@blamejs/blamejs-shop 0.3.7 → 0.3.9

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.9 (2026-05-30) — **Automatic discounts now apply at checkout.** The automatic-discount rules you define in the admin console — an amount or percentage off a cart that meets a threshold — now reduce the order total at checkout. When a rule matches, the discount is applied (capped so it never exceeds the order subtotal) and shown in the quote the shopper pays; when no rule matches, or none are defined, the total is exactly as before, so a store that has not set up rules is unaffected. The admin screen for managing rules already shipped; this wires it through to the checkout quote and the charge. **Added:** *Automatic cart discounts at checkout* — When a cart matches a configured automatic-discount rule, the checkout reduces the order total by the rule's saving — capped to the order subtotal so the total is never negative — and the reduced amount is what the shopper is charged. With no matching rule, or no rules defined, the order total is unchanged, so the change stays invisible until you set rules up; any rule-engine error degrades to no discount rather than blocking checkout.
+
+- v0.3.8 (2026-05-30) — **Update the vendored blamejs runtime to v0.14.6.** Refreshes the vendored blamejs runtime from v0.14.5 to v0.14.6, a maintenance update. The createApp request-lifecycle security stack the shop composes — CSRF, fetch-metadata, body-parser, cookies, rate limiting — is unchanged in default behavior. v0.14.6 adds opt-in RFC 9457 problem+json and onDeny response hooks to the access-refusal middleware (defaults unchanged, so nothing the shop relies on shifts) and corrects a few internal export and bearer-scope paths. No operator action is required. **Changed:** *Vendored blamejs runtime updated to v0.14.6* — The pinned blamejs runtime moves from v0.14.5 to v0.14.6. The middleware the storefront and admin compose keeps its current default behavior; the release adds opt-in problem-details / onDeny response hooks to the refusal middleware and fixes internal export and bearer-scope paths. No behavior change for the shop.
+
 - v0.3.7 (2026-05-30) — **Shipping zones now apply at checkout.** The shipping zones you define in the admin console — per-region rates by destination, parcel weight, and order value — now drive the shipping options shown at checkout. When a cart's destination matches a zone, the shopper sees that zone's rates; when no zone matches, or none are defined, checkout falls back to the existing flat-rate table exactly as before, so a store that has not configured zones is entirely unaffected. A fully digital order is never quoted physical shipping. The admin screen for managing zones already shipped; this wires it through to the checkout quote. **Added:** *Zone-based shipping rates at checkout* — When a cart's destination matches a configured shipping zone, the checkout shipping quote uses that zone's rates — resolved by destination country and region, parcel weight, and order subtotal — instead of the flat-rate table. With no matching zone, or no zones defined, checkout returns the existing flat rates unchanged, so the change stays invisible until you set zones up; any lookup error degrades to the same flat fallback. A fully digital order (no shipping-requiring item) is never quoted physical shipping.
 
 - v0.3.6 (2026-05-30) — **Update the vendored blamejs runtime to v0.14.5.** Refreshes the vendored blamejs runtime from v0.13.46 to v0.14.5, a maintenance update. The request-lifecycle security stack the storefront and admin depend on — CSRF, fetch-metadata, body-parser, cookies, and rate limiting — is unchanged across this range. The runtime's breaking changes in this window (stricter OAuth JAR request-object typing and a PGP signature return type) are in surfaces this shop does not use, so there is no behavior change and no operator action is required. **Changed:** *Vendored blamejs runtime updated to v0.14.5* — The pinned blamejs runtime moves from v0.13.46 to v0.14.5, picking up the framework's maintenance and hardening work across that range. The createApp request-lifecycle middleware the shop composes (CSRF, fetch-metadata, body-parser, cookie, and rate-limit layers) is unchanged, so this refresh carries no behavior change for the storefront or admin console.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.7",
+  "version": "0.3.9",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/checkout.js

@@ -146,6 +146,17 @@ function create(deps) {
   // server-authoritative computation the cart page renders, so the
   // "review your order" subtotal and the charged amount agree.
   var quantityDiscounts = deps.quantityDiscounts || null;
+  // Optional automatic-discount engine. When wired, the quote consults
+  // every operator-authored auto-discount rule against the resolved
+  // cart and reduces the subtotal by the matched savings (clamped to
+  // [0, subtotal] so a rule can never drive the order negative or
+  // charge more than the cart is worth). Disabled when absent — the
+  // discount is zero and every total is identical to the un-wired
+  // flow, so production stays unchanged until a rule is defined. Only
+  // subtotal-reducing savings feed `discount_minor`; a `free_shipping`
+  // rule's savings are a shipping concern and are left to the shipping
+  // primitive, not folded into the subtotal discount here.
+  var autoDiscount  = deps.autoDiscount || null;
 
