused", "Unsupported Media Type");
         }
         if (gateDecision.action === "sanitize" && gateDecision.sanitized) {
@@ -929,7 +958,7 @@ function create(opts) {
     if (ifMatch && ifMatch !== "*" && ifMatch !== meta.etag) {
       stats.failures += 1;
       _emitObs("staticServe.precondition_failed", 1, { route: urlPath, header: "if-match" });
-      return _writeError(res, HTTP.PRECONDITION_FAILED || 412,
+      return writeErr(res, HTTP.PRECONDITION_FAILED || 412,
         "precondition_failed", "Precondition Failed");
     }
 
@@ -956,7 +985,7 @@ function create(opts) {
       if (isFinite(ius) && Math.floor(meta.mtimeMs / C.TIME.seconds(1)) > Math.floor(ius / C.TIME.seconds(1))) {
         stats.failures += 1;
         _emitObs("staticServe.precondition_failed", 1, { route: urlPath, header: "if-unmodified-since" });
-        return _writeError(res, HTTP.PRECONDITION_FAILED,
+        return writeErr(res, HTTP.PRECONDITION_FAILED,
           "precondition_failed", "Precondition Failed");
       }
     }
@@ -970,19 +999,19 @@ function create(opts) {
         if (range && (range.malformed || range.multi)) {
           stats.failures += 1;
           _emitObs("staticServe.range_invalid", 1, { route: urlPath });
-          return _writeError(res, HTTP.RANGE_NOT_SATISFIABLE, "range_not_satisfiable",
+          return writeErr(res, HTTP.RANGE_NOT_SATISFIABLE, "range_not_satisfiable",
             "Range Not Satisfiable", { "Content-Range": "bytes */" + meta.size });
         }
         if (range && range.unsatisfiable) {
           stats.failures += 1;
           _emitObs("staticServe.range_invalid", 1, { route: urlPath });
-          return _writeError(res, HTTP.RANGE_NOT_SATISFIABLE, "range_not_satisfiable",
+          return writeErr(res, HTTP.RANGE_NOT_SATISFIABLE, "range_not_satisfiable",
             "Range Not Satisfiable", { "Content-Range": "bytes */" + meta.size });
         }
         if (range && cfg.maxRangeBytes !== Infinity && range.length > cfg.maxRangeBytes) {
           stats.failures += 1;
           _emitObs("staticServe.range_too_large", 1, { route: urlPath });
-          return _writeError(res, HTTP.RANGE_NOT_SATISFIABLE, "range_too_large",
+          return writeErr(res, HTTP.RANGE_NOT_SATISFIABLE, "range_too_large",
             "Range Not Satisfiable", { "Content-Range": "bytes */" + meta.size });
         }
         if (range) {
@@ -1005,7 +1034,7 @@ function create(opts) {
           current: concCheck.current, cap: concCheck.cap,
         }, actorCtx));
       }
-      return _writeError(res, HTTP.TOO_MANY_REQUESTS,
+      return writeErr(res, HTTP.TOO_MANY_REQUESTS,
         "concurrency_cap", "Too Many Requests",
         { "Retry-After": "5" });
     }
@@ -1021,7 +1050,7 @@ function create(opts) {
           scope: bwCheck.scope, used: bwCheck.used, cap: bwCheck.cap,
         }, actorCtx));
       }
-      return _writeError(res, HTTP.TOO_MANY_REQUESTS,
+      return writeErr(res, HTTP.TOO_MANY_REQUESTS,
         "bandwidth_quota", "Too Many Requests",
         { "Retry-After": String(bwCheck.retryAfter) });
     }
@@ -1077,7 +1106,7 @@ function create(opts) {
             error: e && e.message,
           }, actorCtx));
         }
-        return _writeError(res, HTTP.INTERNAL_SERVER_ERROR, "onServe_threw",
+        return writeErr(res, HTTP.INTERNAL_SERVER_ERROR, "onServe_threw",
           "Internal Server Error");
       }
     }

package/lib/vendor/blamejs/lib/uri-template.js

@@ -29,6 +29,7 @@
  */
 
 var { defineClass } = require("./framework-error");
+var codepointClass = require("./codepoint-class");
 
 var UriTemplateError = defineClass("UriTemplateError", { alwaysPermanent: true });
 
@@ -59,7 +60,8 @@ function _pctEncode(str, allowReserved) {
     var ch = str.charAt(i);
     // Preserve existing percent-encoded triplets when the reserved set is
     // allowed (operators "+" and "#").
-    if (allowReserved && ch === "%" && /^[0-9A-Fa-f]{2}$/.test(str.substr(i + 1, 2))) {
+    // allow:regex-no-length-cap — the substr is a fixed 2-char window
+    if (allowReserved && ch === "%" && codepointClass.HEX_PAIR_RE.test(str.substr(i + 1, 2))) {
       out += str.substr(i, 3); i += 2; continue;
     }
     if (UNRESERVED.test(ch) || (allowReserved && RESERVED.test(ch))) { out += ch; continue; }

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.16",
+  "version": "0.14.19",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.14.17.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.17",
+  "date": "2026-05-31",
+  "headline": "In-session API-encrypt errors stay confidential, and the encrypted client can read them",
+  "summary": "When b.middleware.apiEncrypt is active, a normal response is sealed in the { _ct } envelope, but a terminal error that bypassed res.json (an error page, a validation refusal, an RFC 9457 problem+json document, a deny-middleware body) shipped in plaintext on the otherwise-encrypted channel, and the b.httpClient.encrypted client threw on the response shape because it tried to decrypt every reply. This release makes errors symmetric: those four sinks now seal their body in the same envelope a success uses whenever a session is active (via a new req.apiEncryptEncode the middleware installs after a successful decrypt), and the client gains a responseMode: \"passthrough\" that reads a non-2xx — decrypting an in-session error and returning a plaintext one verbatim — instead of throwing. Errors raised before a session exists (a Bearer 401, a handshake rejection, a replay refusal) deliberately stay plaintext and human-readable. Two adjacent streaming fixes ride along: a streamed (responseMode \"stream\") non-2xx now keeps a bounded prefix of the error body on the thrown error instead of draining it, and an SSE channel closed by a transport fault audits as a failure with a reason rather than looking like a clean operator close.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.httpClient.encrypted` gains `responseMode: \"passthrough\"`",
+          "body": "The encrypted client defaults to `responseMode: \"reject\"` (a non-2xx rejects, exactly as before). Set `responseMode: \"passthrough\"` at create time, or per request, to resolve a non-2xx instead: the result is `{ statusCode, headers, body, ok }`, where `body` is the decrypted object when the reply carries an encrypted `_ct` envelope (an in-session error) and the parsed plaintext otherwise (a pre-session error such as a Bearer 401 or a proxy 502). The additive `ok` boolean (status 200–299) is present on every result. This lets a client read an error's status and detail instead of failing on the response shape."
+        },
+        {
+          "title": "`req.apiEncryptEncode` — the in-session error encoder",
+          "body": "`b.middleware.apiEncrypt` installs `req.apiEncryptEncode(obj)` after it successfully decrypts a request body. It returns the same `{ _ct }` (plus `_sid` / `_ctr` in per-session mode) envelope a normal response uses, so a terminal handler that writes its body directly (bypassing the wrapped `res.json`) can keep an error confidential on the encrypted channel. It is present only after a valid decrypt, so every pre-session path has no encoder and its errors stay plaintext."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "In-session terminal errors are sealed in the encrypted envelope",
+          "body": "The error page (JSON branch), the router's schema-validation refusal, `b.problemDetails.respond` (now accepting an optional `req`), and the access-deny middleware now seal their error body via `req.apiEncryptEncode` when a session is active — so an in-session error no longer ships as plaintext while the surrounding traffic is encrypted. A sealed problem+json is labelled `application/json` (the envelope), not `application/problem+json`. With no active session (or if encoding fails) the body stays plaintext and readable, unchanged."