   // Reprice a list of cart lines through the quantity-discount engine.
   // Returns a shallow copy with `unit_amount_minor` overwritten by the
@@ -179,6 +190,72 @@ function create(deps) {
     return out;
   }
 
+  // Resolve the automatic-discount effect for a priced cart. Builds
+  // the engine's cart shape from the resolved lines + subtotal, asks
+  // the engine which operator-authored rules apply, and returns the
+  // subtotal-reducing savings (clamped to [0, subtotal]) plus the
+  // per-rule breakdown the post-commit recorder replays.
+  //
+  // FALLBACK (zero regression): no engine wired, a non-finite or
+  // negative aggregate, an empty result, or ANY throw collapses to
+  // `{ discount_minor: 0, applied: [] }` — byte-identical to the
+  // un-wired flow. The engine is consulted but never trusted to keep
+  // the buy path alive.
+  //
+  // PAYMENT SAFETY: the returned discount is clamped to
+  // [0, subtotalMinor] so it can never be negative and never exceeds
+  // the subtotal — the order total can therefore never go negative,
+  // and a customer can never be charged less than zero or credited
+  // more than the cart is worth.
+  async function _resolveAutoDiscount(lines, subtotalMinor, customerId) {
+    if (!autoDiscount || typeof autoDiscount.evaluate !== "function") {
+      return { discount_minor: 0, applied: [] };
+    }
+    try {
+      var evalLines = [];
+      for (var i = 0; i < lines.length; i += 1) {
+        var l = lines[i];
+        evalLines.push({
+          sku:              l.sku,
+          quantity:         l.qty,
+          unit_price_minor: l.unit_amount_minor,
+        });
+      }
+      var res = await autoDiscount.evaluate({
+        cart: {
+          subtotal_minor: subtotalMinor,
+          lines:          evalLines,
+        },
+        customer_id: customerId || undefined,
+      });
+      var appliedRaw = res && Array.isArray(res.applied) ? res.applied : [];
+      var total   = 0;
+      var applied = [];
+      for (var j = 0; j < appliedRaw.length; j += 1) {
+        var entry = appliedRaw[j];
+        // A `free_shipping` rule's savings are a shipping reduction,
+        // not a subtotal discount — excluded so the subtotal-level
+        // `discount_minor` stays a pure subtotal reduction (the
+        // shipping primitive owns the shipping side).
+        if (!entry || entry.value_kind === "free_shipping") continue;
+        var s = entry.savings_minor;
+        if (!Number.isInteger(s) || s <= 0) continue;
+        total += s;
+        applied.push({ rule_slug: entry.rule_slug, savings_minor: s });
+      }
+      if (!Number.isFinite(total) || total <= 0) {
+        return { discount_minor: 0, applied: [] };
+      }
+      // Clamp to the subtotal floor: the discount can reduce the
+      // subtotal to zero but never past it.
+      if (total > subtotalMinor) total = subtotalMinor;
+      return { discount_minor: total, applied: applied };
+    } catch (_e) {
+      // Any engine failure -> no discount, never a 5xx on the buy path.
+      return { discount_minor: 0, applied: [] };
+    }
+  }
+
   // Validate a gift-card code against a priced quote: the card exists,
   // is active, not expired, and matches the order currency. Returns
   // the credit to apply (capped at the grand total so an order total
@@ -336,6 +413,33 @@ function create(deps) {
     });
   }
 
+  // Record each applied auto-discount rule against a committed order
+  // so the engine's redemption counter + event log reflect the use.
+  // Best-effort / drop-silent: the customer has already been charged
+  // (or the order is otherwise placed) by the time this runs, so a
+  // recording failure must NEVER fail or reverse the order. Each
+  // record is isolated in its own try/catch so one bad row can't stop
+  // the rest. No-op when the engine isn't wired or nothing applied.
+  async function _recordAutoDiscounts(quote, orderId, customerId) {
+    if (!autoDiscount || typeof autoDiscount.recordApplication !== "function") return;
+    var applied = quote && Array.isArray(quote.auto_discounts) ? quote.auto_discounts : [];
+    for (var i = 0; i < applied.length; i += 1) {
+      var a = applied[i];
+      if (!a || !a.rule_slug) continue;
+      try {
+        await autoDiscount.recordApplication({
+          rule_slug:     a.rule_slug,
+          order_id:      orderId,
+          savings_minor: a.savings_minor,
+          customer_id:   customerId || undefined,
+        });
+      } catch (_e) {
+        // drop-silent — by design: the order is already placed; a
+        // failed redemption record must not surface to the buyer.
+      }
+    }
+  }
+
   // Compose a quote from a cart + ship-to + (optional) selected
   // shipping service. Pure read — no DB writes.
   async function _buildQuote(input) {
@@ -390,10 +494,18 @@ function create(deps) {
     }
 