+        },
+        {
+          "title": "Streamed non-2xx responses preserve a bounded error-body prefix",
+          "body": "`b.httpClient.request({ responseMode: \"stream\" })` (and `b.httpClient.downloadStream`, which composes it) previously drained and discarded the body of a `>= 400` response. The rejection is unchanged, but the thrown error now carries a bounded (16 KiB) prefix of the body on `err.body`, so a caller can read the problem+json / error detail. The prefix is collected through `b.safeBuffer.boundedChunkCollector`, so a hostile oversized error body can't accumulate unbounded."
+        },
+        {
+          "title": "SSE transport-fault close audits as a failure",
+          "body": "An SSE channel closed by a transport fault (a stream `error`, a failed heartbeat write) now emits its `sse.channel_closed` audit event with `outcome: \"failure\"` and a `reason`, instead of the `\"success\"` outcome an intentional `channel.close()` records — so an operator's evidence stream can tell a dropped connection from a clean shutdown."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Error bodies no longer leak in plaintext on an encrypted channel",
+          "body": "Before this release, a request that established an apiEncrypt session but then failed (validation error, access denial, server error rendered through the error page or problem-details) returned its error body in plaintext, even though every successful response on the same channel was encrypted — exposing error detail (paths, field names, refusal reasons) to a network observer. In-session errors are now encrypted symmetrically with successes; pre-session errors, which a client must be able to read to recover, remain plaintext by design."
+        }
+      ]
+    },
+    {
+      "heading": "Migration",
+      "items": [
+        {
+          "title": "Opt into reading non-2xx encrypted errors",
+          "body": "No change is required for existing callers — `b.httpClient.encrypted` still defaults to `responseMode: \"reject\"` (throw on non-2xx). To read an error's status and decrypted detail, create the client with `responseMode: \"passthrough\"` (or pass it per request) and branch on the returned `ok` / `statusCode`. The new `ok` field is additive and does not affect existing `{ statusCode, headers, body }` consumers."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.14.18.json

@@ -0,0 +1,127 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.18",
+  "date": "2026-06-01",
+  "headline": "Advertised endpoints that silently failed now work, plus opt-in response-shaping, transport hardening, and ZIP64 read",
+  "summary": "This release closes a set of advertised-but-broken surfaces and adds the extensibility hooks operators kept having to work around. Three endpoints silently failed: the CSP-report endpoint returned 413 to every POST (it never parsed a report), the SCIM server broke on any streamed request body, and both came from misusing the bounded-buffer collector as if it consumed a stream — so this release adds the missing b.safeBuffer.collectStream(stream, opts) primitive and routes both through it. The agent orchestrator's graceful-drain phase never registered (wrong method name), the OpenAPI/AsyncAPI doc endpoints ignored a documented single-origin CORS allowlist, and the EU AI Act Article 50 HTML banner skipped Buffer response bodies. Deny-path refusals gained an RFC 9457 problem-type derived from the problem code (a 429 read about:blank before) and now treat a consumer hook that commits headers as terminal. On top of the fixes, several middlewares gain operator hooks (custom JSON/HTML error formatters, problem+json, refusal callbacks), several entry points gain escape-hatch opts (a configurable Authorization scheme, legacy filename charsets, a submission relay port, an exit-after-phases shutdown), the local job queue can point at an operator-supplied database/table/schema, breach-notification deadlines gain a running escalation clock, the archive reader now reads ZIP64, and external databases gain an opt-in TLS-required posture plus OpenTelemetry db.* trace attributes. Every behavior-changing addition is strictly opt-in — an operator who sets no new option sees no change.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.middleware.cspReport` returned 413 to every POST; `b.middleware.scimServer` broke on streamed bodies",
+          "body": "Both read the request body by calling `b.safeBuffer.boundedChunkCollector(req, …)` — but that primitive takes a single options object and returns a push-collector, it does not consume a stream. The call passed the request as the options argument (so `maxBytes` was undefined and it threw), turning every CSP-report POST into a 413 and failing every streamed SCIM request. Both now read the body through the new `b.safeBuffer.collectStream`. A valid CSP report now reaches the parse/audit/`onReport` path and returns 204."
+        },
+        {
+          "title": "Agent orchestrator graceful-drain phase never registered",
+          "body": "`b.middleware.agentOrchestrator` registered its drain phase against a method the shutdown handle does not expose, so the phase silently never ran — connections were not drained on a graceful shutdown. It now registers through the real `addPhase` so the documented drain actually fires."
+        },
+        {
+          "title": "OpenAPI / AsyncAPI doc endpoints ignored `accessControl: { allowOrigin }`",
+          "body": "The documented single-origin CORS form was read by neither serve middleware (only `accessControl: \"public\"` was handled), so an operator passing `{ allowOrigin: \"https://docs.example.com\" }` got no `Access-Control-Allow-Origin` header. The object form now emits a validated origin (passed through `b.safeUrl`, rejecting CR/LF injection, userinfo, and non-http(s) schemes) with `Vary: Origin`."
+        },
+        {
+          "title": "EU AI Act Article 50 HTML banner skipped Buffer response bodies",
+          "body": "In HTML mode the disclosure banner was injected only when the final response chunk was a string; a `res.end(Buffer.from(html))` body (the common path through templating/render) silently received no banner. Buffer bodies are now decoded under the response charset, injected, and re-encoded (with a one-time warning and untouched bytes for charsets without a transcoder)."
+        },
+        {
+          "title": "Deny-path 429 (and any refusal) emitted `type: about:blank`",
+          "body": "The shared deny-path writer documented deriving the RFC 9457 problem-type URI from the refusal's problem code, but only ever read an explicit problem type — so a rate-limit 429 (which supplies a code, not a type) reported `about:blank`. The type is now derived from the problem code (`<base>/<code>`) when no explicit type is given, so a 429 reads `…/rate-limit-exceeded`."
+        },
+        {
+          "title": "A deny-path `onDeny` hook that commits headers is treated as terminal",
+          "body": "The deny-path writer's terminal check looked only at `res.writableEnded`; a response-wrapping consumer whose `onDeny` sent headers without ending the response fell through into a second `writeHead` and hit \"headers already sent\". The writer now also treats `res.headersSent` as terminal, so wrapping responders compose cleanly."
+        },
+        {
+          "title": "`b.mail.send.deliver` DANE TLSA lookup ignored the configured port",
+          "body": "The DANE TLSA query name (`_<port>._tcp.<host>`) was hardcoded to port 25; a delivery configured for a 587/465 relay still queried port 25. The lookup now uses the configured port."
+        }
+      ]
+    },
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.safeBuffer.collectStream(stream, opts)` — bounded stream-to-Buffer reader",
+          "body": "Reads a Node Readable (a request body, an upstream response) fully into one Buffer with the byte cap enforced at every chunk — the streaming sibling of `boundedChunkCollector`, which is a push-collector, not a stream consumer. Resolves the concatenated Buffer on end; rejects (and destroys the stream) the moment a chunk would overflow `maxBytes`."
+        },
+        {
+          "title": "Operator response-shaping hooks",
+          "body": "`b.errorPage` gains `jsonFormatter(info, req)` and `renderHtml(info, req)` overrides plus a `problemDetails: true` RFC 9457 mode (each falls back to the built-in envelope on throw, so the original error is never masked); `b.render.json` gains an `opts.replacer` passthrough (BigInt/Date); `b.middleware.cspReport` gains `onReject(req, res, { status, reason })` for the otherwise-empty-bodied 405/413/400 refusals; `b.static` gains `onError` firing on every refusal path, mirroring `onServe`."