     var shippingMinor = selected ? selected.amount_minor : 0;
+
+    // Automatic discounts: consult the operator-authored rule engine
+    // (when wired) for the subtotal reduction this cart earns. The
+    // resolver clamps the result to [0, subtotal] and falls back to 0
+    // on any failure, so the total math below is identical to the
+    // un-wired flow whenever no rule applies.
+    var autoDisc = await _resolveAutoDiscount(lines, sub.amount_minor, c.customer_id || null);
+
     var totals = pricing.totals(c, lines, {
       tax_minor:      taxRow.tax_minor,
       shipping_minor: shippingMinor,
-      discount_minor: 0,
+      discount_minor: autoDisc.discount_minor,
     });
 
     return {
@@ -405,6 +517,10 @@ function create(deps) {
       shipping_rates:    ratesRow.services,
       selected_shipping: selected,
       totals:            totals,
+      // Per-rule breakdown that fed `totals.discount_minor`, replayed
+      // by confirm()'s post-commit recorder. Empty when no rule
+      // applied (or no engine wired).
+      auto_discounts:    autoDisc.applied,
     };
   }
 
@@ -499,6 +615,10 @@ function create(deps) {
         });
         if (gc) await _redeemGiftCard(gc, paidOrder.id);
         if (loy) await _redeemLoyalty(loy, loyaltyCustomerId, paidOrder.id);
+        // Best-effort: record the auto-discount redemptions against the
+        // placed order. Runs post-commit so a recording failure can't
+        // reverse an order that's already paid.
+        await _recordAutoDiscounts(quote, paidOrder.id, cartRow.customer_id || null);
         await cart.setStatus(quote.cart_id, "converted");
         var settled = await order.transition(paidOrder.id, "mark_paid", {
           reason: loy && !gc ? "loyalty:full" : "gift_card:full",
@@ -552,6 +672,10 @@ function create(deps) {
       // guard.
       if (gc) await _redeemGiftCard(gc, createdOrder.id);
       if (loy) await _redeemLoyalty(loy, loyaltyCustomerId, createdOrder.id);
+      // Best-effort: record the auto-discount redemptions against the
+      // placed order. Runs post-commit so a recording failure can't
+      // reverse or fail an order whose PaymentIntent already exists.
+      await _recordAutoDiscounts(quote, createdOrder.id, cartRow.customer_id || null);
 
       // Mark the cart converted so a refresh of the storefront
       // doesn't accidentally re-quote the same cart.

package/lib/storefront.js

@@ -7139,7 +7139,7 @@ function mount(router, deps) {
 
   // Compute the cart/checkout totals the shopper sees BEFORE paying.
   // Composes the SAME tax + shipping primitives the charge runs through
-  // (via checkout.quote, which prices tax against the post-discount
+  // (via checkout.quote, which prices tax against the pre-discount
   // subtotal + picks shipping rates for the destination), so the
   // displayed grand total agrees with what Stripe is later asked to
   // charge for that destination. Returns:

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.14.5",
-      "tag": "v0.14.5",
+      "version": "0.14.6",
+      "tag": "v0.14.6",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/.github/workflows/ci.yml

@@ -169,6 +169,33 @@ jobs:
         # so a transient registry hang doesn't block unrelated releases.
         run: node scripts/check-vendor-currency.js
 
+  actions-currency:
+    # Asserts every SHA-pinned GitHub Action in .github/workflows
+    # matches the latest upstream release. A stale action becomes a
+    # release blocker HERE, with a ready-to-paste pin line in the
+    # report — so it's fixed in the release rather than surfaced
+    # after-the-fact by a Dependabot PR.
+    name: Actions currency (pinned actions vs upstream latest)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        with:
+          node-version: 24.14.1
+      - name: Run actions-currency check
+        # Resolves each pinned `uses: owner/repo@<sha>  # vX.Y.Z` against
+        # the GitHub API (releases/latest, falling back to highest
+        # semver tag). Fails on any "stale" finding; API errors stay
+        # advisory unless BLAMEJS_ACTIONS_CURRENCY_STRICT=1 so a
+        # transient API hang doesn't block unrelated releases.
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: node scripts/check-actions-currency.js
+
   secret-scan:
     name: Secret scan (gitleaks)
     runs-on: ubuntu-latest

package/lib/vendor/blamejs/.github/workflows/codeql.yml

@@ -32,7 +32,7 @@ jobs:
       # hop); the language ID picks up the .js files under lib/ +
       # scripts/ regardless.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba  # v4.35.5
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v4.36.0
         with:
           languages: javascript-typescript
           # security-extended adds higher-precision queries beyond the
@@ -45,6 +45,6 @@ jobs:
       # Auto-build is skipped because CommonJS files don't need a build
       # step; CodeQL extracts straight from source.
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba  # v4.35.5
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v4.36.0
         with:
           category: "/language:javascript-typescript"

package/lib/vendor/blamejs/.github/workflows/release-container.yml

@@ -128,14 +128,14 @@ jobs:
           persist-credentials: false
 
       - name: Set up QEMU (for ARM64 cross-build)
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4.0.0
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3  # v4.1.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
 