+        },
+        {
+          "title": "Escape-hatch opts for non-default deployments",
+          "body": "`b.appShutdown.create({ exitAfterPhases })` lets a manual `shutdown()` exit after its phases (not only a signal-driven shutdown); `b.middleware.attachUser({ bearerScheme, tokenExtractor })` reads `Token`/`DPoP`/gateway Authorization schemes (RFC 6750 / RFC 9449); `b.middleware.bodyParser` multipart `filenameCharsets` opts iso-8859-1 `filename*` decoding in (RFC 5987); `b.mail.send.deliver.create({ port })` routes through a 587/465 submission relay (RFC 6409 / RFC 8314)."
+        },
+        {
+          "title": "Local job queue: bring-your-own database, table, and schema",
+          "body": "`b.queue.init` local-backend config accepts `db` (an operator-supplied handle), `table`, and `schema`. Table and schema names are validated and quoted as SQL identifiers (refused at init time when unsafe); the sealed `payload`/`lastError` columns stay sealed regardless of the physical table. Defaults are unchanged (`_blamejs_jobs` on the framework/cluster database)."
+        },
+        {
+          "title": "`b.breach.deadline.createClock` — running breach-notification escalation clock",
+          "body": "A detection-to-notification clock that escalates each affected US state's statutory breach-notification deadline (an approaching warning, a passed alert) and accepts per-state filing acknowledgements, complementing the existing static deadline lookup. It composes the incident-report deadline clock, so there is a single timer to start and stop."
+        },
+        {
+          "title": "`b.archive.read.zip` reads ZIP64",
+          "body": "Archives with more than 65535 entries or with sizes/offsets past 4 GiB now decode transparently (APPNOTE 6.3.10 §4.3.14 / §4.3.15 / §4.5.3). Previously such archives were refused outright. The bomb, Zip-Slip, PATH_MAX, and entry-type defenses all continue to apply to the resolved 64-bit values."
+        },
+        {
+          "title": "External-database opt-in TLS posture and OpenTelemetry `db.*` traces",
+          "body": "`b.externalDb` backends accept `requireTls: true` (default off), which refuses a backend at config time unless its declared transport is TLS (`tls` / a truthy `ssl` / `sslmode` `require|verify-ca|verify-full`) — for cardholder data or ePHI (PCI-DSS v4.0 Req 4 / HIPAA §164.312(e)). Query/transaction/read traces now also carry OpenTelemetry database semantic-convention attributes (`db.system`, `db.operation`, `db.statement` (sanitized), `db.name`)."
+        },
+        {
+          "title": "Opt-in schema-drift detection",
+          "body": "`b.db.init({ onDrift })` (and the underlying `reconcile({ onDrift })`) opts into config-vs-live column-drift detection: `\"warn\"` reports columns present in the live database but absent from the declared schema; `\"refuse\"` makes the framework refuse to boot on drift (a strict-schema posture — ISO 27001:2022 A.8.9 / SOC 2 CC8.1). The default (`\"ignore\"`) is unchanged, and drift is never resolved destructively."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "`b.guardEmail` documents its actual Unicode scope",
+          "body": "Domain-side IDN/Punycode and mixed-script confusable detection are supported (and unchanged); the local-part is ASCII atext only (RFC 5321/5322). The documentation previously implied RFC 6531 SMTPUTF8/EAI mailbox names were accepted — they are rejected by default, re-openable behind a future `allowUnicodeLocalPart` opt-in, to keep homograph/confusable exposure bounded to the domain side. No validation behavior changed."
+        },
+        {
+          "title": "Body-parse 4xx responses send `Connection: close`",
+          "body": "Every body-parse rejection (malformed JSON, poisoned key, oversized payload, bad content-length) now closes the connection, matching the chunked-decode path, to deny an upstream proxy reusing a socket whose request stream the parser abandoned mid-body (RFC 9112 §9.6)."
+        },
+        {
+          "title": "Archive-reader default entry-count cap raised to 1,048,576",
+          "body": "To read large (ZIP64) archives, the default `bombPolicy.maxEntries` rises from 65535 to 2^20. An operator who set `maxEntries` explicitly is unaffected; the cap can still be lowered."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Closed a request-smuggling socket-reuse window on body-parse rejections",
+          "body": "Pairing every body-parse 4xx with `Connection: close` stops an upstream proxy from reusing a connection whose request body the parser abandoned mid-stream — a request/response desync vector that previously applied only to the chunked-decode rejections."