       - name: Log in to GHCR
         if: ${{ !inputs.dry_run }}
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -317,7 +317,7 @@ jobs:
       # against a public package, so this is the right shape regardless
       # of visibility.
       - name: Log in to GHCR
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

package/lib/vendor/blamejs/.github/workflows/scorecard.yml

@@ -40,7 +40,7 @@ jobs:
           retention-days: 5
 
       - name: Upload SARIF to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba  # v4.35.5
+        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v4.36.0
         with:
           sarif_file: results.sarif
 

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.14.x
 
+- v0.14.6 (2026-05-30) — **Access-refusal middleware can return RFC 9457 problem+json or a custom response, and several documented-but-uncallable APIs are now reachable.** Every access-refusal middleware — the auth gates (bearer, DPoP, mTLS, AAL, bound-key), CSRF, CORS, rate-limit, bot-guard, age-gate, the host and network allowlists, and the method and content-type gates — now accepts two uniform options: `problemDetails: true` returns an RFC 9457 `application/problem+json` body, and `onDeny(req, res, info)` hands the response to the caller. With neither set the refusal is byte-for-byte what it was, so this is a drop-in change that lets a service standardize one error envelope across its API instead of working around each middleware's hardcoded body. Alongside that: `b.middleware.requireBoundKey` is now exported (it was documented and tested but never wired into the middleware surface), `b.middleware.bearerAuth` accepts `requiredScopes` (previously rejected at construction, which made its scope-enforcement path unreachable), API-key refusals send the RFC 6750 challenge code that matches the failure, two documented call paths that named a missing namespace segment are corrected, and the release flow now flags stale GitHub Actions and vendored bundles — with a ready-to-paste pin — before a dependency PR is needed. **Added:** *Uniform `onDeny` and `problemDetails` options on every access-refusal middleware* — Each request-lifecycle middleware that refuses a request now takes `problemDetails: true` to emit an RFC 9457 `application/problem+json` body (composing `b.problemDetails`) and `onDeny(req, res, info)` to take over the response entirely; `info` carries the status, a machine reason, and the middleware-specific fields. The deny-path response headers (`Allow`, `WWW-Authenticate`, `Retry-After`, `Accept`) survive every mode. When neither option is set the response is unchanged. Covers `requireAuth`, `requireAal`, `requireMethods`, `requireContentType`, `requireMtls`, `requireBoundKey`, `bearerAuth`, `dpop`, `csrfProtect`, `fetchMetadata`, `botGuard`, `ageGate`, `hostAllowlist`, `networkAllowlist`, `cors`, `rateLimit`, and `dailyByteQuota` (whose existing `onExceeded` keeps working as an alias of `onDeny`). **Fixed:** *`b.middleware.requireBoundKey` is now callable* — The Bearer-API-key middleware was documented (with examples and tests) but never exported on `b.middleware`, so `b.middleware.requireBoundKey(...)` threw `undefined is not a function`. It is now wired into the middleware surface. · *`b.middleware.bearerAuth` accepts `requiredScopes`* — The RFC 6750 scope-enforcement path read `opts.requiredScopes`, but the option was rejected at construction with `unknown option`, making the 403 `insufficient_scope` behavior unreachable. `requiredScopes` is now an accepted option. · *RFC 6750 challenge codes on API-key refusals* — `b.middleware.requireBoundKey` now sends the `WWW-Authenticate` error code that matches the failure: `insufficient_scope` on a 403 missing-scope, `invalid_token` on an unknown or revoked token, and no error code on a 401 that presented no credentials (RFC 6750 §3). It previously sent `invalid_request` for every refusal. · *Corrected two documented call paths* — The compliance and network references named a path that dropped a namespace segment: the conformity-assessment scaffold is at `b.cra.report.conformityAssessment` (not `b.cra.conformityAssessment`), and the per-socket tuning helper is at `b.network.socket.applyToSocket` (not `b.network.applyToSocket`). The documented signatures now match the callable paths. · *GitHub Actions pins refreshed* — `github/codeql-action` 4.35.5 to 4.36.0, and `docker/login-action`, `docker/setup-buildx-action`, and `docker/setup-qemu-action` to their latest releases. **Detectors:** *`@primitive` reachability gate* — A new check resolves every documented `b.X.Y` primitive against the actual public surface and fails the build when a documented path is not callable (factory-instance shorthands excluded). This is the gate that would have caught the `requireBoundKey` and call-path issues above. · *Deny-path composition gate* — A new check requires every access-refusal middleware to route its refusal through the shared deny-response writer, so a future middleware cannot reintroduce a hardcoded body that locks callers out of `onDeny` / `problemDetails`. · *Actions and vendor currency in the release flow* — The release flow now fails the cut when a SHA-pinned GitHub Action or a vendored bundle is behind its latest upstream release. The actions report prints a ready-to-paste `owner/repo@<sha>  # vX.Y.Z` pin and every file and line that uses it, so the bump is copy-paste rather than an after-the-fact dependency PR. Transient registry or API errors stay advisory so a flaky network response does not block an unrelated release.
+
 - v0.14.5 (2026-05-30) — **Finished cleaning up the mislabeled byte-literal lint suppressions, with no API or behavior changes.** A follow-up to the byte-literal lint tightening. The remaining suppression comments that named the byte-literal check on values that are not byte sizes — JSON-RPC error codes, HTTP status codes, octet ranges, day-in-milliseconds constants — are removed, keeping their explanatory text and any correctly-named companion suppression. Every byte-literal suppression that remains is now on genuine 1024-scale byte arithmetic. Source-comment hygiene only. **Changed:** *Remaining mislabeled byte-literal suppressions removed* — The byte-literal lint was previously a check on any multiple-of-8 integer, so suppression comments naming it were scattered across non-byte values. The last of those (in a handful of files, in mixed comment formats) are now removed — their explanatory text is retained as plain comments, and any correctly-named companion suppression is kept. The only byte-literal suppressions that remain are on genuine 1024-scale byte arithmetic. No change to any exported API, error code, wire format, or runtime behavior.
 
 - v0.14.4 (2026-05-30) — **Removed three pieces of dead code from the SAML, TLS, and JMAP surfaces; no API or behavior changes.** Cleanup of unreachable code. A reverse signature-algorithm lookup in the SAML verifier was never called — the actual verification path resolves the algorithm through the supported-signature table — so it is removed and a stale comment that referenced it is corrected. A leftover no-op placeholder in the TLS certificate re-encode path (a zero-length slice that was assigned and discarded) is removed, leaving the verbatim extension re-encode it sat next to. An unused JMAP well-known-path constant that existed only to be discarded is removed. None of this changes any exported API, error code, wire format, or runtime behavior. **Removed:** *Unreachable code in SAML, TLS, and JMAP* — Removed `_sigAlgFromUri` from the SAML module (a reverse alg lookup that was never called — the embedded XML-DSig verifier resolves the algorithm via the supported-signature table, and the redirect-binding path uses the forward `_sigAlgUrn`), a discarded zero-length-slice placeholder in the TLS certificate extension re-encode path, and an unused well-known-path constant in the JMAP server. Internal cleanup only — no change to any exported API, error code, wire format, or runtime behavior.

package/lib/vendor/blamejs/README.md

@@ -129,6 +129,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
   - CSRF protection — double-submit cookie + Origin/Referer cross-check; auto-skips Authorization-header / cookieless requests, which are not CSRF-able (`b.middleware.csrfProtect`)
   - CORS (W3C Private Network Access preflight refusal default + `allowPrivateNetwork` opt) and rate-limit are wired when configured via `middleware.cors` / `middleware.rateLimit`
   - `Cache-Control: no-store` on every 401 from `requireAuth` / `requireAal` / `requireStepUp` per RFC 9111 §5.2.2.5
+  - Every access-refusal layer takes a uniform `problemDetails: true` for an RFC 9457 `application/problem+json` body or `onDeny(req, res, info)` to render the refusal itself — so a service can standardize one error envelope across its API without working around hardcoded bodies (`b.problemDetails`)
 - **Additional middleware** to mount in your `routes` callback: compression, SSE, request logging, request-time DB role binding (`b.middleware.dbRoleFor`), in-process CIDR fence (`b.middleware.networkAllowlist`)
 - **Outbound HTTP client** — HTTP/1.1 + HTTP/2 with SSRF gate (cloud-metadata IPs hard-denied; private / loopback / link-local overridable per call); scheme + userinfo + per-host destination allowlist; redirects, multipart, interceptors, progress, encrypted cookie jar (`b.httpClient`, `b.ssrfGuard`, `b.safeUrl`)
 - **Network configurability (`b.network`)** — env-driven NTP / NTS (RFC 8915), IPv4/IPv6 NTP, DNS with IPv6 / DoH / DoT (private-CA pinning) / cache / lookup timeout; local DNSSEC signature verification (RFC 4035 — `b.network.dns.dnssec.verifyRrset` over a canonicalised RRset against RSA / ECDSA P-256·P-384 / Ed25519 DNSKEYs, plus DS-digest + key-tag, plus `verifyDenial` for NSEC / NSEC3 (RFC 5155) NXDOMAIN / NODATA proofs with iteration caps + Opt-Out handling, plus `verifyChain` to validate a full root→TLD→zone delegation chain against the pinned IANA root anchors) so a resolver client can verify both positive and negative answers instead of trusting the upstream AD bit; DANE / TLSA certificate matching (RFC 6698/7671 — `b.network.dns.dane.matchCertificate`) to pin a service's key through DNSSEC instead of a public CA; TSIG transaction signatures (RFC 8945 — `b.network.dns.tsig.sign` / `verify`) for shared-key HMAC authentication of zone transfers, dynamic updates, and query/response pairs, with constant-time MAC compare + fudge-window check (verified against dnspython); outbound HTTP proxy (`HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`); runtime DPI trust-store CA additions; application-level heartbeats; TCP socket defaults