+        },
+        {
+          "title": "Opt-in TLS-required posture for regulated external databases",
+          "body": "Set `requireTls: true` on an external-database backend carrying cardholder data or ePHI so a non-TLS (or fallback-permitting `sslmode`) connection is refused at boot rather than silently transmitting in the clear (PCI-DSS v4.0 Req 4 / HIPAA §164.312(e))."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Regression guards for every fixed bug class",
+          "body": "The internal pattern gate gains detectors so each fixed mistake cannot return: a bounded-collector call used as a stream consumer, a deny-path writer that does not guard `headersSent`, an `appShutdown` phase registered through a non-existent method, a body-parse error writer missing `Connection: close`, a raw `_blamejs_jobs` table reference bypassing the configured-table quoting, and a breach clock that re-rolls its own timer instead of composing the incident-report clock."
+        }
+      ]
+    },
+    {
+      "heading": "Migration",
+      "items": [
+        {
+          "title": "No action required; new behavior is opt-in",
+          "body": "Every addition is additive or opt-in: `requireTls`, schema-drift `onDrift`, the response-shaping hooks, the new entry-point opts, and the breach clock all default to prior behavior when unset. Two defaults shift in a backward-compatible direction: body-parse 4xx now send `Connection: close`, and the archive reader's default entry-count ceiling rises to 2^20 (lower it via `bombPolicy.maxEntries` if you relied on the old cap). `b.db.reconcile` now returns a drift report object instead of undefined; the framework's own call ignores the return, so existing callers are unaffected."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.14.19.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.19",
+  "date": "2026-06-02",
+  "headline": "ZIP64 write completes large-archive support, plus a PKCE-downgrade defense, SCIM Bulk, OID4VCI kid-resolution, SPF macros, DMARC report building, and OpenAPI 3.2",
+  "summary": "This release fills out several standards the framework previously read but could not write, or advertised but did not fully implement. The ZIP writer now emits ZIP64, so archives larger than 65535 entries or 4 GiB are produced instead of refused (the reader gained ZIP64 in the previous release; the two now round-trip). The OAuth client refuses an OP whose discovery metadata advertises PKCE methods without S256 — closing a stripped-S256 downgrade. The SCIM server gains opt-in Bulk operations, the OID4VCI issuer accepts a kid-resolution hook for EUDI-Wallet attested-key proofs (and a latent cache-cleanup crash on the issuance path is fixed), the inbound SPF check expands RFC 7208 macros and evaluates the exists mechanism, a DMARC aggregate-report builder is the inverse of the existing parser, and the OpenAPI emitter supports 3.2 with webhooks and a JSON Schema dialect. Every behavior-changing addition is opt-in or additive: classic archives emit byte-for-byte unchanged, OpenAPI still defaults to 3.1.0, SCIM Bulk stays disabled unless configured, and the PKCE refusal only fires for an OP that explicitly advertises a non-S256 method set.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.archive.zip` writes ZIP64",
+          "body": "When an archive exceeds 65535 entries, or any entry's compressed/uncompressed size or local-header offset exceeds 4 GiB, the writer now emits ZIP64 — the classic field carries the `0xFFFF`/`0xFFFFFFFF` sentinel and a ZIP64 extended-information extra field (header id `0x0001`) plus a ZIP64 EOCD record and locator are written (APPNOTE 6.3.10 §4.3.14 / §4.3.15 / §4.4.8 / §4.5.3). Archives within the classic limits emit byte-for-byte unchanged, and `b.archive.read.zip` reads the ZIP64 output transparently. Previously the writer refused past 65535 entries."