package/lib/vendor/blamejs/SECURITY.md

@@ -260,6 +260,8 @@ Every tagged release writes a public-transparency-log entry through [Sigstore Re
 
 Both flows publish the repository's identity (`blamejs/blamejs`), the workflow path, and the release commit SHA into the public Rekor instance. `github.com/blamejs/blamejs` is intentionally public — see the [repository's settings](https://github.com/blamejs/blamejs/settings) — so the transparency-log entry doesn't disclose anything an attacker couldn't already observe from the public repo, and the auditability gain is the operator-desired property.
 
+**Currency is a release gate, not a periodic chore.** Both the SHA-pinned GitHub Actions in `.github/workflows` and the vendored bundles in `lib/vendor/MANIFEST.json` are checked against their latest upstream release on every PR (`scripts/check-actions-currency.js`, `scripts/check-vendor-currency.js`) and again in the release flow. A pin that has fallen behind fails the cut — a stale, potentially-vulnerable dependency cannot ship simply because no one noticed the upstream bump. An actually-newer upstream version is a hard failure; a transient registry/API error is advisory so a flaky network response doesn't block an unrelated release.
+
 The release workflow passes `private-repository: true` to the SLSA reusable workflow as an explicit acknowledgement that the transparency-log write is intentional. Without the override, SLSA's internal privacy detection (which inspects workflow permissions rather than repository visibility and so reports false positives for permissive-permission workflows even on public repos) would halt the attest step to avoid leaking the repository name.
 
 **Downstream forks operating from a private mirror should flip the input.** If you fork blamejs into a private GitHub organization or a non-public namespace and want releases NOT to write Rekor entries, set `private-repository: false` in `.github/workflows/npm-publish.yml`'s `provenance` job. The SLSA workflow will then halt the attest step and the release pipeline will fail; you'll either accept the loss of SLSA provenance or migrate to a private-Sigstore deployment (the SLSA framework supports this via `sigstore-go` configuration outside the scope of this document).

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.14.5",
-  "createdAt": "2026-05-30T14:33:33.657Z",
+  "frameworkVersion": "0.14.6",
+  "createdAt": "2026-05-30T16:00:48.364Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -41124,6 +41124,10 @@
           "type": "function",
           "arity": 1
         },
+        "requireBoundKey": {
+          "type": "function",
+          "arity": 1
+        },
         "requireContentType": {
           "type": "function",
           "arity": 2

package/lib/vendor/blamejs/lib/cra-report.js

@@ -190,8 +190,8 @@ function create(opts) {
 }
 
 /**
- * @primitive b.cra.conformityAssessment
- * @signature b.cra.conformityAssessment(opts)
+ * @primitive b.cra.report.conformityAssessment
+ * @signature b.cra.report.conformityAssessment(opts)
  * @since     0.8.77
  *
  * EU Cyber Resilience Act (Regulation 2024/2847) — Annex VIII
@@ -223,7 +223,7 @@ function create(opts) {
  *   }
  *
  * @example
- *   var dossier = b.cra.conformityAssessment({
+ *   var dossier = b.cra.report.conformityAssessment({
  *     manufacturer: { name: "Acme Inc.", address: "1 St", contact: "ce@acme.example" },
  *     product:      { name: "Widget Pro", identifier: "WID-001", version: "1.0", description: "..." },
  *     classification: "default",

package/lib/vendor/blamejs/lib/middleware/age-gate.js

@@ -38,6 +38,7 @@
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response").denyResponse;
 
 var audit = lazyRequire(function () { return require("../audit"); });
 
@@ -72,6 +73,8 @@ var AgeGateError = defineClass("AgeGateError", { alwaysPermanent: true });
  *     errorMessage:       string,
  *     privacyPostureHeader: string,                     // default "X-Privacy-Posture"; null/false to suppress
  *     audit:              boolean,                      // default true
+ *     onDeny:             function(req, res, info): void,  // own the 451; info = { status, reason, age, classification, requireAge }
+ *     problemDetails:     boolean,                      // default false — emit RFC 9457 application/problem+json instead of the default JSON envelope
  *   }
  *
  * @example
@@ -89,6 +92,7 @@ function create(opts) {
   validateOpts(opts, [
     "audit", "getAge", "requireAge", "consentRequired",
     "hasParentalConsent", "skipPaths", "errorMessage", "privacyPostureHeader",
+    "onDeny", "problemDetails",
   ], "middleware.ageGate");
 
   if (typeof opts.getAge !== "function") {
@@ -105,6 +109,8 @@ function create(opts) {
   var auditOn = opts.audit !== false;
   var errorMessage = typeof opts.errorMessage === "string" && opts.errorMessage.length > 0
     ? opts.errorMessage : "service unavailable without parental consent";
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
   // privacyPostureHeader (default "X-Privacy-Posture") names the response
   // header carrying the below-threshold classification. Pass null/false to
   // suppress it, or a string to rename it for a downstream convention.
@@ -168,13 +174,20 @@ function create(opts) {
       var hasConsent = hasParentalConsent ? !!hasParentalConsent(req) : false;
       if (!hasConsent) {
         _emitAudit("refused", "denied", { age: age, classification: classification, requireAge: requireAge });
-        if (!res.writableEnded && typeof res.writeHead === "function") {
-          res.writeHead(451, {                                                            // HTTP 451 Unavailable For Legal Reasons
-            "Content-Type":  "application/json; charset=utf-8",
-            "Cache-Control": "no-store, private",
-          });
-          res.end(JSON.stringify({ error: errorMessage, requireAge: requireAge, parentalConsent: false }));
-        }
+        denyResponse(req, res, {
+          onDeny:        onDeny,
+          problem:       problemMode,
+          status:        451,                                                             // HTTP 451 Unavailable For Legal Reasons
+          info:          { status: 451, reason: "parental-consent-required",
+            age: age, classification: classification, requireAge: requireAge },
+          problemCode:   "parental-consent-required",
+          problemTitle:  "Unavailable For Legal Reasons",
+          problemDetail: errorMessage,
+          problemExt:    { requireAge: requireAge, parentalConsent: false },
+          headers:       { "Cache-Control": "no-store, private" },
+          contentType:   "application/json; charset=utf-8",
+          body:          JSON.stringify({ error: errorMessage, requireAge: requireAge, parentalConsent: false }),
+        });
         return;
       }
     }

package/lib/vendor/blamejs/lib/middleware/bearer-auth.js

@@ -37,21 +37,34 @@
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response").denyResponse;
 var { AuthError } = require("../framework-error");
 
 var audit = lazyRequire(function () { return require("../audit"); });
 var observability = lazyRequire(function () { return require("../observability"); });
 
-function _writeUnauthorized(res, scheme, message, realm) {
-  if (res.headersSent) return;
-  var body = JSON.stringify({ error: message });
-  var challenge = scheme + (realm ? ' realm="' + realm + '"' : "");
-  res.writeHead(401, {                                                           // HTTP 401 status
-    "Content-Type":     "application/json; charset=utf-8",
-    "Content-Length":   Buffer.byteLength(body),
-    "WWW-Authenticate": challenge,
+// Shared 401/403 refusal writer for every bearer-auth deny path —
+// routes through denyResponse so a consumer can override via onDeny
+// or emit RFC 9457 application/problem+json via problemDetails.
+function _refuse(req, res, status, challenge, bodyObj, reason, problemExt, onDeny, problemMode) {
+  denyResponse(req, res, {
+    onDeny:        onDeny,
+    problem:       problemMode,
+    status:        status,
+    info:          Object.assign({ status: status, reason: reason }, problemExt || {}),
+    problemCode:   "bearer-" + reason,
+    problemTitle:  status === 403 ? "Forbidden" : "Unauthorized",
+    problemDetail: typeof bodyObj.error === "string" ? bodyObj.error : ("bearer authentication failed: " + reason),
+    problemExt:    problemExt || null,
+    headers:       { "WWW-Authenticate": challenge },
+    contentType:   "application/json; charset=utf-8",
+    body:          JSON.stringify(bodyObj),
   });
-  res.end(body);
+}
+
+function _writeUnauthorized(req, res, scheme, message, realm, onDeny, problemMode) {
+  var challenge = scheme + (realm ? ' realm="' + realm + '"' : "");
+  _refuse(req, res, 401, challenge, { error: message }, "unauthorized", null, onDeny, problemMode);
 }
 