+        },
+        {
+          "title": "`b.middleware.scimServer` opt-in SCIM 2.0 Bulk operations",
+          "body": "A `/Bulk` POST endpoint (RFC 7644 §3.7) with `maxOperations` / `maxPayloadSize` caps, `bulkId` cross-reference resolution (§3.7.2), and `failOnErrors` short-circuiting, advertised in `ServiceProviderConfig` when enabled via `opts.bulk`. The request body is read through the bounded stream reader. Bulk stays disabled (and `/Bulk` returns 501) unless `opts.bulk` is set."
+        },
+        {
+          "title": "`b.auth.oid4vci` accepts a `resolveKid` proof-key hook",
+          "body": "An OID4VCI proof JWT that carries a header `kid` without an inline `jwk` (the EUDI-Wallet attested-key shape) can now be verified by supplying `create({ resolveKid(kid, header) })`, which maps the key id to a holder key. The resolved key passes the same alg/key-type cross-check (CVE-2026-22817) as the inline path before import and becomes the credential's `cnf` binding. Without a resolver, a kid-only proof is still refused, exactly as before."
+        },
+        {
+          "title": "SPF macro expansion + `exists`; DMARC aggregate-report builder",
+          "body": "`b.mail.spf.verify` now expands RFC 7208 §7 macros (`%{i}`/`%{s}`/`%{l}`/`%{d}`/`%{o}`/`%{h}`/`%{v}` with the reverse / digit-count / delimiter transformers and `%%`/`%_`/`%-` escapes) and evaluates the `exists` mechanism (§5.7); the §4.6.4 DNS-lookup and void-lookup ceilings still bound every macro-driven query. New `b.mail.dmarc.buildAggregateReport` serializes a DMARC aggregate (RUA) report to RFC 7489 Appendix C XML — the inverse of `parseAggregateReport` — with optional gzip and XML-metacharacter escaping of observed identifiers."
+        },
+        {
+          "title": "OpenAPI 3.2 — webhooks and `jsonSchemaDialect`",
+          "body": "`b.openapi.create({ openapi: \"3.2.0\" })` opts into OpenAPI 3.2; a `webhook(name, method, opts)` builder registers top-level `webhooks` (API-initiated out-of-band operations), and `jsonSchemaDialect` declares the document's default JSON Schema dialect. `parse()` accepts 3.1.x or 3.2.x and validates webhook operations (including dangling-security references) with the same rules as paths. 3.1.0 stays the default emitted version and existing 3.1 documents are unchanged."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "OID4VCI issuance crashed on cache cleanup",
+          "body": "The pre-authorized-code exchange and credential-issuance paths called `.delete()` on their internal `b.cache` stores, which expose `del()` — so the cleanup step threw and the issuance flow could not complete end-to-end. The three call sites now use `del()`."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "PKCE-downgrade defense for OAuth / OIDC clients",
+          "body": "The OAuth client already mandates PKCE-S256 on its own side but never inspected the OP's published `code_challenge_methods_supported`. It now refuses, at `authorizationUrl` / `pushAuthorizationRequest`, an OP whose discovery metadata advertises that field without `\"S256\"` (plain-only / empty) — blocking a stripped-S256 downgrade that would otherwise drive the client into an authorization request the OP claims it cannot verify (RFC 9700 §4.13, RFC 7636). An OP that does not publish the field, and static-endpoint clients that perform no discovery, are unaffected."
+        }
+      ]
+    },
+    {
+      "heading": "Migration",
+      "items": [
+        {
+          "title": "No action required; additions are additive or opt-in",
+          "body": "ZIP64 write is additive — archives within the classic 65535-entry / 4 GiB limits emit identical bytes, and the writer simply no longer refuses larger ones. SCIM Bulk, the OID4VCI `resolveKid` hook, the DMARC report builder, and OpenAPI 3.2 are all opt-in (OpenAPI still defaults to 3.1.0). The SPF `exists` mechanism, previously returning permerror, now evaluates per RFC 7208 — `b.mail.spf.verify` returns a verdict and refuses nothing. The PKCE-downgrade refusal only fires for an OP that explicitly advertises a non-S256 PKCE method set."
+        }
+      ]
+    }
+  ]
+}