 // Three-state extractor: { state: "absent" } when no Authorization
@@ -102,10 +115,13 @@ function _extractToken(req, scheme) {
  *     verify:         async function(token): user|null,  // required
  *     scheme:         string,    // default "Bearer"; some ops use "Token"
  *     realm:          string,
+ *     requiredScopes: string[],  // RFC 6750 §3 — refuse 403 insufficient_scope when the verified token lacks one
  *     errorMessage:   string,
  *     tokenAttachKey: string,
  *     userAttachKey:  string,
  *     audit:          boolean,   // default true
+ *     onDeny:         function(req, res, info): void,  // own the 401/403; info = { status, reason, ... }
+ *     problemDetails: boolean,   // default false — emit RFC 9457 application/problem+json instead of the default JSON envelope
  *   }
  *
  * @example
@@ -122,7 +138,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "verify", "audit", "scheme", "errorMessage", "realm",
-    "tokenAttachKey", "userAttachKey",
+    "tokenAttachKey", "userAttachKey", "requiredScopes", "onDeny", "problemDetails",
   ], "middleware.bearerAuth");
 
   if (typeof opts.verify !== "function") {
@@ -131,6 +147,8 @@ function create(opts) {
       "the verification path (b.apiKey.verify / b.auth.jwt.verifyExternal / custom)");
   }
   var auditOn       = opts.audit !== false;
+  var onDeny        = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode   = opts.problemDetails === true;
   var scheme        = opts.scheme || "Bearer";
   var errorMessage  = opts.errorMessage || "Bearer token required.";
   var realm         = opts.realm || null;
@@ -197,13 +215,8 @@ function create(opts) {
       if (!res.headersSent) {
         var malformedChallenge = scheme + ' error="invalid_request"' +
           (realm ? ', realm="' + realm + '"' : "");
-        var malformedBody = JSON.stringify({ error: errorMessage });
-        res.writeHead(401, {                                                     // HTTP 401 status
-          "Content-Type":     "application/json; charset=utf-8",
-          "Content-Length":   Buffer.byteLength(malformedBody),
-          "WWW-Authenticate": malformedChallenge,
-        });
-        res.end(malformedBody);
+        _refuse(req, res, 401, malformedChallenge, { error: errorMessage },       // HTTP 401 status
+          "malformed-authorization", null, onDeny, problemMode);
       }
       return;
     }
@@ -221,13 +234,8 @@ function create(opts) {
       var challenge = scheme + ' error="invalid_token"' +
         (realm ? ', realm="' + realm + '"' : "");
       if (!res.headersSent) {
-        var body = JSON.stringify({ error: errorMessage });
-        res.writeHead(401, {                                                     // HTTP 401 status
-          "Content-Type":     "application/json; charset=utf-8",
-          "Content-Length":   Buffer.byteLength(body),
-          "WWW-Authenticate": challenge,
-        });
-        res.end(body);
+        _refuse(req, res, 401, challenge, { error: errorMessage },                // HTTP 401 status
+          "invalid-token", null, onDeny, problemMode);
       }
       return;
     }
@@ -235,7 +243,7 @@ function create(opts) {
     if (!user) {
       _emitAudit("auth.bearer.failure", "failure", req, "verifier-returned-null");
       _emitObs("auth.bearer.rejected", 1, { reason: "verifier-null" });
-      _writeUnauthorized(res, scheme, errorMessage, realm);
+      _writeUnauthorized(req, res, scheme, errorMessage, realm, onDeny, problemMode);
       return;
     }
 
@@ -260,16 +268,9 @@ function create(opts) {
           var scopeChallenge = scheme + ' error="insufficient_scope"' +
             ', scope="' + opts.requiredScopes.join(" ") + '"' +
             (realm ? ', realm="' + realm + '"' : "");
-          var scopeBody = JSON.stringify({
-            error: "insufficient_scope",
-            required: opts.requiredScopes.slice(),
-          });
-          res.writeHead(403, {                                                     // HTTP 403 status
-            "Content-Type":     "application/json; charset=utf-8",
-            "Content-Length":   Buffer.byteLength(scopeBody),
-            "WWW-Authenticate": scopeChallenge,
-          });
-          res.end(scopeBody);
+          _refuse(req, res, 403, scopeChallenge,                                    // HTTP 403 status
+            { error: "insufficient_scope", required: opts.requiredScopes.slice() },
+            "insufficient-scope", { required: opts.requiredScopes.slice() }, onDeny, problemMode);
         }
         return;
       }